Good evening all,
After heaving sweated for months, I finally call for help at the community...
My target is to program several SPI chips in order to repare some ASUS laptops, which was solved before by purchasing pre-programmed BIOS Chips
I first tried to access with an SOIC "gripper" clip, directly on the chip being soldered on the main board.
Facing to a lot of failures (unknown chip), I decided than to work on de-soldered chips.
This allowed me to extract some dumps on failing and fresh purchased SPIs.
Now, I have a satisfying database of complete images of BIOS, that I expect to use for programming new chips according each need.
At that point begin my problem :
After a abort during the first trial, I decided to erase my chip, and got the following advise :
_"C:\Flashrom>flashrom -E -p buspirate_spi:dev=/COM3,spispeed=1M_ _flashrom v0.9.6.1-r1704 on Windows 6.1 (x86)_ _flashrom is free software, get the source code at http://www.flashrom.org [1]_
_Calibrating delay loop... OK._ _Found Winbond flash chip "W25Q32.V" (4096 kB, SPI) on buspirate_spi._ _Erasing and writing flash chip... FAILED at 0x00000800! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x00000fff: 0x600_ _ERASE FAILED!_ _Reading current flash chip contents..."_
Than I decided to purchase a DIP to SOIC adaptor in order to eliminate my doubts on the connection by gripper. Now the chips I use are soldered ...
I tried to write again the BIOS image and got the following after a very long time of writing operation (more than one hour) and using the following command :
_"flashrom -w flash.bin -VVV -p buspirate_spi:dev=/COM3,spispeed=1M"_
The reslult is :
_"Your flash chip is in an unknown state._ _Please report this on IRC at chat.freenode.net (channel #flashrom) or_ _mail flashrom@flashrom.org, thanks!_ _buspirate_sendrecv: write 1, read 0 Sending 0x00_ _buspirate_sendrecv: write 0, read 4 , receiving 0x42 0x42 0x49 0x4f_ _buspirate_sendrecv: write 0, read 1 , receiving 0x31_ _Raw bitbang mode version 1_ _buspirate_sendrecv: write 1, read 0 Sending 0x0f_ _Bus Pirate shutdown completed."_
Considering than I took every possible care on the connection between Buspirate and SPI, and having a satisfying reading result (dumps are checked with Hex Editor and look OK), I am stucked at that point...
I would appreciate any support from you.
Thanks !
J.
Links: ------ [1] http://www.flashrom.org
On Thu, 11 Jun 2015 22:09:55 +0200 jackjean jackjean@vivaldi.net wrote:
Good evening all,
After heaving sweated for months, I finally call for help at the community...
My target is to program several SPI chips in order to repare some ASUS laptops, which was solved before by purchasing pre-programmed BIOS Chips
I first tried to access with an SOIC "gripper" clip, directly on the chip being soldered on the main board.
Facing to a lot of failures (unknown chip), I decided than to work on de-soldered chips.
This allowed me to extract some dumps on failing and fresh purchased SPIs.
Now, I have a satisfying database of complete images of BIOS, that I expect to use for programming new chips according each need.
At that point begin my problem :
After a abort during the first trial, I decided to erase my chip, and got the following advise :
_"C:\Flashrom>flashrom -E -p buspirate_spi:dev=/COM3,spispeed=1M_ _flashrom v0.9.6.1-r1704 on Windows 6.1 (x86)_ _flashrom is free software, get the source code at http://www.flashrom.org [1]_
_Calibrating delay loop... OK._ _Found Winbond flash chip "W25Q32.V" (4096 kB, SPI) on buspirate_spi._ _Erasing and writing flash chip... FAILED at 0x00000800! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x00000fff: 0x600_ _ERASE FAILED!_ _Reading current flash chip contents..."_
Than I decided to purchase a DIP to SOIC adaptor in order to eliminate my doubts on the connection by gripper. Now the chips I use are soldered ...
