XFX 6950 1GB Flash testing

[padrino]

I purchased a couple of XFX 695X ZNDC cards with the hope I could flash the bios because some had successfully flashed them, it seems the version of the card has a lot to do with it. Mine at VA.3 cards with flash M25P10/C and do not have the BIOS switch.

After many failed attempts in both windows and DOS I decided to take the card apart and see if bridging the absent BIOS switch for position 1 would help. I bridged the two traces for position 1 and sadly the card is reporting the same errors when trying to flash, essentially the ROM cannot be erased and flashed no matter what I do (unlockrom, etc.). Since I have seen a few people ask about bridging the missing BIOS switch I thought I would report my findings.

 

[padrino]

If anyone has any further ideas or options to hack the hardware it would be much appreciated. I wonder how hard it is to swap chips these days, that would definitely solve my problems however I need to dig back into the card to figure it out.

 

[gazorp]

I have the XFX 695X ZNFC and cannot flash either. I get the error cannot erase flash.

Surely there must be some way to unlock the flash to get a custom bios on there!

Please w1zzard! Help us XFX owners out with a fresh hack!

Since i just got the card, i will most likely return it in the next couple of days and get one from a vendor who isnt locking them down...

 

[cadaveca]

Both erocker and I have 695X ZNFC 2GB cards we flashed, working fine. Maybe restricted to 2GB cards only?

 

[erocker]

Both erocker and I have 695X ZNFC 2GB cards we flashed, working fine. Maybe restricted to 2GB cards only?

Mine are 1gb, but I have the switch.

 

[cadaveca]

Mine are 1gb, but I have the switch.

I thought you had 2GB cards. My bad!


Hmmm. You have a switch, mine do not.

Yours are 1GB, with switch, flashed fine, mine 2GB without switch, flashed fine.




Can you tell us the ver. of your cards? OP has A3...I have A1...you have....A2, perhaps?

 

[erocker]

Version A.1

 

[cadaveca]

Hmm. I wonder what version other cards that have been successfully modded are. Perhaps ver A.1 is the one to get...

 

[gazorp]

Mine is version A.3, no switch, 1GB. The error is always cannot erase rom.

I have tried in RBE, where the error is unknown. Then i tried in winflash and get the cannot erase error. Then i tried w1zzards directions of running from admin cmd prompt manually to unlock and flash. There is nothing returned from the prompts and the card still has default rom.

I have a full lab to make any mods necessary, but have little experience with cards this new. I am not sure if the flash is encrypted or locked now or perhaps just needs to be added for support in winflsh. I will tinker for a few more days, but it looks like its going back for a better brand next week.

 

[padrino]

The flash is a standard chip but it looks like they are using hardware write protection, the datasheet indicates that if W is 0 then hardware write protection is enabled, looks like W needs to be 1 so it can be unlocked with unlockrom command. http://www.datasheetcatalog.org/datasheet/SGSThomsonMicroelectronics/mXuvyxs.pdf

 

[gazorp]

So you are suggesting shorting write protect to VCC then boot or perhaps should we install a switch and only activate before flashing, after boot.

Either way, definitely use a pull up resistor!

 

[padrino]

So you are suggesting shorting write protect to VCC then boot or perhaps should we install a switch and only activate before flashing, after boot.

Either way, definitely use a pull up resistor!

From reading it that looks like it might be the case, I'm no expert so looking for more confirmation before I give it a shot.

 

[padrino]

The table of write protect modes has a 0, 1, or X depending on the mode used. In that context does X mean unconnected, can one clip that pin and get the desired results? Just exploring the easiest mode, I've built basic circuits in the past but never tried to mess with something like this before so I'm hesitant without being sure.

 

[padrino]

Still looking for additional feedback if anyone has any insights.

 

[ChuckyD]

Padrino -

The BIOS chip must have pins 3 and 8 bridged to enabled writes. This can be done by soldering a jumper in place, or more easily by using a circuit writer pen sold at radio shack.

On the ZNFC model the BIOS chip is located on the front face of the PCB to the lower left of the GPU under the heatsink. See the red arrow in the picture. Pin 1 is the pin located closest to the dot on the top of the chip and the pins are numbered counterclockwise thereafter.

I performed this mod earlier this week and have since flashed sucessfully many times. Still have not been able to unlock the shaders though - not sure if the BIOSs are edited correctly or if i have a hardware limitation. If anyone has a BIOS that has worked on a ZNFC model, then the help is appreciated!

Enjoy!

 

[snipes420]

I just picked up a XFX HD-695X-ZNDC 1GB card like mentioned in the original post.
Mine is VA.2 and it does not have the dual bios switch. I have tried everything possible to get it flashed with a modded bios but atiwinflash just disappears like mentioned in previous posts. Or errors about flash not erasable.

I don't have the chutzpah to disassemble mine yet but I really hope someone can sort out how to flash these units.
Good Luck!

Edit: Cool ChuckyD. Is that a picture of your card?

 

[padrino]

Padrino -

The BIOS chip must have pins 3 and 8 bridged to enabled writes. This can be done by soldering a jumper in place, or more easily by using a circuit writer pen sold at radio shack.

On the ZNFC model the BIOS chip is located on the front face of the PCB to the lower left of the GPU under the heatsink. See the red arrow in the picture. Pin 1 is the pin located closest to the dot on the top of the chip and the pins are numbered counterclockwise thereafter.

I performed this mod earlier this week and have since flashed sucessfully many times. Still have not been able to unlock the shaders though - not sure if the BIOSs are edited correctly or if i have a hardware limitation. If anyone has a BIOS that has worked on a ZNFC model, then the help is appreciated!

Enjoy!

Great information! I will try it when I get back home at the end of the week and post the results.

 

[snipes420]

I sucked it up and voided my warranty

The procedure works exactly as ChuckyD said. I saved then modded my cards bios and then flashed it. The flash procedure went all the way this time, I do not get errors about not being able to erase the chip. But like ChuckyD said, after rebooting and checking gpu-z the extra shaders are not enabled. To double check it, I saved the bios out of the chip again and checked md5sums for all the files and Yep if definitely flashed the modded bios but it looks like that patch does not work.

It sure sucks that this card doesn't have a dual bios because it may make it hard to test patches to the bios. [easy to brick ]

 

[snipes420]

I literally tried unlocking and flashing every 6950 1024MB bios available on techpowerup.com's 'vga bios database'. I bricked it a few times but my trusty S3 Trio32 pci VGA card was always handy. Still hope some video card bios hacking guru needs a challenge and picks up this ones trail
Edit: sorry for double post

 

[jzv]

A quick heads up my XFX HD-695X-ZNDC cards are of the XXX variant the 830 mhz versions. And they have the bios switch and unlock shaders fine.

 

[SlaveOnDope]

Did this the other day without issue
XFX HD-695X-ZNFC VA.3 Radeon HD 6950 1GB
Pm25LV010

 

[ChuckyD]

SlaveOnDope - Can you send me a copy of your BIOS?

 

[SlaveOnDope]

SlaveOnDope - Can you send me a copy of your BIOS?

Unlock using RBE. Good luck.

 

[gazorp]

Unlock using RBE. Good luck.

Can anyone confirm that this bios worked for them? Thanks Slave for the upload! I will try it on my card next week.

 

[ThaSpacePope]

Oh man I have 2 of these coming from newegg. Really have to remove the HSF to get the bios to reflash?

ChuckyD: How would you suggest using a circuitwriter for this? removing the chip and writing between the pins, then resoldering?