Dell bios, how to decompose / mod.

Discussion in 'BIOS Mods' started by wolf69, Nov 21, 2009.

  1. Apokrif

    Apokrif MDL Addicted

    Dec 7, 2008
    542
    35
    30
    There is no problem with changing service tag, not sure about clearing it though.
    Although, you can easily find all info you need, we do not discuss/help with such questions, because they are related to theft most likely... :sorry:
     
  2. WIND0WS 7

    WIND0WS 7 MDL Member

    Sep 28, 2009
    145
    0
    10
    #542 WIND0WS 7, Jun 13, 2011
    Last edited by a moderator: Apr 20, 2017
    BIOS CPU microcode

    What did you use to get those codes? Is there 18 microcodes in my BIOS?
     
  3. Apokrif

    Apokrif MDL Addicted

    Dec 7, 2008
    542
    35
    30
    WinHex + some DIY stuff :)
     
  4. WIND0WS 7

    WIND0WS 7 MDL Member

    Sep 28, 2009
    145
    0
    10
    What DIY stuff exactly?
    Can I replace any of the 000007D0 sized ones like the 1st one 00 or should I replace the last one 11?
    Do I need to fix CRCs as well?
     
  5. adi_adit

    adi_adit MDL Novice

    Oct 20, 2010
    9
    0
    0
    It cannot be changed on newer systems ! I want to change the service tag that I have incorrectly entered in my new replaced motherboard. The tag that I have accidentally entered does not even exist.
     
  6. Apokrif

    Apokrif MDL Addicted

    Dec 7, 2008
    542
    35
    30
    #546 Apokrif, Jun 13, 2011
    Last edited by a moderator: Apr 20, 2017
    I wrote few programs for myself long time ago.
    Never had enough time to document properly to release to public. :eek:

    Yep. Any will do. I would go with 11...
    Try to figure out, what would be 3rd column for 0F65.
    Code:
    0D - 00000F60:00009622:434D4130 - 000007D0
    0E - 00000F61:00009DF2:434D4230 - 000007D0
    0F - 00000F62:0000A5C2:434D4231 - 000007D0
    
    Might be easier to lookup/compare numbers in some newer BIOS.

    Absolutely.
    Once you done with it – drop me a link, I’ll check it before you flush.
     
  7. Apokrif

    Apokrif MDL Addicted

    Dec 7, 2008
    542
    35
    30
    I would open new thread. Somebody might be able to help...
     
  8. WIND0WS 7

    WIND0WS 7 MDL Member

    Sep 28, 2009
    145
    0
    10
    What about in manufacturing mode, it still won't allow it to be changed?
     
  9. WIND0WS 7

    WIND0WS 7 MDL Member

    Sep 28, 2009
    145
    0
    10
    #549 WIND0WS 7, Jun 13, 2011
    Last edited by a moderator: Apr 20, 2017
    I don't know how to man, I couldn't find them in my own BIOS. :eek:

    I don't think I know how to change CRCs either. :(
     
  10. Apokrif

    Apokrif MDL Addicted

    Dec 7, 2008
    542
    35
    30
    #551 Apokrif, Jun 14, 2011
    Last edited by a moderator: Apr 20, 2017
  11. WIND0WS 7

    WIND0WS 7 MDL Member

    Sep 28, 2009
    145
    0
    10
    #552 WIND0WS 7, Jun 14, 2011
    Last edited by a moderator: Apr 20, 2017
    :dunno::weep:
     
  12. Apokrif

    Apokrif MDL Addicted

    Dec 7, 2008
    542
    35
    30
    #553 Apokrif, Jun 14, 2011
    Last edited by a moderator: Apr 20, 2017
    Code:
    Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
    00037A50                  4A 0F 62  B5 30 52 52 49                 J.bµ0RRI
    We are replacing microcode for 0F4A with 0F65
    62 B5 / B562 is pointer to microcode update - you have replaced update already, pointer remains the same.
    Replace 4A 0F to 65 0F - let BIOS know it has microcode update for 0F65 (not for 0F4A)
    Don't know what to put instead of 30 52 52 49 / 49525230 :confused:
    Need to find some other Dell BIOS with 0F65 AND any other CPUID we have in our BIOS.
    If other CPUID has same number in both our and another BIOS, we can use number for 0F65 for our modded BIOS.
    Capish? ;)
     
  13. WIND0WS 7

    WIND0WS 7 MDL Member

    Sep 28, 2009
    145
    0
    10
    #554 WIND0WS 7, Jun 14, 2011
    Last edited by a moderator: Apr 20, 2017
    Does it have to be another Dell BIOS and what exactly should I search in them for?
     
  14. aascut

    aascut MDL Junior Member

    Feb 10, 2011
    53
    15
    0
    #556 aascut, Jun 14, 2011
    Last edited by a moderator: Apr 20, 2017
    I find update microcode routing in "preboot" rom unit:

    Code:
    code D810_A05.rom
    Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
    
    000F4090                            70 44 44 4F 43 75 10 03           pDDOCu  
    
    ....
    000F4470   66 BE 00 00 F6 FF 67 AC  8A F8 66 67 AD 80 FF 0E   f¾  öÿg¬Šøfg*€ÿ 
    000F4480   74 0A 80 FF FF 74 3A 66  03 F0 EB EA 66 8B FE 66   t €ÿÿt:f ðëêf‹þf
    000F4490   B9 17 00 00 00 0F 32 66  C1 EA 12 83 E2 07 8B EA   ¹     2fÁê ƒâ ‹ê
    000F44A0   66 B8 01 00 00 00 0F A2  67 8B 0E 66 83 C6 02 67   f¸     ¢g‹ fƒÆ g
    000F44B0   3B 06 75 07 67 0F A3 6E  02 72 11 66 83 C6 0A E2   ; u g £n r fƒÆ â
    000F44C0   EE 66 B8 78 78 78 55 66  E7 E0 EB 20 66 67 8B 46   îf¸xxxUfçàë fg‹F
    000F44D0   06 66 E7 E0 66 67 0F B7  46 04 66 83 E8 04 66 03    fçàfg ·F fƒè f 
    000F44E0   C7 66 B9 79 00 00 00 66  33 D2 0F 30 66 B9 10 00   Çf¹y   f3Ò 0f¹  
    000F44F0   00 00 66 33 C0 66 33 D2  0F 30 C3                    f3Àf3Ò 0Ã
     
    asm code IDA Pro:
    000:4470 ; ---------------------------------------------------------------------------
    F000:4470 microcod update routing for proc
    F000:4470
    F000:4470 uCOD:                                   ; CODE XREF: F000:429FJ
    F000:4470                 mov     esi, 0FFF60000h ; phys.address of begining code?
    F000:4476
    F000:4476 loc_F4476:                              ; CODE XREF: F000:448Aj
    F000:4476                 lods    byte ptr [esi]  ; load data in eax
    F000:4478                 mov     bh, al
    F000:447A                 lods    dword ptr [esi] ; loads next data in eax
    F000:447D                 cmp     bh, 0Eh         ; Compare Two Operands
    F000:4480                 jz      short loc_F448C ; Jump if Zero (ZF=1)
    F000:4482                 cmp     bh, 0FFh        ; Compare Two Operands
    F000:4485                 jz      short Update_END ; Jump if Zero (ZF=1)
    F000:4487                 add     esi, eax        ; Add
    F000:448A                 jmp     short loc_F4476 ; Jump
    F000:448C ; ---------------------------------------------------------------------------
    F000:448C
    F000:448C loc_F448C:                              ; CODE XREF: F000:4480j
    F000:448C                 mov     edi, esi
    F000:448F                 mov     ecx, 17h
    F000:4495                 rdmsr                   ; Read Machine Status Register ID platform
    F000:4495                                         ; put into edx:eax;
    F000:4497                 shr     edx, 12h        ; bits 52:50 shift to bits 2:0
    F000:449B                 and     dx, 7           ; bits 2:0 = 1?
    F000:449E                 mov     bp, dx          ; save it in bp
    F000:44A0                 mov     eax, 1
    F000:44A6                 cpuid                   ; Get CPU ID
    F000:44A8                 mov     cx, [esi]
    F000:44AB                 add     esi, 2          ; Add
    F000:44AF
    F000:44AF loc_F44AF:                              ; CODE XREF: F000:44BFj
    F000:44AF                 cmp     ax, [esi]       ; Compare Two Operands
    F000:44B2                 jnz     short loc_F44BB ; Jump if Not Zero (ZF=0)
    F000:44B4                 bt      [esi+2], bp     ; Bit Test
    F000:44B9                 jb      short loc_F44CC ; Jump if Below (CF=1)
    F000:44BB
    F000:44BB loc_F44BB:                              ; CODE XREF: F000:44B2j
    F000:44BB                 add     esi, 0Ah        ; Add
    F000:44BF                 loop    loc_F44AF       ; Loop while CX != 0
    F000:44C1
    F000:44C1 Update_END:                             ; CODE XREF: F000:4485j
    F000:44C1                 mov     eax, 55787878h
    F000:44C7                 out     0E0h, eax       ; DELL indicator2="Uxxx"
    F000:44CA                 jmp     short loc_F44EC ; Jump
    F000:44CC ; ---------------------------------------------------------------------------
    F000:44CC
    F000:44CC loc_F44CC:                              ; CODE XREF: F000:44B9j
    F000:44CC                 mov     eax, [esi+6]
    F000:44D1                 out     0E0h, eax
    F000:44D4                 movzx   eax, word ptr [esi+4] ; Move with Zero-Extend
    F000:44DA                 sub     eax, 4          ; Integer Subtraction
    F000:44DE                 add     eax, edi        ; Add
    F000:44E1                 mov     ecx, 79h ; 'y'
    F000:44E7                 xor     edx, edx        ; Logical Exclusive OR
    F000:44EA                 wrmsr                   ; Write Machine Status Register
    F000:44EC
    F000:44EC loc_F44EC:                              ; CODE XREF: F000:44CAj
    F000:44EC                 mov     ecx, 10h
    F000:44F2                 xor     eax, eax        ; Logical Exclusive OR
    F000:44F5                 xor     edx, edx        ; Logical Exclusive OR
    F000:44F8                 wrmsr                   ; Write Machine Status Register
    F000:44FA                 retn                    ; return to f000:42A2
    
    The question is: where is the code of ROM if the physical address that is exposed on the bus is 0FFF60000h ? At this address may be located four 2KB microcode update modules. (I found this at the some old motherboards spec.) Вecause by this time the bios sees only the mem.region 0F0000-0FFFFF.Hence the code should be in this ROM area :confused:
     
  15. Apokrif

    Apokrif MDL Addicted

    Dec 7, 2008
    542
    35
    30
    XPS 420 microcode update in 111,600 bytes, so memory gotta be in "flat mode" already.
    It's "preboot" - that's might be the reason why microcode update module is not compressed.
     
  16. WIND0WS 7

    WIND0WS 7 MDL Member

    Sep 28, 2009
    145
    0
    10
    Apokrif should I be searching the .ROMs in DUMP folder as well as the .HDR? If there's another BIOS which uses the same chipset as mine (Intel 915G Express) and supports the CPU I want to add support for but is not for a Dell would that be okay?

    Thanks mate.