PDA

View Full Version : This is no request thread! HP COMPAQ bioses, how to modify the bios?



Pages : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 [29] 30 31 32 33 34 35 36 37 38

murdemon
06 Feb 2011, 02:22
some models like probook are affect by this problem, i've removed it from the list.
Are you interesed by WLAN or by WWAN whitelist removal, i can make a new release with only one of them.

Yes sure i am interesting with it.. better with WLAN.

TTAV134
06 Feb 2011, 03:32
Yes sure i am interesting with it.. better with WLAN.

it a very soft mod, only one byte changed, you will not have any "104-Unauthorized...." error message but i'm not sure that the WLAN will be detect.
let me know.

murdemon
06 Feb 2011, 04:00
i was check new one.. the same result bios not startup... when i flash original one with erompaq it is shutdown then i press power button it start for 3-5 sec. and then restart again (automaticly) and bios startup normaly. With moded bios it is not restart after first powerup.. look like bootloader check somethink (consistense) checksum or signatures... and forbiden to startup bios..

TTAV134
06 Feb 2011, 15:23
i was check new one.. the same result bios not startup... when i flash original one with erompaq it is shutdown then i press power button it start for 3-5 sec. and then restart again (automaticly) and bios startup normaly. With moded bios it is not restart after first powerup.. look like bootloader check somethink (consistense) checksum or signatures... and forbiden to startup bios..

May be something wrong in Bios reconstruction with AndyP tool.

murdemon
06 Feb 2011, 17:27
May be something wrong in Bios reconstruction with AndyP tool.
But when i decompress original firmware with PhonixTool and then compress it back without changes everithink is ok ... flashing and startup bios.

TTAV134
06 Feb 2011, 19:50
But when i decompress original firmware with PhonixTool and then compress it back without changes everithink is ok ... flashing and startup bios.

for a complete test you must make a change, compile, decompile result, undo the change and compile again then you can compare to the original!

note: I've just made this test above and the "redo" file is identical to the original one. The tool is not the cause of the issue.

The following test may be helpful, changing a useless byte and see the result:

in 5EE86B35-0839-4A21-8845-F1ACB0F688AB_3_155.ROM at address A00 change the "T" of the string "Text" to "t" , 54 to 74 in hexa.
compile and flash. let me know if the machine is bricked again.

murdemon
06 Feb 2011, 23:04
Yes it is bricked again... maybe i'm doing somethink wrong .. i open PhonixTool open original firm. bin file in advensed set to change other medule and no slic... then press go .. then in dump dir make changes and press ok in PhonixTool to recompile firm... everythink is correct? then put on dos flash with name 68DVA.BIN boot from flash start pached erompaq /! ... and then brick again... i check changing in comresed bin file with original ... it is changings comlicated because this module (recompressed) - maybe checksum for this module (5EE...) not corrected recalculated?

TTAV134
06 Feb 2011, 23:06
Yes it is bricked again... maybe i'm doing somethink wrong .. i open PhonixTool open original firm. bin file in advensed set to change other medule and no slic... then press go .. then in dump dir make changes and press ok in PhonixTool to recompile firm... everythink is correct? then put on dos flash with name 68DVA.BIN boot from flash start pached erompaq /! ... and then brick again... i check changing in comresed bin file with original ... it is changings comlicated because this module (recompressed) - maybe checksum for this module (5EE...) not corrected recalculated?

what you've done is correct. These bios don't accept to be modified.

murdemon
07 Feb 2011, 23:54
Just need find out ... what is the features (it is not bug) i start compare from model 620 (those in yours pached list 68PVI) and 68PDV from 625.. just need more time... (and need deasm erompaq 5.0Fa) to undestand what they calculate to permit flash bios.. do you have original version on erompaq 5.0Fa?

majoradi
08 Feb 2011, 02:05
is whitelist removal ready for nc6000 ?

