HP Compaq 6710b F.20 BIOS issues.

Discussion in 'BIOS Mods' started by coreburner, Oct 7, 2012.

  1. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    #1 coreburner, Oct 7, 2012
    Last edited: Oct 8, 2012
    Hi all,
    My HP Compaq 6710b was issued with a F.20- version BIOS, a version as we all know, can't be flashed with a changed, edited and modified own version, even downgrading is impossible with the tools we have at hand, such as HPQFlash etc..
    This is not a desirable situation, so i've de-soldered the BIOS- chip (in my case a 25VF080B type, brand: SST, 8Mbit wide in a SOIC 200mil 8-pin outline/package).
    This little chip i've put in a SPI- programmer wich i've ordered off eBay (brand: Sofi, model: SP8-A). It's not an expensive device and comes with software, cables and a universal adapter kit.
    After installing the apropriate usb- driver and software next, my Windows 7 (64bit) system found it directly.
    I've read the chip and dumped the contents to disk. So far, so good.
    With a Hexedit (Winhex, latest build) i've compared the original HP downloaded rom- file, after unpacking the sp55553.exe file with 7-zip, with the one already residing on disk (the dumped one).
    It draw my attention that there was code wich matched, but also there where a lot of "y"'s in the HP file, where in my dumped rom there was code.
    Immediatly it was clear that one could not load the HP original file into the programmer and start programming. (I did just that and re-soldered the chip back, but the notebook didn't boot at all. So this is a dead end.)

    Next i tried to modify the SLIC- tables with the one that was posted here on MDL a while ago. Some code from that file wis indeed different then the one found in the dumped file. I changed that.
    Also i've flashed the BIOS- chip, but now a version with the modified SLIC- tables in it. You have already guessed it, no boot at all.
    Someone pointed out to me that after modification of the original dumped rom, the checksum of the whole "new" version rom had to be adjusted, logical it sounds, because some code has been changed therefore the initial checksum was not correct anymore.

    Now the problem, how on earth does one correct the faulty checksum of an edited rom? What tools are to be used? ...if there are any.

    I gave up... and soldered the original flash BIOS- chip (with the good F.20 code) back on the motherboard and assembled the notebook this afternoon.
    Yes, the notebook works, but still with the F.20 BIOS, with regret i'll have to say.

    I'am stuck, big time.
    One last idea springs to mind, maybe one of you girls or guys have tried to use the program flashrom under a Linux environment. Is this possible, because the HPQFlash.exe program works under DOS/Windows, maybe it is possible to circumvent this by using the mentioned flashrom program.
    Anyone? ...please?

    I'am anxious to hear your opinios about the <grrr> F.20 stuck bios flash thingy. :(
    Thank you kindly for your attention.
    B.T.W.: i have the original dumped rom available for experiments, if somebody is willing to give it a try to get those pesky SLIC- tables for Windows 7 activation in it.
    ...or revert back to for example the F.16 bios version.
     
  2. conghoaxa1

    conghoaxa1 MDL BIOS/EFI Modifier

    Oct 30, 2009
    2,069
    1,195
    90
  3. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    Hi conghoaxa1, i'll try both of them (the spxxxxx.exe) files tomorrow. Why? Because i'an using the "Sanitizing option" now on my notebook after mounting an second-hand WDC320GB drive in it.
    The drive itself is full of old data from the person who sold it to me and i want to start-off with a clean disk.
    I'll hope to install Windows 7 (32-bit) tonight on it, after that i'am going to try both of your files. I'll hope these files contain the appropriate tables to get w7 activate. :friends2:
    Also i'll keep you and MDL posted on my endeavours (it's more and more some sort of quest). :)
     
  4. conghoaxa1

    conghoaxa1 MDL BIOS/EFI Modifier

    Oct 30, 2009
    2,069
    1,195
    90
    I fix ver bios is F21. hope it will flash. sp50197.exe is bios original, I don't modify it
     
  5. Galileo Figaro

    Galileo Figaro MDL Junior Member

    Sep 6, 2010
    86
    13
    0
    I have one of these too.
    Where does one find the BIOS chip?
     
  6. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    @Galileo Figaro; the BIOS chip is located on the main-, or motherboard at position U23. When you remove the topside it's just i the middle behind the pcmcia- connector.
    In my case it is a 25VF080B chip (text on the chip itself) and mostly has a drop of some sort of paint on it (blue, read, yellow, white) to indicate that it is a part with contains (modifyable) software.
    I've seen on eBay pictures of main-, or motherboards wich where fitted with a Atmel chip, so i presume HP did use parts from various/different manufacturers.
    Hoped to have answered your question.

    @conghoaxa1; i'll go try the files now. Fingers crossed... :tankyou:
     
  7. conghoaxa1

    conghoaxa1 MDL BIOS/EFI Modifier

    Oct 30, 2009
    2,069
    1,195
    90
    :( I'm sorry. you extract ROM.cab with winrar then try recover it
     
  8. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    Hi, no because i haven't got an external froppydrive wich connects to an USB- port, recovery for me is impossible. I'am going to dismantle the notebook and de-solder the BIOS-chip again, wipe the contents in my SPI- programmer and flash the backup rom (the dumped one, you know) back into it. Then solder the chip back on the mainboard and re-assemble the notebook. A lot of work...
    It's not your fault, i don't blame you. Honest. At least you where the one wich stood up and tried to help here, i'll appriciated that very much. Maybe you have another solution for this F.20- problem soon or in the (near) future.
    At lease your modification was able to flash the rom contents into the eeprom, that's half of the problem solved! :)

    Still one thing, when the original HP F.20 rom is flashed (the one you download from HP's ftp- servers or via the browser, you never ever can revert back to an ealier version, let's say a F.16 or a F.18- version etc., the F.20 bios won't allow this operation in any way.
    You can't fool this process either, by renaming and or setting the date back, this won't work. Believe me.

