Page 1 of 1
W29C020 - software bootblock unlock
Posted: Sun Apr 18, 2004 7:54 pm
by Rainbow
I've bought DTK PRM-0080I E1 (rev. B) board - very cheap because previous owner did not know if the board works or not. It works. There's Winbond W29C020 chip installed.
I tried to flash the BIOS using UniFlash - but it failed on the first 8KB and last 8KB - obviously because both top and bottom boot block protection was enabled. But I was able to flash the BIOS OK using the old AMIFLASH that I have on my webpage - so it's now proven that it can be done. After flashing, it even left the bottom bootblock area unprotected
So it must disable the protection (both top and bottom) somehow, then flash and finally enable the top block protection. Now only find a way how to reverse it...
Posted: Sun Apr 18, 2004 9:31 pm
by Rainbow
GOT IT
Finally, after that long time...
Hacked out of awdflash v7.52 that was bundled with one of DTK BIOSes for this board.
Code: Select all
[05555],0AA
[02AAA],055
[05555],080
[05555],0AA
[02AAA],055
[05555],040
[02AAA],0AA
The first 6 commands are for entering the lockout mode. The documented writes after this are:
[00000],0 - enable bottom block lockout
[3FFFF],0FF - enable top block lockout
And the undocumented one:
[02AAA],0AA - disable both top&bottom block lockout
Posted: Mon Apr 19, 2004 2:16 pm
by NickS
Sorry, Rainbow - I don't understand the syntax you are using here. What is meant by (e.g.)
[05555],080 ?
Using debug, can I create a pair of little .com files to unlock and lock ?
Posted: Mon Apr 19, 2004 7:12 pm
by Rainbow
"[05555],0AA" means that you write data 0AAh to address 5555h in the flash ROM. If you read a datasheet for some flash ROM, it will become clear.
I'm now thinking about how to include this in UniFlash...
Posted: Tue Apr 20, 2004 8:43 pm
by NickS
Fine, thanks.
Posted: Tue Apr 20, 2004 10:07 pm
by Rainbow
Any ideas about how this should be implemented in UniFlash?
I'm thinking about adding new menu that will include bootblock lock/unlock and maybe some (destructive) tests - write all zeros, all ones...
It's a lot of work to do so I'll release v1.35 before.
Posted: Tue Apr 20, 2004 10:47 pm
by wsw243
Rainbow wrote:"[05555],0AA" means that you write data 0AAh to address 5555h in the flash ROM. If you read a datasheet for some flash ROM, it will become clear.
I'm now thinking about how to include this in UniFlash...
Where can I get datasheet of flash roms?
Regards,
Vicky
Posted: Tue Apr 20, 2004 11:19 pm
by Rainbow
Posted: Wed Apr 21, 2004 10:53 pm
by edwin
Rainbow wrote:Any ideas about how this should be implemented in UniFlash?
I'm thinking about adding new menu that will include bootblock lock/unlock and maybe some (destructive) tests - write all zeros, all ones...
It's a lot of work to do so I'll release v1.35 before.
yep. "for uniflash gurus only"
Posted: Thu Dec 30, 2004 7:00 pm
by xam
Thanks Rainbow for the disable lockout mode code!
Today i have add the code in the ct flasher (original flasher
ftp://ftp.heise.de/pub/ct/projekte/ctflash.zip ). I put the code before the erase-code for the W29C020C and it works.