W29C020 - software bootblock unlock

Only for programmers and BIOS gurus with technical questions.
Post Reply
Rainbow
The UniFlasher
Posts: 3122
Joined: Wed Mar 20, 2002 4:16 pm
Location: Slovakia
Contact:
Contact Rainbow

I've bought DTK PRM-0080I E1 (rev. B) board - very cheap because previous owner did not know if the board works or not. It works. There's Winbond W29C020 chip installed.
I tried to flash the BIOS using UniFlash - but it failed on the first 8KB and last 8KB - obviously because both top and bottom boot block protection was enabled. But I was able to flash the BIOS OK using the old AMIFLASH that I have on my webpage - so it's now proven that it can be done. After flashing, it even left the bottom bootblock area unprotected :) So it must disable the protection (both top and bottom) somehow, then flash and finally enable the top block protection. Now only find a way how to reverse it...
Patched and tested BIOSes are at http://wims.rainbow-software.org
UniFlash - Flash anything anywhere
Top
Rainbow
The UniFlasher
Posts: 3122
Joined: Wed Mar 20, 2002 4:16 pm
Location: Slovakia
Contact:
Contact Rainbow

GOT IT
Finally, after that long time... :D
Hacked out of awdflash v7.52 that was bundled with one of DTK BIOSes for this board.

Code: Select all

[05555],0AA
[02AAA],055
[05555],080
[05555],0AA
[02AAA],055
[05555],040
[02AAA],0AA
The first 6 commands are for entering the lockout mode. The documented writes after this are:
[00000],0 - enable bottom block lockout
[3FFFF],0FF - enable top block lockout
And the undocumented one:
[02AAA],0AA - disable both top&bottom block lockout
Patched and tested BIOSes are at http://wims.rainbow-software.org
UniFlash - Flash anything anywhere
Top
NickS
BIOS Bodhisattva
Posts: 3145
Joined: Fri May 03, 2002 10:34 am
Location: Thames Valley, UK

Sorry, Rainbow - I don't understand the syntax you are using here. What is meant by (e.g.)
[05555],080 ?
Using debug, can I create a pair of little .com files to unlock and lock ?
Tested patched BIOSes. Untested patched BIOSes.
Emails *will* be ignored unless the subject line starts "Wim's BIOS forum"
Top
Rainbow
The UniFlasher
Posts: 3122
Joined: Wed Mar 20, 2002 4:16 pm
Location: Slovakia
Contact:
Contact Rainbow

"[05555],0AA" means that you write data 0AAh to address 5555h in the flash ROM. If you read a datasheet for some flash ROM, it will become clear.
I'm now thinking about how to include this in UniFlash...
Patched and tested BIOSes are at http://wims.rainbow-software.org
UniFlash - Flash anything anywhere
Top
NickS
BIOS Bodhisattva
Posts: 3145
Joined: Fri May 03, 2002 10:34 am
Location: Thames Valley, UK

Fine, thanks. :)
Tested patched BIOSes. Untested patched BIOSes.
Emails *will* be ignored unless the subject line starts "Wim's BIOS forum"
Top
Rainbow
The UniFlasher
Posts: 3122
Joined: Wed Mar 20, 2002 4:16 pm
Location: Slovakia
Contact:
Contact Rainbow

Any ideas about how this should be implemented in UniFlash?
I'm thinking about adding new menu that will include bootblock lock/unlock and maybe some (destructive) tests - write all zeros, all ones...
It's a lot of work to do so I'll release v1.35 before.
Patched and tested BIOSes are at http://wims.rainbow-software.org
UniFlash - Flash anything anywhere
Top
wsw243
New visitors - please read the rules.
Posts: 9
Joined: Fri Dec 05, 2003 5:01 am

Rainbow wrote:"[05555],0AA" means that you write data 0AAh to address 5555h in the flash ROM. If you read a datasheet for some flash ROM, it will become clear.
I'm now thinking about how to include this in UniFlash...
Where can I get datasheet of flash roms?

Regards,

Vicky
Top
Rainbow
The UniFlasher
Posts: 3122
Joined: Wed Mar 20, 2002 4:16 pm
Location: Slovakia
Contact:
Contact Rainbow

For example:
http://www.winbond-usa.com/products/win ... ml?name=MP
Patched and tested BIOSes are at http://wims.rainbow-software.org
UniFlash - Flash anything anywhere
Top
edwin
The Hardware Archivist
Posts: 6287
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:
Contact edwin

Rainbow wrote:Any ideas about how this should be implemented in UniFlash?
I'm thinking about adding new menu that will include bootblock lock/unlock and maybe some (destructive) tests - write all zeros, all ones...
It's a lot of work to do so I'll release v1.35 before.
yep. "for uniflash gurus only"
edwin/evasive

Do not assume anything

System error, strike any user to continue...
Top
xam
New visitors - please read the rules.
Posts: 1
Joined: Thu Dec 30, 2004 6:51 pm

Thanks Rainbow for the disable lockout mode code!
Today i have add the code in the ct flasher (original flasher ftp://ftp.heise.de/pub/ct/projekte/ctflash.zip ). I put the code before the erase-code for the W29C020C and it works.
Top
Post Reply

Return to “In-depth High-tech BIOS section”