made acer aspire 6930g 2.1 slic - but is it correct?

justinkb · Jul 30, 2009

lenovo (new process) PROS: acer aspire 6930g 2.1 slic mod done, need verification

I just made this mod, using the new Lenovo Phoenix bios method, but I'm hoping to get some feedback on whether I did it right, before I flash it. I will post exactly what I did as Yen did basically. Here goes:

First step (uncompressing .FL1 file) can be skipped, Acer bios is just .wph/.rom .

I decomposed it and started looking for OEMID and OEM TABLEID in the BIOSCODEXX.ROMs.

Found ACRSYSACRPRDCT in BIOSCODE02.ROM: Good news, since there is a 2.1 SLIC for that. So I downloaded that acer slic .BIN and made a .ROM from it using slic.bat. ACPI modules ranged from 00 to 04 after decompose, so I hexedited _A00 to _A05 and recalculated the first checksum. Saved .ROM

Went to end of last _A module in original .wph file, saved block from there till FF FF FF gap in seperate file block1.rom.

I then noted the size of the FF FF FF gap from its header and calculated the end (this was exactly at the last FF byte, so no romhole) then I inserted (overwriting, not actually inserting) the SLIC.ROM at the end of the last _A module. Then I inserted (again, overwriting...) block1.rom after the SLIC.ROM and corrected the size in the gap header so it corresponds with the end at that last FF byte. Last thing I did was correct the checksum of the gap header.

The final .wph file got processed OK by phnxsplit.exe as far as I can see. Anything I missed? I could post detailed hex blocks if it's needed.

Thanks for any help!

edit:

the only thing i'm not a 100% about is the placing of the ACPI SLIC module. I placed it after the last _A module, as instructed in the tutorial. However, there is a strange 'module' (?) after it, it has a proper header and everything.
Code:
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

000F46C0   87 84 59 D3 9B 25 53 27  E7 CA 75 65 CF 0E 40 C9   ‡„YÓ›%S'çÊueÏ.@É
000F46D0   3B AA 03 F2 83 7E 27 E7  CA 47 A4 4B 1F C5 77 DF   ;ª.òƒ~'çÊG¤K.Åwß
000F46E0   8C F8 00 BC 3D 48 00 00  06 53 33 52 65 73 75 6D   Œø.¼=H...S3Resum
000F46F0   65 FF 00 00 00 00 00 00  00 16 00 00 1B 02 F5 6E   eÿ............õn
000F4700   B8 2A B5 EC 34 41 B5 56  38 54 CA 1F E1 B4 08 1A   ¸*µì4AµV8TÊ.á´..
000F4710   00 00 C4 30 30 30 30 30  30 32 31 00 00 00 00 00   ..Ä00000021.....
000F4720   00 00 00 46 8D E2 FF 03  00 F8 00 B3 18 48 00 00   ...Fâÿ..ø.³.H..
000F4730   06 4C 6F 61 64 46 69 6C  65 FF 00 00 00 00 00 00   .LoadFileÿ......
in the tutorial there is a _L module after the last _A module. not so for me. will it be a problem? i dont think so,
but i would like some verification from Yen maybe before i brick my laptop's mobo of course the module marked in
blue has the same issue... notice the 06 bytes in both cases. Yen only mentions 01, 02 or F0 as possibilities for that byte.

justinkb · Jul 31, 2009

bumped with more info... it seems WinPhlash.exe has a problem with this file. Right before it starts flashing I get an access violation.

justinkb · Jul 31, 2009

You need to login to view this posts content.

Yen · Jul 31, 2009

Does latest Phoenix Bios editor decompose your mod without errors?
Unfortunately I cannot download here from file sharing providers. If you give me the original link from acer I can have a look right now...have to see that strange module.

Btw: Good work so far!

justinkb · Jul 31, 2009

You need to login to view this posts content.

Yen · Jul 31, 2009

I have here only restricted posibilities to check...
The block to save from offset F4553-F469E should be OK. I did some acer ext. successfully that way so it should work for you also.

Write your acpi module at offset F4553, append again saved block1.rom, correct gap size and gap header sum. Gap ends right before NAPI string at 17FFFF.
This sounds very familiar to me

Btw:

Phoenix.rom + platform.bin = Phoenix.wph

Try to cut the first 200000h bytes to a separate file and try to open with PBE again....