    Ok, if you're still up to it, please don't stop and keep an eye on this, that is if you have the time for it.
    (I have the complete dumped F.20 contents from the flash- chip (SST25VF080B) for you available, just send me an email about this if you need it.
    With respect, Harm
     
  9. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    11:36 PM; update flash chip removed, cleared and programmed again with the original F.20 bios dump, thus the system is running again. :biggrin:
    Maybe i'll have to look for a working serialnumber for my Windows 7 Ultimate edition... :(
     
  10. akuma6099

    akuma6099 MDL Novice

    Mar 20, 2012
    25
    18
    0
    #14 akuma6099, Oct 10, 2012
    Last edited: Oct 10, 2012
    I answered you on the other forum...DualIDA-QuadIDA. The recovery method utilizes a USB stick so no need for a floppy drive. Just needs to be setup correctly. You can revert back to an older BIOS, it's not a simple flash tho as you can see. I'm running F.0F Dual-IDA. Downgraded from F.20..... Can I get that dump? I can help out more if I could see.
     
  11. akuma6099

    akuma6099 MDL Novice

    Mar 20, 2012
    25
    18
    0
    Thanks for the dump. As I expected, this one is just as easy as the 2730P. Just need to know what to look for. I have provided an F.10 and F.16 version. Just pick one, program it up and you should be good to go. As an experiment, you could try and flash via software and see if it takes. These versions have all your system specific data in it so no need to program serial or P/N. You can find the recovery procedure on the thread under/over this one "HP 2530p laptop with corrupted bios". Unfortunately this didn't work for that individual, but it could be due to corruption outside of the bios region.

    Still can't post links yet.....Workin on it
    datafilehost.com/download-d85347a8.html
     
  12. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    Experiment #2; I've used the HPQFlash.exe (patched and non-pached), WinPhlash and Phlash16 to flash the binaries under DOS and Windows. They all didn't flash correct and/or didn't flash at all. Bummer.
    Next i've took the complete F.16 ROM, wrecked my notebook again to flash this binary into an brand new eeprom, verified it (checks OK) and soldered it back on, guess what? ... NO BOOT and bricked again. (4th time now.)
    This is one impossible HP Compaq piece of .... (fill in the blanks) and i'am thiking of getting an smd- SOIC-8, 200mil IC- socket for the notebook to swich easy without soldering. :)

    I've retraced my steps and went searching in the original binaries and did locate the SLIC- tables (in the original HP Softpaq) at:
    1st-block (offset) : E5222h ends at E52B5h (this is the first SLIC 2.x table)
    2nd-block (offset) : F5222h ends at F52B5h (this is the second SLIC2.x table)
    Checksum original F.20 Softpaq ROM (with SLIC2.0-tables in it) : 08 22 21 E6 (hex)
    Checksum modified F.20 Softpaq ROM (with SLIC2.1- tables in it) : 0F 70 5F F9 (hex)
    and at offset 0000h in the original Softpaq ROM is F1 (hex), in the modified one is F9 (hex).

    Question why does offset 0000h differ from each other (F1h, F9h)? This can't be a checksumcorrection, not with one byte and a difference of 8.
    (I know that it is the checksum, but where resides it in the ROM- file. Is there a program (besides ADDCC, wich is for spi/wifi/network cards etc.)?
     
  13. akuma6099

    akuma6099 MDL Novice

    Mar 20, 2012
    25
    18
    0
    I'm not sure about offset 0. If you do a compare between your orginal dump and the F.20 Rom.bin the only changes are in section 0-B00. Everything else matches exactly. Your BIOS definitely starts at 0x10000-EOF. I'm not sure how to calculate the checksum or where it is even stored in what order. I've seen sometimes the checksum needs to sum up to "00000000" and sometimes "FFFFFFFF" depending on 8/16/32bit. Neither AMImod, Award, or Phoenix tool will open these bin's for automatic SLIC modding. Since the first 0x10000 seems to be system specific data, I would try programming the Rompaq F.16 bin by itself with no mods. Program Rom.bin to your flash. If it boots, then you can update your serial and product number.

    On the 2730 I have a 4MB dump. The Bios is only 1.5MB. I found it by doing a file compare and section 0x280000-0x400000 matched the F.20 Rom.bin (0x30000-EOF). Everything (except 0x0-0x30000) was exactly the same. I then took the F.16 and copied 0x30000-EOF into section 0x280000 of my dump. When I programmed it up, the laptop had lost its serial and product information. So, my system specific data was overwritten. I'm thinking it worked because the checksum checked out in the original F.16 Rom.bin. No adjustments were needed. I do not know where it is or how to verify it. Maybe someone else here could advise. I'm sorry that you have taken your notebook apart 4-6 times now. I think you'll succeed tho with all this hard work:biggrin: