Professional Documents
Culture Documents
4/18/14 8:04 PM
Cristal hack
The Ultimate Hack's Ever
Search
Archive
People Find
Archives
You Archive IT
Go
About Author
Chitika | Opt out?
Seema Rawat
Toonswarz
Total Pageviews
Hello guys, Today i will talking about How You Can Update Your BIOS software.Most of old
6 5 7 7 8
computer has old Bios software and it does't support new HDD and Pen-drive boot systems.
So I Found Some Solutions for updating your bios.
Support Mee !!
Dedicated for those
lazy to read and those
who just want to get it
done A.S.A.P.
NOTE: if youre
interested in this
Subscribe
background in things
like:
Delivered by FeedBurner
Blog Archive
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 1 of 23
4/18/14 8:04 PM
At least, you should be able to find the required/missing information in the Net this
article wont help you with it. So, instead of starting from basics, lets do just the
opposite and start with clearing up the most typical myths and confusions.
Some Myths
be lazy to read this part of the article and the next one!
Myth #2: One has to (should) use the so-called Hot Swap method only with a motherboard of
exactly the same type (same chipset, same manufacturer, etc.)
Thats wrong, and its the second most common mistake. It comes from the lack of knowledge
Labels
Adsense
Blogging
(1)
(6)
CMD
(1)
about how different flash chips work, and this difference actually may cause some limitations
on the type of motherboards that can be used to (re)program a specific flash memory chip.
Informative (29)
Anyway, if you need to reprogram the flash chip of a (dead) motherboard, and you have a
Book
Ms-Dos
(1)
(15)
(1)
Mobile
(8)
Windows (30)
Categories
are AwdFlash,AMIFlash and UniFlash; other flashers are mostly special ones for specific
Adsense (1)
brands, like aFlash for ASUS motherboards or special flashers for Intel boards (note that
Blogging (6)
universal flashers may not work with these boards). In this article well concentrate only on the
CMD (1)
downloads (11)
FaceBook (4)
As most DOS programs, flashers can be controlled by command line switches. As there is
plenty of information about them in the Net, so only the essential ones will be described here.
G-Mail (1)
ATTENTION GUYS ! Running a flasher WITHOUT specifying any swithes (i.e. using the
default ones) might damage the BIOS, even though you had no intention to reflash it and
were just wondering how it works and/or just wanted to backup the current version of your
BIOS. Although its a very rare case and is related usually to some specific versions of
AMIFlash, it has happened personally to the author, and not just once!
Executing some
special utilities (like DMICFG), which are sometimes included on CDs that came with a
motherboard (for fine-tuning BIOS), often causes the same problem damages the BIOS,
even when you had no intention to reflash the flash chip, but just wanted to have a look on
what the utility does.
Informative (29)
Lunix (2)
Mac Book (1)
Mobile (8)
Ms-Dos (1)
Programming (3)
regedit (3)
Tools (15)
Windows (30)
AwdFlash
The most popular flasher but not the best one. Should be used with the following switches:
AWDFLASH bios_file /py/sn/f/r/cd/cp
Page 2 of 23
4/18/14 8:04 PM
My Other Blog
Next To Shine
AMIFLASH bios_file /b /n /-o /-c /-d /-r /v /-i /-k /-e /-g
To backup your current BIOS, run AMIFlash as follows (NOTE: there is no SPACE character
after the /s switch):
Healthy tips
8 months ago
AMIFLASH /b /n /-o /-c /-d /-r /v /-i /-k /-e /-g /sbackup_file
If youre going to reprogram a flash chip(s) more than twice dont be lazy and prepare a
.BAT file on your DOS system disk(ette), with a string like this:
A:\UTILS\AMIFLASH.EXE %1 /b /n /-o /-c /-d /-r /v /-i /-k /-e /-g
A UniFlash
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 3 of 23
4/18/14 8:04 PM
BIOS image files size does not match the flash memory chip
capacity.
