Intel DB85FL firmware corruption

Discussion in 'PC Hardware' started by johnkeates, May 28, 2016.

  1. johnkeates

    johnkeates MDL Novice

    Oct 2, 2009
    39
    8
    0
    Hi there, I have a DB85FL board which seems to have a crappy/broken bootblock/UEFI boot rom. There are two SPI flash chips on the board, which I can desolder etc, to read and write them. I also have an Intel BIO file which (amongst other stuff) contains the firmware image. Now, here is the obvious problem: the firmware file is intended for the UEFI firmware upgrade process which does all sorts of neat things like preserving MAC addresses, serial numbers, maybe upgrading some configurations etc, and it's of course not just a flash dump you can put in to an SPI chip and boot from.

    Now, I'm not sure how to go about fixing this; i'd either need someone else's raw dump, edit the MAC/Serial data and flash it to the flash chip(s), or I'd need to figure out how to get the raw flash data out of the BIO file from Intel and put that into the SPI chip... anyone have any ideas?
     
  2. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,695
    15,679
    340
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. johnkeates

    johnkeates MDL Novice

    Oct 2, 2009
    39
    8
    0
    #3 johnkeates, May 29, 2016
    Last edited: May 29, 2016
    (OP)
    Yes, just to be sure, tried again with different USB drive, one with a status LED, and it's not blinking like it's not being accessed. Because I'm curious as to what's wrong with the board, I ordered a new CPU (just a cheap Pentium G-series) and new DDR3 RAM, just to see what happens or if anything changes. Already have enough PSU's to swap.

    Just to be sure, the generic procedure:

    - Remove BIOS jumper
    - Plug in FAT32 formatted MBR USB stick into a USB2 port with the BIO recovery file on it
    - Plug in power
    - Turn on system

    Left it for about 30 minutes, nothing happened. Power LED is on on the motherboard front panel header (as well as the +5vsb Power_Good LED). fan spins, but there are no beeps, no video output and no USB activity.
     
  4. johnkeates

    johnkeates MDL Novice

    Oct 2, 2009
    39
    8
    0
    #5 johnkeates, May 30, 2016
    Last edited by a moderator: Apr 20, 2017
    (OP)
    I thought the Intel BIO flash files weren't directly writable? Or is that exactly what the internal EFI flasher is doing. I'll simply desolder the chips and hook them up to a TUMPA or Pi, done that before for many SPI SOIC's (this board has 2x 8 pin SOICs). Not sure if this board has an A-B rom construction or if one is for something else... I'll just dump both and check back.

    A quick binwalk:

    Code:
    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------
    324           0x144           Certificate in DER format (x509 v3), header length: 4, sequence length: 679
    1749          0x6D5           LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 9248772 bytes
    3976557       0x3CAD6D        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 5754884 bytes
    6834376       0x6848C8        Microsoft executable, portable (PE)
    6893936       0x693170        Microsoft executable, portable (PE)
    6900940       0x694CCC        Microsoft executable, portable (PE)
    7055120       0x6BA710        Microsoft executable, portable (PE)
    7063428       0x6BC784        Microsoft executable, portable (PE)
    7067784       0x6BD888        Microsoft executable, portable (PE)
    7070768       0x6BE430        Microsoft executable, portable (PE)
    7072024       0x6BE918        Microsoft executable, portable (PE)
    7074192       0x6BF190        Microsoft executable, portable (PE)
    7085415       0x6C1D67        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
    7085836       0x6C1F0C        Microsoft executable, portable (PE)
    7091968       0x6C3700        Microsoft executable, portable (PE)
    7095424       0x6C4480        Microsoft executable, portable (PE)
    7102280       0x6C5F48        Microsoft executable, portable (PE)
    7104840       0x6C6948        Microsoft executable, portable (PE)
    7112184       0x6C85F8        Microsoft executable, portable (PE)
    7115108       0x6C9164        Microsoft executable, portable (PE)
    7134872       0x6CDE98        Microsoft executable, portable (PE)
    7139392       0x6CF040        Microsoft executable, portable (PE)
    7163272       0x6D4D88        Microsoft executable, portable (PE)
    7166080       0x6D5880        Microsoft executable, portable (PE)
    7169352       0x6D6548        Microsoft executable, portable (PE)
    7170800       0x6D6AF0        Microsoft executable, portable (PE)
    7177500       0x6D851C        Microsoft executable, portable (PE)
    7194528       0x6DC7A0        Microsoft executable, portable (PE)
    7196792       0x6DD078        Microsoft executable, portable (PE)
    7198008       0x6DD538        Microsoft executable, portable (PE)
    7232272       0x6E5B10        Microsoft executable, portable (PE)
    7253444       0x6EADC4        Microsoft executable, portable (PE)
    7268840       0x6EE9E8        Microsoft executable, portable (PE)
    7301520       0x6F6990        Microsoft executable, portable (PE)
    7304876       0x6F76AC        Microsoft executable, portable (PE)
    7308016       0x6F82F0        Microsoft executable, portable (PE)
    7311224       0x6F8F78        Microsoft executable, portable (PE)
    7313940       0x6F9A14        Microsoft executable, portable (PE)
    7315340       0x6F9F8C        Microsoft executable, portable (PE)
    7317920       0x6FA9A0        Microsoft executable, portable (PE)
    7319112       0x6FAE48        Microsoft executable, portable (PE)
    7321784       0x6FB8B8        Microsoft executable, portable (PE)
    7323424       0x6FBF20        Microsoft executable, portable (PE)
    7334360       0x6FE9D8        Microsoft executable, portable (PE)
    7340312       0x700118        Microsoft executable, portable (PE)
    7355552       0x703CA0        Microsoft executable, portable (PE)
    7358688       0x7048E0        Microsoft executable, portable (PE)
    7418248       0x713188        Microsoft executable, portable (PE)
    7425252       0x714CE4        Microsoft executable, portable (PE)
    7579432       0x73A728        Microsoft executable, portable (PE)
    7587740       0x73C79C        Microsoft executable, portable (PE)
    7592096       0x73D8A0        Microsoft executable, portable (PE)
    7595080       0x73E448        Microsoft executable, portable (PE)
    7596336       0x73E930        Microsoft executable, portable (PE)
    7598504       0x73F1A8        Microsoft executable, portable (PE)
    7609727       0x741D7F        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
    7610148       0x741F24        Microsoft executable, portable (PE)
    7616280       0x743718        Microsoft executable, portable (PE)
    7619736       0x744498        Microsoft executable, portable (PE)
    7626592       0x745F60        Microsoft executable, portable (PE)
    7629152       0x746960        Microsoft executable, portable (PE)
    7636496       0x748610        Microsoft executable, portable (PE)
    7639420       0x74917C        Microsoft executable, portable (PE)
    7659184       0x74DEB0        Microsoft executable, portable (PE)
    7663704       0x74F058        Microsoft executable, portable (PE)
    7687584       0x754DA0        Microsoft executable, portable (PE)
    7690392       0x755898        Microsoft executable, portable (PE)
    7693664       0x756560        Microsoft executable, portable (PE)
    7695112       0x756B08        Microsoft executable, portable (PE)
    7701812       0x758534        Microsoft executable, portable (PE)
    7718840       0x75C7B8        Microsoft executable, portable (PE)
    7721104       0x75D090        Microsoft executable, portable (PE)
    7722320       0x75D550        Microsoft executable, portable (PE)
    7756584       0x765B28        Microsoft executable, portable (PE)
    7777756       0x76ADDC        Microsoft executable, portable (PE)
    7793152       0x76EA00        Microsoft executable, portable (PE)
    7825832       0x7769A8        Microsoft executable, portable (PE)
    7829188       0x7776C4        Microsoft executable, portable (PE)
    7832328       0x778308        Microsoft executable, portable (PE)
    7835536       0x778F90        Microsoft executable, portable (PE)
    7838252       0x779A2C        Microsoft executable, portable (PE)
    7839652       0x779FA4        Microsoft executable, portable (PE)
    7842232       0x77A9B8        Microsoft executable, portable (PE)
    7843424       0x77AE60        Microsoft executable, portable (PE)
    7846096       0x77B8D0        Microsoft executable, portable (PE)
    7847736       0x77BF38        Microsoft executable, portable (PE)
    7858672       0x77E9F0        Microsoft executable, portable (PE)
    7864624       0x780130        Microsoft executable, portable (PE)
    7879864       0x783CB8        Microsoft executable, portable (PE)
    7962960       0x798150        Microsoft executable, portable (PE)
    8225128       0x7D8168        Microsoft executable, portable (PE)
    8407341       0x80492D        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 14499844 bytes
    11550952      0xB040E8        Microsoft executable, portable (PE)
    14108928      0xD74900        Microsoft executable, portable (PE)
    14126152      0xD78C48        Microsoft executable, portable (PE)
    14149480      0xD7E768        Microsoft executable, portable (PE)
    14150560      0xD7EBA0        Microsoft executable, portable (PE)
    14152536      0xD7F358        Microsoft executable, portable (PE)
    14155408      0xD7FE90        Microsoft executable, portable (PE)
    14157576      0xD80708        Microsoft executable, portable (PE)
    14159712      0xD80F60        Microsoft executable, portable (PE)
    14165132      0xD8248C        Microsoft executable, portable (PE)
    
    Not sure if that means the BIOS simply has some code at the front to jump or if it's a firmware package and not a flash bin file...




    Okay, so I desoldered both SPI chips, read them a few times to make sure I had no read errors (checksummed all outputs and they were the same), and both seem fine to me. One is a standard "Intel serial flash for PCH ROM" (even `file` knows about that magic header), 8MBytes (64Mbit), the other one is 4Mbytes and contains a bunch of EFI programs and encrypted/signed data.

    Put everything back together, nothing changed so it hasn't gotten 'worse' but still doesn't actually do anything either.

    When I but the board back in to a chassis, I noticed next to the nuvoton I/O controller there's another small SPI flash rom, only 24Mbit or something like that, hard to read the number on it, but definitely a 24C from Winbond. Wonder what's in there... might just be for the I/O controller.

    My next best guess would be something wrong with the clock generator or reset line to the CPU as it doesn't seem to start at all, but I don't know where to measure/check that. Also checked out all caps as they are those crappy CapXon brand, but they all measure fine. I wish there was more information on this board online, like maybe schematics or a boardview, it's a brand new out-of-the-box board (yes, it's a few generations old in terms of specs, I know) but nobody seems to have looked into getting any 'secret' data on it :confused: