Insyde BIOS MobilePro 4.20.10 (HQD70) on Acer Aspire 9500 - Change Boot Logo at least

Discussion in 'BIOS Mods' started by itsmemario1, Sep 10, 2012.

  1. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    #1 itsmemario1, Sep 10, 2012
    Last edited: Nov 29, 2016
    1st of all, try to be gentle and forgive me my nescience. ;)


    In my opinion I already searched and read so much about my problem...that I feel confused and stuck now.

    I try to give as much informations as possible:


    Ive got a Acer Aspire 9500 (Modell DQ70).

    Mainboard: Compal Stork (Chipset i915PM/GM, Southbridge 82801FBM (ICH6-M)

    Pentium M 760 @ 2 GHz

    Insyde Software MobilePRO Version 4.20.10, using the "Acer HQD70" Bios 1.60. (512kb)

    Right after startup it additionally says "Insyde ACPI Bios 4.20.09" short before initialising the HDD and the CD-Rom.

    I made a backup of the 1.60 using the "Universal BIOS Backup ToolKit 2.0" but couldnt open it.

    1.70 is the newest, which I also tried to open after downloading it from acer, original bin format, also renamed to .fd, no luck, cant find any other format or download of this 1.70.

    h**p://global-download.acer.com/GDFiles/BIOS/BIOS/BIOS_v1.70.zip?acerid=633643257974888117&Step1=Notebook&Step2=Aspire&Step3=Aspire%209500&OS=X01&LC=de&BC=Acer&SC=EMEA_8

    Its UUID is : 61373537326131356136000FB0F07732

    Firmware 101.114
    Bios Date: 12/29/2005
    Bios Starting Segment : EB00h

    EZh20 (up to 2.0.13) cant open it, neither 1.60 original backup, nor the new 1.70 or says it is not an insyde H20 bios and the Phoenix Tool (up to 2.10) says it is not a Insyde Bios.

    I also tried MMTool which gives a "Error loading rom".

    I tried to read through the "a-way-to-mod-insyde-bios-which-can-t-be-opened-with-ezh2o" here but I still cant open my 1.60/1.70.

    And yes I read somewhere "my bios would be too old" in some other modding section, but Im not exactly sure if this is the reason EZh20 or Phoenix Tool wont work. (?)

    In a hex editor, the 1.60 backup looks (nearly) the same as the 1.70 I downloaded. Btw. what is the difference between the files "all.rom (547kb) and bios.rom (512kb) ?

    I would already be happy if I could at least change the boot logo.
    So if there is any other way, idea or software, please post. :)

    Hell, any answer is appreciated right now.


    Original BIOS files v1.30 to 1.70 can be downloaded here :


    ftp://ftp.support.acer-euro.com/../Archiv/notebook/aspire_9500/bios/
     
  2. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    If its any help, here are the RW Everything ACPI Tables :

    *ttp://w*w.datafilehost.com/download-332012ff.html
     
  3. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    I recently revived this old Laptop with Windows 8.1 Pro x32 and like to bump this, as Im still interested in a BIOS Mod.

    Acer Aspire 9500 (Modell DQ70).
    Mainboard: Compal Stork (Chipset i915PM/GM, Southbridge 82801FBM (ICH6-M)
    Pentium M 760 @ 2 GHz
    Insyde Software MobilePRO Version 4.20.10, using the "Acer HQD70" Bios 1.60. (512kb)
    Right after startup it additionally says "Insyde ACPI Bios 4.20.09" short before initialising the HDD and the CD-Rom.

    I made a backup of the 1.60 using the "Universal BIOS Backup ToolKit 2.0" but couldnt open it.

    I downloaded the 1.70 : (cant post links yet)

    h**p://global-download.acer.com/GDFiles/BIOS/BIOS/BIOS_v1.70.zip?acerid=633643257974888117&Step1=Not ebook&Step2=Aspire&Step3=Aspire%209500&OS=X01&LC=d e&BC=Acer&SC=EMEA_8



    No tool can open this ROM either. (Andy's Tool, Phoenix Bios Editor Pro etc.)


    There is no sign of LZMA or any other compression method, when viewing the ROM in a hex editor

    I then extracted the winflash.exe and the platform.ini does not have the line "MODEL="

    What to do next ?
    Any additonal info is welcome.
     
  4. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    Are there any new achievements regarding Insyde modding this BIOS that I might have missed ?
     