Page 4 of 23
4/18/14 8:04 PM
capacity in different motherboard revisions. The MS6117 motherboard (made by MSI) may serve as an example: look at
its BIOS list and youll see that all AMI BIOS releases are for
a 1Mbit flash chip, as well as AWARD BIOS releases 1.x and 2.x;
however, the AWARD BIOS release 3.2 is for a 2Mbit flash chip.
Its an even more common issue, but if youre 100% sure that you
know what youre doing, just use the switches described
previously to force the flasher to do the job.
A flasher cannot recognize the used flash memory chip and thus
cannot (re)program it.
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 5 of 23
4/18/14 8:04 PM
For recovering in this case, you will need to read the article
further
CHAPTER TWO. Dedicated for those who hasnt read the first
chapter on time and now needs a recovery.
Plain and simple you will have to break your piggy-box, pull
out your flash chip, take a floppy disk, bottle of beer (keg
sounds better :) and go to one of your tech-buddies. If the
flash chip is soldered in, then you will have to break another
piggy-box and take the motherboard with you. In this case,
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 6 of 23
4/18/14 8:04 PM
So, if our recovery board uses the same (or compatible) type of
BIOS flash chip as the dead one (and of same or larger capacity)
everything should work fine.
How-to Do ?
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 7 of 23
4/18/14 8:04 PM
As for the square chips aka PLCC32 its a bit harder. One can
try using fishing line as well or any non-conducting type of
threads or if you have a good access point and your hands are
straight just use a needle, slowly lifting the chip from
access corners in chipbed. If you, however, reprogram chips
everyday or just want to be 100% sure glue something like a
piece of plastic or even melt some glue from the glue-gun to the
top of the chip. This would allow you to pull it out. You can
also just buy PLCC32 extractor. Anyway, it is your choice.
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 8 of 23
4/18/14 8:04 PM
for AwdFlash:
for AMIFlash:
amiflash amibios.rom /b /n /-o /-c /-d /-r /v /-i /-k /-e /-g
It is not recommended to use other names for the BIOS image file
and/or flashers (use only the standard names mentioned above)
some BIOS-es (basically, their bootblocks) may just ignore
them, producing an error message like NON SYSTEM DISK or DISK DRIVE
NOT READY.
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 9 of 23
4/18/14 8:04 PM
because both the flasher and the BIOS would be built into that
file. Usually, this may be applicable to newer boards.
Dedicated for those who want to know not only how to do, but
also how and why it works
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 10 of 23
4/18/14 8:04 PM
CE# chip enable (or chip select); this signal enables the chip to
be read/written (think of it as a turn on button);
It is quite simple to understand even when you dont have a degree in elec
tronics.
Now we can see that a 8-bit data bus seriously limits the read speed from
the chip (you can think of it as a road with 8 lanes, while e.g. the nForc
e chips access the RAM through a highway of 128 lanes!), so the startup
process of even the fastest computer could become a turtle run. To avoid t
hat, the chip is connected to the south bridge in a special way, allowing
the latter toshadow the contents of the flash to RAM, thus improving the s
peed dramatically.
The flash chip occupies upper addresses E0000-FFFFF of the address space (
True for 1Mbit) and because of similarity to other chips lets take 1Mbit/
AwardBIOS for example. After you turn computer on and RESET# signal disapp
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 11 of 23
4/18/14 8:04 PM
ears, the CPU executes the first command located by F000:FFF0 address. Aft
er initialization process beginning, CPU recalculates different checksums
(there are quite a bit of those in BIOS) but the main is at E000:0-FFFF+F0
00:0-BFFC. If this one is wrong, then bootblock located in *most* upper ad
dresses (F000:C000/E000-FFF -the last 8/16Kb) is executed trying to initia
lize floppy drive and to read the system and/or flasher and/or BIOS file f
rom floppy disk in attempt to recover/boot normally.
