ASUS Bioses, new way, anyone who wants to test it? Disassembly skills are welcome!

Discussion in 'BIOS Mods' started by offon7544, Oct 10, 2008.

  1. offon7544

    offon7544 MDL Expert

    Sep 27, 2007
    1,018
    8
    60
    Edit by Yen:
    I've copied an interesting part out of the Mod your own bios thread.
    Important:
    The bios mod provided later should ONLY BE FLASHED by someone who is able to RECOVER the bios by HOTFLASHING OR by someone who has got a EEPROM programmable device or a spare chip!!!!


    EDIT: WAY IS CONFIRMED TO WORK!!!


    First generation of lock :

    [​IMG]

    I hope that is comprehensible

    New generation of lock :

    See attach file, this is for a Rampage Bios
    I can't test patch (i have some ideas), i don't have a motherboard with Rampage Bios.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    10,938
    10,473
    340
    Thank you very much for your help, I really appreciate:)
    I'm not very skilled in disassembly. I'll have a look at you modification and will try to understand it.

    Have you checked the latest P5Q bios' config. lock?
    Is it the same routine (code) as Rampage bios?

    We can try for P5Q mod so baribal can test it.
    Best is to test first mod WITHOUT the additional afudos switches and NOT to update bootblock of bios. Then to try if it boots, AFTER that flash with additional switches to update FC module and Bblock.

    I'll have a look next time, I'm too busy now.....
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. offon7544

    offon7544 MDL Expert

    Sep 27, 2007
    1,018
    8
    60
    Look like the same.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. hnfz

    hnfz MDL Novice

    Oct 16, 2008
    19
    1
    0
    Hi, Yen, I modified a p5q bios (ver 1611) following the discussions on this forum.

    :p Link:
    http://rapidshare.com/files/172861540/P5Q-ASUS-1611.zip.html

    Edit by Yen:
    TRY IT ONLY if you are able to RECOVER the bios by HOTFLASHING OR if you've got a EEPROM programmable device or a spare chip!!!!

    THIS IS EXPERIMENTAL!

    To flash with afudos, It should show HPQOEMSLIC-CPC!

     
  5. hnfz

    hnfz MDL Novice

    Oct 16, 2008
    19
    1
    0
    Here is my analysis of p5qbios from helps on this forum, not sure it is correct:):

    _4000:9C3A db 1
    _4000:9C3B db 2
    _4000:9C3C
    _4000:9C3C ; =============== S U B R O U T I N E =======================================
    _4000:9C3C
    _4000:9C3C
    _4000:9C3C sub_9C3C proc far
    _4000:9C3C pushad
    _4000:9C3E push ds
    _4000:9C3F push 0F000h
    _4000:9C42 pop ds
    _4000:9C43 assume ds:nothing
    _4000:9C43 mov al, 1
    _4000:9C45 mov ds:0A0E0h, al
    _4000:9C48 push cs
    _4000:9C49 call near ptr sub_9DB5 ; loop through the PUBKEY+MAKER block
    _4000:9C49 ; starting from the 2nd byte
    _4000:9C49 ; plus one byte after it
    _4000:9C49 ; length = 0x152
    _4000:9C4C jb short loc_9C62 ; jump if not all 0xFF
    _4000:9C4C ;
    _4000:9C4E mov bx, 9C3Ah
    _4000:9C51 mov al, cs:[bx]
    _4000:9C54 cmp al, 0
    _4000:9C56 jz short loc_9C5E
    _4000:9C58 push cs
    _4000:9C59 call near ptr sub_9DF0
    _4000:9C5C jb short loc_9C62
    _4000:9C5E
    _4000:9C5E loc_9C5E: ; CODE XREF: sub_9C3C+1Aj
    _4000:9C5E push cs
    _4000:9C5F call near ptr sub_9E7C
    _4000:9C62
    _4000:9C62 loc_9C62: ; CODE XREF: sub_9C3C+10j
    _4000:9C62 ; sub_9C3C+20j
    _4000:9C62 pop ds
    _4000:9C63 assume ds:nothing
    _4000:9C63 popad
    _4000:9C65 retf
    _4000:9C65 sub_9C3C endp
    _4000:9C65
    _4000:9C66
    _4000:9C66 ; =============== S U B R O U T I N E =======================================
    _4000:9C66
    _4000:9C66
    _4000:9C66 sub_9C66 proc far
    _4000:9C66 pushf
    _4000:9C67 pushad
    _4000:9C69 push ds
    _4000:9C6A push cs
    _4000:9C6B call near ptr sub_9DB5
    _4000:9C6E jnb short loc_9C8A ; Jump if all 0xFF
    _4000:9C70 push cs
    _4000:9C71 call near ptr sub_9CF6 ; xor the PUBKEY+MAKER block
    _4000:9C71 ; with 0xFF
    _4000:9C74 jnb short loc_9C8A ; jump if there is an error
    _4000:9C76 push cs
    _4000:9C77 call near ptr sub_9D22 ; copy OEM string to
    _4000:9C77 ; SLIC header, RSDT, XSDT
    _4000:9C7A push 2CCFh
    _4000:9C7D pop ds
    _4000:9C7E assume ds:nothing
    _4000:9C7E lea esi, ds:0C25h
    _4000:9C83 call far ptr 5936h:9EDEh ; Copy SLIC to High Memory
    _4000:9C83 ; and add it to RSDT, XSDT
    _4000:9C88 jb short $+2
    _4000:9C8A
    _4000:9C8A loc_9C8A: ; CODE XREF: sub_9C66+8j
    _4000:9C8A ; sub_9C66+Ej
    _4000:9C8A pop ds
    _4000:9C8B assume ds:nothing
    _4000:9C8B popad
    _4000:9C8D popf
    _4000:9C8E retf
    _4000:9C8E sub_9C66 endp
     
  6. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    10,938
    10,473
    340
    hnfz

    THANKS A LOT!
    I don't have any tools here. So you've removed the config lock?:D
    That would be great.:):)
    Best is to test first mod WITHOUT the additional afudos switches and NOT to update bootblock of bios. Then to try if it boots, AFTER that flash with additional switches to update FC module and Bblock.


    Do you think it will work and it's a safe mod?
    I'll have a look when I'm back at home.......
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. offon7544

    offon7544 MDL Expert

    Sep 27, 2007
    1,018
    8
    60
    In my opinion, I think the second part of the patch is dangerous (the lock part), not the first.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. hnfz

    hnfz MDL Novice

    Oct 16, 2008
    19
    1
    0
    Hi, Yen,
    I didn't see any configlock. But there is a little piece of code in f000:72bd which pull values at f000:e1a0 (0f00 0000 6201 0000 00) and set al to 0:

    E1A000F0 => 0F00 0000 6201 0000 00

    ds = 0xf000
    si = 0xA0E1
    bx = [si+2] = 0
    cx = [si+4] = 0x162
    dx = [si+4]-0x10 = 0x152
    al = [si+8] = 0
    si = [si+6] = 0

    later on the function branched based on the al value. What happens next is the part I am not so sure of. But since the edi was pointing to the PUBKEY+MAKER block, I guess one of the branch will change the data preventing it being copied to high memory.
    I don't have a eprom programmer.:(
    So I need someone test it first. If it is correct, then we can start a new thread
    I didn't find the configlock. I just skipped it:confused: Not sure I am correct.
    I am not good at assembly language. So don't be surprised if I made a mistake:p
     
  9. offon7544

    offon7544 MDL Expert

    Sep 27, 2007
    1,018
    8
    60
    The truth will come behind the test ;)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. hnfz

    hnfz MDL Novice

    Oct 16, 2008
    19
    1
    0
    Here are the flow charts I created when I traced function at f000:72bd.
    Hope it will help if anyone wants to take a look into it too.
     
  11. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    10,938
    10,473
    340
    Please post results here.

    Any further development regarding ASUS config lock, please post here.

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. iDaemon

    iDaemon MDL Novice

    Dec 17, 2008
    1
    0
    0
    waiting for the result if the mod bios is safe.
     
  13. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    10,938
    10,473
    340
    :D Me, too! That would be great and allow to make a real dynamic mod.

    We need somebody who has got two of that boards, or is able to hotflash, re-program the bios chip.

    Not sure if it's needed or the ASUS crash free bios is supposed to be really crash free...:D;)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  14. beppe_7

    beppe_7 MDL Junior Member

    Feb 20, 2008
    87
    0
    0
    what is this mod suppose to do exactly?
     
  15. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    10,938
    10,473
    340
    To introduce the SLIC exactly the same way as ASUS would do it. (Dynamic)
    This time there is no need to, but for educational purposes it would be great to know if it's possible.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  16. beppe_7

    beppe_7 MDL Junior Member

    Feb 20, 2008
    87
    0
    0
    ahh yes that would be great for future reference :D
     
  17. Anonymouz

    Anonymouz MDL Novice

    Oct 6, 2008
    29
    1
    0
    Sorry I cant help because I only have 1 Rampage Formula board and I do not have the skills to recover if it screws up :(
     
  18. hnfz

    hnfz MDL Novice

    Oct 16, 2008
    19
    1
    0
    Merry Christmas, everyone.

    I am building a computer for my friend. So I got a chance to test my modification.

    Result: Success! See attached screen shots.

    BIOS Link: http://rapidshare.com/files/176806764/P5Q-MOD.ZIP.html

    There is one problem: ASUS have their own version of AMI BIOS. If the BIOS is altered by amimmwin.exe, both EZ-FLASH and AFUDOS.exe will give an error saying 'Boot block in file is not valid!'. The link is the BIOS I flashed on my computer. It works fine.

    Since I got another computer to play with, I did some testing using EZ-FLASH.

    I guess the error message has something to do with the dword value after $BCS in the BIOS. When I changed the value after $BCS to the value in the original BIOS file, the error message 'Boot block in file is not valid!' was gone and let me to flash. However, EZ-FLASH gave another error message saying 'Unable to update BIOS due to an internal error!'.

    I walked around this problem by flashing the original BIOS first. Then when I load the modified BIOS, the EZ-FLASH didn’t flash the boot block. And the flashing went through. If you are interested, please feel free to test it.

    The EZ-FLASH is in module F5. A standard .exe file. It will be great if someone can figure out how EZ-FLASH verifies BIOS.
    :p
     
  19. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    10,938
    10,473
    340
    hnfz

    Congratulations I'm very impressed.:)
    I don't have any tools here to have a look.
    A few questions:

    What tool have you used to replace the 1b module?
    Have you re-inserted the ASUSTEK signature string?

    Original way is to use amimmwin to replace the 1b module, after that re-insert the ASUSTEK signature manually. This string is located somewhere at the biosfile sometimes at offset 0 sometimes at 10000h, amimmwin overwrites it!

    EZ-flash isn't able to flash the mods, it is afudos.
    To perform a full flash you have to use the switches:
    Afudos /ixxxx.rom /pbnc /n

    Way that should work:
    -use amimmwin to manipulate 1b module
    -re-insert ASUSTEK (folowed by zero bytes) manually
    -Use Afudos /ixxxx.rom /pbnc /n to flash (the version that is provided by ASUS for your board)


    What about latest MMtool 3.22? Does it create a biosfile that is flashable using EZ flash?

    I'll have a closer look at your modification way.
    Could you please write brief instructions how to perform your way? I'll try to reproduce your way at another bios, not sure if I get it.
    How do I locate the bytes to NOP at other bioses? I don't get the address relationship of your analysis and the relative offsets of the 1b module.

    Thanks again, excellent work!
    You have NOP'ed 1A409-1A40E and 1A562-1A566, filled SLIC, added slp1 strings right after $ODB$, anything else?

    Edit: I've tried to NOP another bios: rampage formula_0701.

    Would you please have a look if I did it right. I didn't use a disassembler, hexeditor only.
    http://www.sendspace.com/file/3ka2yw
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  20. hnfz

    hnfz MDL Novice

    Oct 16, 2008
    19
    1
    0
    Hi, Yen,

    I used 'amimmwin.exe romfile /r 1b 1b-mod' to replace the 1b module

    I did re-insert ASUSTEK bios signature

    I didn't flash using 'afudos /ixxxx.rom /pbnc /n'. I only tried the method on P5Q's user manual --- 'afudos /ixxxx.rom'

    I have the latest MMtool 3.22 available on the internet.

    BIOS files created by MMtool 3.22 are not flashable by EZ-flash nor afudos. ASUS has their additional verification methods. But the modified BIOS works fine once you flash it in. I found the P5Q BIOS modified by the super static mod 3 had the same problem -- it cannot flashed by EZ-flash nor afudos

    I only changed the 1B module.

    Here are the steps:

    extract 1b using mmtool.exe
    open it in winhex; find the offset 0x10798; delete everything from offset 0x0 to 0x10798; save it to a new file.
    open the new file in ida. the first 0x520 bytes are BIOS check points and function pointers --- it is a six-byte structure, if the first word is not 0xffff, it is a bios check point and its value; the second word is the function offset and the third word is the function segment
    search for the string "System version"; there are hex 0x0, 0x1, 0x1, 0x2 after the string. at the byte after the 0x2 press "c" to convert the rest from binary to code. these are the functions I changed.

    Your 1b-mod for rampage formula_0701 looks OK to me:D I checked it in IDA. It is amazing how you did it without a disassembler