It should work that way, re-check your sums......

justinkb · Jul 31, 2009

Yen said: ↑

I have here only restricted posibilities to check...
The block to save from offset F4553-F469E should be OK. I did some acer ext. successfully that way so it should work for you also.

Write your acpi module at offset F4553, append again saved block1.rom, correct gap size and gap header sum. Gap ends right before NAPI string at 17FFFF.
This sounds very familiar to me

Btw:

Phoenix.rom + platform.bin = Phoenix.wph

Try to cut the first 200000h bytes to a separate file and try to open with PBE again....

It should work that way, re-check your sums......
Click to expand...

what you said above is exactly how i did it, but winphlash doesnt accept the file... (access violation right before flash begins.. note! bios backup works so hardware can be accessed, i use 32bit usb windows boot image)

how would i do the mod using PBE? is it possible from scratch? opening in PBE worked after cutting first 200000h bytes, thats a start

ps i will post hex blocks so you can see if i did checksum fixes right. will take a few minutes

justinkb · Jul 31, 2009

SLIC.MOD original:

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   F8 00 71 00 8E 01 00 01  5F 41 30 30 00 00 00 00   ø.q.Ž..._A00....
00000010   FF 00 00 00 00 00 00 00  53 4C 49 43 76 01 00 00   ÿ.......SLICv...
00000020   01 3E 41 43 52 53 59 53  41 43 52 50 52 44 43 54   .>ACRSYSACRPRDCT
00000030   01 00 00 00 41 4E 4E 49  01 00 00 00 00 00 00 00   ....ANNI........
00000040   9C 00 00 00 06 02 00 00  00 24 00 00 52 53 41 31   œ........$..RSA1
00000050   00 04 00 00 01 00 01 00  B3 6D 83 60 8D 83 65 6E   ........³mƒ`ƒen
00000060   E6 4B A7 6F 38 04 31 C1  E2 45 BF 34 66 1F 17 91   æK§o8.1ÁâE¿4f..‘
00000070   7F 5C 15 12 B7 01 4D 57  6D 8E AE 6B E4 CC F8 A0   \..·.MWmŽ®käÌø*
00000080   E1 BB 79 FF 08 53 E3 77  E7 D4 70 5E 5C EF 6F 81   á»yÿ.SãwçÔp^\ïo
00000090   DD 1B 5F 30 E2 99 9B B9  D0 93 46 AB D8 17 7A E0   Ý._0â™›¹Ð“F«Ø.zà
000000A0   F0 A7 4C 32 D4 91 86 BA  A1 6C A2 3C 73 CF 86 2D   ð§L2Ô‘†º¡l¢<sÏ†-
000000B0   95 9A 06 50 F3 F7 7E 06  5B 5E 27 66 01 3A 31 9F   •š.Pó÷~.[^'f.:1Ÿ
000000C0   0C B1 91 96 49 5C CC 81  BA 77 32 52 B2 10 5D 5B   .±‘–I\Ìºw2R².][
000000D0   CA DE 9D 25 90 95 F7 97  01 00 00 00 B6 00 00 00   ÊÞ%•÷—....¶...
000000E0   00 00 02 00 41 43 52 53  59 53 41 43 52 50 52 44   ....ACRSYSACRPRD
000000F0   43 54 57 49 4E 44 4F 57  53 20 01 00 02 00 00 00   CTWINDOWS ......
00000100   00 00 00 00 00 00 00 00  00 00 00 00 00 00 49 90   ..............I
00000110   AC 34 3B 98 88 52 62 2C  FB 25 A8 A9 A0 7D 2D 12   ¬4;˜ˆRb,û%¨©*}-.
00000120   70 EE D5 9A 7C CF 0C 83  B4 29 1B 55 3B 88 A5 F7   pîÕš|Ï.ƒ´).U;ˆ¥÷
00000130   E6 29 A9 2C E7 17 5D 7A  EE 38 4D 27 E0 A9 69 7C   æ)©,ç.]zî8M'à©i|
00000140   FC 20 4A 68 0B 5D 83 AD  E5 D6 6E 49 C1 66 28 E4   ü Jh.]ƒ*åÖnIÁf(ä
00000150   D4 CE 72 64 A1 7C BE 93  AD 64 32 DA CC 72 24 47   ÔÎrd¡|¾“*d2ÚÌr$G
00000160   FE B4 97 87 01 55 A0 5D  2F EF 06 93 E8 87 84 59   þ´—‡.U*]/ï.“è‡„Y
00000170   D3 9B 25 53 27 E7 CA 75  65 CF 0E 40 C9 3B AA 03   Ó›%S'çÊueÏ.@É;ª.
00000180   F2 83 7E 27 E7 CA 47 A4  4B 1F C5 77 DF 8C         òƒ~'çÊG¤K.ÅwßŒ

header after edit:

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   F8 00 6C 00 8E 01 00 01  5F 41 30 35 00 00 00 00   ø.l.Ž..._A05....
00000010   FF 00 00 00 00 00 00 00                            ÿ.......

more to follow...

justinkb · Jul 31, 2009

SLIC.MOD is 18Eh bytes, so gap shrunk by that much.

original gap header:

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

000F4810                  F8 00 D6  00 79 B9 08 F0 00 00 00        ø.Ö.y¹.ð...
000F4820   00 00 00 00 00 00 00 00  00 00 00 00 00            .............

8B979h - 18Eh = 8B7EBh, so new header becomes:

Code:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

000F4810                  F8 00 66  00 EB B7 08 F0 00 00 00        ø.f.ë·.ð...
000F4820   00 00 00 00 00 00 00 00  00 00 00 00 00            .............

Yen · Jul 31, 2009

I had no doubt that you did it right. You did it right.
Q: Does the cut mod open in PBE?

Suggestion: Try for another place. Probably the 'strage' module must remain its offset.

Try before info module: new block to save F462B-F469E, to inset at offset F462B....

justinkb · Jul 31, 2009

the cut mod opens in PBE... shows ACPI05.ROM exactly as expected...

Code:

Offset      0  1  2  3  4  5  6  7   8  9 10 11 12 13 14 15

00000000   53 4C 49 43 76 01 00 00  01 3E 41 43 52 53 59 53   SLICv....>ACRSYS
00000016   41 43 52 50 52 44 43 54  01 00 00 00 41 4E 4E 49   ACRPRDCT....ANNI
00000032   01 00 00 00 00 00 00 00  9C 00 00 00 06 02 00 00   ........œ.......
00000048   00 24 00 00 52 53 41 31  00 04 00 00 01 00 01 00   .$..RSA1........
00000064   B3 6D 83 60 8D 83 65 6E  E6 4B A7 6F 38 04 31 C1   ³mƒ`.ƒenæK§o8.1Á
00000080   E2 45 BF 34 66 1F 17 91  7F 5C 15 12 B7 01 4D 57   âE¿4f..‘.\..·.MW
00000096   6D 8E AE 6B E4 CC F8 A0  E1 BB 79 FF 08 53 E3 77   mŽ®käÌø*á»yÿ.Sãw
00000112   E7 D4 70 5E 5C EF 6F 81  DD 1B 5F 30 E2 99 9B B9   çÔp^\ïo.Ý._0â™›¹
00000128   D0 93 46 AB D8 17 7A E0  F0 A7 4C 32 D4 91 86 BA   Ð“F«Ø.zàð§L2Ô‘†º
00000144   A1 6C A2 3C 73 CF 86 2D  95 9A 06 50 F3 F7 7E 06   ¡l¢<sÏ†-•š.Pó÷~.
00000160   5B 5E 27 66 01 3A 31 9F  0C B1 91 96 49 5C CC 81   [^'f.:1Ÿ.±‘–I\Ì.
00000176   BA 77 32 52 B2 10 5D 5B  CA DE 9D 25 90 95 F7 97   ºw2R².][ÊÞ.%.•÷—
00000192   01 00 00 00 B6 00 00 00  00 00 02 00 41 43 52 53   ....¶.......ACRS
00000208   59 53 41 43 52 50 52 44  43 54 57 49 4E 44 4F 57   YSACRPRDCTWINDOW
00000224   53 20 01 00 02 00 00 00  00 00 00 00 00 00 00 00   S ..............
00000240   00 00 00 00 00 00 49 90  AC 34 3B 98 88 52 62 2C   ......I.¬4;˜ˆRb,
00000256   FB 25 A8 A9 A0 7D 2D 12  70 EE D5 9A 7C CF 0C 83   û%¨©*}-.pîÕš|Ï.ƒ
00000272   B4 29 1B 55 3B 88 A5 F7  E6 29 A9 2C E7 17 5D 7A   ´).U;ˆ¥÷æ)©,ç.]z
00000288   EE 38 4D 27 E0 A9 69 7C  FC 20 4A 68 0B 5D 83 AD   î8M'à©i|ü Jh.]ƒ*
00000304   E5 D6 6E 49 C1 66 28 E4  D4 CE 72 64 A1 7C BE 93   åÖnIÁf(äÔÎrd¡|¾“
00000320   AD 64 32 DA CC 72 24 47  FE B4 97 87 01 55 A0 5D   *d2ÚÌr$Gþ´—‡.U*]
00000336   2F EF 06 93 E8 87 84 59  D3 9B 25 53 27 E7 CA 75   /ï.“è‡„YÓ›%S'çÊu
00000352   65 CF 0E 40 C9 3B AA 03  F2 83 7E 27 E7 CA 47 A4   eÏ.@É;ª.òƒ~'çÊG¤
00000368   4B 1F C5 77 DF 8C                                  K.ÅwßŒ

