DosFlash and DosFlash32 V1.1 Beta
-----------------------------------
- DosFlash.typ modified for better BenQ support 
- DosFlash16 Flash Manufacturer and Device ID screen output restructured
- flash chips are first erased before writing starts
- DosFlash32 no reenable of DVD-ROMs in device manager after flashing, this means you can't see drive
  and maybe have to activate it manual again in device manager, this could give better compatibility and
  hopefully no more blue screens

Many thanks to Jumba, Redline99, TeamModfreakz and Tiros for inspiration and help!


DosFlash and DosFlash32 V1.0 Beta
-----------------------------------
DosFlash can be used to read/write/erase the flash chips of most CD/DVD-ROM drives
that have a mediatek chipset installed. DosFlash is for DOS flashing, DosFlash32
for Windows flashing.


Features:
-----------
- flashes IDE and SATA drives
- supports parallel and serial flash chips
- flash drives in Windows with direct port access
- no vendor cdb flashing commands are used
- tested with the following drives:
  - TS-H943A MS25, MS28
  - SH-D162C
  - SH-D163A
  - and some other drives like Liteon, Hitachi, ...
- NEC drives are not supported, cause they have no mediatek chipset installed
 

DosFlash
----------
DosFlash supports two flashing modes, Auto and Manual. If you type DOSFLASH at a DOS prompt it
will start in Auto mode. All drives and the corresponding flash chips are detected automatically.
If you can't get a flash chip recognized due to a bad flash or other problems you should use the
Manual mode. In Manual mode you can enter all the parameters used for flashing by hand. The
following help screen is displayed if you start DosFlash with a wrong number of parameters:


DOSFLASH by Kai Schtrom, 08/05/2007 (Ver 1.0 Beta)
DOSFLASH [R|W|E] [PORT] [PORT TYPE] [DRIVE POS] [FLASH TYPE]
         [FLASH SIZE] [FLASH SECTOR ERASE OPCODE] [FILE NAME]
                        R: Read FLASH
                        W: Write FLASH
                        E: Erase FLASH
                     PORT: Port to send command to
                PORT TYPE: 0 for IDE, 1 for SATA
                DRIVE POS: A0 for Master, B0 for Slave
               FLASH TYPE: 0 for parallel flash, 1 for serial flash
               FLASH SIZE: size of flash chip in number of banks
FLASH SECTOR ERASE OPCODE: individual sector erase opcode command byte
                           this is only needed for erasing a serial flash
                FILE NAME: name of the file to read/write from/to flash
All numbers are intepreted as hex values!

Example Usage:
"DOSFLASH R 01F0 0 A0 1 4 C:\flash.bin"
=> Read serial flash with a size of 4 bank (262144 bytes) from Master Device
   on IDE port 0x01F0
"DOSFLASH E C000 1 A0 1 4 D8"
=> Erase serial flash with opcode 0xD8 and a size of 4 banks (262144 bytes)
   from Master Device on SATA port 0xC000
   
   
Explanation of the Parameters:
--------------------------------

[R|W|E]
---------
- this will set the mode of flashing, it is recommended to first try read on any
  drive, if the read will fail, it is highly unlikely that a write or erase will
  succeed

[PORT]
--------
- the port to which the drive is connected, a port number should always be entered
  in hexadecimal and have 4 hex digits, valid ports are: 01F0, 0170, C000, C800
- this option can be used if your PCI adapter card or on board IDE/SATA ports are
  not identified by the auto mode

[PORT TYPE]
-------------
- the port type tells DosFlash what type of port is installed on the before entered
  port address
- valid values are 0 for IDE and 1 for SATA
- make sure you never mix the wrong port with the wrong port type, this could give
  strange results or in the worst case a bricked drive
  
