Showing posts with label Project. Show all posts
Showing posts with label Project. Show all posts

Feb 4, 2013

Huawei BM622i Firmware Destroyer HW Protector

This is the latest automatic hardware protection all protected firmware and wan chips when protection is "on". Credit ko to kay boss lavaboy sa mga idea na binigay at design niya salamat bossing. nagpapasalamat din ako sa kasama kong technician na si tools1180 sa pagtulong nya sakin sa paggawa ng circuit design...


LED indicator:

1 Red = unprotected firmware & wan
1 Green = protected firmware & wan read-only mode (lan & wan cannot be change)

Switches :

1 rocker switch = on & off
1 push botton = to change wan & lan mac unprotected.

Relay and some parts.


Adapter is plug in modem off


Modem turn on


Modem protected


The modem is boot-up completed and operates with protected mode...Firmware chip is in read-only mode (no configuration setting can be changed); wan chip is in read-only mode (no wan/wimax signal settings can be changed... Wan mac cannot be changed even by the user)

This article can be found at Symbianize Forum created by soundbass1967

Dec 25, 2012

Huawei Bm622i MAC Changer Flasher by dBug


Today dBug from Symbianize Forum release his year end tutorial on how to change MAC address on CPE Huawei BM622i Wimax modem to the public. Yes the cost of the hardware is only 50 pesos about $1 believe it or not, you may now be able to tweak your CPE Huawei BM622i WiMAX modem such as changing the MAC address that many people have been awaited. In addition, bad firmware or brick WiMAX CPE is now possible to be repaired by this tiny electronic circuit its the (SPI Flasher/LPT). What you need are just this few things.


Download the rar file that include:
  • BM622i bin 2010
  • bm622i_public pdf file full tutorial
  • X-Ways.WinHex.v15.9.SR-7
  • SPI FlashROM Programmer 1.9c

SPI FlashROM Programmer 1.9c
****************************

SPIPGM - binary for Linux
SPIPGM.EXE - binary for DOS/Win9x
SPIPGMW.EXE - binary for Win9x/NT/2k/XP
IOPERM.DLL - low-level HW access library for Win9x/NT/2k/XP/Vista/7(NoUAC)

Version 1.7+ has improved LPT port handling resulting in 1.6x faster reading

You can check from here the list of supported SPI FlashROM:

https://docs.google.com/file/d/0Bx41Hy9aW5BaN25Dd1hWLWY5VjQ/edit?pli=1

http://rapidshare.com/files/1462160046/bm622i_fixed.rar

http://www.mediafire.com/?58z12yy533lc5ba

This article is taken from Symbianize forum you can check the original link here.

Jan 7, 2011

DIY Flash EEPROM BIOS Programmer

I got this Gateway Dx4300 computer motherboard with a dead BIOS chip in it, that wont start at all, so I figured it must be a corrupt bios. The motherboard was kinda nice that supports Phenom II quad processors & DDR3 ram (I think) .. so I didn't want to waste it just because it had a bad bios chip.


Buy a replacement bios chip you say ? .. sure , but i dont feel like spending $25-$35 right now for a motherboard i got for free .. so I had an idea to build a simple BIOS programmer that I can build & use to save his board and possibly others in the future ..

so the bios chip was an Macronix MX25L8005 (1MB) .. and .. luckily, it sat on a socket (not soldered in) ..


After some research, I found a few DIY kits & projects along with comercial ones like the Willem, Acron, SMARTPRO ..etc , they were all expensive. Eventually I stumbled upon a design that will probably do the job, so I built the simple circuit & started experiminteng with it .. a few attempts later, I was able to reflash the chip with a new bios that saved the motherboard from the garbage man, later I decided to add some improvements to this design to make it more convenient to use in the future.

My design is based on RayeR's with slight improvements, I have added a voltage regulator to power it directly from USB port, a switch and some LED indicators ..

