finally a method to modify Insyde bios?!

Discussion in 'BIOS Mods' started by acinismar, Jun 20, 2009.

Tags:
Thread Status:
Not open for further replies.
  1. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #1 acinismar, Jun 20, 2009
    Last edited: Jun 20, 2009
  2. frwil

    frwil MDL Addicted

    Sep 22, 2008
    520
    161
    30
    I'm not sure, where's the download link?
     
  3. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    491
    180
    #3 911medic, Jun 20, 2009
    Last edited by a moderator: May 23, 2017
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #4 acinismar, Jun 20, 2009
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Ah I didn't realize anyone had mentioned it here.. I realize there is no HP 2.1 SLIC but is there any way of editing the SLIC with this tool or no?

    EDIT: I have tried removing the module with id:

    1A1E2341-A2FB-42c7-8D17-3073D08EB21D

    This caused Vista to deactivate so it seems it is this module with contains the SLIC table. However with this tool it seems unable to save a module file so I am unsure of the format of it. :( Any ideas?

    EDIT (again): When I viewed the SLIC table in RW-Everything it was basically all zeros. However when I added that module back and removed module DD6569A7-E455-4ee5-B2BA-ECDA84ACBC99, some (but not all) of the SLIC appeared (shown below). The reason I chose these modules is because they are the default two in the Replace module menu and there are references to SLIC's in the load file drop down box.

    Code:
    53 4C 49 43 76 01 00 00 01 03 48 50 51 4F 45 4DSLICv.....HPQOEM
    53 4C 49 43 2D 4D 50 43 00 00 04 06 20 4C 54 50SLIC-MPC.... LTP
    01 00 00 00 00 00 00 00 9C 00 00 00 06 02 00 00................
    00 24 00 00 52 53 41 31 00 04 00 00 01 00 01 00.$..RSA1........
    5B AB 60 56 BC 58 1E E8 C1 D2 A1 5C E5 4F BB FD[.`V.X.....\.O..
    1D A9 8C 94 B4 AE 08 11 DC 13 59 D3 7F F6 3E 87..........Y...>.
    31 B9 95 74 10 DA 3B A4 5B B5 19 82 7C 39 D7 0D1..t..;.[...|9..
    7C 22 AC 1C 2A 84 E9 0A 88 6D FA B1 E2 D8 E8 21|"..*....m.....!
    96 E1 2E 68 9A BF 44 45 3E 3C 8E 99 90 DE 37 38...h..DE><....78
    57 0B 92 15 BC DE FF F2 07 7E B5 40 8C 51 3A C3W........~.@.Q:.
    02 48 F6 13 12 72 FB 42 78 E6 47 88 54 C7 B0 F0.H...r.Bx.G.T...
    93 9E FB 04 B7 B8 B8 90 DE DB ED 32 E1 FB 54 A6...........2..T.
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
    ... zeros from here onwards. So obviously the SLIC table is split among these two files. :) Hopfully we are able to document their format so it can modified in future. It seems the author of this application knows how to do this but I'm not sure if anyone else does! :)
     
  5. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #5 acinismar, Jun 20, 2009
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Here is my full SLIC with both modules present:

    Code:
    53 4C 49 43 76 01 00 00 01 6A 48 50 51 4F 45 4DSLICv....jHPQOEM
    53 4C 49 43 2D 4D 50 43 00 00 04 06 20 4C 54 50SLIC-MPC.... LTP
    01 00 00 00 00 00 00 00 9C 00 00 00 06 02 00 00................
    00 24 00 00 52 53 41 31 00 04 00 00 01 00 01 00.$..RSA1........
    5B AB 60 56 BC 58 1E E8 C1 D2 A1 5C E5 4F BB FD[.`V.X.....\.O..
    1D A9 8C 94 B4 AE 08 11 DC 13 59 D3 7F F6 3E 87..........Y...>.
    31 B9 95 74 10 DA 3B A4 5B B5 19 82 7C 39 D7 0D1..t..;.[...|9..
    7C 22 AC 1C 2A 84 E9 0A 88 6D FA B1 E2 D8 E8 21|"..*....m.....!
    96 E1 2E 68 9A BF 44 45 3E 3C 8E 99 90 DE 37 38...h..DE><....78
    57 0B 92 15 BC DE FF F2 07 7E B5 40 8C 51 3A C3W........~.@.Q:.
    02 48 F6 13 12 72 FB 42 78 E6 47 88 54 C7 B0 F0.H...r.Bx.G.T...
    93 9E FB 04 B7 B8 B8 90 DE DB ED 32 E1 FB 54 A6...........2..T.
    01 00 00 00 B6 00 00 00 00 00 02 00 48 50 51 4F............HPQO
    45 4D 53 4C 49 43 2D 4D 50 43 57 49 4E 44 4F 57EMSLIC-MPCWINDOW
    53 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00S ..............
    00 00 00 00 00 00 30 A8 7E 10 1B 0F 13 DD 2E 2D......0.~......-
    36 C2 AB 54 A7 8C 3A A0 2F C6 5B B3 B3 DD 93 EE6..T..:./.[.....
    8E 39 A9 92 D0 5A 20 E1 2D F5 A2 1C 7A 3E 54 85.9...Z .-...z>T.
    99 72 56 5F EC 6B 07 17 63 82 3E 79 02 50 40 C9.rV_.k..c.>y.P@.
    F1 D3 C5 58 39 A8 18 F1 56 91 EA 9C 54 1A E0 CE...X9...V...T...
    C9 16 F0 5D D1 90 B1 B0 9E 81 E6 BA 62 F1 3B 96...]........b.;.
    B0 7D D7 47 10 78 03 C9 28 52 E7 2D 4A F7 70 BB.}.G.x..(R.-J.p.
    53 1F BE CD 4F 77 D1 2F A8 3D 5C 26 AF 80 42 25S...Ow./.=\&..B%
    EF 7A B2 67 BA 1C                              .z.g..          
    :) If someone has a link to a full SLIC (or split into two parts, the cert and the marker) from another OEM, I am going to try the SLIC in my BIOS so we can see if it is possible! :)

