Difference between revisions of "Xbox 360 BenQ VAD6038 Flash"

From ivc wiki
Jump to navigationJump to search
 
(9 intermediate revisions by the same user not shown)
Line 2: Line 2:


== DosFlash ==
== DosFlash ==
Download the DosFlash tool [http://www.xboxhacker.net/index.php?topic=8517.0] and put the DosFlash files from the DosFlash16 folder on a working MS-DOS boot disk.
Download the DosFlash tool [http://www.xboxhacker.net/index.php?topic=8517.0] and put the DosFlash files from the DosFlash16 folder on a working MS-DOS boot disk [http://www.bootdisk.com/].


== Install Switch ==
== Install Switch ==
For the DosFlash application to read the BenQ flash memory, the power to the flash memory has to be applied after DosFlash discovered the drive. The purpose of this is to go around the FirmGuard and jump into the flash memory right before the FirmGuard protection is enabled.
For the DosFlash application to read the BenQ flash memory, the power to the flash memory has to be applied after DosFlash discovered the drive. The purpose of this is to go around the FirmGuard and jump into the flash memory right before the FirmGuard protection is enabled.


By delaying powering up (with a switch) the flash memory after applying power to the drive, the FirmGuard can be circumvented.
By keeping the the power disconnected from the flash memory after the main power to the drive is connected, the FirmGuard can be circumvented. FirmGuard is not enabled and DosFlash can freely read the content.


=== Cut Traces ===
=== Cut Traces ===
Two traces has to be cut to install the switch. The traces are on the bottom side of the circuit board, facing down into the drive.
Two traces has to be cut to install a simple switch. The traces are on the bottom side of the circuit board, facing down into the drive. Unmount the circuit board from the drive.


I used a razorblad to cut the traces and a fiberpen to scratch the coating to expose the copper.
I used a razorblad to cut the traces and a fiber pen to scratch the coating to expose the copper.


[[Image:Benq flash cut traces tools.jpg]]
[[Image:Benq flash cut traces tools.jpg]]
Line 19: Line 19:


=== Solder Switch ===
=== Solder Switch ===
Solder two wires to the traces facing away from the cut and flash memory, as seen in the picture below. Connect the ends to a simple on/off switch.
Solder two short wires to the traces facing away from the cut and each other, as seen in the picture below. Connect the ends to a simple on/off switch.
 
[[Image:Benq flash switch pads.jpg]]


[[Image:Benq flash solder switch.jpg]]
[[Image:Benq flash solder switch.jpg]]
Line 32: Line 34:
# In DosFlash, enter the number of the discovered drive, normally '6', press enter.
# In DosFlash, enter the number of the discovered drive, normally '6', press enter.
# To read the firmware, press 'r', and enter a new filename to dump the firmware.
# To read the firmware, press 'r', and enter a new filename to dump the firmware.
# The drive should now be dumping the 4 banks.
# The drive should now be dumping the 4 banks, reboot into Windows when done.
 
[[Image:Benq flash read.jpg]]


== Write Flash ==
== Write Flash ==
To flash the drive, replace 'r' with 'w' in the procedure above.
To flash the drive, follow in the procedure above but replace 'r' with 'w' to program a new firmware.
 
[[Image:Benq flash write.jpg]]
 
== Spoof BenQ ==
* [[Xbox 360 BenQ VAD6038 64930C Spoof]]


== References ==
== References ==
* [http://www.xbox-scene.com/xbox1data/sep/EEllkyFpFyWmXBfbSm.php Dumping and flash BenQ VAD6038 drive]
* [http://www.xbox-scene.com/xbox1data/sep/EEllkyFpFyWmXBfbSm.php Dumping and flash BenQ VAD6038 drive]
* [http://dwl.xbox-scene.com/tutorial/vad6038_tutorial.pdf Team Modfreakz PDF Guide]
* [http://dwl.xbox-scene.com/tutorial/vad6038_tutorial.pdf Team Modfreakz PDF Guide]

Latest revision as of 18:30, 30 September 2007

For a few months the new BenQ VAD6038 drive for the Xbox 360 couldn't be dumped or flashed. A new DosFlash tool by Schtrom made it possible to access the drive flash memory.

DosFlash

Download the DosFlash tool [1] and put the DosFlash files from the DosFlash16 folder on a working MS-DOS boot disk [2].

Install Switch

For the DosFlash application to read the BenQ flash memory, the power to the flash memory has to be applied after DosFlash discovered the drive. The purpose of this is to go around the FirmGuard and jump into the flash memory right before the FirmGuard protection is enabled.

By keeping the the power disconnected from the flash memory after the main power to the drive is connected, the FirmGuard can be circumvented. FirmGuard is not enabled and DosFlash can freely read the content.

Cut Traces

Two traces has to be cut to install a simple switch. The traces are on the bottom side of the circuit board, facing down into the drive. Unmount the circuit board from the drive.

I used a razorblad to cut the traces and a fiber pen to scratch the coating to expose the copper.

Benq flash cut traces tools.jpg

Benq flash traces cut.jpg

Solder Switch

Solder two short wires to the traces facing away from the cut and each other, as seen in the picture below. Connect the ends to a simple on/off switch.

Benq flash switch pads.jpg

Benq flash solder switch.jpg

Read Flash

Disconnect the drive from the computer if it's connected and turn the switch to OFF-position.

  1. Boot MS-DOS and connect the SATA cable to the computer.
  2. Execute DosFlash.exe and wait for it to finish searching for drives.
  3. Connect the power cable to the BenQ drive.
  4. A second later turn the switch to ON.
  5. In DosFlash, enter the number of the discovered drive, normally '6', press enter.
  6. To read the firmware, press 'r', and enter a new filename to dump the firmware.
  7. The drive should now be dumping the 4 banks, reboot into Windows when done.

Benq flash read.jpg

Write Flash

To flash the drive, follow in the procedure above but replace 'r' with 'w' to program a new firmware.

Benq flash write.jpg

Spoof BenQ

References