Supported chips (and possibly others):

AMIC
SST
ST Microelectronic
A25L05PU/PT (64kB)
A25L10PU/PT (128kB)
A25L20PU/PT (256kB)
A25L40PU/PT (512kB)
A25L80PU/PT (1MB)
A25L16PU/PT (2MB)
A25L32PU/PT (4MB)
A25L64PU/PT (8MB)
A25L512 (64kB)
A25L010 (128kB)
A25L020 (256kB)
A25L040 (512kB)
A25L080 (1MB)
SST25VF010 (128kB)
SST25VF020 (256kB)
SST25VF040 (512kB)
SST25VF080 (1MB)
SST25VF016 (2MB)
SST25VF032 (4MB)
SST25VF064 (8MB)
SST25VF128 (16MB)
SST26VF016 (2MB)
SST26VF032 (4MB)
SST26VF064 (8MB)
M25P10 (128kB)
M25P20 (256kB)
M25P40 (512kB)
M25P80 (1MB)
M25P16 (2MB)
M25P32 (4MB)
M25P64 (8MB)
M25P128 (16MB)
EON
Winbond
Macronix
EN25P16 (2MB)
EN25P32 (4MB)
EN25P64 (8MB)
EN25P128 (16MB)
EN25F16 (2MB)
EN25F32 (4MB)
EN25F64 (8MB)
EN25F128 (16MB)
W25X10 (128kB)
W25X20 (256kB)
W25X40 (512kB)
W25X80 (1MB)
W25X16 (2MB)
W25X32 (4MB)
W25X64 (8MB)
MX25L1005 (128kB)
MX25L2005 (256kB)
MX25L4005 (512kB)
MX25L8005 (1MB)
MX25L1605 (2MB)
MX25L3205 (4MB)
MX25L6405 (8MB)

Spansion
Atmel

S25FL004A (512kB)
S25FL008A (1MB)
S25FL016A (2MB)
S25FL032A (4MB)
S25FL064A (8MB)
S25FL128P (16MB)


AT26DF041 (512kB)
AT26DF081A (1MB)
AT26DF161A (2MB)
AT26DF321 (4MB)




NOT BAD AT ALL FOR A $5 HOME-MADE FLASHER !!!


The finished PCB in action, just remember to erase the chip first before re-programming, it works best that way... the extra 3 pin white-connector you see is for my personal use to get +5VDC & +3.3VDC directly out (optional) .. you don't need to have that.

Software ???

There are many option out there that work with SPI based LPT port programmer .. I tested a few, SPIPGM (DOS) worked best for me .. the pic below is from a Window$ based GUI that I also tested .. and finaly, I will definately make a nice housing for this PCB and add a ZIF socket to make it more convenient to use ..


And off-course .. here's the schematic ..


This project being written by Nader Gator all works are credited to him.

Mar 27, 2010

Programmer SPI FlashROM for parallel port

March 23, 2008 Since I'm such a meddler, as drilled in codes like BIOS, and he will not rest until the screen for good nezčerná :), and also need to be able to manually reprogram FlashROM. I used it in parallel flashek that were on the board at DIL32 or PLCC32 socket, solved simply hotflash when I had prepared in advance of the second chip with a working BIOS. The one I put into the slot at runtime exchange for badly programmed chip and reprogrammed.


Now I'm on my new motherboard Gigabyte GA-P31-DS3L met with a new type of memory - a high speed SPI FlashROM Winbond 25X40VSIG SMD SOIC-8 housing, which is soldered directly to the board. South bridge intel ICHx longer time support both variants FWH and SPI. Using certain chipset registers and pins can select from the interface is primarily used for BIOS. 

Due to the fact that with SMD components save a dime at base, overall reducing the costs of production and thus managers have more $ for better cars and bitches ;). Šťouralům then we have no choice but to take the hand solder ... To flash with that reasonably could work, I soldered it to the precise DIL8 slot. The second slot DIL8 I then soldered to the motherboard. Because I would be on-site with a solder around the base (opposite the SATA connector) did not make it, I let it dangle on two bits of 4-core braces:

Followed by a production programmer. SPI devices to connect to the PC but just an ordinary parallel port, 5 wire, a few resistors and connectors. Involvement based on the type of cable programming SPI BSD programming Atmel AVR microcontrollers. Advertised W25X40V memory is designed for 3.3 V power supply, so I separated the data line resistors, to suffer from a higher voltage LPT. At the same time acts as a damping resistors, otherwise it will on the long (about 1.5 meters) flat cable without shielding between the signal lines causing crosstalk and thus incorrect data transmission. Interestingly, the same AVR MCU me a lead they work without problems. I used to power an external source.


The whole thing then jumbled the universal plošňáku looks something like this:


Another thing that is only software that I had to write. First, it must be programmed lowest layer that works with LPT registers and sets / reads the required level of the SPI lines. On this topic, I refer to the book Burkhard Kainka - Using the PC port of Publishing HEL 1997, from which I once learned how to blink his first light on LPT. But the Internet is a resource on this topic more than enough.

In addition, I said something to the SPI bus itself. It consists of three lines: SCK - Serial Clock (up to tens of MHz), MISO - Master Output Slave Input, MOSI - Master Output Slave Input and in this case there is also an auxiliary control unit # CS - Chip Select. Communication typically takes place between two devices, one of which is the master (in this case the PC), which controls the SCK clock (there is a resting level log. 0) and sends commands / data on MOSI line while simultaneously reads the data from the MISO line. 

Slave devices (in this case, memory) then responds to the SCK clock by the falling edge of the clock sends a bit on the MISO line and the rising edge of the bit clock reads MOSI lines. Byte is sent in MSB first, LSB last. After the transfer is complete master clock returns to the idle level (logical 0). The bus is to be opposed by I2C full duplex. Slave devices do not identify any address. In order to connect to multiple lines SPI slave devices must be master with any device connected to a separate control line CS # to log levels. N 0, activates one slave device (other SPI outputs are in high impedance state to affect the ongoing communication (SPI devices have 3-state outputs are required pull-ups). In the case of SPI Flash memory, CS # is used for the beginning and end of the frame so it can not be easily connected to the ground. following picture tells more as being read from memory:


First Master starts moving beyond CS # to log. 0 and thereby activates the memory. Then starts the master clock and transmits the first byte command 3h - reading from memory. Memory determines, what we want to her and knows he has yet to address. Then the master sends the next 3 bytes. Memory address decoding and immediately starts the next byte to send data. If Master requests data from the following addresses, lets start the clock and automatically increments the memory address. Further incoming data from the Master are ignored. End of the frame, then the Master terminates transfer hours in standby log. 0 and CS # going to idle status log.

First memory supports a standard set of commands, which include the need to read, write, delete pages, erasing sectors, deleting the whole chip, lock, unlock, identifying the manufacturer and type of chip JEDEC, reading the status register, ... Some commands are byte, others have parameters and data. Some memory corresponds sending data to another Sun For more details see datasheet for specific memory.

Further step was therefore write functions for sending and receiving bytes and data blocks, and finally processing functions commands of Flash memory. The current version of the program allows you to identify the type of memory / i, to read and display the data block of a given size from a given address / r, read the entire file into memory / d, the entire program memory from / p, delete the entire memory / ea unlock write protect bits / u . Other parameters / L = Adjustable base address of LPT / d = extension of SCK pulse in microseconds (except Windows version, where there is no timer with a higher resolution than 1 ms). The download package are 3 versions for DOS, Windows and Linux.

Due to the limited speed of LPT and serial transmission method takes a read or write tens of seconds to minutes. Chip erase time depends on the speed of the internal mechanisms in memory and takes about units to tens of seconds. Faster communication could be achieved using microcontroller, preferably with a hardware SPI controller, which communicates with the PC either 8-bit after LPT or USB. Sample event program memory M25P32 Wed: More information at Rayer's Blog.