Unbrick Synology DS918+

Hi All,
does anyone have a ready-made bios to send me? I have unfortunately damaged my chip. I bought another one but I guess I can't just write the file extracted from the bios. I have a ds918+ . Thanks in advance to anyone who can help me.

Finally I managed to login to the forum
I have working bios for DS218+ and just managed to upload to dropbox
let's hope this link works and still comply with the rules of the forum

https://www.dropbox.com/scl/fi/n2e2oaw9rb8tcmwkpyvky/DSM_DS218-_69057-mod_final?rlkey=r58rzia3jgztcn7zxp1ytf6rm&st=q8ownq5q&dl=0

barto2 Wrote:
-------------------------------------------------------
> Hi All,
> does anyone have a ready-made bios to send me? I
> have unfortunately damaged my chip. I bought
> another one but I guess I can't just write the
> file extracted from the bios. I have a ds918+ .
> Thanks in advance to anyone who can help me.

Someone can help me?

@superchromix I send you a PM.



Edited 1 time(s). Last edit at 12/01/2024 04:08PM by barto2.

Hi I am trying to recover a DS220+ can you tell me from which version of .PAT, you took this bios. This content is very different from the one I am trying with the DS220.

Hi All

I have also a 918+ which break and flashing blue light. When I tried to use the crocodile clip to read the bios it show all zero not sure if it is fired. I bought some of the Winbond chip and downloaded the new bios but without any information from the old bios I am unable to connect to the chip.

Hey, thanks for this info, I'll read it carefully and try to understand it as it seems I have same issue. purchased a 918+ without memory or power adapter and ... endless blue blinking led, no other leds are on on the front.
BUT if I plug ethernet cables to the ports, both leds of each port go to static green... was this same situation on your side?
thanks!

first of all, thanks to everybody, op and superchromix

Well I bite the bullet, purchased the CH341 flasher with the 1.8v mod, I can read the chip (connected to the mainboard using aligator clips) but each time I read it the saved file is different (I run a checksum on it) I dont know if that's normal, doesnt seem so...
anyhow, now I'm stuck on how to generate the valid firmware from the bios.rom file in the .pat downloaded. I'm completely clueless on this task...

I use "CH341 programmer 1,29" and HxD on a windows 11 machine


anyone care to explain again (like if I were a 6 years old kid) or share the correct bios for 918+ ?

There seems to be some confusion about the binary file which needs to be flashed onto the winbond chip.

To clarify: the original content of the winbond chip does not need to be read out.

All of the binary data needed for flashing is obtained from the .pat file, as described above.

So, if you can read the original (probably corrupted) data from the winbond chip, that’s fine, but it is not necessary.

@poseidoposeido

If you read a different data each time you try to read, it doesn’t sound to me like the reader is working. I’m not sure I would trust that setup for writing.

As described above, I used a different flasher and I also desoldered the chip from the board.



Edited 1 time(s). Last edit at 01/17/2025 12:10AM by superchromix.

Hello @superchromix, thanks for your reply.

My main goal in reading the chip was to check if I could successfully communicate with it and understand how to use the CH341 programming software (it's my first time). I backed up the chip's content multiple times but noticed that the checksum of the saved files was different each time. This makes me suspect that I'm doing something wrong. I'll try desoldering the chip and reading it outside of the motherboard. (or Maybe my problem is that I'm not doing the check-in calculation properly!)

My second goal was to follow the instructions on how to find the correct section of the BIOS file—identifying the start and end of the original BIOS dump within the downloaded BIOS file. I can do this part, but when I edit the downloaded BIOS file to remove the header and... "footer?" I end up with a file size that isn't quite right. It's close but not exactly the expected size.

For this, could someone share with me the already trimmed BIOS file for the 918+?

I'm sure I'm missing some details. English is not my first language, so I might not be fully understanding the instructions or expressing myself correctly. My apologies, and thanks for your help!

poseidoposeido Wrote:
-------------------------------------------------------
> Hello @superchromix, thanks for your reply.
>
> My main goal in reading the chip was to check if I
> could successfully communicate with it and
> understand how to use the CH341 programming
> software (it's my first time). I backed up the
> chip's content multiple times but noticed that the
> checksum of the saved files was different each
> time. This makes me suspect that I'm doing
> something wrong. I'll try desoldering the chip and
> reading it outside of the motherboard. (or Maybe
> my problem is that I'm not doing the check-in
> calculation properly!)
>
> My second goal was to follow the instructions on
> how to find the correct section of the BIOS
> file—identifying the start and end of the
> original BIOS dump within the downloaded BIOS
> file. I can do this part, but when I edit the
> downloaded BIOS file to remove the header and...
> "footer?" I end up with a file size that isn't
> quite right. It's close but not exactly the
> expected size.
>
> For this, could someone share with me the already
> trimmed BIOS file for the 918+?
>
> I'm sure I'm missing some details. English is not
> my first language, so I might not be fully
> understanding the instructions or expressing
> myself correctly. My apologies, and thanks for
> your help!


Hi,

You are on the right track. After cutting out the correct section, you need to add zeros to bring the file up to the correct size, before writing it to the chip.

I believe the final size of the file should be 16MB = 16777216 bytes. See above.

ok, now I'm quite puzzled, the file backup.bin that I'm extracting from the chip it's not 16 mb but 8, exactly the 8,388,608 bytes you comment, so I dont understand the padding step to 16mb
also when I trim bios.rom from the original PAT file, is exactly 8,388,608 (I used this https://global.synologydownload.com/download/DSM/release/6.2.4/25556/DSM_DS918%2B_25556.pat )

any hint?