And yet, another conclusion: if you want to force boot block execution (fo
r reflashing purposes, as an example) you can do it purposely corrupting C
RC (checksum) by shortening address lines above bootblocks. As for myself
, I usually shorten bylocated A15 and A16 lines (pin 2 and 3). Bootblock s
ize=16Kb=2^14 and so this would not lead to bootblock corruption, but chec
ksum of the *rest* will be corrupted. If you can not understand why you ne
ed that, you will when you meet soldered in flash chip fashed with *simila
r* bios and, by the way, such shortening is harmless for address lines and
chip itself.
After successful CRC check, bios is shadowed i.e. the flash contents is co
pied to the ram and flash chip is turned off by south bridge. To force all
programs working with shadowed bios as with ROM contents it is marked wit
h READ ONLY atribute by means of programming south bridge SB (and/or Model
Specific Registers MSRs for AMD K7/K8 CPUs). All foregoing bios calls ar
e redirected to the shadowed copy of the bios.
Conclusion: So you can extract the flash chip just after the report Start
ing Windows/DOS/linux on the screen. And now if you wish to work with the
flash itself (for example write ESCD/DMI), you have to fulfil the special
procedures (chipset specific !). You have to connect the flash to the bus
before the operation and disconnect after.
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 12 of 23
4/18/14 8:04 PM
If your motherboard has an INTEL flash chip you have to be triple careful
while flashing it, because intel chips use hardware botblock protection. W
hat does it mean ? This means that intel chips have one more signal RP# (p
in 30), and this signal allows chip bootblock programming. For 2Mbit it is
A17, 1Mbit -NC (not connected, not used) i.e. for correct flashing of _al
l_memory_space_, there should be +12Volt present on RP# pin. The special j
umpers were made on many Socket7 motherboards and named: INTEL/NON-INTEL f
or this purpose.
Conclusion: If the particular motheroard has Intel 28FXXX flash chip and P
CB (Printed Circuit Board) does not support correct commutation for progra
mming those chips (a common matter) BIOS will die after the first attemp
t to flash the chip without any chances for revival (on this board).
For flashing Intel 28FXXX on such boards (without RP# pin) you have to con
nect pin30 to +12Volt source manually, but so it would not get to the moth
erboard itself (A17). To avoid this you may just bend this pin so it will
not have a connection with chipbed.
The main aspect you have to know is that you can not reprogram this flash
chip *at once*. You can not also write one separate byte. This type of chi
ps supports blocks (sectorization) reprograming methods only. Different ty
pe of flash chips support different type of sector organization. For examp
le, a very popular flash Intel 28F001BX has the following blocks:
1. First block, in the very beginning and the biggest one -*main* block, o
ccupies 112Kb of space, it usually contains main body of the bios (that
is why it is the biggest).
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 13 of 23
4/18/14 8:04 PM
2. Next are two identical blocks, each occupies 4Kb space the data relat
ed toESCD/DMI/CMOS/PASSWORDS etc. located usually in these blocks.
Some flash chips are made with very high sectorization, for example: SST29
EE020 (2Mbit) has 2048 similar sectors each occupying 128 bytes, but most
part of chips has organization similar to Intel one, because smaller block
s have drawbacks as for example quite complicated write protection realiza
tion.
CHAPTER 4
Old schoolHow simple it wasaddress bus, data bus CE/WE/OEBut the progre
ss is not standing on the same spot (especially In certaIn. companies) and
with appearing of the i8XX chipsets, there came so called hub flash chips
.
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 14 of 23
4/18/14 8:04 PM
LPC Interface
The end of year 1997. Intel decided that powerful processor must have BIG
bios (4-8Mbit and more) eventhough, many that time companies were OK with
what they had and present companies still use 2Mbit.
Regular* (PLCC32), widely used flash type chips, would not have enough
pins for address lines, so Intel invented LPC standart (Low Pin Count)
but decided to keep PLCC body. Besides possibility to have huge flash c
hip capacieties up to 4Gb, one of the other main reasons to have LPC,
was soon-to-be-useless ISA bus, absense of which would remove address/
data lines and allowed to have less traces in between Super I/O chip an
d the south bridge (obvious possibility to hide SIO in to the South Bri
dge were kept in secret).
