I present you a tool to decompress Dell UEFI BIOS

Discussion in 'MDL Projects and Applications' started by JimboBobB, May 4, 2013.

  1. JimboBobB

    JimboBobB MDL Novice

    Joined:
    May 2, 2013
    Messages:
    12
    Likes Received:
    41
    Trophy Points:
    0
    #1 JimboBobB, May 4, 2013
    Last edited by a moderator: Apr 20, 2017
    I tested this on latest revisions of downloadable BIOS for E6410 and E6420 and it worked great.

    You're welcome.

    JB

    Code:
    
    #This script finds the compressed data embedded in a Dell BIOS update program
    #and decompresses it to an apparent HDR file. The main data seems to start
    #at offset 0x58 in the HDR FWIW
    
    
    import zlib
    import sys
    import re
    import binascii
    
    
    if(len(sys.argv) < 2 or sys.argv[1] == "-h"):
        print "usage: python DecompNewDell.py <biosupdate.exe>"
        exit()
    
    
    f = open(sys.argv[1], "rb")
    
    
    string = f.read()
    
    
    #The 0x789C at the end is the zlib header. 
    #It's necessary to check for that too because the string
    #appears a couple times in the file.
    pat = re.compile(r'.{4}\xAA\xEE\xAA\x76\x1B\xEC\xBB\x20\xF1\xE6\x51.{1}\x78\x9C')
    match = pat.search(string)
    
    
    #Once you find that string, the first 4 bytes are the little endian
    #size of the compressed data. The span will give you the starting
    #offset into the file where it is found
    (start_match, end_match) = match.span()
    #print match.span()
    compessed_len = string[start_match:start_match+4]
    
    
    #Now switch the order around since it's little endian
    #and also convert it to a hex string
    compessed_len = binascii.b2a_hex(compessed_len[::-1])
    #and then make it a proper number (separate lines for clarity)
    compessed_len = long(compessed_len, 16)
    
    
    #read len bytes out of the file into the new string to decompress
    f.seek(start_match+16)
    string = f.read(compessed_len)
    
    
    o = zlib.decompress(string)
    
    
    f2 = open(sys.argv[1] + "_decompressed.hdr", "wb")
    f2.write(o)
    f.close()
    f2.close()
    print "Decompressed data written to %s_decompressed.hdr" % sys.argv[1]
    
     
  2. Tito

    Tito Super Mod / Adviser Staff Member

    Joined:
    Nov 30, 2009
    Messages:
    17,888
    Likes Received:
    16,542
    Trophy Points:
    340
    #2 Tito, May 5, 2013
    Last edited: Jun 2, 2013
    Thanks for the movement.

    :worthy:
     
  3. scoxx

    scoxx MDL Novice

    Joined:
    Nov 4, 2012
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    0
  4. p3duy

    p3duy MDL Novice

    Joined:
    Mar 19, 2013
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    0
    I'm a noob and i dont know how to use this script.

    Anyone help me plz! ..

    Thanks
     
  5. sebus

    sebus MDL Guru

    Joined:
    Jul 23, 2008
    Messages:
    6,201
    Likes Received:
    1,945
    Trophy Points:
    210
    Then try to put some effort before asking, did you do anything at all so far?

    Stating being a n00b is just simply not enough!

    Reading helps:
    "usage: python DecompNewDell.py <biosupdate.exe>"

    How about installing python for a start?
     
  6. akuma6099

    akuma6099 MDL Novice

    Joined:
    Mar 20, 2012
    Messages:
    25
    Likes Received:
    18
    Trophy Points:
    0
    That is awesome!!! Nice find on the Zlib PE header. Just gave it a test on the Optiplex 390 A02 + A03 files. Typically the HDR file is the exact size of the EEPROM/Flash. The HDR I received is 36,864 bytes shy of 4MB(4,194,304). I will try dumping it directly to Flash and see if the board comes alive. On HP Bios, there is a chunk that's about 32K that holds the branding info. The image-rom you get from HP has this area set to 0xFF(Blank). You can dump this image directly to flash and the laptop will function normally. After that you need to put your serial, product number etc...back. I usually clone this info and merge it into the ROM before flashing so I don't have to run the branding tools. The last time I extracted an HDR was for a Dell D630C. This HDR was exactly 2MB(2,097,152). After programming it directly to flash I had to set my service tag. Lets hope that the 390 will act the same. The E5520 will not. I have already tried to rip and clone a factory image on that model and it ALWAYS retains the service tag. There are 2 flash modules on that unit side by side to make 6MB total. I wonder which one to dump the HDR to? 2MB or 4MB flash.......probably 4MB.....I will get back to you with results. Thanks again!
     
