HP Compaq 6710b F.20 BIOS issues.

Discussion in 'BIOS Mods' started by coreburner, Oct 7, 2012.

  1. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    #21 coreburner, Oct 11, 2012
    Last edited: Oct 11, 2012
    (OP)
    You mean, download the original HP Rompaq with version F.16 from HP directly, de-archive the spxxxxx.exe and ROM and use the remaining Rom.bin to directly flash wit the SPI- programmer into the SST 25VF080B eeprom?
    B.T.W. yes, the eeprom of a 6710b notebook is 8Mbit wide, resulting in 1MB for short (see datasheet on the 25VF080B part, brand: SST, Silicon Storage Technologies).
    Question; how do i get my serialnumber etc. back, there are tools for it, how do they get called, i.e. what are their names and final where do i get them?

    N.B.: There's another thing i just noticed, you can't never ever initiate a recovery procedure with or without an external floppydisk and/or usb- stick, beause the "bootloader" doesn't run under DOS, it's a protected mode loader, that's why the F.20 Rompaq update only executes in Windows itself (XP/Vista) and not with a bootable floppy.
    This is a very dirty job of Hewlett Packard to design such a system...
     
  2. akuma6099

    akuma6099 MDL Novice

    Mar 20, 2012
    25
    18
    0
    #22 akuma6099, Oct 11, 2012
    Last edited: Oct 12, 2012
    Yes. do exactly that.

    This is why I said "Burn this line into your Brain!"
    8 bits = 1 Byte
    8000000 bits / 8 = 1000000 Bytes(1MB)
    Convert to file geometry 1024*1024 = 1048576 byte file size on disk or 1024KB.
    This is just fyi. Its hard starting out. After awhile you'll be able to see "0xA4" as 2 groups of binary. A = 10(DEC) = 1010 and 4 = 0100 10100100. This will help when talking SPI or I2C. You can understand the waveforms in the datasheet(CLK,CS,SO,SI). Active low=0-GND Active High=1-VCC, 3.3v or 5v.


    You need HPDmiFit. Luckily, I do this stuff for a living:biggrin: I kicked out a copy of the latest tool pack in 1 post and it started floating around the boards. At least most posts say thanks akuma6099 hehe. I don't mind.

    filehosting.org/file/details/362968/NbDmiFit118.zip
     
  3. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    Maybe another option; if someone has the same notebook/laptop as me, an HP Compaq 6710b maybe that person or persons is/are willing to make a rom-dump from version F.16 or F.18?
    I believe DavidXXX has written such a tool and the link is posted here on the forum somewhere (just can't remember where exactly).
    Maybe... :(
     
  4. Galileo Figaro

    Galileo Figaro MDL Junior Member

    Sep 6, 2010
    86
    13
    0
    Do you need the original F.18 BIOS dump or the one with the SLIC 2.1 mod? There is somewhere here one SLIC 2.1 modded F.18 BIOS for flashing, which is not a dump. Btw, thanks for describing the location of the ROM chip.
    Have you looked for an SPI interface on the motherboard? Would save you all the desoldering and resoldering jobs. If not, maybe you should make one, it's just six signals.
    Your energy is admirable.
     
  5. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
  6. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    #26 coreburner, Oct 13, 2012
    Last edited: Oct 13, 2012
    (OP)
    *double post*
     
  7. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    #27 coreburner, Oct 13, 2012
    Last edited: Oct 13, 2012
    (OP)
    Additional info on the ROM- checksum.
    There is a global checksum for the whole BIOS.

    000e86c0 45 58 54 44 15 c5 0a b6 00 00 00 00 43 4b 53 4d |EXTD........CKSM|
    --------------------------^^^^^^^
    -------------------32-bit additive checksum---------------------Extended Checksum

    The checksum is such that when the entire file is added up, four bytes at a time, the result is zero.
    To make this happen, the value in-between the Extended Checksum brackets is changed.
    In short, if you change a value upwards (add), then you need to subtract the same difference from the correctly aligned byte
    of the checksum.
     
  8. akuma6099

    akuma6099 MDL Novice

    Mar 20, 2012
    25
    18
    0
    Here's the page with the modded F.16 BIOS from TTAV134. TTAV134 had a full dump listed in aother post, but the sendspace link is dead. No File.
    forums.mydigitallife.net/threads/7681-This-is-no-request-thread!-HP-COMPAQ-bioses-how-to-modify-the-bios/page29?p=111460#post111460

    I think you'll run into the same issue. This is the pre-modded ROM from HP so it has the 0xFF for the first 0x10000. I take it that flashing the F.16 Rom.bin didn't work. I'm not sure what else to try at this point other than reversing through IDA. Some models are easier than others I guess.

    Generally I try to use an 8Pin SOIC test clip to perform an in circuit program. This doesn't always work but when it does, it'll save you from desoldering. Sometimes I find WP is wired to VSS so it is protected from writes.
     
  9. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
  10. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    #30 coreburner, Oct 14, 2012
    Last edited: Oct 14, 2012
    (OP)
    Reading/writing with a 3M- testclip or similar on the chip generates noise and interference, not advisable, sorry.
     
  11. Galileo Figaro

    Galileo Figaro MDL Junior Member

    Sep 6, 2010
    86
    13
    0
    Sorry, I was mistaken. There seems to be no modded F.18 BIOS here. If I were you, I'd use the latest modded or moddable version, which appears to be the F.16 version.

    I read in some other forum that the F.20 version is merely a "trap" for people like us. There are no new features or improvements there, which the high version number would imply. The primary reason for the existance of the F.20 is to lure you into painting yourself into a corner. You get an unmoddable BIOS and in addition it doesn't allow you to go back to an earlier, moddable BIOS. So after flashing the F.20, your rabbit is cooked.

    My guess is that this move is a reaction to what is happening on this very board. Other producers will probably follow suit.

    Some kind of easy accessible SPI interface, like the one you displayed, would be a good idea. Else the mere handling of disassembling the laptop and desoldering that poor chip will likely harm your electronics. You don't need to drill a hole in the laptop shell, just place your SPI interface where it is easily accessible, like maybe under the keyboard? Make sure to insulate all leads and glue the connector so it won't accidentally shortcut something in there.
     
  12. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    Galileo Figaro; thank you idd it's the F.16- version with SLIC2.1_no_whitelist. This morning i've boldly flashed the F.16 rom contents from the HP- download (after unpacking) into my removed a new eeprom, externally with a SPI-programmer. This is probably NOT going to work with software in the near future, i think.
    To my surprise my notebook came to life again, but alas with no user data in it. Logical because the initial rom contents reserves a chunk of user data wich includes the serialnumber, sku and other info.
    This chunk (0000-FFFF) i copied off the original F.20 dumped rom and pasted it into the newly F.16 eeprom contents. Et voila! Success. No more F.20 issues, thank goodness.
    Next i'am going to check with the DMI- tools if all that "pasting" was correct, i have a tiny feeling that it will be ok.
    I'll keep MDL posted.
     
  13. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    WP# is never hardwired, the machine itself writes in the eeprom all the time. Hardwiring prohibites that. The individual sector protection is set and reset when necessary.
     
  14. akuma6099

    akuma6099 MDL Novice

    Mar 20, 2012
    25
    18
    0
    So flashing the F.16 Rom.bin from HP(Extracted CAB) worked? Then you merged your system data back into 0x10000 region? I suggested this earlier and never saw a reply on it. I thought you tried that and failed. I also thought there was a checksum in the 0x10000 region that was preventing this.

    I think it is safe to say that you can only downgrade F.20 if you have a SPI programmer. Confirmed on 2 Models now. Same method. :biggrin:
     
  15. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    #35 coreburner, Oct 15, 2012
    Last edited: Oct 16, 2012
    (OP)
    Maybe someone knows where to get the 6710BS_6510B_F16_sp50197_SLIC21_no_whitelist_dualIDA.rar file (for free), i.e. without paying for it as told by email when seen on notebookreview.com?
     
  16. Galileo Figaro

    Galileo Figaro MDL Junior Member

    Sep 6, 2010
    86
    13
    0
    I have this one:

    sp50197_SLIC21_SLPon_no_whitelist.zip

    Probably downloaded from here, MDL.
    Seems this ended well after all?

    What we have learned from this is that it pays to never give up.
    And that one shouldn't rush and flash the newest BIOS just because it is new.
    And that it is good to have an SPI programmer. :)
     
  17. akuma6099

    akuma6099 MDL Novice

    Mar 20, 2012
    25
    18
    0
    #37 akuma6099, Oct 15, 2012
    Last edited: Oct 15, 2012
    If I had control over it, I would. I'm not the original author and I would never think about charging for someone elses hard work. I posted the link for this BIOS a page ago. It is still available for FREE from sendspace. Here's the link again. Also, you just have to EMAIL nando as stated in the numerous posts on that forum if you want the DualIDA option as well.

    forums.mydigitallife.net/threads/7681-This-is-no-request-thread!-HP-COMPAQ-bioses-how-to-modify-the-bios/page29?p=111460#post111460

    Here's the direct sendspace link.
    sendspace.com/file/s70t72

    file: sp50197_SLIC21_SLPon_no_whitelist.zip
    SLIC 2.1 merged and No Whitelist. No DualIDA....

    Glad to see you up and running. Peace out.
     
  18. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
    #38 coreburner, Oct 15, 2012
    Last edited: Oct 15, 2012
    (OP)
    Akuma6099; sorry, i was under the impression that you where the same person as Nando4 on NBR, he who set the Ida- mod files to the private status on Mediafire.com (so people can't download them) and when one emails him about this, he's told to have to pay approx. $20,- (USD) first to get (the download link) of the file in question. Personally i think the latter is rather strange, because he used the F.16 mod from an author on this forum, and adapted the Ida- code part himself.
    Not nice to "borrow" a file from someone, modify it, and then try to sell it for money. I suppose therefore he's banned there at notebookreview.com (NBR).
    B.T.W.: i won't hesitate (if i where a moderator) to do the same.

    Sorry, for the mixup, maybe an IP- check on some of them is in order here to tell who's-who.
    Just my 2 cents.

    P.S.: thanks for the url.
     
  19. coreburner

    coreburner MDL Junior Member

    Feb 1, 2011
    80
    2
    0
  20. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,059
    3,346
    90
    #40 pf100, Oct 27, 2012
    Last edited: Oct 27, 2012
    coreburner, a few questions please.
    First, I can't find a modified Rompaq v4.73c, only reference to a modified Rompaq v4.78c. Can you or someone provide a link to the modded Rompaq v4.73c?
    Second, is it as simple as flashing the modded F.20 (6510B_6710BS_F.20_sp55553_SLIC21_no_whitelist_dualIDA) over the official F.20 bios with the modded Rompaq v4.73c from a DOS USB stick?
    I have written roms before but no longer have the equipment to do so and hope I don't need to ;)
    I apologize if this information is already here somewhere but I somehow missed it. Thanks for any additional info you can give.