TTAV134
08 Feb 2011, 02:10
is whitelist removal ready for nc6000 ?

i had a lot of problem of support with this bios so i've prefer to delete it for ever.

linian525
14 Feb 2011, 00:24
For HP EliteBook: a patched version of EROMPAQ V5.0F can be request by PM



I am trying to use a new wlan card on my hp mini 5102.
It seems HPQFlash (not patched version and patched version) not work for me, Can you PM me the patched erompaq? (I'm too newer to PM you ...)

TTAV134
14 Feb 2011, 02:58
You need to login to view this posts content.

samaarons
14 Feb 2011, 08:26
You need to login to view this posts content.

zerg32
17 Feb 2011, 05:45
I have ported the ADDCC v3 unpacker routine from VB.NET to C language (gcc). ...

I have written a wrapper to your code, and tried it on HP 8710w BIOS. Decompression works perfect.
But If I try to compress and then decompress the BIOS parts, the results differ for some parts.
I'm going to look into it, but I'm not very good in C language, but I'll try.
If anybody is interested I can upload the parts which cause problems.

My goal is to write a full BIOS compressor so I can make changes to the Video BIOS stored in the main BIOS.

pepito2
17 Feb 2011, 19:43
I have written a wrapper to your code, and tried it on HP 8710w BIOS. Decompression works perfect.
But If I try to compress and then decompress the BIOS parts, the results differ for some parts.
I'm going to look into it, but I'm not very good in C language, but I'll try.
If anybody is interested I can upload the parts which cause problems.

My goal is to write a full BIOS compressor so I can make changes to the Video BIOS stored in the main BIOS.

Great! Though I haven't the skills to help... :(

DWW_Wolf
18 Feb 2011, 01:07
TTAV134,
Your patch to bypass the whitelist on my N620c worked flawlessly. I ran it for a few hours and rebooted several times so it's holding up pretty well. No more "104-Unsupported wireless network device detected" error. I hope your "whitelist" of HP/Compaq laptops continues to grow with your de-whitelisting patches. Thank you for the big help.

Hi, could you send me a link for downloading the BIOS N620c version F16? I just change form N610c to N620c with the big problem that my wlan minipci ards don't works. Do even could add a small note how to flash the Bios. Thx for any help.
Andreas

TTAV134
18 Feb 2011, 01:10
Hi, could you send me a link for downloading the BIOS N620c version F16? I just change form N610c to N620c with the big problem that my wlan minipci ards don't works. Do even could add a small note how to flash the Bios. Thx for any help.
Andreas

http://forums.mydigitallife.info/threads/7681-This-is-no-request-thread!-HP-COMPAQ-bioses-how-to-modify-the-bios?p=333358&viewfull=1#post333358

in "some antiques (without SLIC table)" section

DWW_Wolf
18 Feb 2011, 01:17
next in the "to do" list, but unfortunately there is no known tool to decompress the bios and no known DMI utility to enable the SLIC table.

regards

Sorry for contacting you that way. I saw you have been able to offer a Bios/patch for N620c version F16 with no limits to the wlan cards. Could help me and tell me how to get. Please give me a note how to install it. Thx for any response.

Kind regards,

Andreas

TTAV134
18 Feb 2011, 01:20
Sorry for contacting you that way. I saw you have been able to offer a Bios/patch for N620c version F16 with no limits to the wlan cards. Could help me and tell me how to get. Please give me a note how to install it. Thx for any response.

Kind regards,

Andreas

http://forums.mydigitallife.info/threads/7681-This-is-no-request-thread!-HP-COMPAQ-bioses-how-to-modify-the-bios?p=333358&viewfull=1#post333358

in "some antiques (without SLIC table)" section

DWW_Wolf
18 Feb 2011, 02:02
Thank you so much. I was unable to find it. It works perfect. You made my day.

Kind regards,

Andreas

Shuny
19 Feb 2011, 23:14
Hello,

How to make and flash a corrupted BIOS ? My question is serious: I've tried to flash an hex-edited BIOS with HPQFlash-patch but after reboot, a message saying the BIOS couldn't be updated appeared.