    EDIT:

    I have successfully patched the SLIC table (I just tried modifying the windows marker version to 2.1)by replacing module DD6569A7-E455-4ee5-B2BA-ECDA84ACBC99 with a patched version.. here is the new SLIC table when patched:

    Code:
    53 4C 49 43 76 01 00 00 01 67 48 50 51 4F 45 4DSLICv....gHPQOEM
    53 4C 49 43 2D 4D 50 43 00 00 04 06 20 4C 54 50SLIC-MPC.... LTP
    01 00 00 00 00 00 00 00 9C 00 00 00 06 02 00 00................
    00 24 00 00 52 53 41 31 00 04 00 00 01 00 01 00.$..RSA1........
    5B AB 60 56 BC 58 1E E8 C1 D2 A1 5C E5 4F BB FD[.`V.X.....\.O..
    1D A9 8C 94 B4 AE 08 11 DC 13 59 D3 7F F6 3E 87..........Y...>.
    31 B9 95 74 10 DA 3B A4 5B B5 19 82 7C 39 D7 0D1..t..;.[...|9..
    7C 22 AC 1C 2A 84 E9 0A 88 6D FA B1 E2 D8 E8 21|"..*....m.....!
    96 E1 2E 68 9A BF 44 45 3E 3C 8E 99 90 DE 37 38...h..DE><....78
    57 0B 92 15 BC DE FF F2 07 7E B5 40 8C 51 3A C3W........~.@.Q:.
    02 48 F6 13 12 72 FB 42 78 E6 47 88 54 C7 B0 F0.H...r.Bx.G.T...
    93 9E FB 04 B7 B8 B8 90 DE DB ED 32 E1 FB 54 A6...........2..T.
    01 00 00 00 B6 00 00 00 00 00 02 00 48 50 51 4F............HPQO
    45 4D 53 4C 49 43 2D 4D 50 43 57 49 4E 44 4F 57EMSLIC-MPCWINDOW
    53 20 01 00 02 00 00 00 00 00 00 00 00 00 00 00S ..............
    00 00 00 00 00 00 30 A8 7E 10 1B 0F 13 DD 2E 2D......0.~......-
    36 C2 AB 54 A7 8C 3A A0 2F C6 5B B3 B3 DD 93 EE6..T..:./.[.....
    8E 39 A9 92 D0 5A 20 E1 2D F5 A2 1C 7A 3E 54 85.9...Z .-...z>T.
    99 72 56 5F EC 6B 07 17 63 82 3E 79 02 50 40 C9.rV_.k..c.>y.P@.
    F1 D3 C5 58 39 A8 18 F1 56 91 EA 9C 54 1A E0 CE...X9...V...T...
    C9 16 F0 5D D1 90 B1 B0 9E 81 E6 BA 62 F1 3B 96...]........b.;.
    B0 7D D7 47 10 78 03 C9 28 52 E7 2D 4A F7 70 BB.}.G.x..(R.-J.p.
    53 1F BE CD 4F 77 D1 2F A8 3D 5C 26 AF 80 42 25S...Ow./.=\&..B%
    EF 7A B2 67 BA 1C                              .z.g..          
    Is it normal for Vista to not activate when the marker version is changed? I guess it breaks the digital signature? Either way at least we are now able to modify Insyde BIOS's! :)
     
  6. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #6 acinismar, Jun 21, 2009
    Last edited: Jun 21, 2009
    (OP)
    Just to summarize (sorry for all the posts in a row) -