  5. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
  6. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,208
    14,759
    340
    These are early implementations of Insyde firmware where they didn't use EFI compatible structure... most of the thing is undocumented.

    o_O
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    Early ? Undocumented ? oh :(

    Now that might explain the silence in this thread.


    I stumbled across these instructions..but ya, I cant open/read any of the bios files,
    from v1.30 to v1.70.

    http://donovan6000.blogspot.de/2013/06/insyde-bios-modding-advanced-and-power-tabs.html

    http://donovan6000.blogspot.de/2013/06/insyde-bios-modding-splash-screen-logo.html


    So, maybe the ROM uses a different compression routine...as it does look crypted...

    Are there alternatives to dump a bios, except for Universal Tool or Linux command line ?
     
  8. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,208
    14,759
    340
    1. Most of the guide you'll find online are applicable for newer Insyde firmware.
    2. donovan6000 is a member of MDL too.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    #9 itsmemario1, Nov 29, 2016
    Last edited: Nov 29, 2016
    (OP)
    Im aware of "newer" guides, but sometimes (russian, chinese) forums slip through google or my eyes and info will stay unread that way. :g:



    For example stuff like this...not sure what it is, but its a lot of text fragments from the inside of an Insyde BIOS :

    http://acer.it168.com/thread-467802-1-1.html

    which I can find as well :
    OSBLOGO.jpg

    On some parts you can clearly read inside the BIOS via hexeditor, but how would the header look like ?
    You can see OSBLOGO and IMAG001 there, the Acer branding image and the intel logo.


    If you search through the ROM file, you will find all of these words 2 times.
    1x within that "List" and 1x inside the mess of the ROM file, in the very same order.
    So at least it is sorted. Interesting for now are "IMAG001" and "OSBLOGO".


    The size of the data part between OSBLOGO and USBCORE is 10kb.
    Even unpacked this is enough for a small 16 color Intel graphic, but I cant find a file header.

    The data between IMAG001 and BOOTMSG is 31kb. Enough for a midsize 16 color Acer logo.
    Again, no file header or whatever.


    Or here, where someone claims phoenixtools 2.50 was able to decrypt his Insyde BIOS while 2.66 wasnt :
    (failed for me)

    http://hardware.forumsee.com/a/m/s/...e-decrypt-with-andy-s-tool-but-which-one.html


    The "newer" H2OEZE-W.exe also fails with non H2O BIOS files.

    https://forums.mydigitallife.net/threads/529-Bios-Tools/page59?p=1005615&viewfull=1#post1005615

    ezH20 wont load any of the files. Maybe there is a needed header hidden in the FLASH exe file ?

    Or are there maybe "older" versions of ezH20 around ? Or a pre-ezH20 insyde bios tool that has another name ?
    Even in chinese it would be ok ;)

    donovan6000 wasnt online since august 2015. o_O


    I also tried the "crisis" recovery with the BUIDROM.BAT from v1.30 and unpacked winflash..without any real progress :



    !Screenshots.jpg


    I agree, without proper documentation this will be a long, looong way...:31:


    But what I know now is that different vendors bought a BIOS from Insyde and used their own way of compression and encryption. I do indeed find the "common" LZMA compression file header "5D 00 00" in the BIOS files but trying to unpack these results in a "not an LZMA file" using Easy 7-Zip". o_O


    Right before the "5D 00 00" you can read "PXEBIOS1" in every BIOS

    pxebios1.jpg
     

    Attached Files:

  10. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    #10 itsmemario1, Nov 29, 2016
    Last edited: Nov 29, 2016
    (OP)
    Found a decompressor for Insyde BIOS files. (original download link gone, see bottom of this post)