LPC chips are using only 5 lines: LAD0-LAD3 + LFRAME# (thats why it is cal
led LOW PIN COUNT) See typical LPC flash chip pinout at picture below (thi
s standart may be used not only in flash chips, thats why iam being specif
ic)
LPC/FWH interface
As you can see this type of flash can work in 2 different modes: LPC and P
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 15 of 23
4/18/14 8:04 PM
As of LPC mode, communication between flash chip and south bridge is made
through 4 bit bus and fifth LFRAME# needed as a start point for data to tr
avel. LRESET# and LCLK# which are identical to their cousin signals used o
n motherboards all other lines are optional. This is how interface got sim
lpyfied, but, its still not serial interface as I2C and still allowing it
to use DMA and BUS MASTERING (Which are used in devices like DiskOnChip/LP
C)
FWH INTERFACE
Intel was very pleased with own work and decided to carry the flag forward
and made another standart FWH (Firm Ware Hub, thats how *HUB* type of f
lash chips appeared). It was fully electrically and by pin number compatib
le, but _absolutely_ incompatible by communication protocol. As you can re
ad in many papers it was made in purpose, so those chips can be set up in
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 16 of 23
4/18/14 8:04 PM
one system, on the same bus (electrically compatible) but during communica
tion each chip would take own data packets, because of the difference in c
ommunication protocols. by the way it is possible to hook up to 16 *HUB* t
ype flash chips in one system, because of additional ID0-ID3 signals.
(by Author: Please think of all my stones towards the Father of x86 as a j
oke, however every joke has a piece of joke ;0)
As you can see FWH is similar to LPC, only pins LAD0-3 + LFRAME# renamed t
o FWH0-3 + FWH4. PP mode is absolutely same.
FWH differs from LPC by protocol, i.e. all commands for operation have dif
ferent code values in the field of data exchange, plus, the ability to use
up to 16 FWH devices, thanks to newly implemented identification signals
ID0-3. As of system default ID configuration for flash chip it is assigned
ID=0000, you may easily check it (intel boards) with multimeter (ohms), a
ll those pins are connected to the ground.
Common way to check what kind of (FWH/LPC) flash chip we have is: using Oh
m meter, check continuity between PINs 16/28 (flash chip) and GND (anywher
e on the board) in *HUB* type flash chip resistance will be 0 Ohms (or clo
se to it) while *regular* will have about 1KOhms.
If you have the need of flashing chips every-so-often, at work, or for any
other reasons, i would have a few suggestions for you.
Someone may recommend you, in this case, to use a flash chip programmer de
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 17 of 23
4/18/14 8:04 PM
vice, but personally myself i would not advice that and not even recommend
to use one. There are two major reasons. Reason one is : many programmer
device will not recognize all flash chip types and those which do, cost we
ll over three digit numbers. Second reason would be: just any programmer d
evice cost would be, as low as, a three digit number, that being said here
is my solution all you may need to flash 99% of flash chips (talking ab
out the chips that are used in motherboards) are next three type of mother
boards:
2. Something out of PII (Pentium 2) age with 2Mbit BIOS chip for flashin
g *regular* 1Mbit and 2Mbit flash chips.
As of myself, towards the first point, I use ASUS motherboard built on i43
0HX chipset P55T2P4, for cases like this one i recommend ASUS, because o
f very usable asus made flasher program, an old PFLASH or newer version
AFLASH, very simple to use, stable and may show you memory address where e
rror occured, in case you will have an error of course.
Talking about second point, I use motherboard built on i440BX, PC Partner928.It has 2Mbit flash chip, which allows us to flash *regular* chips with
1 and 2Mbit capacities.It has a DIP32 bed, for flashing PLCC32, I use PLC
C32<->DIP32 adapter, which was made out of old non working board with PLCC
32 bed.
