Using Uniflash to flash Am29C020 EEPROM using a NIC, tryin..

G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.chips (More info?)

Hi,

I'm a newbie but this is interesting!
I've found a neat utility called Uniflash that allows you to either
flash using your motherboard's BIOS socket or using a socket on a PCI
card, like the boot rom socket of an ethernet card.


Apparently, I can Uniflash can get the card to save what is already on
the cchip to a file ok. I can tell Uniflash to flash the image file
back into the EEPROM chip ok.

However, anytime I use a different .bin file as the source, Uniflash
shows a few red boxes within the progress bar instead of all green
boxes. Then it's says Flash verification failed or something to that
effect.

I tried widdling a bit on the original ROM contents' image file by
adding a character at random. It seems that wherever in the file I add
the character (using the UltraEdit HEX editor), the flashing fails.

I'm imagining that there must be some type of line-by-line checksum
going on , to make sure the characters make sense together on any
particular line?
This is only a guess since I'm failry new to this.

Any ideas of how I can get a known good image burned into this chip?
The chip is an Amd 29C020.
Thanks
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.chips (More info?)

On 20 Aug 2004 16:05:28 -0700, heirbrande@yahoo.com (heirbrande) put
finger to keyboard and composed:

>I've found a neat utility called Uniflash that allows you to either
>flash using your motherboard's BIOS socket or using a socket on a PCI
>card, like the boot rom socket of an ethernet card.

I can't see how you could use any NIC to flash an EEPROM, although I
*can* see how you could flash a NIC boot ROM using the mainboard's
BIOS socket. Can you point me to a URL that proves otherwise?

>Apparently, I can Uniflash can get the card to save what is already on
>the cchip to a file ok. I can tell Uniflash to flash the image file
>back into the EEPROM chip ok.
>
>However, anytime I use a different .bin file as the source, Uniflash
>shows a few red boxes within the progress bar instead of all green
>boxes. Then it's says Flash verification failed or something to that
>effect.
>
>I tried widdling a bit on the original ROM contents' image file by
>adding a character at random. It seems that wherever in the file I add
>the character (using the UltraEdit HEX editor), the flashing fails.
>
>I'm imagining that there must be some type of line-by-line checksum
>going on , to make sure the characters make sense together on any
>particular line?

Highly unlikely.

>This is only a guess since I'm failry new to this.
>
>Any ideas of how I can get a known good image burned into this chip?
>The chip is an Amd 29C020.
>Thanks

It looks like your EEPROM socket is write protected. I can't find a
datasheet for an AM29C020, but pin 31 of a Winbond W29C020 or Atmel
AT29C020 is WE* (write enable). If this pin is tied high or low on
your NIC, then you won't be able to flash your chip. In any case, many
NIC chips only support 128K x 8 boot ROMs, ie 1Mbit.


- Franc Zabkar
--
Please remove one 's' from my address when replying by email.
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.chips (More info?)

thanks Franc


to attempt to flash the Am29C020, I got this tool from
www.uniflash.org
I think (now that I remember) I must have reprogrammed a rectangular
style chip using a 3Com NIC card. The one I'm using now uses square
chips and it doesn't want to work with Uniflash. I used UltradeEdit to
view the chips contents, from the file I saved, after flashing with
the NIC , after reebooting, to verify the contents had changed.


I think some people are using it to reflash Xbox chips now, but I just
want to flash my chip for a terminal! arrrrr I wonder can I flash it
with an Xbox??

hmmm, is there any way to defeat the WE* without frying the NIC? :)
:)

It seems like this Intel NIC supports 256k (2MBit) since the saved
file size is something like 262,144 (I can't remember the number and
I'm at school right now)


help a budding electronics hobbyist!

