Firmware downgrade using official (patched) flasher, the "Ultra hax0r guide"
Posted: Tue Feb 05, 2019 10:35 pm
NOTE: Information in this post is mostly obsolete, please see the main FAQ thread for an up-to-date information - viewtopic.php?f=16&t=19634
As mentioned many times earlier, I personally do not recommend downgrading your drive firmware without understanding the possible consequences.
However recently the firmware downgrade method using SPI access via vendor ATA commands (a.k.a. dosflash method, a.k.a. DVDFab tool method) became more and more popular. Live flash update in raw mode became a commodity. Guides on our forum written by fellow members are also based on this method. This method is highly dangerous ( please see viewtopic.php?f=16&t=18857 ) but is used widely because this is the only method that is publicly available.
To stop the painful drive abuse I have to divulge some information. Normally I avoid doing so, but the current insanity has to be stopped.
Here is my "guide" how to downgrade any MTK firmware using only official flashing app. No dosflash, no direct flash write, no meddling with IDE controller settings.
What we would need:
A patched official MTK flasher. Can be downloaded from https://forum.cdrinfo.pl/f29/crossflash ... s58-96313/ This flasher operates using drive self-update mode.
An unpacked official update image (bin file). The archive at link above contains some images already. This is important step - the official update BIN is needed, not a dump of any sort or "cleaned" dump. These are easy to come by.
Normally official flasher would refuse to downgrade firmware from latest versions - the so-called "Write DRAM NG 05/24/00" error. For example ASUS drive with 3.03 firmware would refuse to flash firmware 3.0 (present in archive from link above). A custom step is required to make the old firmware flash-able on a latest-firmware drive. Any old firmware can be patched this way.
Here are instructions for the super-duper-secret-mega hack that would allow flashing the old firmware into drives with latest firmware:
Open the firmware BIN file with a hex editor.
Navigate to the offset 0x1ec056 . The byte at this location should be FF . In fact on all (old) firmwares the bytes just before this byte have some distinct values, and all bytes after this byte are FFs.
Change just this single byte (at location 0x1ec056) from 0xFF to 0xDE ("downgrade enable").
Congratulations! You are an elite hacker now. With this byte changed, the firmware will be accepted by drives with latest firmware, allowing downgrade using official flasher. No checksums, no digital signatures, nothing. Just. One. Byte.
If anyone wants to make a community service and post official firmware images with this byte patched, you are welcome to do so in this thread.
p.s. There is no doubt that as with UHD support, in a few days the respectable commercial firmware downgrade utilities would stop requiring changing the setting of IDE controller and would start working with USB drives.
p.p.s. SPI bus access via vendor ATA is a firmware-controlled feature, not a hardware interface. There is no doubt that in response to mainstream usage of this interface, it will be disabled in upcoming firmware versions, making life significanty difficult for everyone. Just because greed is greed and $109 is still $109...
As mentioned many times earlier, I personally do not recommend downgrading your drive firmware without understanding the possible consequences.
However recently the firmware downgrade method using SPI access via vendor ATA commands (a.k.a. dosflash method, a.k.a. DVDFab tool method) became more and more popular. Live flash update in raw mode became a commodity. Guides on our forum written by fellow members are also based on this method. This method is highly dangerous ( please see viewtopic.php?f=16&t=18857 ) but is used widely because this is the only method that is publicly available.
To stop the painful drive abuse I have to divulge some information. Normally I avoid doing so, but the current insanity has to be stopped.
Here is my "guide" how to downgrade any MTK firmware using only official flashing app. No dosflash, no direct flash write, no meddling with IDE controller settings.
What we would need:
A patched official MTK flasher. Can be downloaded from https://forum.cdrinfo.pl/f29/crossflash ... s58-96313/ This flasher operates using drive self-update mode.
An unpacked official update image (bin file). The archive at link above contains some images already. This is important step - the official update BIN is needed, not a dump of any sort or "cleaned" dump. These are easy to come by.
Normally official flasher would refuse to downgrade firmware from latest versions - the so-called "Write DRAM NG 05/24/00" error. For example ASUS drive with 3.03 firmware would refuse to flash firmware 3.0 (present in archive from link above). A custom step is required to make the old firmware flash-able on a latest-firmware drive. Any old firmware can be patched this way.
Here are instructions for the super-duper-secret-mega hack that would allow flashing the old firmware into drives with latest firmware:
Open the firmware BIN file with a hex editor.
Navigate to the offset 0x1ec056 . The byte at this location should be FF . In fact on all (old) firmwares the bytes just before this byte have some distinct values, and all bytes after this byte are FFs.
Change just this single byte (at location 0x1ec056) from 0xFF to 0xDE ("downgrade enable").
Congratulations! You are an elite hacker now. With this byte changed, the firmware will be accepted by drives with latest firmware, allowing downgrade using official flasher. No checksums, no digital signatures, nothing. Just. One. Byte.
If anyone wants to make a community service and post official firmware images with this byte patched, you are welcome to do so in this thread.
p.s. There is no doubt that as with UHD support, in a few days the respectable commercial firmware downgrade utilities would stop requiring changing the setting of IDE controller and would start working with USB drives.
p.p.s. SPI bus access via vendor ATA is a firmware-controlled feature, not a hardware interface. There is no doubt that in response to mainstream usage of this interface, it will be disabled in upcoming firmware versions, making life significanty difficult for everyone. Just because greed is greed and $109 is still $109...