    http://biosgfx.narod.ru/insydeco/



    InsyDeco.jpg


    -=InsyDeco, version 0.1 (DOS32)=-

    InsydeBIOS information:
    Filelength : 80000 (524288 bytes)
    Filename : v190.rom
    BootBlock Table : 71E00
    Modules: : 23
    Released : 03 November 2000
    +------------------------------------------------------------------------------+
    | Instance (Name) Packed Len CRC Segment Offset |
    +------------------------------------------------------------------------------+
    [00] VGABIOS 9A17 F115 C0000000 10000h
    [01] VGABIOS 1EC6 F909 00000000 19A2Bh
    [02] TSBLOGO 0F71 DA25 63000000 1B910h
    [03] DYNALOGO 09F1 6073 63000000 1C8A0h
    [04] TSBDEV 09AE A202 66000000 1D2B0h
    [05] BARG 01B9 97FF 68000000 1DC80h
    [06] BARL 01AE 93AA 69000000 1DE50h
    [07] DISPSEG 16AD 2A97 80000000 20000h
    [08] IMAG001 240F 59CA 40000000 216D0h
    [09] ISC02 025F 1EAE 90000000 23B00h
    [10] ISC02P 024C 10C1 90000000 23D80h
    [11] ESLOGO01 10FB A8F8 9E000000 23FE0h
    [12] OSBLOGO 3D75 A762 50000000 250F0h
    [13] OSBLOGO 006C 3CDA 00000000 28E80h
    [14] USBCORE 1B86 15FF E0000000 28F00h
    [15] ACPIROM 0A3B C068 E6000000 2AAA0h
    [16] ACPIDSDT 25C2 D247 40000000 2B540h
    [17] BIOS SCU 3C62 5A3E 30000100 2DB20h
    [18] PM PM 8B12 6C39 A0001510 317A0h
    [19] PM PM 10AD 7CB2 00000000 3A2F0h
    [20] PCI BIOS 259B 5895 E7000000 3B3C0h
    [21] PNP BIOS 370D 0491 E7004000 3D990h
    [22] SYSBIOS A129 3F6C F0000000 410E0h
    [23] SYSBIOS 2A74 AD30 00000000 4B260h
    [24] CBBOOT 05AA 664F 7000F000 4DCF0h
    [25] PXEBIOS 726B 28B6 D4000000 4E2B0h
    [26] EXTOEM 10DA D254 E0004000 55530h



    "InsyDeco" can be downloaded here :
    (I could only unpack it with "Easy 7 Zip". "Winrar" and "7-Zip" failed!)

    http://http://www.filedropper.com/insydeco01



    The "Advanced BIOS Logo Reader" can still be downloaded here :
    (even with parts of the source code)


    http://biosgfx.narod.ru/v3/
     
  11. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    Its not working with my Insyde BIOS, so good luck to everyone else from 2004.
     
  12. quid

    quid MDL Senior Member

    Oct 22, 2010
    335
    382
    10
  13. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    #13 itsmemario1, Dec 2, 2016
    Last edited: Dec 2, 2016
    (OP)
    A COMPAL BIOS tool from 2004, holy s**t... :O


    One version is by Jessica Hsieh (BIOS DM Compal)
    (mentioned in the screenshots in the info text)

    https://hk.linkedin.com/in/jessica-hsieh-051479119



    Your version is made by Vanessa Chen, BIOS Engineeer at Compal

    https://kr.linkedin.com/in/vanessa-chen-5bab6480


    1st of all thanks for posting this !

    I will try it at the weekend, but I have a bad feeling about the Acer/Insyde "compression"
    that is probably still present.

    Anyway, better then no reply at all. :tasty:



    The "coolest" thing for now is, that the IMAGE.CFG file has this special word IMAG001 inside ahe insyde :D
    That cant be a coincidence...

    DL17 Tool IMAG001.jpg
     
  14. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    #14 itsmemario1, Dec 4, 2016
    Last edited: Dec 4, 2016
    (OP)
    The PRELOC.EXE from the PCX2CHB folder is an Insyde Tool.

    preloc insyde.jpg

    It will only run in DOS mode using 32bit Windows (XP).

    It cannot open my BIOS files, nor does it even detect SLP...the screen blinks for a second and shows nothing, but C:\ again, when using the desired commandline parameter.

    The CF.EXE has info about COMPAQ and 2 exe files enlisted: prepare.exe and bmp2pgx.exe
    (missing form the archive)


    The txt file also says:
    2. SLP Location: FE00:0660 (INVESTRONICA).

    CF.EXE lists "Compal Inc."s SLP as F000:FA00.

    Investronica does industry machinery... (?)

    And Vincent Chen is inside the CF.EXE as well. Senior Manager at Compal...if thats him.