  7. iLLiniCapt

    iLLiniCapt MDL Novice

    Joined:
    Jun 13, 2013
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    0
    Thanks for this, it works great. How did you arrive at the signature you used to locate the firmware?

    pat = re.compile(r'.{4}\xAA\xEE\xAA\x76\x1B\xEC\xBB\x20\xF1\xE6\x51.{1}\x78\x9C')

    Thanks.
     
  8. lkjhasdwe

    lkjhasdwe MDL Novice

    Joined:
    Aug 28, 2013
    Messages:
    18
    Likes Received:
    3
    Trophy Points:
    0
  9. karthikimfak

    karthikimfak MDL Novice

    Joined:
    Aug 22, 2011
    Messages:
    10
    Likes Received:
    2
    Trophy Points:
    0
    Hi.... Thank you so much...Will this script extract Dell 1450 Bios Hdr file. Then I have installed python 2.7 in windows and I just saved your script in DecompNewDell.py
    name and just executed like this and nothing happened. Sorry if I asked any nooby question... Pls Help me brothers.:worthy::worthy:

    C:\>Python27\pythonw.exe DecompNewDell.py 1450_A06.exe
     
  10. jawal37

    jawal37 MDL Novice

    Joined:
    Jun 7, 2012
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    0
    THINKS FOR YOUR WORK I AM NOT GOOD IN PYTHON CAN YOU HELP ME PLZ I INSALL PYTHON33
    NOW I CAN't apply for my exe bios
     
  11. nexus76

    nexus76 MDL Addicted

    Joined:
    Jan 25, 2009
    Messages:
    788
    Likes Received:
    298
    Trophy Points:
    30
    #12 nexus76, Oct 5, 2013
    Last edited by a moderator: Apr 20, 2017
  12. sebus

    sebus MDL Guru

    Joined:
    Jul 23, 2008
    Messages:
    6,201
    Likes Received:
    1,945
    Trophy Points:
    210
  13. tarfoh

    tarfoh MDL Novice

    Joined:
    May 31, 2013
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    0
    How do we flash the decompress HDR after we have extracted and modified it? I need to do this on my E6520? It's kind of urgent if anyone can let me know I will be greatly appreciative.
     
  14. throw1029384756

    throw1029384756 MDL Novice

    Joined:
    Oct 28, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    0
    Use Python 2.7
     
  15. throw1029384756

    throw1029384756 MDL Novice

    Joined:
    Oct 28, 2013
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    0
  16. Overmaxx

    Overmaxx MDL Novice

    Joined:
    Aug 16, 2011
    Messages:
    28
    Likes Received:
    19
    Trophy Points:
    0
    i decompress bios for dell precision M6600. Now i want flash bios for deactivate computrace. What i must do? Press END dont help/
     
  17. telanx

    telanx MDL Novice

    Joined:
    Nov 11, 2013
    Messages:
    2
    Likes Received:
    20
    Trophy Points:
    0
  18. hbissou

    hbissou MDL Novice

    Joined:
    May 12, 2011
    Messages:
    6
    Likes Received:
    2
    Trophy Points:
    0
  19. Mikkey

    Mikkey MDL Novice

    Joined:
    Mar 30, 2010
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    0
    #20 Mikkey, Nov 20, 2013
    Last edited by a moderator: Apr 20, 2017
    Because not found pattern.
    In original code no check for this.
    Here some mod for it:
    Code:
    match = pat.search(string)
    
    if match is None :
      print "No match"
      f.close()
      exit()