I present you a tool to decompress Dell UEFI BIOS

Discussion in 'MDL Projects and Applications' started by JimboBobB, May 4, 2013.

  1. JimboBobB

    JimboBobB MDL Novice

    May 2, 2013
    12
    39
    0
    #1 JimboBobB, May 4, 2013
    Last edited by a moderator: Apr 20, 2017
    I tested this on latest revisions of downloadable BIOS for E6410 and E6420 and it worked great.

    You're welcome.

    JB

    Code:
    
    #This script finds the compressed data embedded in a Dell BIOS update program
    #and decompresses it to an apparent HDR file. The main data seems to start
    #at offset 0x58 in the HDR FWIW
    
    
    import zlib
    import sys
    import re
    import binascii
    
    
    if(len(sys.argv) < 2 or sys.argv[1] == "-h"):
        print "usage: python DecompNewDell.py <biosupdate.exe>"
        exit()
    
    
    f = open(sys.argv[1], "rb")
    
    
    string = f.read()
    
    
    #The 0x789C at the end is the zlib header. 
    #It's necessary to check for that too because the string
    #appears a couple times in the file.
    pat = re.compile(r'.{4}\xAA\xEE\xAA\x76\x1B\xEC\xBB\x20\xF1\xE6\x51.{1}\x78\x9C')
    match = pat.search(string)
    
    
    #Once you find that string, the first 4 bytes are the little endian
    #size of the compressed data. The span will give you the starting
    #offset into the file where it is found
    (start_match, end_match) = match.span()
    #print match.span()
    compessed_len = string[start_match:start_match+4]
    
    
    #Now switch the order around since it's little endian
    #and also convert it to a hex string
    compessed_len = binascii.b2a_hex(compessed_len[::-1])
    #and then make it a proper number (separate lines for clarity)
    compessed_len = long(compessed_len, 16)
    
    
    #read len bytes out of the file into the new string to decompress
    f.seek(start_match+16)
    string = f.read(compessed_len)
    
    
    o = zlib.decompress(string)
    
    
    f2 = open(sys.argv[1] + "_decompressed.hdr", "wb")
    f2.write(o)
    f.close()
    f2.close()
    print "Decompressed data written to %s_decompressed.hdr" % sys.argv[1]
    
     
  2. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,696
    15,683
    340
    #2 Tito, May 5, 2013
    Last edited: Jun 2, 2013
    Thanks for the movement.

    :worthy:
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. p3duy

    p3duy MDL Novice

    Mar 19, 2013
    3
    0
    0
    I'm a noob and i dont know how to use this script.

    Anyone help me plz! ..

    Thanks
     
  4. sebus

    sebus MDL Guru

    Jul 23, 2008
    5,964
    1,821
    180
    Then try to put some effort before asking, did you do anything at all so far?

    Stating being a n00b is just simply not enough!

    Reading helps:
    "usage: python DecompNewDell.py <biosupdate.exe>"

    How about installing python for a start?
     
  5. akuma6099

    akuma6099 MDL Novice

    Mar 20, 2012
    25
    17
    0
    That is awesome!!! Nice find on the Zlib PE header. Just gave it a test on the Optiplex 390 A02 + A03 files. Typically the HDR file is the exact size of the EEPROM/Flash. The HDR I received is 36,864 bytes shy of 4MB(4,194,304). I will try dumping it directly to Flash and see if the board comes alive. On HP Bios, there is a chunk that's about 32K that holds the branding info. The image-rom you get from HP has this area set to 0xFF(Blank). You can dump this image directly to flash and the laptop will function normally. After that you need to put your serial, product number etc...back. I usually clone this info and merge it into the ROM before flashing so I don't have to run the branding tools. The last time I extracted an HDR was for a Dell D630C. This HDR was exactly 2MB(2,097,152). After programming it directly to flash I had to set my service tag. Lets hope that the 390 will act the same. The E5520 will not. I have already tried to rip and clone a factory image on that model and it ALWAYS retains the service tag. There are 2 flash modules on that unit side by side to make 6MB total. I wonder which one to dump the HDR to? 2MB or 4MB flash.......probably 4MB.....I will get back to you with results. Thanks again!
     
  6. iLLiniCapt

    iLLiniCapt MDL Novice

    Jun 13, 2013
    1
    0
    0
    Thanks for this, it works great. How did you arrive at the signature you used to locate the firmware?

    pat = re.compile(r'.{4}\xAA\xEE\xAA\x76\x1B\xEC\xBB\x20\xF1\xE6\x51.{1}\x78\x9C')

    Thanks.
     
  7. lkjhasdwe

    lkjhasdwe MDL Novice

    Aug 28, 2013
    18
    3
    0
  8. karthikimfak

    karthikimfak MDL Novice

    Aug 22, 2011
    10
    2
    0
    Hi.... Thank you so much...Will this script extract Dell 1450 Bios Hdr file. Then I have installed python 2.7 in windows and I just saved your script in DecompNewDell.py
    name and just executed like this and nothing happened. Sorry if I asked any nooby question... Pls Help me brothers.:worthy::worthy:

    C:\>Python27\pythonw.exe DecompNewDell.py 1450_A06.exe
     
  9. jawal37

    jawal37 MDL Novice

    Jun 7, 2012
    4
    0
    0
    THINKS FOR YOUR WORK I AM NOT GOOD IN PYTHON CAN YOU HELP ME PLZ I INSALL PYTHON33
    NOW I CAN't apply for my exe bios
     
  10. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #12 nexus76, Oct 5, 2013
    Last edited by a moderator: Apr 20, 2017
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. sebus

    sebus MDL Guru

    Jul 23, 2008
    5,964
    1,821
    180
  12. tarfoh

    tarfoh MDL Novice

    May 31, 2013
    1
    0
    0
    How do we flash the decompress HDR after we have extracted and modified it? I need to do this on my E6520? It's kind of urgent if anyone can let me know I will be greatly appreciative.
     
  13. throw1029384756

    throw1029384756 MDL Novice

    Oct 28, 2013
    2
    0
    0
    Use Python 2.7
     
  14. Overmaxx

    Overmaxx MDL Novice

    Aug 16, 2011
    28
    19
    0
    i decompress bios for dell precision M6600. Now i want flash bios for deactivate computrace. What i must do? Press END dont help/
     
  15. Mikkey

    Mikkey MDL Novice

    Mar 30, 2010
    8
    0
    0
    #20 Mikkey, Nov 20, 2013
    Last edited by a moderator: Apr 20, 2017
    Because not found pattern.
    In original code no check for this.
    Here some mod for it:
    Code:
    match = pat.search(string)
    
    if match is None :
      print "No match"
      f.close()
      exit()