I tried to write again the BIOS image and got the following after a very long time of writing operation (more than one hour) and using the following command :
_"flashrom -w flash.bin -VVV -p buspirate_spi:dev=/COM3,spispeed=1M"_
The reslult is :
_"Your flash chip is in an unknown state._ _Please report this on IRC at chat.freenode.net (channel #flashrom) or_ _mail flashrom@flashrom.org, thanks!_ _buspirate_sendrecv: write 1, read 0 Sending 0x00_ _buspirate_sendrecv: write 0, read 4 , receiving 0x42 0x42 0x49 0x4f_ _buspirate_sendrecv: write 0, read 1 , receiving 0x31_ _Raw bitbang mode version 1_ _buspirate_sendrecv: write 1, read 0 Sending 0x0f_ _Bus Pirate shutdown completed."_
Considering than I took every possible care on the connection between Buspirate and SPI, and having a satisfying reading result (dumps are checked with Hex Editor and look OK), I am stucked at that point...
I would appreciate any support from you.
Hi,
you should have come here earlier probably :) Regarding your initial problems there are some hints at http://flashrom.org/ISP
The failed erases and probably also the cause of the unknown state at the end comes from unconnected an !WP and/or !HOLD pin. See http://flashrom.org/Bus_Pirate for more details on these connections.
If that does not help please post the write.log file generated by: flashrom -w flash.bin -p buspirate_spi:dev=/COM3,spispeed=1M -o write.log
Le 13/06/2015 09:54, Stefan Tauner a écrit :
On Thu, 11 Jun 2015 22:09:55 +0200 jackjean jackjean@vivaldi.net wrote:
Good evening all,
After heaving sweated for months, I finally call for help at the community...
My target is to program several SPI chips in order to repare some ASUS laptops, which was solved before by purchasing pre-programmed BIOS Chips
I first tried to access with an SOIC "gripper" clip, directly on the chip being soldered on the main board.
Facing to a lot of failures (unknown chip), I decided than to work on de-soldered chips.
This allowed me to extract some dumps on failing and fresh purchased SPIs.
Now, I have a satisfying database of complete images of BIOS, that I expect to use for programming new chips according each need.
At that point begin my problem :
After a abort during the first trial, I decided to erase my chip, and got the following advise :
_"C:\Flashrom>flashrom -E -p buspirate_spi:dev=/COM3,spispeed=1M_ _flashrom v0.9.6.1-r1704 on Windows 6.1 (x86)_ _flashrom is free software, get the source code at http://www.flashrom.org [1] [1]_
_Calibrating delay loop... OK._ _Found Winbond flash chip "W25Q32.V" (4096 kB, SPI) on buspirate_spi._ _Erasing and writing flash chip... FAILED at 0x00000800! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x00000fff: 0x600_ _ERASE FAILED!_ _Reading current flash chip contents..."_
Than I decided to purchase a DIP to SOIC adaptor in order to eliminate my doubts on the connection by gripper. Now the chips I use are soldered ...
I tried to write again the BIOS image and got the following after a very long time of writing operation (more than one hour) and using the following command :
_"flashrom -w flash.bin -VVV -p buspirate_spi:dev=/COM3,spispeed=1M"_
The reslult is :
_"Your flash chip is in an unknown state._ _Please report this on IRC at chat.freenode.net (channel #flashrom) or_ _mail flashrom@flashrom.org, thanks!_ _buspirate_sendrecv: write 1, read 0 Sending 0x00_ _buspirate_sendrecv: write 0, read 4 , receiving 0x42 0x42 0x49 0x4f_ _buspirate_sendrecv: write 0, read 1 , receiving 0x31_ _Raw bitbang mode version 1_ _buspirate_sendrecv: write 1, read 0 Sending 0x0f_ _Bus Pirate shutdown completed."_
Considering than I took every possible care on the connection between Buspirate and SPI, and having a satisfying reading result (dumps are checked with Hex Editor and look OK), I am stucked at that point...
I would appreciate any support from you.
Hi,
you should have come here earlier probably :) Regarding your initial problems there are some hints at http://flashrom.org/ISP [2]
The failed erases and probably also the cause of the unknown state at the end comes from unconnected an !WP and/or !HOLD pin. See http://flashrom.org/Bus_Pirate [3] for more details on these connections.
If that does not help please post the write.log file generated by: flashrom -w flash.bin -p buspirate_spi:dev=/COM3,spispeed=1M -o write.log
Hello, and thank you for your appreciated support.