Is there a way to force this flash ? I just hex edited it using WinHEX. Is there a way to fix the BIOS file so it would avoid the motherboard to refuse the new BIOS ?

Thank you (and sorry for the silly question)

zerg32
20 Feb 2011, 05:37
I have managed to create HP bios packer/unpacker.

My tool should work for BIOSes which could be unpacked bu ADDC V3.

I tested it on my HP 8710w BIOS.
Currently I can replace modules like DSDT table, Video BIOS, Logo etc.


I'll post the software after more testing.

If somebody has a similar laptop and like to help me in testing, you can write here and I'll try to mod you BIOS.

For myself I replaced boot logos and reduced voltage for the video card to make it run cooler.

andmail
20 Feb 2011, 19:55
You need to login to view this posts content.

nando4
20 Feb 2011, 20:07
You need to login to view this posts content.

zerg32
21 Feb 2011, 18:17
ACPI modded in 8710w bios

<link removed>

My ACPI bios modded bios does not work :(
It seems that I'm not able to decompile and recompile the DSDT correctly.
It is strange because this modded table works if loaded with asl /loadtable.

I noticed that recompiled table is smaller than original one.

I'll try to look more into it.

Are there any ideas why the table is no recompiled correctly ?

DmanX
21 Feb 2011, 21:45
I wonder if it is possible to unlock the advanced options menu in BIOS?

phu_dj
22 Feb 2011, 18:09
You need to login to view this posts content.

TTAV134
22 Feb 2011, 18:15
You need to login to view this posts content.

phu_dj
22 Feb 2011, 18:18
You need to login to view this posts content.

TTAV134
22 Feb 2011, 18:28
i want to know how can modify man , thank you.

the tool to decompose ADDCC V3: http://forums.mydigitallife.info/threads/529-Bios-Tools?p=201676&viewfull=1#post201676

module involved in whitelist: 02_POST_00020100_Rom.dec

but already done!

http://forums.mydigitallife.info/threads/7681-This-is-no-request-thread!-HP-COMPAQ-bioses-how-to-modify-the-bios?p=333358&viewfull=1#post333358

zerg32
23 Feb 2011, 04:21
I've modded 8710w BIOS as nando4 asked me. I've tested it and it works correctly.

here is the link w w w . s e n d s p a c e . c o m / f i l e / w h 1 i r x

If somebody interested I can post my tools for modding and a quick tutorial.

sebus
23 Feb 2011, 05:52
Definitely! Please do post

sebus

pepito2
23 Feb 2011, 16:12
I've modded 8710w BIOS as nando4 asked me. I've tested it and it works correctly.

here is the link w w w . s e n d s p a c e . c o m / f i l e / w h 1 i r x

If somebody interested I can post my tools for modding and a quick tutorial.


Yes, please post them!

zerg32
24 Feb 2011, 03:07
I analyzed ADDC V3 and the code supplied by Relay on this forum.
So I made a tool that can unpack and compress HP BIOSes for laptops like 8710w, 6910p etc.

BIOS contains several compressed parts and some special part called ROM block by ADDC.
My tool can manage this compressed parts.

Here is an example of such parts in a BIOS:


65556; 10014; 2; 1; 14; 1; 112; 96; 20000; POST
65672; 10088; 2; 1; 14; 1; 65056; 43838; 20100; POST
109530; 1ABDA; 2; 1; 14; 1; 2873; 2231; 31000; SETU
111781; 1B4A5; 2; 1; 14; 1; 65536; 33595; 40000; KBC
145396; 237F4; 2; 1; 14; 1; 7616; 3756; 60000; MESS
149172; 246B4; 2; 1; 14; 1; 2584; 1383; 9D000; OSBI
150575; 24C2F; 2; 1; 14; 1; 2950; 1238; 9DC00; NVID
151833; 25119; 2; 1; 14; 1; 65536; 32193; E0000; ROME
184046; 2CEEE; 2; 1; 14; 0; 65536; 51739; F0000; F000
235805; 3991D; 2; 1; 14; 1; 228784; 122003; 40000; F10_
357828; 575C4; 2; 1; 14; 1; 40448; 25522; 40000; MEBX
383370; 5D98A; 2; 1; 14; 1; 85753; 46013; 65000; DSDT
429403; 68D5B; 2; 1; 14; 1; 131072; 68405; A0000; SMM2
497828; 798A4; 2; 1; 14; 1; 30208; 21113; D0000; MBA
518961; 7EB31; 2; 1; 14; 1; 28160; 21392; D1000; UNDI
540373; 83ED5; 2; 1; 14; 1; 65536; 23822; 10000; P16X
564215; 89BF7; 2; 1; 14; 1; 4305; 2881; 10000; TPM
567116; 8A74C; 2; 1; 14; 1; 8253; 3172; 200000; SEC3
570308; 8B3C4; 2; 1; 14; 1; 57856; 47771; C0000; G84_
618099; 96E73; 2; 1; 14; 1; 57856; 47754; C0000; G84N
665873; A2911; 2; 1; 14; 1; 59904; 48568; C0000; G92_
714461; AE6DD; 2; 1; 14; 0; 7574; 2689; 90000; HPLO


columns are the following:

offset; ofset in hex; header version; reserved; more bytes; unpacked length; packed length; target address; description
For more information you can look into documentation of ADDC

Here are the most intresting parts for me:

DSDT - DSDT ACPI table. Can be used to configure fan behaviour.
HPLO, NVID, OSBI - different logos. Their format is 4bit RLE compressed BMP
G84, G84_, G92 are video bioses for different video cards.


Currently my tool can do two things:
* Unpack bios. HPUnpack <BIOS File>. There will be a lot of files like 90000_HPLO.bin and 90000_HPLO.dec.bin.
First are compressed sections without headers, second decompressed sections.

* Replace a section. HPUnpack <BIOS File> replace <Targed Address in hex like in the previous table> <replacement file>.
Check that <replacement file> is named differently from the decompressed section or it will be replaced and integrated incorrectly.

I tested it on 8710w and 6910p bios, I managed to replace images, video bios, dsdt table.

There is the following strange behaviour with dsdt table editing.
If you decompile dsdt with asl.exe and compile it back, the resulting file will be less than source file.
So if you want to edit the dsdt you should do the following:
* decompile it
* recompile it
* compare result with source file
* only the ending should differ
* cut this ending and store it somewhere
* edit the decompiled source
* compile it
* add previously stored ending to compiled file
* replace the dsdt in the bios with resulting file

There is also an assumption that rom block begins at offset C8BDC hex. Before editing the bios you should look at this offset
and check that this is the first not FF byte and a lot of bytes before it are FF.

Current version is beta and needs more testing, I'll post the sources of my tool on github after some cleanup of the code.
Sources are in C#.

Here is the link
h t t p : / / w w w . s e n d s p a c e . c o m / f i l e / k y h 7 a 1

pepito2
24 Feb 2011, 18:28
There is also an assumption that rom block begins at offset C8BDC hex. Before editing the bios you should look at this offset
and check that this is the first not FF byte and a lot of bytes before it are FF.

Current version is beta and needs more testing, I'll post the sources of my tool on github after some cleanup of the code.
Sources are in C#.



Hi,

I have tried changing a logo in my 6820s BIOS. The changes which I made, are hex edit the palette of the bmp. So same size, but more compressable because the palette is only 2 colors (all FFFFFF and one 000000)


It works ok (I haven't flashed) but when I decompile the new rom it has these changes:

1) The logo (obivusly)
2) Romblock:

The original one: 19_FFF65366_ROMBLOCK_ROM (414.567 bytes)
The new one: 19_FFF6539F_ROMBLOCK_ROM (414.624 bytes)


And the diffs are extra FFs just before the romblock starts (the one in offset C8BDC). In new rom.bin the offset C8BDC looks like the original one


Is this reasonable?



Thanks

zerg32
24 Feb 2011, 19:33
Is this reasonable?