P.S. mine is a synology 918+

PS2: I just did a CRC on the bios.rom file after trimming start and end and shows 24EC72E2 then I programmed the chip with this bios.rom trimmed file, (using NeoProgrammer) the unit didnt boot properly (same flashing light), but I downloaded the bios content again with the aligator clips from the chip and did a CRC, showing the 24EC72E2 value too, so I understand that my flashing procedure works (both original flashed bios file and downloaded file has the same CRC... I guess I'm failing on the trimming and padding thingy...

could anyone share with me the trimmed and padded 918+ 16mb bios file so I can flash it?



Edited 3 time(s). Last edit at 01/18/2025 11:49AM by poseidoposeido.

The chip has a storage size of 16MB. So, it doesn’t matter that the rom is only 8MB - you should fill the rest with zeros up to 16MB.

The address of the start and end if the trim region are posted in the thread above.

Umm, I was able to boot it (using the 8mn file without extra padding) even got network and was found by ds finder, even updated it to dsm 7

https://imgur.com/a/1J7xVOV


But it does not work consistently, boat of the times I try to boot, it does not boot or even show anything on serial.. there must be something else wrong with mi device too.
Other times it shows boot info on serial but stops in different actions..

Oh hell :(

Thanks anyhow to everyone!



Edited 2 time(s). Last edit at 01/18/2025 01:05PM by poseidoposeido.

cool, congrats! Sounds like the bios is fixed at least

Hi everyone,

I've got a DS918+ as usefull as a brick and I want to revive it.
After a long period of reading this topic, is it correct to say that I can use the bios.rom file directly from the synology website?
I will directly replace the chipset from a new on, so I will add some zeros at the end to reach an finished size file of 16 777 216 octets to flash the 25Q128FWSQ, is it correct?

Thanks for your help,
Regards.

You should extract a section of the bios.rom file, then add zeros up to the correct size, and flash with this. I would recommend flashing the original chip, not a new one. Good luck.

Hi Superchromix,

Thanks for your quick answer.
So, if I understand, I need to shrink the original bios file from address 000AD1D0 to address 008AD1C8 (lines with full FF) and to complete it with zeros to reach a 16Mb file size (16 777 216 precisely). Correct?

I will flash an original chip, as I have seen some people get trouble when flashing the old one.

Hi, here‘s the relevant quote from above:

*****
I read the bios using the CH341a and flashrom on Ubuntu creating a backup.bin file. I did this twice using a new filename with the 2nd file and checked that both files were the same, and they were. I then started looking at the BIOS.ROM file from the Synology.pat file and the backup.bin file that was read from the Winbond IC using a hex editor. I did a manual review of the files side by side and noted that the start of the backup.bin file was the same as 0xAD1D0 in the BIOS.ROM file (There is also ASCII text just before that offset that says "$_IFLASH_BIOSIMG". I cut everything from from offset 0x0 to 0xAD1CF so that the BIOS.ROM matched the start of the backup.bin file.

I then continued to review the file and found they had a matching "pattern of data" until offset 0x8AD1D0. This section after this offset reads "$_IFLASH_INI_IMG. I cut the file again from offset 0x8AD1D0 to the end of the file. After cutting this and the previous section I was left with a file that matched the pattern of the backup.bin file more closely. I saved the modified file with the cut header and footer and found that file was 8,388,608 bytes in size which is half of the 16,777,216 bytes available on the Winbond flash.
*****

You should recognize the start of the flash region by the text „$_IFLASH_BIOSIMG“ and the end with "$_IFLASH_INI_IMG“ (not including those texts). I can’t say that the addresses are correct for each file, but they were for the file we used.

That's exactly what I did, and the adress I gave was for the bios file from the Synology installation file, version 6.2.4.

Thanks for your help, I will post a message regarding the result of my procedure.

Ok, so my DS918+ is in worst condition than never.
I bought a new chip and flash it with the bios from the synology PAT file. It seems ok as I followed step by step all advices from this topic (but not the one from superchromix which is to flash the old chip instead of the new one, I read it too lately, my bad).

I have the same problem than jarugut:
-------------------------------------------------------
Are you sure you're flashing the chip correctly?
> Yes. First I've deleted the chip and verify it.
> Later I wrote the chip and verified with the
> software itself. Later I've read the chip and save
> in a file and compare the both files having clear
> that the bios is the same like I've writed.
> the strange is after the first try to boot the
> NAS If I read the chip, the content always it's
> different than the wrote before.
>
Did you remove the chip from the board to flash it? Which programmer are you using?
>
> At the beginning yes because using the CH431
> programmer always have problems on verification,
> but later I've soldered and do it direclty in the
> mainboard with the software
> NeoProgrammer_2.2.0.8_from_4pda and
> AsProgrammer_2.0.3a, both works perfectly.
>
During boot, are you watching the output on the UART serial port?
>
> During the boot I not see anything on the serial
> port. Only if I remove the memory ram in that case
> I see something like "Memory training fail, In a
> Dead Loop: Acting...". if I plug again the memory
> then not shows anything.
>
> I've seen in the forum something about this, I
> need to check it but I'm open to some
> sugeriments...
-------------------------------------------------------

Differences are :
* When I check the bios after the first boot, it is the same, no differences like it did not touch the chip.
* During the boot, I see nothing on the UART serial port, even if I remove the RAM (I had the message about the RAM problem before I changed the chip).
* This bloody blue light turns me crazy...

Any ideas of what I can do from this point?

NB: I used NeoProgrammer_2.2.0.10 to flash the chip (with a CH341A device) and CoolTermWin64Bit to watch the UART serial port (with a CP2102 device)

re-use the old chip

Superchromix, I will follow you advice but I want to be sure to use the good bios file, as each time I have to paid a third party to do the soldering job.

Can someone check my file and tell me if I did the correct procedure to create it?

https://www.transfernow.net/dl/20250317CNB6ObZv

Thanks