[DRIVE POS]
-------------
- old style IDE channels have the possibility to connect two drives at one IDE
  channel, the first drive is called the master, the second drives is called the
  slave
- you can select which drive should be flashed on the channel, A0 selects Master,
  B0 selects Slave
- on SATA ports this value is always A0, cause you can only connect one drive to
  a SATA port, so for SATA you will always type A0 here
- it is not recommended to flash IDE drives with another drive connected to the
  same IDE channel, this could be risky if something in the Master/Slave selection
  fails
  
[FLASH TYPE]
--------------
- there are two types of flash chips out for CD/DVD-ROM drives atm
- the older type is parallel flash, which is also supported by mtkflash for example
- the newer type is serial flash, which is supported by flashers like XSF
- the problem here is that no tool is out that can flash serial flash chips on 
  SATA ports
  
[FLASH SIZE]
--------------
- this is specifies the flash chip size in banks
- one bank is always 65.536 bytes in size
- if you know your drive has a flash chip of 262.144 bytes in size you need to enter 4

[FLASH SECTOR ERASE OPCODE]
-----------------------------
- the opcode used in the flash chips datasheet for erasing
- for serial chips this command can be different from the standard and needs to be
  entered for flash erase
- for parallel flash chips you can enter a dummy cmd byte, the integrated command
  should work on all parallel flash chips without a prob
  
[FILE NAME]
-------------
- name of the file that should be used for flashing
- for reading operations this should be the output file
- for writing operations this should be the input file


Hints and Warnings
--------------------
- read, write erase TS-H943A MS28 after the firmware stealth has been disabled with Enable0800 disc
  - this only works one time, after the first mtk vendor specific intro cmd is send
  - if the mtk vendor specific outro cmd is send the chip goes back to stealth mode and you need
    again the Enable0800.iso to disable it
  - therefor the mtk vendor specific intro is send at program start to all present devices and the
    mtk outro is sent at program end
  - if you have a chip manufacturer id of 0x02 and a chip device id of 0x02 for the TS-H943A
    the flash chip is in stealth mode and won't give access to any reading, writing, erasing
- always have a look at the DataSum generated, this is exactly the DataSum of mtkflash
  - the DataSum is calculated as the sum of all bytes of the firmware in a short integer
  - to make 100% sure that the flash is written right compare that DataSum to a known one
- this tool has not been tested on all drives out there, the typ list is simply copied from well
  known programs like mtkflash and XSF
  - always try a flash read on a not yet tested drive before doing anything else
  - if the read doesn't succeed it is highly unlikely that a write or erase will
- some LiteOn drives seem to have probs to write the firmware correct, this prob seems to be
  related to windows register flashing, cause even an assembler app can't do this error free
  - if you get errors on LiteOn drives, write the flash two times in a row
- for direct port I/O in windows the givoio.sys driver is used, this driver is loaded at DosFlash32
  start and unloaded at program end, be warned, this driver can possibly make your system unstable,
  it's intention is to let privileged assembler instruction like in and out pass, even in windows,
  if this driver is not used you will not be able to get direct access to port registers
- DosFlash was tested on MS-DOS 6.22 and later, you can easily copy it on a MS-DOS boot disk created
  in Windows XP and start DosFlash directly from the disk
- don't forget to also copy the DosFlash.typ file, it has all the informations about flash chips
  for auto mode flashing
- DosFlash32 was tested without a prob on Windows XP SP2, you'll need also the typ file for the 
  win version
- DosFlash32 will deactivate all CD-ROMs in device manager at startup, this is better for flashing,
  cause Windows seems to poll the drives all the time and this could result in a bad fw file or
  a program hang, the drives are activated again at program end
- you should make sure that the flash is not in an erased state at program end, cause device manager
  don't like drives that do not respond to the inquiry command
- deactivating all CD-ROMs could take a few seconds, so please be patient at program start
- DosFlash and DosFlash32 will try to scan for the VIA 6421L Raid Controller card, based on vendor
  id 1106 and device id 3249, it doesn't matter if the card driver is installed or not


Many thanks to Dale Roberts and his Direct Port I/O driver giveio.sys!

Avoid a bad flash!
Kai Schtrom