Franc Zabkar <fzabkar@optussnet.com.au> wrote in message news:<p91ii0di7tusg2n4n00ovfk6unkme3r9el@4ax.com>...
> On 20 Aug 2004 16:05:28 -0700, heirbrande@yahoo.com (heirbrande) put
> finger to keyboard and composed:
>
> >I've found a neat utility called Uniflash that allows you to either
> >flash using your motherboard's BIOS socket or using a socket on a PCI
> >card, like the boot rom socket of an ethernet card.
>
> I can't see how you could use any NIC to flash an EEPROM, although I
> *can* see how you could flash a NIC boot ROM using the mainboard's
> BIOS socket. Can you point me to a URL that proves otherwise?
>
> >Apparently, I can Uniflash can get the card to save what is already on
> >the cchip to a file ok. I can tell Uniflash to flash the image file
> >back into the EEPROM chip ok.
> >
> >However, anytime I use a different .bin file as the source, Uniflash
> >shows a few red boxes within the progress bar instead of all green
> >boxes. Then it's says Flash verification failed or something to that
> >effect.
> >
> >I tried widdling a bit on the original ROM contents' image file by
> >adding a character at random. It seems that wherever in the file I add
> >the character (using the UltraEdit HEX editor), the flashing fails.
> >
> >I'm imagining that there must be some type of line-by-line checksum
> >going on , to make sure the characters make sense together on any
> >particular line?
>
> Highly unlikely.
>
> >This is only a guess since I'm failry new to this.
> >
> >Any ideas of how I can get a known good image burned into this chip?
> >The chip is an Amd 29C020.
> >Thanks
>
> It looks like your EEPROM socket is write protected. I can't find a
> datasheet for an AM29C020, but pin 31 of a Winbond W29C020 or Atmel
> AT29C020 is WE* (write enable). If this pin is tied high or low on
> your NIC, then you won't be able to flash your chip. In any case, many
> NIC chips only support 128K x 8 boot ROMs, ie 1Mbit.
>
>
> - Franc Zabkar
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.chips (More info?)

On 29 Aug 2004 14:02:48 -0700, heirbrande@yahoo.com (heirbrande) put
finger to keyboard and composed:

>thanks Franc
>
>
>to attempt to flash the Am29C020, I got this tool from
>www.uniflash.org
>I think (now that I remember) I must have reprogrammed a rectangular
>style chip using a 3Com NIC card. The one I'm using now uses square
>chips and it doesn't want to work with Uniflash. I used UltradeEdit to
>view the chips contents, from the file I saved, after flashing with
>the NIC , after reebooting, to verify the contents had changed.
>
>
>I think some people are using it to reflash Xbox chips now, but I just
>want to flash my chip for a terminal! arrrrr I wonder can I flash it
>with an Xbox??
>
>hmmm, is there any way to defeat the WE* without frying the NIC? :)
>:)
>
>It seems like this Intel NIC supports 256k (2MBit) since the saved
>file size is something like 262,144 (I can't remember the number and
>I'm at school right now)

After a little research I found to my surprise that my own Realtek
RTL8139 based NIC can support flash memory up 128K x 8. Unfortunately
the card's manufacturer has tied the boot ROM's WE* pin to the +5V
rail.

FWIW, here are the RTL8139 datasheets:
ftp://202.65.194.18/cn/nic/rtl8139abcd8130810xseries/rtl8139cspec_1.4.pdf
ftp://202.65.194.18/cn/nic/rtl8139abcd8130810xseries/8139dv111.pdf

The datasheet states that pin 89 (WEB, Write Enable) "strobes data
into the Flash memory during a write cycle". To add flash support to
my NIC, I would cut the etch going to the WE* pin of my NIC's flash
EEPROM and wire a link from this pin to pin 89 of the RTL8139.

Your particular case may be different. You would need to first
determine how the AM29C020's WE* pin is wired. Then you would need to
locate the datasheet for your NIC's network chip.

>help a budding electronics hobbyist!

If you can you post the part number(s) of the various chips, and if we
are able to locate the datasheets, then we may be able to hack your
NIC, if need be.