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 18 of 23
4/18/14 8:04 PM
Hand-made PLCC32->DIP32
adapter (made by a figured groove by a fret saw on faulty motherboards;) p
lus manually soldered pins)
Point 4. I use motherboard on nForce1 ABIT NV7-133R (it is not a big dea
l if it be NF2 /NF3).This board is used for heavyest cases, for flashing *
PURE LPC* chips.Many mobo manufacturers, if not all of them, that built bo
ards on nForce1/2/3/etc chipsets are using chips that are compatible with
both LPC and FWH protocols, which allows us to flash those on equipment me
ntioned in point#3
Talking overall, about facts towards motherboard choices, there are no suc
h thing, so it is solely depends on your personal needs, but i will mentio
n the case with an ASUS for Intel flash chips combination.
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 19 of 23
4/18/14 8:04 PM
lled No-Name boards are good, Acorp or PC-Partner are just a couple of suc
h. Other important fact is easy access to flash chip bed.
As of the software I use for major flashing purpose AMIFLASH (v.8.37 wit
h keys, of course) Flasher knows many flash chips/chipsets and very friend
ly to use (I prefer command prompt).
For rare cases, when AMIFLASH cannot handle the task (some kind of exotic
chips/bioses/chipsets)- I recommend to use AWDFLASH with /f key.
PMCs are compatible with all three protocols LPC/FWH/PP and that is the p
robable cause of an error in case of *regular* flasher usage (those may ev
en just hang/lock the PC), however UNIFLASH works just fine.
There are cases when you may need to use two flashers to flash one chip, f
or example you reprogram chip with amiflash, at the end it may give you an
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 20 of 23
4/18/14 8:04 PM
error, then, you will reprogram it rightaway, again with uniflash, but yo
u should not use it counterwise, because you will fail, its more likely wi
ll not work other way.
If you have a board that has only 1Mbit chip, but you need to reprogram 2M
bit chip you may do it in two sets, first megabit last and second megabi
t first, as separate processes, when your first part is done, you will nee
d to short PIN#30 (A17 for 2Mbit and PIN#NC in 1Mbit) to the ground and th
en flash second part.You will need to split file in two pieces, 1Mbit each
(1Mbit=128kb), you may do it with any HEX editor, the only limitation for
this process will be no support from flash chip for sector writing.
This situation may evolve in to case when we need only a bootblock. the se
cond part (end part) of the splitted file. After this will be done, you ne
ed to insert this chip in to motherboard and start the pc, because of unfi
nished flashing, chip will have bad crc and bootblock will be loaded for r
ecovery purposes, where you can use a floppy disk with bios file.
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 21 of 23
4/18/14 8:04 PM
For example, if the motherboard has 5V chip (usually 29xxxx series), you c
an flash the chips designed for lower voltages on this board and you will
succeed.
But in the case when you try to flash 12V chip in 5V motherboard (or with
jumpers set to 5V), you may succeed and may not, thence when you reprogram
28xxxx series chips (most of them are 12V ones) you have to pay attention
to the jumpers and dont try to reprogram those using HOT-SWAP method on
newer boards (12V chips were mostly used in P1/P2 period). So, the older m
otherboard you have, the bigger chance to succeed.
If the motherboard jumpers have no marks, you can use multimeter to see th
e pin32 voltage (the first one by the right side from the key, when lookin
g to the chips top). You also can bend or isolate this pin on the board/s
ocket and connect the chips pin right to 12V manually (from the power sup
ply).
AweSome (0)
Funny (0)
Interesting (0)
Cool (0)
Booring (0)
0 comments
Labels: Fix Problems, Informative
Newer Posts
Home
http://cristalhack.blogspot.com/2012_09_30_archive.html
Older Posts
Page 22 of 23
4/18/14 8:04 PM
Archive
People Find
Archives
You Archive IT
Carter
Used Boats
Archived
Hours
Public
http://cristalhack.blogspot.com/2012_09_30_archive.html
Page 23 of 23