How to check if bios already modded?

Discussion in 'Windows Vista' started by nbat58, Apr 24, 2008.

  1. flagmax

    flagmax MDL Member

    Jun 22, 2008
    206
    2
    10
    #21 flagmax, Jul 1, 2008
    Last edited by a moderator: May 23, 2017
  2. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    13,081
    13,980
    340
    #22 Yen, Jul 2, 2008
    Last edited: Jul 2, 2008
    Additionally for AMI bios:

    Get some typical SLIC's and open them with a hexeditor, have a look how a SLIC looks like to make sure that you are able to identify it.

    Rename bios to *.rom, open it with Mmtool, extract 1b module, have a look for FC module, if present extract FC module as well.

    At 1b module search for SLIC string, and check if the following 176h bytes are full of SLIC data. The SLIC string only is NOT a SLIC table!!!

    At FC module you'll find a SLIC without the header (which means WITHOUT the SLIC string) if present....(RSA1 string)


    Phoenix bios:

    Open it with PBE, go to PBE's temp dir and open all ACPI.ROM files with a hexeditor, have a look if a full SLIC table is present.
    Also open BIOSCOD1.ROM and have a look for a present full SLIC.

    If found, there is a chance that you will get a SLIC.

    BUT: To make it sure you have to check it with ACPIScope, since some SLIC'S are prevented to be fully mapped.
    To see that at bios you have to know how ROMHOLES and the structure are working at Phoenix bios. ACPIScope is much easier here.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...