I confirm that pins 3 and 7 were free, according the advises from an ASUS laptops forum.
I than connected both pins 3 (HOLD) and 7 (WP) to the 3.3V.
Having also doubts on the Winbond SPI, I choosed to replace it by a Macronix.
First strange reaction is that flashrom recognises 3 possible different chips :
Than I choosed to add the "-c MX25L3205(A)" as option in the flashrom commands
I tried than to launch the writing command, but returns allways a fail, as you will read in attached log file.
Links: ------ [1] http://www.flashrom.org [2] http://flashrom.org/ISP [3] http://flashrom.org/Bus_Pirate
On Mon, 15 Jun 2015 23:00:01 +0200 jackjean jackjean@vivaldi.net wrote:
Hello, and thank you for your appreciated support. I confirm that pins 3 and 7 were free, according the advises from an ASUS laptops forum. I than connected both pins 3 (HOLD) and 7 (WP) to the 3.3V. Having also doubts on the Winbond SPI, I choosed to replace it by a Macronix. First strange reaction is that flashrom recognises 3 possible different chips :
Than I choosed to add the "-c MX25L3205(A)" as option in the flashrom commands I tried than to launch the writing command, but returns allways a fail, as you will read in attached log file. […] Erasing and writing flash chip... Trying erase function 0... 0x000000-0x00ffff:EFAILED at 0x00001000! Expected=0xff, Found=0x20, failed byte count from 0x00000000-0x0000ffff: 0x8c6a ERASE FAILED! Reading current flash chip contents...
Hello,
flashrom does not find 3 chips but a chip with three possible/matching definitions and it can not distinguish them so you have to tell it which one you have. You chose the wrong one and thus get an error for the first erase function. However, the other erase functions would (most probably) have worked. Either choose the right one or let flashrom finish. :)
Le 15/06/2015 23:08, Stefan Tauner a écrit :
On Mon, 15 Jun 2015 23:00:01 +0200 jackjean jackjean@vivaldi.net wrote:
Hello, and thank you for your appreciated support. I confirm that pins 3 and 7 were free, according the advises from an ASUS laptops forum. I than connected both pins 3 (HOLD) and 7 (WP) to the 3.3V. Having also doubts on the Winbond SPI, I choosed to replace it by a Macronix. First strange reaction is that flashrom recognises 3 possible different chips :
Than I choosed to add the "-c MX25L3205(A)" as option in the flashrom commands I tried than to launch the writing command, but returns allways a fail, as you will read in attached log file. […] Erasing and writing flash chip... Trying erase function 0... 0x000000-0x00ffff:EFAILED at 0x00001000! Expected=0xff, Found=0x20, failed byte count from 0x00000000-0x0000ffff: 0x8c6a ERASE FAILED! Reading current flash chip contents...
Hello,
flashrom does not find 3 chips but a chip with three possible/matching definitions and it can not distinguish them so you have to tell it which one you have. You chose the wrong one and thus get an error for the first erase function. However, the other erase functions would (most probably) have worked. Either choose the right one or let flashrom finish. :)
Second shot OK!
The read + erase + write were successful. It is now running the verify... It smells good...
Great !!!
Tomorrow I will try a new Winbond...
I have a "parallel" question : Do you know where I can find how to modify the GUID and MAC address of Laptop, and on which chip are these data stored ?
The reason of this question is that I have a Laptop which has a corrupted MAC address, that does not allow to install properly the Ethernet driver...
On Tue, 16 Jun 2015 00:01:29 +0200 jackjean jackjean@vivaldi.net wrote:
I have a "parallel" question : Do you know where I can find how to modify the GUID and MAC address of Laptop, and on which chip are these data stored ?
The reason of this question is that I have a Laptop which has a corrupted MAC address, that does not allow to install properly the Ethernet driver...
Nowadays this is often stored in the flash chip with the firmware. You can try to find the wrong ones in the binary flashrom has read from the chip if you stored that before writing other data. Be aware that the data is probably stored in little endian thus all bytes might need to be reversed to find it.
-
jackjean -
Stefan Tauner