Thanks

I think so.

ADDC uses different algorithm to extract the romblock. It includes all the FF between last section end and C8BDC. My tools skips them.

Also compressed section size can differ even if size of the logo is the same, because different data comresses differently.

But I recommend to have a USB FDD with recovery floppy.

pepito2
24 Feb 2011, 22:30
I think so.

ADDC uses different algorithm to extract the romblock. It includes all the FF between last section end and C8BDC. My tools skips them.

Also compressed section size can differ even if size of the logo is the same, because different data comresses differently.

But I recommend to have a USB FDD with recovery floppy.


Ok, I will modify the date of the BIOS and I will try...

Someone knows where to find the latest X1350 bios?

Thanks

sebus
25 Feb 2011, 06:06
See post #1441 on next page for a success outcome

@zerg32, a single byte change to 20100_POST.dec.bin & saving it as 20100_POST_new.bin
then replacing it in original BIOS with correct syntax

hpunpack 68YTT.BIN replace 20100 POST 20100_POST_new.bin

creates new compressed 20100new.comp.bin which is 1 byte shorter (ABB8) then original compressed 20100_POST.bin (ABB9) but the difference in hex are plenty.

Would that be expected? Would one byte change make such difference to the compression?

If the size was the same of the newly compressed module (shouldn't it?), then hex replacement in main BIOS would be easy...

Also comparing original 68YTT.BIN to newly created newBios.rom, the are many differences also BEYOND the 20100new.comp.bin section (something I would not expect?! or maybe yes, if the replacement module is different size then original?)

But comparing 2 folders (one unpacked original BIOS 68YTT.BIN - second unpacked newly created newBios.rom)
shows ONLY the edited modules being different (which is promising...)

sebus

pepito2
25 Feb 2011, 16:19
I have flashed my mod, and it worked...

I moded the 6820s BIOS for ATI of TTAV (SLIC2.1, SPLon, whitelist removed):

- Hex edited the palette of the intel log to make it black and white
- Changed the date of the bios to a more current one

The results:

It flashed correctly
It booted correctly
The new BIOS date was correct
The intel logo was a white square, I will have to look more closely (As I hexedited it by hand...)

:worthy:


Some suggestions for hpunpack (If you don't mind...)

In the instructions posted here, is missing the parameter 'name' for the replace action.
It should check for the argument first, if you missed one it crashes...


cheers

sebus
25 Feb 2011, 18:36
You need to login to view this posts content.

teils
25 Feb 2011, 23:58
Hello for all i have a question i have this motherboard dc5100 hp rompaq. I would modify the bios with slic 2.1 wher is the name of tool for mod it? thankyou

TTAV134
26 Feb 2011, 00:13
Hello for all i have a question i have this motherboard dc5100 hp rompaq. I would modify the bios with slic 2.1 wher is the name of tool for mod it? thankyou

as far as i know there is no tool for this model.

phu_dj
28 Feb 2011, 14:40
You need to login to view this posts content.

pepito2
28 Feb 2011, 15:52
One note about hpunpack,

I have replaced the intel logo, whith other one a few bytes smaller and the result was a non bootable machine. I have used the recovery disk so everything is ok.

But take care of the sizes... I don't know if instead of FFs just before romblock it can take care and fill FFs till the end of the section.

@Zerg32 great work! I had recovery the bios from one modified by your tool, so is quite safe to use and try mods....

TTAV134
28 Feb 2011, 16:33
You need to login to view this posts content.

zerg32
01 Mar 2011, 03:39
Thanks for your comments, I'll answer all questions and try to fix found issues after I'll return from my vacation next week.

Bebbub
07 Mar 2011, 21:37
You need to login to view this posts content.

steko
10 Mar 2011, 07:53
Hello for all i have a question. Is it possible to mod bios HP ML350 g6 whith slic 21. I unpack it by Rompaq. what's that bios? thankyou

ermethic
10 Mar 2011, 20:02
You need to login to view this posts content.