    CF.EXE initializes LZINT to compress...all I found for that is :

    2008-11-09: phnxsplit - new Phoenix BIOS structure (sourcebased on phnxdeco, uses its lzint decompression routine). Very dumb tool similar to what phnxdeco was for older Phoenix BIOS structure. The result cannot be considered complete, but you get the modules and if you're good enough, you can modify them and inject back to original ROM. There are also new tools fp.exe/fi.exe instead of prepare.exe/catenate.exe. Find them perhaps in any Lenovo BIOS update for recent machine
    http://www.endeer.cz/bios.tools/


    InsyDeco decompressor is made by the same guy as the tool "phnxdeco", from the link above...same interface...
    Mister Anton Borisov / Anthony Borisow...I tried the various emails from 2004 to get in contact with him.

    phnxsplit.exe does at least say "DONE" when using it with my BIOS files...but the files stay exactly the same.

    Hmmkay, this is all very confusing and interesting at the same time to me right now,
    as I dont have a fitting BIOS that could be at least tested with these tools, to be able to compare it with mine.

    Anyone ? ^^
     
  15. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    #15 itsmemario1, Dec 14, 2016
    Last edited: Dec 14, 2016
    (OP)
    I compared file entry and exit points of the files I "extracted" from the ROM.

    Which would be :
    -PXEBIOS1 (24kb)Pre Boot Execution Environment
    -PXEBIOS
    (25kb) " "
    -VGABIOS
    (45kb) VGA Bios
    -BIOS SCU (20kb) Storage Control Unit (?)
    -DISPSEG
    (8kb) (?)
    -BOOTMSG
    (1kb) Text while booting
    -F12MSG (2kb) Press F2 for Setup or F12 for Boot Order
    -IMAG001 (31kb) A 16 color Acer logo
    -OSBLOGO (7kb) A 4 color Intel Centrino Logo
    -USBCORE (10kb) USB
    -ACPIROM (3kb) ACPI
    -ACPIDSDT (10kb) APCI Differentiated System Description Table
    -EXTOEM (3kb) (?)
    -SCU SRVR (10kb) Storage Control Unit Server (?)
    -PM PM
    (10kb) Power Management Core ?
    -PCI BIOS (12kb) PCI
    -PNP BIOS (10kb) Plug'n Play
    -SYSBIOS (43kb) System
    -CPOEM (3kb) (?)

    -ABOCUS
    (? kb) - (?)
    found only Entry Point, as the table that enlists all options is inbetween abocus and crisis

    -CRISIS
    (? kb) -Crisis Recovery
    found only Entry Point


    All have the same file "entry points" FF 88 filename 0C 88 and all end with different amount of FF FF FF FF



    You can download my "extracted" files with this archive if you like :

    http://www.filedropper.com/extractedbiosoptions


    Entry Points.jpg


    exit points.jpg



    ACPIROM has clear text at the beginning for example :
    acpirom text.jpg

    It does so look like lza/lzh/zip compression...but I cant find entry points :

    lzh zip compression intel.jpg

    The splashscreen is probably 1920x1080...not sure...

    foto splashscreen.jpg



    p.s.
    Found 7 times a tar.z header..."1F 9D"...could be a coincidence as I cant unpack them usign tartool.exe (Illegal characters found and/or "cannot be less then zero")
     
  16. itsmemario1

    itsmemario1 MDL Senior Member

    Sep 10, 2012
    256
    21
    10
    #16 itsmemario1, Dec 14, 2016
    Last edited: Dec 16, 2016
    (OP)
    Found another guy with nearly the same Insyde BIOS for his TOSHIBA Laptop :

    https://forums.mydigitallife.net/threads/24686-Uneditable-Insyde-Bios-not-H2O-(Maybe-MobilePro-)


    Exactly the same Bootloader 1.00.3 05/18/04

    Exactly the same Boot Block 1.00. 11/03/00

    But of course different file header per file "EE 88"... :beee:

    Probably no encrpytion no compression as it is 1 megabyte ROM.
    Maybe someone finds this usefull...

    His laptop has same CPU, Pentium M 760 / 2GHz,
    but intel GMA 915 instead of Ati Mobility X700


    The "best" part is, the Insy "Decompression" tool does work with this BIOS :

    insydeco toshi.jpg

    and unpacks it :

    insydeco toshi2.jpg


    Also Advanced BIOS Logo Reader can read all files from it :

    Advanced Bios Logo Reader works.jpg


    PCX (8-bit, RLE) 256 colors

    *sigh*

    So how to unpack this baby to make it become 1mb...


    Any help is appreciated. You can downlaod the readable ROM here :

    http://www.filedropper.com/1_26