>Franc Zabkar <fzabkar@optussnet.com.au> wrote in message news:<p91ii0di7tusg2n4n00ovfk6unkme3r9el@4ax.com>...
>> On 20 Aug 2004 16:05:28 -0700, heirbrande@yahoo.com (heirbrande) put
>> finger to keyboard and composed:
>>
>> >I've found a neat utility called Uniflash that allows you to either
>> >flash using your motherboard's BIOS socket or using a socket on a PCI
>> >card, like the boot rom socket of an ethernet card.
>>
>> I can't see how you could use any NIC to flash an EEPROM, although I
>> *can* see how you could flash a NIC boot ROM using the mainboard's
>> BIOS socket. Can you point me to a URL that proves otherwise?
>>
>> >Apparently, I can Uniflash can get the card to save what is already on
>> >the cchip to a file ok. I can tell Uniflash to flash the image file
>> >back into the EEPROM chip ok.
>> >
>> >However, anytime I use a different .bin file as the source, Uniflash
>> >shows a few red boxes within the progress bar instead of all green
>> >boxes. Then it's says Flash verification failed or something to that
>> >effect.
>> >
>> >I tried widdling a bit on the original ROM contents' image file by
>> >adding a character at random. It seems that wherever in the file I add
>> >the character (using the UltraEdit HEX editor), the flashing fails.
>> >
>> >I'm imagining that there must be some type of line-by-line checksum
>> >going on , to make sure the characters make sense together on any
>> >particular line?
>>
>> Highly unlikely.
>>
>> >This is only a guess since I'm failry new to this.
>> >
>> >Any ideas of how I can get a known good image burned into this chip?
>> >The chip is an Amd 29C020.
>> >Thanks
>>
>> It looks like your EEPROM socket is write protected. I can't find a
>> datasheet for an AM29C020, but pin 31 of a Winbond W29C020 or Atmel
>> AT29C020 is WE* (write enable). If this pin is tied high or low on
>> your NIC, then you won't be able to flash your chip. In any case, many
>> NIC chips only support 128K x 8 boot ROMs, ie 1Mbit.
>>
>>
>> - Franc Zabkar



- Franc Zabkar
--
Please remove one 's' from my address when replying by email.
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.chips (More info?)

Hey Franc,

I guess my brain is fried from studying too much today.
I did want to ask this though:
can I use a NIC manufactures own program to program an arbitrary image
like 3Com's MBAFLASH.exe?

I wonder if I can somehow trick MBAFLASH into flashing some other file.
Hmm but I wonder if bootblock (whatever that is) matters?

I'll get the specs on the card tomorrow night. I know it's an Intel PCI card though.

tHanks

Franc Zabkar <fzabkar@optussnet.com.au> wrote in message news:<mrj5j0p5srg9ibbjh4ugqmp0bsl634402k@4ax.com>...
> On 29 Aug 2004 14:02:48 -0700, heirbrande@yahoo.com (heirbrande) put
> finger to keyboard and composed:
>
> >thanks Franc
> >
> >
> >to attempt to flash the Am29C020, I got this tool from
> >www.uniflash.org
> >I think (now that I remember) I must have reprogrammed a rectangular
> >style chip using a 3Com NIC card. The one I'm using now uses square
> >chips and it doesn't want to work with Uniflash. I used UltradeEdit to
> >view the chips contents, from the file I saved, after flashing with
> >the NIC , after reebooting, to verify the contents had changed.
> >
> >
> >I think some people are using it to reflash Xbox chips now, but I just
> >want to flash my chip for a terminal! arrrrr I wonder can I flash it
> >with an Xbox??
> >
> >hmmm, is there any way to defeat the WE* without frying the NIC? :)
> >:)
> >
> >It seems like this Intel NIC supports 256k (2MBit) since the saved
> >file size is something like 262,144 (I can't remember the number and
> >I'm at school right now)
>
> After a little research I found to my surprise that my own Realtek
> RTL8139 based NIC can support flash memory up 128K x 8. Unfortunately
> the card's manufacturer has tied the boot ROM's WE* pin to the +5V
> rail.
>
> FWIW, here are the RTL8139 datasheets:
> ftp://202.65.194.18/cn/nic/rtl8139abcd8130810xseries/rtl8139cspec_1.4.pdf
> ftp://202.65.194.18/cn/nic/rtl8139abcd8130810xseries/8139dv111.pdf
>
> The datasheet states that pin 89 (WEB, Write Enable) "strobes data
> into the Flash memory during a write cycle". To add flash support to
> my NIC, I would cut the etch going to the WE* pin of my NIC's flash
> EEPROM and wire a link from this pin to pin 89 of the RTL8139.
>
> Your particular case may be different. You would need to first
> determine how the AM29C020's WE* pin is wired. Then you would need to
> locate the datasheet for your NIC's network chip.
>
> >help a budding electronics hobbyist!
>
> If you can you post the part number(s) of the various chips, and if we
> are able to locate the datasheets, then we may be able to hack your
> NIC, if need be.
>
> >Franc Zabkar <fzabkar@optussnet.com.au> wrote in message news:<p91ii0di7tusg2n4n00ovfk6unkme3r9el@4ax.com>...
> >> On 20 Aug 2004 16:05:28 -0700, heirbrande@yahoo.com (heirbrande) put
> >> finger to keyboard and composed:
> >>
> >> >I've found a neat utility called Uniflash that allows you to either
> >> >flash using your motherboard's BIOS socket or using a socket on a PCI
> >> >card, like the boot rom socket of an ethernet card.
> >>
> >> I can't see how you could use any NIC to flash an EEPROM, although I
> >> *can* see how you could flash a NIC boot ROM using the mainboard's
> >> BIOS socket. Can you point me to a URL that proves otherwise?
> >>
> >> >Apparently, I can Uniflash can get the card to save what is already on
> >> >the cchip to a file ok. I can tell Uniflash to flash the image file
> >> >back into the EEPROM chip ok.
> >> >
> >> >However, anytime I use a different .bin file as the source, Uniflash
> >> >shows a few red boxes within the progress bar instead of all green
> >> >boxes. Then it's says Flash verification failed or something to that
> >> >effect.
> >> >
> >> >I tried widdling a bit on the original ROM contents' image file by
> >> >adding a character at random. It seems that wherever in the file I add
> >> >the character (using the UltraEdit HEX editor), the flashing fails.
> >> >
> >> >I'm imagining that there must be some type of line-by-line checksum
> >> >going on , to make sure the characters make sense together on any
> >> >particular line?
> >>
> >> Highly unlikely.
> >>
> >> >This is only a guess since I'm failry new to this.
> >> >
> >> >Any ideas of how I can get a known good image burned into this chip?
> >> >The chip is an Amd 29C020.
> >> >Thanks
> >>
> >> It looks like your EEPROM socket is write protected. I can't find a
> >> datasheet for an AM29C020, but pin 31 of a Winbond W29C020 or Atmel
> >> AT29C020 is WE* (write enable). If this pin is tied high or low on
> >> your NIC, then you won't be able to flash your chip. In any case, many
> >> NIC chips only support 128K x 8 boot ROMs, ie 1Mbit.
> >>
> >>
> >> - Franc Zabkar
>
>
>
> - Franc Zabkar
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.chips (More info?)

On 30 Aug 2004 22:33:04 -0700, heirbrande@yahoo.com (heirbrande) put
finger to keyboard and composed:

>Hey Franc,
>
>I guess my brain is fried from studying too much today.
>I did want to ask this though:
>can I use a NIC manufactures own program to program an arbitrary image
>like 3Com's MBAFLASH.exe?

Prior to your original post I wasn't even aware that you could use a
NIC to flash an EEPROM, so perhaps I'm not the best person to answer
your question. :) However, I've discovered that my own [suitably
modified] RTL8139 based card can be used to flash an arbitrary 128K
binary image using Realtek's rtflash.exe utility:

ftp://152.104.125.40/cn/nic/rtl8139abcd8130810xseries/rtflash(150)-8139.zip

The one proviso appears to be that only a limited number of devices
are supported or recognised. :-( I notice, however, that Uniflash
claims to support the RTL8139.

===========================================================================
Usage: rtflash [command]/filename

Valid Commands:
-s: save flash contains to file
-v: verify contains of flash with filename
-l: list the flash that have test by this program
filename is the ROM code that you want to program to flash.

===========================================================================

Realtek Flash Utility Ver 1.5
(20000520) (C) Copyright, 2000 Realtek Semiconductor Co., LTD.


IOBASE=1000H IRQ= CH
Flash Device :Unknow Manufacturer ID=00
Device Code=00

Following Flash have test

ATMEL:
AT29C512 AT29C010
AT49LV512 AT49001NT

SST:
SST39LV512 SST39SF512
SST39VF010
===========================================================================

>I wonder if I can somehow trick MBAFLASH into flashing some other file.
>Hmm but I wonder if bootblock (whatever that is) matters?

A flash memory device is divided into several blocks, each of which
can be protected by a security bit. A protected boot block may contain
basic code which can be used to recover from a flash failure. If, for
example, you are programming a NIC boot ROM image into a flash EEPROM
that originally contained motherboard BIOS code, then you would need
to overwrite the boot block.

>I'll get the specs on the card tomorrow night. I know it's an Intel PCI card though.


- Franc Zabkar
--
Please remove one 's' from my address when replying by email.