Tool to Insert/Replace SLIC in Phoenix / Insyde / Dell / EFI BIOSes

Discussion in 'MDL Projects and Applications' started by andyp, Nov 26, 2009.

  1. andyp

    andyp SLIC Tools Author

    Aug 8, 2008
    1,673
    2,570
    60
    Yes thanks.
    Contains a split ID with the second '4' of 4+2+4+4 being in code and not just MOV EAX,xxxxxxxx
    Anyway 1.23 can do

    Thanks for letting me know about this,
    Andy

    PS Let me know if it works!
     
  2. b166er

    b166er MDL Junior Member

    Sep 9, 2009
    71
    1
    0
    Thanks alot Andy.

    I decided to go with the BIOS openfly linked to as it has exactly the correct SLIC for this machine.
    Are you still cooking 1.23? I could try it when it is ready.
    Is there any way to test a BIOS without flashing it?

    A few pages back, a couple of people asked about modding an old Dell BIOS for a PowerEdge 2600. Do you think that would be possible at any point?

    You say 'Thanks for letting me know about this'
    I say :worthy::worthy::worthy::worthy: :biggrin:


    PS: Will we be able to modify the SLP1 entry with your tool at some point?
     
  3. TophrHwk

    TophrHwk MDL Novice

    Feb 13, 2010
    6
    2
    0
    Andy,

    Thanks for the update! I am hopeful that apokrif and you can make the appropriate modifications to the decompression algorithm and PhoenixTool to accomodate the PowerEdge 2850. W2K8 (x86 and x64) runs great as one would expect from a "one model back" platform. It's unfortunate that the BIOS packaging is non-standard. :(
     
  4. RandomUser

    RandomUser MDL Novice

    Mar 16, 2009
    34
    6
    0
    Okay, it showed the XSDT as Dell in Everest like any normal BIOS would. I would like to know how you got around or disabled the BIOS lock? In case I encounter more of these BIOS.
    Any way, as you requested the results in the attachment, Before and After SLIC Dumps. As well as an RW-Everything report. It appears that I was using v2.0 SLIC for Lenovo, and I thought it was v2.1.
    I almost forgot to tell that the SLIC Dumps was taken from the tool modded BIOS, as that last BIOS I flashed before the Dell SLIC one. Do you need the SLIC Dump of the original Factory BIOS? If you do, then I will have to re-flash that BIOS again.
    again I am interested on how you did this, or does the tool handles this operation?
    Thanks.
     
  5. andyp

    andyp SLIC Tools Author

    Aug 8, 2008
    1,673
    2,570
    60
    #528 andyp, Feb 21, 2010
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Hi

    Did my custom one activate windows then??

    I noticed this:

    Code:
    seg000:F917                 sub     ebx, 176h
    seg000:F91E                 add     ebx, 24h ; '$'
    seg000:F922                 mov     edi, ebx
    seg000:F925                 push    ds
    seg000:F926                 push    offset unk_0
    seg000:F928                 pop     ds
    seg000:F929                 mov     esi, 0FFFE8000h
    seg000:F92F                 mov     ecx, 152h
    seg000:F935
    seg000:F935 loc_F935:                               ; CODE XREF: seg000:F942j
    seg000:F935                 mov     al, [esi]
    seg000:F938                 xor     al, 36h
    seg000:F93A                 mov     es:[edi], al
    seg000:F93E                 inc     esi
    seg000:F940                 inc     edi
    seg000:F942                 loop    loc_F935
    seg000:F944                 pop     ds
    seg000:F945                 retn
    
    Which copies 338 (SLIC size - header) from FFFE8000 - which happens to be the offset in memory of USER00.ROM module - which is 338 bytes in size!!!