i will try to put the slic in the other place

done now... same effect, loads in PBE too... im still wary to try with winphlash though.

justinkb · Jul 31, 2009

You need to login to view this posts content.

Yen · Jul 31, 2009

I'm still at work. Here I cannot check for the modules, but will do it when I'm back home.....

justinkb · Jul 31, 2009

ah of course , thanks very much

justinkb · Jul 31, 2009

update: i guess the problem was with my winphlash.exe or .ini... replaced entire folder on usb stick and now flashing worked.

BUT, i now have 2 SLIC tables in everest, one with ACRSYSACRPRDCT (2.0) and one with DELL QA09 (2.1) and windows 7 won't activate.

how do i kill the first one? i want to keep the dell one since there is no acer cert yet.

Yen · Jul 31, 2009

justinkb said: ↑

update: i guess the problem was with my winphlash.exe or .ini... replaced entire folder on usb stick and now flashing worked.

BUT, i now have 2 SLIC tables in everest, one with ACRSYSACRPRDCT (2.0) and one with DELL QA09 (2.1) and windows 7 won't activate.

how do i kill the first one? i want to keep the dell one since there is no acer cert yet.
Click to expand...

The activation algorithm doesn't allow 2 SLICs!
The solution: Mod it e.g. to SLAC and re-compress it using the Fi / FP tools at BIOSCODE04 folder of the L_Process tools. You just may rename it to BIOSCODE04.ROM. You have to watch for the new compressed size of the module. It will be located at the dummy bios.rom. Cut it, change the module ID to _B02, correct the sum at header.

Also you need to edit the address range where the OEMIDs are read.
Decompressed BIOSCOD2.ROM
Code:
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

0000E700   67 A4 1F 66 5E 66 5F 66  59 C3 53 4C 49 43 00 00   g¤.f^f_fYÃSLIC..
0000E710   00 00 01 00 4F 45 4D 49  44 5F 4F 45 4D 54 41 42   ....OEMID_OEMTAB
0000E720   4C 45 00 00 00 00 61 63  65 72 00 00 00 00 50 66   LE....acer....Pf
0000E730   53 51 57 66 56 9A 7B 47  00 F0 74 1B 67 66 3E 8B   SQWfVš{G.ðt.gf>‹
0000E740   75 04 E8 1A 00 67 66 3E  8B 75 0C E8 11 00 66 2E   u.è..gf>‹u.è..f.
0000E750   8B 36 BE E5 E8 08 00 66  5E 5F 59 66 5B 58 C3 66   ‹6¾åè..f^_Yf[XÃf
0000E760   33 DB BF 71 E7 2E 8A 01  67 88 44 33 0A 43 83 FB   3Û¿qç.Š.gˆD3.Cƒû
0000E770   0E 72 F2 C3 66 50 51 52  66 B8 09 00 00 00 B1 09   .ròÃfPQRf¸....±.
0000E780   BA 0D 00 E8 6E 04 F8 5A  59 66 58 C3 41 43 52 53   º..èn.øZYfXÃACRS
0000E790   59 53 41 43 52 50 52 44  43 54 F8 FF 38 00 58 00   YSACRPRDCTøÿ8.X.
0000E7A0   F9 FF 3C 00 58 00 FA FF  40 00 59 00 FB FF 44 00   ùÿ<.X.úÿ@.Y.ûÿD.
0000E7B0   59 00 FC FF 48 00 5A 00  FD FF 4C 00 5B 00 FE FF   Y.üÿH.Z.ýÿL.[.þÿ
SLIC to SLAC, ACRSYSACRPRDCT to
Code:
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000                                  44 45 4C 4C 20 20             DELL  
00000010   51 41 30 39 20 20 20 00                            QA09   .
Size 0xE

To fit compressed size play with strings here after SLIC header:
Code:
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

0000E710               4F 45 4D 49  44 5F 4F 45 4D 54 41 42       OEMID_OEMTAB
0000E720   4C 45 00 00 00 00 61 63  65 72                     LE....acer
Use space 0x20, recompress again, check size, edit again...and so on till it matches original compressed size 0xAA09 again...

