finally a method to modify Insyde bios?!

Discussion in 'BIOS Mods' started by acinismar, Jun 20, 2009.

Tags:
Thread Status:
Not open for further replies.
  1. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #1 acinismar, Jun 20, 2009
    Last edited: Jun 20, 2009
    I just found this tool called Insyde EzH20 available for download at http://www.biosrepair.com/ :) It seems like it may have options to insert SLIC, modify logo, etc but I cannot read whatever language it is in. :( Anyone able to understand it? I am willing to test a modded BIOS!

    EDIT: I have tested the modify logo portion and this works perfectly on my HP dv5t! :) My BIOS is here: ftp://ftp.hp.com/pub/softpaq/sp43501-44000/sp43819.exe.. it already has a normal SLP 2.0 included. I am wondering if anyone can try mod with this tool so it has SLP 2.1? Yen? :)

    Thanks!
     
  2. frwil

    frwil MDL Addicted

    Sep 22, 2008
    520
    158
    30
    I'm not sure, where's the download link?
     
  3. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    488
    180
    #3 911medic, Jun 20, 2009
    Last edited by a moderator: May 23, 2017
    We have had this tool for a while now, a couple of months....It works for most, but not all insyde..

    http://forums.mydigitallife.net/posts/62768

    or here...http://www.biosrepair.com/bios/insydeEzH2O.rar

    There is no SLP 2.1 HP SLIC....When they become available, Bios updates may contain them...
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #4 acinismar, Jun 20, 2009
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Ah I didn't realize anyone had mentioned it here.. I realize there is no HP 2.1 SLIC but is there any way of editing the SLIC with this tool or no?

    EDIT: I have tried removing the module with id:

    1A1E2341-A2FB-42c7-8D17-3073D08EB21D

    This caused Vista to deactivate so it seems it is this module with contains the SLIC table. However with this tool it seems unable to save a module file so I am unsure of the format of it. :( Any ideas?

    EDIT (again): When I viewed the SLIC table in RW-Everything it was basically all zeros. However when I added that module back and removed module DD6569A7-E455-4ee5-B2BA-ECDA84ACBC99, some (but not all) of the SLIC appeared (shown below). The reason I chose these modules is because they are the default two in the Replace module menu and there are references to SLIC's in the load file drop down box.

    Code:
    53 4C 49 43 76 01 00 00 01 03 48 50 51 4F 45 4DSLICv.....HPQOEM
    53 4C 49 43 2D 4D 50 43 00 00 04 06 20 4C 54 50SLIC-MPC.... LTP
    01 00 00 00 00 00 00 00 9C 00 00 00 06 02 00 00................
    00 24 00 00 52 53 41 31 00 04 00 00 01 00 01 00.$..RSA1........
    5B AB 60 56 BC 58 1E E8 C1 D2 A1 5C E5 4F BB FD[.`V.X.....\.O..
    1D A9 8C 94 B4 AE 08 11 DC 13 59 D3 7F F6 3E 87..........Y...>.
    31 B9 95 74 10 DA 3B A4 5B B5 19 82 7C 39 D7 0D1..t..;.[...|9..
    7C 22 AC 1C 2A 84 E9 0A 88 6D FA B1 E2 D8 E8 21|"..*....m.....!
    96 E1 2E 68 9A BF 44 45 3E 3C 8E 99 90 DE 37 38...h..DE><....78
    57 0B 92 15 BC DE FF F2 07 7E B5 40 8C 51 3A C3W........~.@.Q:.
    02 48 F6 13 12 72 FB 42 78 E6 47 88 54 C7 B0 F0.H...r.Bx.G.T...
    93 9E FB 04 B7 B8 B8 90 DE DB ED 32 E1 FB 54 A6...........2..T.
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    ... zeros from here onwards. So obviously the SLIC table is split among these two files. :) Hopfully we are able to document their format so it can modified in future. It seems the author of this application knows how to do this but I'm not sure if anyone else does! :)
     
  5. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #5 acinismar, Jun 20, 2009
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Here is my full SLIC with both modules present:

    Code:
    53 4C 49 43 76 01 00 00 01 6A 48 50 51 4F 45 4DSLICv....jHPQOEM
    53 4C 49 43 2D 4D 50 43 00 00 04 06 20 4C 54 50SLIC-MPC.... LTP
    01 00 00 00 00 00 00 00 9C 00 00 00 06 02 00 00................
    00 24 00 00 52 53 41 31 00 04 00 00 01 00 01 00.$..RSA1........
    5B AB 60 56 BC 58 1E E8 C1 D2 A1 5C E5 4F BB FD[.`V.X.....\.O..
    1D A9 8C 94 B4 AE 08 11 DC 13 59 D3 7F F6 3E 87..........Y...>.
    31 B9 95 74 10 DA 3B A4 5B B5 19 82 7C 39 D7 0D1..t..;.[...|9..
    7C 22 AC 1C 2A 84 E9 0A 88 6D FA B1 E2 D8 E8 21|"..*....m.....!
    96 E1 2E 68 9A BF 44 45 3E 3C 8E 99 90 DE 37 38...h..DE><....78
    57 0B 92 15 BC DE FF F2 07 7E B5 40 8C 51 3A C3W........~.@.Q:.
    02 48 F6 13 12 72 FB 42 78 E6 47 88 54 C7 B0 F0.H...r.Bx.G.T...
    93 9E FB 04 B7 B8 B8 90 DE DB ED 32 E1 FB 54 A6...........2..T.
    01 00 00 00 B6 00 00 00 00 00 02 00 48 50 51 4F............HPQO
    45 4D 53 4C 49 43 2D 4D 50 43 57 49 4E 44 4F 57EMSLIC-MPCWINDOW
    53 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00S ..............
    00 00 00 00 00 00 30 A8 7E 10 1B 0F 13 DD 2E 2D......0.~......-
    36 C2 AB 54 A7 8C 3A A0 2F C6 5B B3 B3 DD 93 EE6..T..:./.[.....
    8E 39 A9 92 D0 5A 20 E1 2D F5 A2 1C 7A 3E 54 85.9...Z .-...z>T.
    99 72 56 5F EC 6B 07 17 63 82 3E 79 02 50 40 C9.rV_.k..c.>y.P@.
    F1 D3 C5 58 39 A8 18 F1 56 91 EA 9C 54 1A E0 CE...X9...V...T...
    C9 16 F0 5D D1 90 B1 B0 9E 81 E6 BA 62 F1 3B 96...]........b.;.
    B0 7D D7 47 10 78 03 C9 28 52 E7 2D 4A F7 70 BB.}.G.x..(R.-J.p.
    53 1F BE CD 4F 77 D1 2F A8 3D 5C 26 AF 80 42 25S...Ow./.=\&..B%
    EF 7A B2 67 BA 1C                              .z.g..          
    :) If someone has a link to a full SLIC (or split into two parts, the cert and the marker) from another OEM, I am going to try the SLIC in my BIOS so we can see if it is possible! :)

    EDIT:

    I have successfully patched the SLIC table (I just tried modifying the windows marker version to 2.1)by replacing module DD6569A7-E455-4ee5-B2BA-ECDA84ACBC99 with a patched version.. here is the new SLIC table when patched:

    Code:
    53 4C 49 43 76 01 00 00 01 67 48 50 51 4F 45 4DSLICv....gHPQOEM
    53 4C 49 43 2D 4D 50 43 00 00 04 06 20 4C 54 50SLIC-MPC.... LTP
    01 00 00 00 00 00 00 00 9C 00 00 00 06 02 00 00................
    00 24 00 00 52 53 41 31 00 04 00 00 01 00 01 00.$..RSA1........
    5B AB 60 56 BC 58 1E E8 C1 D2 A1 5C E5 4F BB FD[.`V.X.....\.O..
    1D A9 8C 94 B4 AE 08 11 DC 13 59 D3 7F F6 3E 87..........Y...>.
    31 B9 95 74 10 DA 3B A4 5B B5 19 82 7C 39 D7 0D1..t..;.[...|9..
    7C 22 AC 1C 2A 84 E9 0A 88 6D FA B1 E2 D8 E8 21|"..*....m.....!
    96 E1 2E 68 9A BF 44 45 3E 3C 8E 99 90 DE 37 38...h..DE><....78
    57 0B 92 15 BC DE FF F2 07 7E B5 40 8C 51 3A C3W........~.@.Q:.
    02 48 F6 13 12 72 FB 42 78 E6 47 88 54 C7 B0 F0.H...r.Bx.G.T...
    93 9E FB 04 B7 B8 B8 90 DE DB ED 32 E1 FB 54 A6...........2..T.
    01 00 00 00 B6 00 00 00 00 00 02 00 48 50 51 4F............HPQO
    45 4D 53 4C 49 43 2D 4D 50 43 57 49 4E 44 4F 57EMSLIC-MPCWINDOW
    53 20 01 00 02 00 00 00 00 00 00 00 00 00 00 00S ..............
    00 00 00 00 00 00 30 A8 7E 10 1B 0F 13 DD 2E 2D......0.~......-
    36 C2 AB 54 A7 8C 3A A0 2F C6 5B B3 B3 DD 93 EE6..T..:./.[.....
    8E 39 A9 92 D0 5A 20 E1 2D F5 A2 1C 7A 3E 54 85.9...Z .-...z>T.
    99 72 56 5F EC 6B 07 17 63 82 3E 79 02 50 40 C9.rV_.k..c.>y.P@.
    F1 D3 C5 58 39 A8 18 F1 56 91 EA 9C 54 1A E0 CE...X9...V...T...
    C9 16 F0 5D D1 90 B1 B0 9E 81 E6 BA 62 F1 3B 96...]........b.;.
    B0 7D D7 47 10 78 03 C9 28 52 E7 2D 4A F7 70 BB.}.G.x..(R.-J.p.
    53 1F BE CD 4F 77 D1 2F A8 3D 5C 26 AF 80 42 25S...Ow./.=\&..B%
    EF 7A B2 67 BA 1C                              .z.g..          
    Is it normal for Vista to not activate when the marker version is changed? I guess it breaks the digital signature? Either way at least we are now able to modify Insyde BIOS's! :)
     
  6. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #6 acinismar, Jun 21, 2009
    Last edited: Jun 21, 2009
    (OP)
    Just to summarize (sorry for all the posts in a row) -

    Module GUID 1A1E2341-A2FB-42c7-8D17-3073D08EB21D - Public Key - tested and this can be replaced with a 156 byte pub key
    Module GUID DD6569A7-E455-4ee5-B2BA-ECDA84ACBC99 - Marker - this can also be replaced with the 182 byte marker

    If there is anyone out there with an Insyde BIOS that doesn't have a SLIC table it may also be possible to insert these modules but I have no way of testing unless someone is willing to give it a go! :) Once Win7 is out it will be possible to mod these Insyde BIOS's (assuming the manufacturer doesn't update their BIOS's themselves). Also note that the Insyde BIOS is automatically updating the checksum byte (byte 9)! :)
     
  7. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    488
    180
    You can replace or insert the slp2mark and the slp2pkey with a pubkey/marker made from a complete slic. It has been done and works..I have changed HP and acer and back on an hp bios..:D My Insyde h2o kit is in english..
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    Great to hear! Out of curiosity what HP laptop do you have? :)
     
  9. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    488
    180
    Not mine..A friends dv7-1270us

    we added a different logo, more custom than the HP stuff, then after that was successful, we changed the pkey/marker back and forth, each time checking with RWE for better validity..

    Some of the Acer bios do not open though..kinda strange.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #10 acinismar, Jun 21, 2009
    Last edited by a moderator: May 23, 2017
    (OP)
    Ah ok is the dv7 one of the laptops that have had the BIOS update that claims "support for future OS versions"? If so you should try out this utility:

    http://forums.mydigitallife.net/threads/5736

    When I ran it on my clean BIOS it had an option for Windows 7 version, which may enable the 2.1 SLIC without any modification.. :)
     
  11. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    488
    180
    #11 911medic, Jun 21, 2009
    Last edited by a moderator: May 23, 2017
    You cannot simply change the version or "enable 2.1" The slics are digitally signed. The HP slp2.1 I have not seen yet, however there are six of them on this site. Just make a slp2pkey.bin and slp2mark.bin files from an available 2.1 SLIC (we have DELL, FUJITSU, Lenovo, MSI, and Toshiba) and change them in your bios. You will then be 2.1 compliant. Just changing the bytes you did breaks the slic, it does nothing good...:D

    I would wait if I were you. We did this bios stuff a couple months ago..when his laptop was new. I think he is past messing with stuff. I see no reason to use the HP EPROM tool with a working slic, it is to enable a blocked slic, like comes with freedos versions..It cant enable 2.1 unless you add SLIC code..
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    Also the other thing I am trying to figure out is how to read the data from a module based off its GUID, which could make other BIOS mods much easier as we would know which modules to replace. I have been trying to use the flas**t.exe tool with the /RB (read binary) parameter but I'm having no luck. Unfortunatly there seems to be no info available on this utility. :(
     
  13. frwil

    frwil MDL Addicted

    Sep 22, 2008
    520
    158
    30
    Need some help please...
    I opened the *.fd file with this tool. But now i feel myself a bit stupid - how do i extract modules? - i just want to extract the existing slic from the file?
     
  14. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    That's the problem. :( It is not possible with this tool. I think beacuse this tool is directly from Insyde they assumed the user would already have the modules themselves anyway and would not need the tool to do this. We need someone with disassembly skills to take a look at this app and see how the .FD files are encoded. My first suspicion would be some form of LZMA compression (based off the fact a file called LzmaDll.DLL is required to run the app).
     
  15. frwil

    frwil MDL Addicted

    Sep 22, 2008
    520
    158
    30
    And you're right!
    Use this tool to decompress BIOS file:
    http://downloads.sourceforge.net/sevenzip/lzma465.tar.bz2
    (we'll need only lzma.exe from this SDK)
    1. Copy *.fd file > bios.tmp for example
    2. Open copied file in hex-editor and delete all bytes before sequence "5D 00 00 80 00" in HEX. Save it. Now we have the pure LZMA compressed file.
    3. lzma.exe d bios.tmp bios.bin
    4. That's it, we've got the uncompressed BIOS.BIN to explore in hex-editor,
    all ACPI tables visible.
     
  16. frwil

    frwil MDL Addicted

    Sep 22, 2008
    520
    158
    30
    Looks like INTEL *.bio files also can be modded this way... Recent versions all contain empty SLIC. If to use efi unpacker, it'll be in moduls:
    file-4A5... .data
    file-77A... .fd
    Should be also decompressed with lzma.exe to find SLIC.
    Just a general idea.
     
  17. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #17 acinismar, Jun 21, 2009
    Last edited: Jun 21, 2009
    (OP)
    Great work! :D We are making real progress! I can't find that sequence of bytes in my BIOS though (link in first post). Are you sure that's the right sequence? At what offset of the file was it at? :)

    EDIT: Found it, my bad I was using a modded file which had become corrupt! :p

    EDIT 2: I guess the next step is figuring out how the difference sections are referenced/seperated (with the GUIDS). Perhaps there is a lookup table of some sorts in near the beginning of the file. I will spend some more time on this in the coming days! :D Also I noticed there is still a lot of data that was cut out before the marker for the beginning of the LZMA part which makes me wonder what is in there!
     
  18. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    10,938
    10,477
    340
    #18 Yen, Jun 24, 2009
    Last edited: Jun 24, 2009
    This is really great!!!
    So the way is:
    Decompress the bios using lzma.exe, replace (pubkey) and marker, compress and reinsert it again, fill up with FFh bytes since the new compressed file is smaller in size, will play with this, too :D:)
    Will first re-compress it without any modifications. I guess some bytes behind are not used and have to be remained.....
    Edit: The unmodified re-compressed bios matches NOT the original, guess we need to play with switches of lzma.......

    Will this bios mod work?
    BTW HP SLIC2.1 is available now.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  19. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    488
    180
    I have successfully modded and flashed bios mods with H2O tool. The problem is that the oemtable/ID (first part) of the SLIC cannot be changed. This matters?

    If we flash with the same manufacturer, upgrading the slics should be not problem. Introducing the bbmark and pkey is no problem. Do we need to change the first part of the slic code also?
    HTML:
    SLICv....zHPQOEMSLIC-MPC....HPQ....
    or is the slp2mark and slp2pkey enough?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  20. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    488
    180
    One more thing. I dont know if this has any significance.

    I searched for the GUID strings. I could not find complete strings, but if you search them in two byte pairs, they are everywhere. I think if a couple were found, it would be happenstance. Every single pair was found in the HP bios. Maybe some disassembly may show where the modules are? I am not good enough to spot minor anomalies..
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...