    So in Hex Workshop I copied the last 338 bytes (pubkey+marker) of the Dell SLIC - XOR'd with 36h (Tools menu) and saved as USER00.ROM with the BIOS

    Then
    Run the tool
    Select other as manufacturer
    Options -> tick only alter RSDT/XSDT tables
    Untick replace all oem/table id occurences
    tick allow user to modify other modules
    MOD
    When the dialog box prompts to replace modules replace the USER00.ROM in the DUMP directory with the one you made earlier.
    Continue and finish

    Done!
    Andy
     
  6. andyp

    andyp SLIC Tools Author

    Aug 8, 2008
    1,673
    2,570
    60
    Hi

    - Only way to really test is to flash!
    - Am looking at older Dells currently
    - SLP1 is actually very difficult for phoenix. I may add later on.

    Andy
     
  7. Manuito

    Manuito MDL Novice

    Feb 20, 2010
    1
    0
    0
    Hi,

    This may be a stupid question (my apologies), but I cannot find a direct answer for it (at least for beginners, as I don't completely understand what it is said in the first post).

    I have a Clevo M860TU with a Phoenix BIOS (version 1.02.16), which has got the SLIC 2.1 version. Now, my question is: would I still have to flash my BIOS (I read something about updating the bootblock? what's that?), or do I just need to flash the SLIC part of it and upload a proper key for my Windows 7? If I can just update the SLIC part of it, would it be dangerous to overwrite what is already written by my manufacturer in the SLIC? Should I back it up before changing it?

    Thanks very much!
     
  8. bennie

    bennie MDL Novice

    Oct 2, 2009
    7
    0
    0
    Thanks Andy for your good work.
    I was able to flash my bios from my old inspiron 9300 laptop from 2005 wich came with no slic in it.
    now it shows slic 2.1 but it did'nt activate windows 7. i used your 1.21 tool for this.I noticed some strange lines in the log
    You will see some older entries that you wont find in newer dell bios
    see for the tekst ACRSYSACRPRDCT in newer bios i can only find the name Dell for this so i think these lines prevent my bios to activating windows 7
    It yust is a tought of my i'am not a expert yust someone that is interested in possible solutions.If i am wrong than i hope that yure 1.23 tool do the trick for me.
    Your 1.22 version gives me a Not enough space in RSDT table.

    Original BIOS size 1048668 bytes
    Checksum found at 100054
    0 extra bytes at end
    $RBUT at 0
    Block at 54
    Block at 60054
    Header pattern 14
    Block at 54
    End of block reached early
    Block at 60054
    60054 Module 01 Size 33759
    68438 Module 0E Size 16082
    6C30F Module 03 Size 26815
    72BD3 Module 04 Size 7812
    74A5C Module 05 Size 70399
    85D60 Module 07 Size 5571
    87328 Module 08 Size 16902
    8B533 Module 12 Size 759
    8B82F Module 10 Size 2610
    8C266 Module 3A Size 2086
    8CA91 Module 3C Size 1502
    8D074 Module 38 Size 2389
    8D9CE Module 42 Size 1888
    8E133 Module 11 Size 2962
    8ECCA Module 3B Size 2024
    8F4B7 Module 3D Size 1315
    8F9DF Module 39 Size 2237
    902A1 Module 43 Size 1771
    90991 Module 13 Size 16734
    94AF4 Module 14 Size 21498
    99EF3 Module 15 Size 5720
    9B550 Module 0F Size 26901
    A1E6A Module 16 Size 185
    A1F28 Module 17 Size 182
    A1FE3 Module 18 Size 46525
    AD5A5 Module 46 Size 21063
    SLIC module size is 374 bytes
    SLIC module checksum is 0
    Parsing RW Everything report for OEM/Table IDs
    RSDT OEM/Table ID is ACRSYSACRPRDCT
    FACP OEM/Table ID is DELL CPi R
    APIC OEM/Table ID is DELL CPi R
    MCFG OEM/Table ID is DELL CPi R
    BOOT OEM/Table ID is DELL CPi R
    SLIC OEM/Table ID is ACRSYSACRPRDCT
    SLIC table from RW Everything report parsed
    OEM/Table IDs identified are:
    1. ACRSYSACRPRDCT
    2. DELL CPi R
    OEM/Table IDs identified are:
    1. ACRSYSACRPRDCT
    2. DELL CPi R
    RSDT table header found in 08_7.ROM
    ** RSDT table OEM and Table ID patched to DELL QA09
    Updated 08_7.ROM written
    DELL CPi R string found in 08_7.ROM at 4DE7 in FACP table (from report)
    DELL CPi R string found in 08_7.ROM at 4E5B in APIC table (from report)
    DELL CPi R string found in 08_7.ROM at 4EC3 in BOOT table (from report)
    DELL CPi R string found in 08_7.ROM at 4F8B in MCFG table (from report)
    Not enough space in RSDT table
    RSDT size patched at 4CE6
    SLIC address F0080 inserted into RSDT
    SLIC inserted at 80
    Module 8 at 87328 reinserted
    Module 1 at 60054 reinserted
    Checksum at 100054 corrected
    HDR checksum corrected
    HDR compressed as bios.gz
    HDR reintegrated into BIOS
    SLIC performed successfully. BIOS file is G:\DOWNLOADS\A05I9300_SLIC.EXE

    I hope your able to do something for the older Dell models


    Ben
     
  9. andyp

    andyp SLIC Tools Author

    Aug 8, 2008
    1,673
    2,570
    60
    Hi

    Can I have a BIOS Link, a RW report (from before) and a SLIC Dump Toolkit (Advanced tab) screendump (from after).

    Andy

     
  10. andyp

    andyp SLIC Tools Author

    Aug 8, 2008
    1,673
    2,570
    60
    1.23 released

    Handles older dells better
    Also fixes a few bugs I have posted about as they have arisen.

    Thanks
    Andy
     
  11. RandomUser

    RandomUser MDL Novice

    Mar 16, 2009
    34
    6
    0
    #534 RandomUser, Feb 22, 2010
    Last edited by a moderator: Apr 20, 2017
    Thank you sooo much. It works Windows 7 Activated just fine. Sorry for the late reply, I had some speed bumps in installing Windows 7 which is actually Windows NT 6.1.

    I understood until to the red part:
    So in Hex Workshop I copied the last 338 bytes (pubkey+marker) of the Dell SLIC - XOR'd with 36h (Tools menu) and saved as USER00.ROM with the BIOS
    How do I XOR the file (is it the USER00.ROM file?) and with what tool, can't seem to find that option in Phoenix Tool. Also you mentioned copying the last 338 bytes of the Dell SLIC, but did not mentioned where to paste them to, I am thinking USER00.ROM file perhaps?
    Sorry for so many questions, but I like to learn so that I may be able to do this on my own if I encounter another BIOS like this, unless if the future version of Phoenix Tool is going to automate this process.
    Again Thanks so much.
    I also found out that if I were to replace the default boot logo with my own, the BIOS SLIC breaks and Windows deactivates, but when I reuse your modded BIOS without modifying the boot logo, Windows reactivates no problem.
     
  12. Russtavo

    Russtavo MDL Junior Member

    Feb 5, 2008
    94
    11
    0
    #535 Russtavo, Feb 22, 2010
    Last edited by a moderator: Apr 20, 2017
    Hey Andy,

    Don't know if this is useful to you, but I tried 1.23 with that old PowerEdge 700 package (after manually setting the memory properties) and the error I get is:

    Code:
    Original BIOS size 524380 bytes
    Checksum found at 80054
    Unable to find GZIP header
     
  13. andyp

    andyp SLIC Tools Author

    Aug 8, 2008
    1,673
    2,570
    60
    Get a copy of Hex Workshop
    Load a SLIC
    Copy the last 338 bytes of the desired SLIC
    Create new file
    Paste into a new file
    Select Tools -> Operations -> XOR
    Set Treat data as 8 bit unsigned byte, ensure Hex is selected and apply on entire file is selected
    Enter 36h in the value textbox and click OK
    Save the file as USER00.ROM (not in the DUMP directory as this gets overwritten everytime the tool runs)
    Follow the other instructions and copy into DUMP directory (overwriting existing file) when the dialog box prompts you to.
    THat is also the right time to copy a custom logo file in.

    I will look at automating but it such a specific case.

    Andy

     
  14. andyp

    andyp SLIC Tools Author

    Aug 8, 2008
    1,673
    2,570
    60