    Module GUID 1A1E2341-A2FB-42c7-8D17-3073D08EB21D - Public Key - tested and this can be replaced with a 156 byte pub key
    Module GUID DD6569A7-E455-4ee5-B2BA-ECDA84ACBC99 - Marker - this can also be replaced with the 182 byte marker

    If there is anyone out there with an Insyde BIOS that doesn't have a SLIC table it may also be possible to insert these modules but I have no way of testing unless someone is willing to give it a go! :) Once Win7 is out it will be possible to mod these Insyde BIOS's (assuming the manufacturer doesn't update their BIOS's themselves). Also note that the Insyde BIOS is automatically updating the checksum byte (byte 9)! :)
     
  7. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    491
    180
    You can replace or insert the slp2mark and the slp2pkey with a pubkey/marker made from a complete slic. It has been done and works..I have changed HP and acer and back on an hp bios..:D My Insyde h2o kit is in english..
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    Great to hear! Out of curiosity what HP laptop do you have? :)
     
  9. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    491
    180
    Not mine..A friends dv7-1270us

    we added a different logo, more custom than the HP stuff, then after that was successful, we changed the pkey/marker back and forth, each time checking with RWE for better validity..

    Some of the Acer bios do not open though..kinda strange.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    #10 acinismar, Jun 21, 2009
    Last edited by a moderator: May 23, 2017
    (OP)
    Ah ok is the dv7 one of the laptops that have had the BIOS update that claims "support for future OS versions"? If so you should try out this utility:

    http://forums.mydigitallife.net/threads/5736

    When I ran it on my clean BIOS it had an option for Windows 7 version, which may enable the 2.1 SLIC without any modification.. :)
     
  11. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    491
    180
    #11 911medic, Jun 21, 2009
    Last edited by a moderator: May 23, 2017
    You cannot simply change the version or "enable 2.1" The slics are digitally signed. The HP slp2.1 I have not seen yet, however there are six of them on this site. Just make a slp2pkey.bin and slp2mark.bin files from an available 2.1 SLIC (we have DELL, FUJITSU, Lenovo, MSI, and Toshiba) and change them in your bios. You will then be 2.1 compliant. Just changing the bytes you did breaks the slic, it does nothing good...:D

    I would wait if I were you. We did this bios stuff a couple months ago..when his laptop was new. I think he is past messing with stuff. I see no reason to use the HP EPROM tool with a working slic, it is to enable a blocked slic, like comes with freedos versions..It cant enable 2.1 unless you add SLIC code..
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    Also the other thing I am trying to figure out is how to read the data from a module based off its GUID, which could make other BIOS mods much easier as we would know which modules to replace. I have been trying to use the flas**t.exe tool with the /RB (read binary) parameter but I'm having no luck. Unfortunatly there seems to be no info available on this utility. :(
     
  13. frwil

    frwil MDL Addicted

    Sep 22, 2008
    520
    161
    30
    Need some help please...
    I opened the *.fd file with this tool. But now i feel myself a bit stupid - how do i extract modules? - i just want to extract the existing slic from the file?
     
  14. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
    That's the problem. :( It is not possible with this tool. I think beacuse this tool is directly from Insyde they assumed the user would already have the modules themselves anyway and would not need the tool to do this. We need someone with disassembly skills to take a look at this app and see how the .FD files are encoded. My first suspicion would be some form of LZMA compression (based off the fact a file called LzmaDll.DLL is required to run the app).
     
  15. frwil

    frwil MDL Addicted

    Sep 22, 2008
    520
    161
    30
    Looks like INTEL *.bio files also can be modded this way... Recent versions all contain empty SLIC. If to use efi unpacker, it'll be in moduls:
    file-4A5... .data
    file-77A... .fd
    Should be also decompressed with lzma.exe to find SLIC.
    Just a general idea.
     
  16. acinismar

    acinismar MDL Novice

    Jun 20, 2009
    31
    0
    0
  17. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    11,238
    11,054
    340
    #18 Yen, Jun 24, 2009
    Last edited: Jun 24, 2009
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  18. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    491
    180
    I have successfully modded and flashed bios mods with H2O tool. The problem is that the oemtable/ID (first part) of the SLIC cannot be changed. This matters?

    If we flash with the same manufacturer, upgrading the slics should be not problem. Introducing the bbmark and pkey is no problem. Do we need to change the first part of the slic code also?
    HTML:
    SLICv....zHPQOEMSLIC-MPC....HPQ....
    or is the slp2mark and slp2pkey enough?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  19. 911medic

    911medic MDL Guru

    Aug 13, 2008
    5,778
    491
    180
    One more thing. I dont know if this has any significance.

    I searched for the GUID strings. I could not find complete strings, but if you search them in two byte pairs, they are everywhere. I think if a couple were found, it would be happenstance. Every single pair was found in the HP bios. Maybe some disassembly may show where the modules are? I am not good enough to spot minor anomalies..
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...