I'm sure you make it...
This is what I'm doing all the time, trial and error, till size matches again..finally replace _B02 at your bios(mod), check with PBE by open it for errors and reflash, the SLAC table will be your old acer SLIC2.0 and is 'disabled'

After that you will be a qualified Phoenix modder...

justinkb · Jul 31, 2009

thanks very much for this, i'm gonna try it out

justinkb · Jul 31, 2009

well that was easier than expected... can you check if i did it right if i upload it? changing 'acer' to 'x ' worked for the compression

can you look at 1B000C in the wph file? it has 'ACRSYSACRPRDCTWINDOWS ' there too... is that supposed to be like that? it is in HOLE6.ROM if i open it in PBE.

Yen · Jul 31, 2009

justinkb said: ↑

well that was easier than expected... can you check if i did it right if i upload it? changing 'acer' to 'x ' worked for the compression

can you look at 1B000C in the wph file? it has 'ACRSYSACRPRDCTWINDOWS ' there too... is that supposed to be like that? it is in HOLE6.ROM if i open it in PBE.
Click to expand...

The mod is well done.

Some facts: The original SLIC is built of three parts:

-SLIC header at BIOSCOD2.ROM (which reads the OEMID from the place below)
-pubkey (RSA field) at MOD_4A08.ROM
-Marker data at HOLE6.ROM

Every marker contains the OEMID as well. They must match to them of the SLIC header in order to activate.

In our case it doesn't matter at all since we don't want a proper SLIC, but a disabled SLAC.

Annoying is that trial and error game. This way to mod is the best. It remains most offsets of the modules. PBE screws sometimes at rebuild the bios.
This is new style Phoenix bios. (_XX is typical for them)
There are also old style Phoenix (different structure)

I'm testing a tool that andyp programs. Hopefully one day we can mod within seconds that safe way....

Any questions?
I have to go in about 15 min.

Btw: Don't forget to copy and write back the rom before you flash.
My compliment you are a fast learner. I soon noticed that you are talented.

justinkb · Jul 31, 2009

Yen said: ↑

Btw: Don't forget to copy and write back the rom before you flash.
Click to expand...

you mean the platform.bin you said before? (bytes after 200000h) if not, what did you mean by that winphlash wont accept the file if those bytes arent added i think btw. otherwise no questions, thanks for all the help, i will go flash in a moment and report back... if i have any trouble i guess i will ask tomorrow if you are available then...

made acer aspire 6930g 2.1 slic - but is it correct?

justinkb MDL Member

justinkb MDL Member

justinkb MDL Member

Yen Admin
Staff Member

justinkb MDL Member

Yen Admin
Staff Member

justinkb MDL Member

justinkb MDL Member

justinkb MDL Member

Yen Admin
Staff Member

justinkb MDL Member

justinkb MDL Member

Yen Admin
Staff Member

justinkb MDL Member

justinkb MDL Member

Yen Admin
Staff Member

justinkb MDL Member

justinkb MDL Member

Yen Admin
Staff Member

justinkb MDL Member

made acer aspire 6930g 2.1 slic - but is it correct?

justinkb MDL Member

justinkb MDL Member

justinkb MDL Member

Yen Admin Staff Member

justinkb MDL Member

Yen Admin Staff Member

justinkb MDL Member

justinkb MDL Member

justinkb MDL Member

Yen Admin Staff Member

justinkb MDL Member

justinkb MDL Member

Yen Admin Staff Member

justinkb MDL Member

justinkb MDL Member

Yen Admin Staff Member

justinkb MDL Member

justinkb MDL Member

Yen Admin Staff Member

justinkb MDL Member

Yen Admin
Staff Member

Yen Admin
Staff Member

Yen Admin
Staff Member

Yen Admin
Staff Member

Yen Admin
Staff Member

Yen Admin
Staff Member