[SOLVED] Where is the boot logo stored in an UEFI system?

The question is pretty straight forward, but I assure you its answer may be harder than it seems.

While trying to unlock the advanced menus of a BIOS for an Acer computer with an Insyde Rev. 5.0 firmware I came across what I thought they'd be the green on black Acer logo I see at boot time.

It was a PCX image, not a problem once you get any of the editing programs that support that kind of image *in the exact format* that was used, so I edited it and replaced it in the BIOS with the help of UEFITool.

Much to my surprise, after flashing the newly edited ROM either via FPT or an SPI programmer I noticed no change. I still saw the same image with the Acer letters written in green black. So I though, maybe there's something preventing them from being loaded? Or the format is different somehow?

The next step was to use one of the other logos that are also present in the BIOS image, namely for PackardBell and Gateway systems. I replaced the Acer ones with the equivalent of those and repeated the operation. Same deal, green Acer logo instead of Gateway (I think I had chosen).

Some of the images are properly used, for example I modded the one that appears when there's no boot device available and that one did appear as intended... but it's not the boot logo.

So my next thought was, is the logo actually residing somewhere else than the BIOS ROM? Or compressed/encrypted of some sort? Looking for compressed data I couldn't find any section that matched known signatures, so there's that.

And then came another revelation, I decided to check the BIOSes of different Acer machines that also used Insyde BIOSes. And the results pretty much confirmed what I hoped wouldn't happen, the boot logo may not be inside the ROM after all or it's hidden as hell.

The one for the Predator PT515-52, the one for the Travelmate P214-52G (any, there were 2 ROM file for that machine) or for the Travelmate P614-51-G2 for example, were devoid of logo images! There were none! Not in PCX, not in JPEG, BPM, Targa, you name it, nada. Yet I'm sure all those machines display a custom Predator logo in one case or the green on black Acer one for the Travelmates, something in any case.


So, where does the UEFI logo actually reside? Is it even possible to get to it to edit it?


Funnily enough, the one for the Triton PT515-51 had several JPEGs with the Predator logo to be used as an animation! As if they were frames to be shown in succession at a given rate instead of a proper animated format.


And the purpose of this thread is to defer to you, BIOS editing gurus, if you have any experience on the matter and can shed a bit of light my way on how to tackle this. I'm just curious at this point, it's not that I'm looking for it to mod my BIOS (that too of course), but because of sheer curiosity.


Thank you for your time in reading all of this and regards to you all,
Kao.

 

That's for the reply @kaljukass!

They seem to be changing the logo directly off the Windows boot manager, which is nice for those who just want to see their custom logo at boot time; but I'm more interested in where it is stored, where it comes from. For example, I took apart my machine and I only saw an SPI chip in the motherboard, yet a in a full dump of it there were just the logos I could find through the BIOS dump. Maybe it's camouflaged there? Maybe it's part of a video BIOS or GOP or something?

I'll take a look at the code of the tool you linked me to, maybe there ir some reference there as to where the image comes from. *Sigh* wouldn't it be nice to have Windows's boot loader code or the one for the UEFI BIOS perfectly readable and structured?

Thanks!

 

You need to login to view this posts content.