Saturday, August 11, 2012

Parallel Port SPI Flash Programmer (and Unbrick via WM8650 tablet)

17 comments
When using spipgm, you might encounter parity error or similar other error. Mostly, it means that the chip is not recognized because of various factor, such as bad connection. This issue has already been answered by Martin Rehak on its own web page. You can see them on SPIPGM FAQ.

Flashing EON EN25F40

The first time I use this software, I too had encounter parity error. So I want to share how I solved this problem and flash successfully the chip (unbrick WM8650 tablet).

If you already built your hardware interface and had this error, you should check all connection again and ensure that the supplied power isn't noisy. It's better to use battery as power supply than using AC to DC power supply. Make sure the cable isn't too long. Do not omit capacitor and resistor. Use resistor with appropriate value.

Also, this programmer cannot run on 64-bit windows. If you have 64-bit OS such as Windows 7 x64, this programmer software cannot run. You will be needing a 32-bit OS. The easy solution is to use virtualization technology such as VirtualBox or VMWare and install a 32-bit windows there, and don't forget to configure the virtual machine to use LPT port. If you don't have a 32-bit windows, you can use linux/ubuntu.

In my cases, the hardware I built failed to communicate with the chip. Then I started over and rebuilt the hardware. The parts I uses are:
- 8x or more (thin) wires. The chip had 8 pins after all.
- 8x pins (taken from unused LPT cable)
- 1x 3V CR2302 battery
- 1x 1000uF capacitor
- 8x 100ohms resistor (Use appropriate value - depends on your LPT port output impedance and wiring parameters)

1. Finding the parts

The first things to do is finding the thin wire. Thick wire will create a problem when soldering the wire to the chip as the spaces between chip's pins is too close.
Use thin wire(right), the other two wire on the left is too thick. 

The next things to do is to find the capacitor and resistor. You can buy them or scrape from unused electronic appliances. The other options is to borrow them from your electronic appliances and return back (solder back) when done.
Some parts I used

Then, a power supply. The chip i'm going to flash is EON EN25F40 and have a power range of 2.7V to 3.6V. So, I pulled out the CMOS battery from my computer motherboard and use it.
Where is my CMOS battery?

2. Making the hardware

Refer circuit diagram here.

The hardware I created was so simple. The wire will be connected to LPT port and to chip directly, but of course there will be a resistor between them. The resistor is soldered to the wire and become parts of the wire itself. Then a pin is soldered to the resistor and finally the other end of the wire is soldered to the chip.
Wire, resistor and pin altogether.

The rest (capacitor and power) can be easily to figure out.

A simple diagram.

3. Testing the hardware

Once the hardware is finished, it's time to test the hardware. Make sure again all the connection is good. Then go to your computer, open command prompt and cd to spipgm directory. Then type
> spipgmw /i



If the programmer identifies the chip correctly, then you can proceed to the next step. Otherwise, you need to debug your hardware and find the problem.

Check the hardware back, ensure all connection is good especially on non soldered or movable part such as the wire to LPT port. Make sure the power supply isn't too weak and provide enough power. Minimize power noise and etc. Make sure to read SPIPGM FAQ on Martin Rehak's page. After all of that, run back the command.

In my cases, the problem still persists. What I do is I create some batch file which contains the following command and saved it to spipgm folder.
---------- SNIP ----------
@echo off
:loop
spipgmw /r 0 32 /d=0
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
goto loop
---------- SNIP ----------
@echo off


:loop
spipgmw /i /d=0
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
sort readme.txt > nul
goto loop
---------- SNIP ----------
You can download it here: http://www.mediafire.com/download.php?zch2a94zza0hqtd

The first batch command above is simply to instruct the spipgm to read 32 bytes of data from the chip and running in loop. If the isn't connected properly, it will show empty data (a lot of FF FF FF... or 00 00 00...). The second one is simply to identify the chip and run in loop.

Then I execute the batch file and let it run. While it's running, I try to touch and reconnect the wire connecting the chip to LPT, the capacitor and the battery until I get some reading on screen. The reading (dump data) might be useless, such as accidental shorting of some pin with another pin might show some garbage data on screen. To know whether the hardware works or not, you should see the chip identification. If the programmer identifies the chip correctly, then it should works. In my case it identifies as EN25F40.

After fixing the hardware problem, I let the batch run for half a minute just to see if the hardware is stable. If the dump reading isn't changed, then you know the hardware is stable.

The connection.

4. Flashing

Before flashing, the chip needs to be unlocked and erased first. Run this command:
> spipgmw /u
> spipgmw /e

The first one is to unlock the write protection bit. If the programmer complain "Status register is protected, you will need to set WP# high", you might need to check your connection again. Especially the connection on WP# pin (pin number 3). WP stands for write protect. You need to set it high, which means you need to apply some voltage to that pin. Make sure the power supply and capacitor is properly connected too.

The second one is to erase the chip. It is required. The chip cannot be flashed when there is still data on it.

After that, it's time to flash the chip with a new data. Obtain or make a file containing data to flash to the chip. I'm in a process of unbricking WM8650 tablet, so the file I used to flash is WM8650a.bin (Taken from techknow forum). Then type:
> spipgmw /p wm8650a.bin

This will flash the files to the chip. Wait until finish. It should be finished in a minute or two or maybe less. The programmer will finish first before you finish to make some coffee/tea, maybe ;) Better make your coffee after finishing step 2.

Then, you need to verify newly flashed data on the chip with the file you used to flash the chip. Type this:
> spipgmw /v wm8650a.bin

If the verify successful, you can safely put back the chip in its place and solder it to the board. If not, try erase and flash again. Make sure not to disturb the hardware while flashing.

5. Finish

When finished and all the data on chip has been verified successfully, I begin to desolder the wire from the chip and solder the chip back into the WM8650 daughter board. Then put proper ROM into sdcard and power the tablet. The tablet was alive again and its flashing a new ROM. Funnily enough, the tablet hasn't been untouched for about a week and while flashing, a warning appear and it tell me "Battery Low!" and the tablet immediately shut down. I got the feeling that the chip need to desolder back and reflashed. Fortunately, no. After plug in the charger and powered on the tablet, the tablet enter ROM Upgrade mode back and able finish it.

Solder back the chip

6. Note

If you are trying to unbrick the tablet, some people successfully flashed the chip without taking the chip out of the board. You might want to try this by solder the wire directly to the chip while its still connected to the board. I already tried without success.

Here the picture of WM8650 after unbricking. The tablet is alive again. RSATK



Helpful Link:

http://img840.imageshack.us/i/spipgmv2.gif/ - Circuit diagram
http://rayer.g6.cz/elektro/spipgm.htm - Circuit diagram and blog
http://rayer.g6.cz/programm/programe.htm#SPIPGM  - spipgm SPI Programmer download and FAQs
http://www.techknow.t0xic.nl/forum/index.php?topic=261.0 - Debrick guide

http://nn1.upanh.com/b4.s28.d2/f4ac7b14f00fa76eed2a98543796d1fd_46323571.spipgm25q80scp.jpg - A simple direct hardware by linhcentrio

17 comments :

  1. thank you very much for your efforts....i'll try it with my bricked netbook....and provide results

    ReplyDelete
  2. Tempted to try this with a bricked CLP281 netbook.

    ReplyDelete
  3. bro, ni lu buat sndri ke.. bravo!! cict student terbaik!!

    ReplyDelete
  4. What I would suggest on this is to also connect GND pins 18 to 25 on the LPT socket together. The above didn't work on a separate BIOS issue until I connected 18-25 pins together.

    ReplyDelete
  5. Thank you so much. Your instructions saved my bricked HP G6.

    ReplyDelete
  6. Thank you very much for this project, Syahmi! I was now able to reprogram Asus Essence One's EEPROM (EON EN25F40). Best regards!

    ReplyDelete
  7. This comment has been removed by the author.

    ReplyDelete

  8. I did the flash with standby power. On an MSI MS-7309 Ver 1.0. Using just 4 100 ohm resistor and the motherboard standby power supply. Worked perfect. The bios chip was a MX 25L4005AM2C. All you credit goes to you guys. Thanks my HTPC is UP AND RUNNING.

    ReplyDelete
  9. does this thing work on windows 10

    ReplyDelete
  10. This comment has been removed by the author.

    ReplyDelete
  11. ERROR: cannot open serviceManager database

    What does this mean??

    ReplyDelete
  12. Teeth Night Guard is offering personalized fitting and highest quality customized dental protectors.

    ReplyDelete
  13. Hi... Sorry my poor english.

    I need help, in detection,/i command,the program return "PARITY ERROR"

    The second error Is in the unlock command, the message Is "ffh, unlock failed, set WP# pin to high level"

    ReplyDelete
  14. This comment has been removed by the author.

    ReplyDelete
  15. i have problems Status = FFh, unlock failed, set WP# pin level high.
    what should i do?

    ReplyDelete