How can BIOS routines be disassemblied?

Question

There was once a disassembler on DOS named Sourcer that can disassembly BIOS routines. However, how do we access to BIOS ROM from software to do such a thing?

Answer 1

In the old days, you could usually dump the high part of the 1MB memory (e.g. E000:0000 to F000:FFFF) to retrieve the copy of your BIOS ROM, but nowadays the BIOS no longer fits into 64K or even 128K so all that you'd get would be a copy of the UEFI's CSM (Compatibility Support Module) with most of the code elsewhere, usually above the 1MB mark.

To retrieve the actual, full BIOS code, you need to read the ROM from the flash chip. This may be possible from the same machine, e.g. by using flashrom or sometimes the board vendor's firmware update tool if it offers a "backup" option. Sometimes the access to the flash may be blocked from the OS (to prevent BIOS modification by malware) and in such cases you may have to use an external flash programmer.

Once you got the copy of the ROM, you can start disassembling it. However, keep in mind that modern BIOSes usually implement the UEFI standard, where only a small part of the code (around the reset vector) is 16-bit while most of the code runs in 32-bit (or 64-bit) protected mode, usually using modules implemented in the PE(Portable Executable) format. Since even the structure of the UEFI firmware's ROM is standardized, you can often use a tool such as UEFITool to extract individual modules for analysis. For more info on UEFI, see the UEFI and PI standards, available for free from www.uefi.org.