4

I have a Gigabyte G41MT-S2PT motherboard with Intel core 2 Pentium processor installed on it for test.I decided to disassemble its bios code.Its bios produced by Award Software International and its version is FA.Despite I have attempted so much to find source code on the Internet,I didn't reach any success.I guess bios is closed source and no source code has been published.So I got a bios backup image using Universal Bios Backup Toolkit to disassemble the code.but it seems not to be the pure hex code belonging to x86 assembly.It seems some extra data or a header is added to.Do somebody know the exact format of file with .rom extension produced by Universal Bios Backup Toolkit? Unfortunately I didn't be successful by looking for it to!

Improve this question
6
  • Yes, most BIOS is closed-source. I think CPU-Z can also extract the BIOS. You can then load it to IDA to see if it can parse your bios image. There are some tutorials on the Internet about RE bios, try Google it
    – raspiduino
    Commented Jul 30, 2022 at 7:23
  • No.CPU-Z just generate a text file contain some report.I couldn't find nothing useful.
    – Farshid
    Commented Jul 30, 2022 at 8:46
  • 1
    Possible duplicate of reverseengineering.stackexchange.com/questions/12772/…
    – Robert
    Commented Jul 30, 2022 at 8:53
  • @Farshid really? There was an option to dump BIOS in the tool list. Have you tried that?
    – raspiduino
    Commented Jul 30, 2022 at 9:20
  • 1
    Of course.I did it today.there is no dump bios option.just there are save bios and bios options,but when I used save bios,it gave me a text file with some hex code in it.unfortunately the code doesn't belong to assembly and it is meaningless.It seems to be a report file.
    – Farshid
    Commented Jul 30, 2022 at 16:15

2 Answers 2

Reset to default
3

The text file produced by CPU-Z is dump of the upper 64K of the run-time memory image. That is just a small part of the code which is contained in the flash ROM. The full image (41mts2p2.fa in the extracted archive) contains multiple modules with compressed (using LZH algorithm) code and data. This is where the name Award Modular BIOS comes from.

A small non-compressed bootblock at the end of the image is responsible for the minimal hardware initialization, unpacking the first of the modules which performs the Power-On Self Test (POST) and then unpacks and execute the rest of the modules as necessary. You can extract them manually or using a vendor tool (CBROM32 or MODBIN). Here's the list of modules for your BIOS:

cb32_198.exe V1.98 [08/27/08] (C)Phoenix Technologies 2001-2008

              ********  41mts2p2.fa BIOS component ********

 No. Item-Name         Original-Size   Compressed-Size Original-File-Name 
================================================================================  0. System BIOS       20000h(128.00K)1288Dh(74.14K)41mts2p2.BIN
  1. XGROUP CODE       0DF00h(55.75K)0997Ch(38.37K)awardext.rom
  2. ACPI table        0447Fh(17.12K)019EEh(6.48K)ACPITBL.BIN
  3. GROUP ROM[18]     04100h(16.25K)02B7Bh(10.87K)ggroup.bin
  4. GROUP ROM[20]     04340h(16.81K)02EA8h(11.66K)ffgroup.bin
  5. TSEG0              04370h(16.86K)024F7h(9.24K)y2group.bin
  6. YGROUP ROM        0D9F0h(54.48K)08215h(32.52K)awardeyt.rom
  7. GROUP ROM[22]     0F630h(61.55K)01CBFh(7.19K)tgroup.bin
  8. GROUP ROM[23]     0F630h(61.55K)022D0h(8.70K)t1group.bin
  9. GROUP ROM[24]     0F630h(61.55K)00B6Ah(2.85K)t2group.bin
 10. GROUP ROM[25]     0F630h(61.55K)0015Ch(0.34K)t3group.bin
 11. GROUP ROM[26]     0F630h(61.55K)0015Ch(0.34K)t4group.bin
 12. GROUP ROM[ 0]     07790h(29.89K)02B0Fh(10.76K)_EN_CODE.BIN
 13. MINIT             168C0h(90.19K)168EBh(90.23K)DS3_DDR3.BIN
 14. VGA ROM[1]        10000h(64.00K)08590h(33.39K)elk_1819.dat
 15. LOGO1 ROM         00B64h(2.85K)00520h(1.28K)dbios.bmp
 16. PCI ROM[A]        10000h(64.00K)096C5h(37.69K)RTEGROM.LOM
 17. GV3                0232Dh(8.79K)00C27h(3.04K)PPMINIT.ROM
 18. OEM0 CODE         034F6h(13.24K)0265Bh(9.59K)SBF.BIN
 19. OEM7 CODE         73000h(460.00K)4891Ah(290.28K)EXTBIOS.BIN
(SP) NCPUCODE          1F801h(126.00K)1F801h(126.00K)NCPUCODE.BIN

  Total compress code space  = E6000h(920.00K)
  Total compressed code size = C9403h(805.00K)
  Remain compress code space = 1CC1Dh(115.03K)

              ********  41mts2p2.fa Bootblock component ********

 No. Item-Name         Original-Size   Compressed-Size Original-File-Name 
================================================================================
                          ** Micro Code Information **
Update ID  CPUID  | Update ID  CPUID   | Update ID  CPUID   | Update ID  CPUID  
------------------+--------------------+--------------------+-------------------
SLOT1  0A 00000F32| SLOT1  02 00000F37| SLOT1  17 00000F34| PGA423 2C 00000F25
SLOT1  17 00000F41| SLOT1  05 00000F43| SLOT1  03 00000F49| SLOT1  04 00000F4A
SLOT1  06 00000F44| SLOT1  03 00000F47| PGA478 07 00000F61| PGA478 0F 00000F62
SLOT1  04 00000F64| PGA478 0B 00000F65| SLOT1  11 000006F1| SLOT1  26 000006F4
SLOT1  33 000006F5| SLOT1  33 000006F5| SLOT1  D0 000006F6| PPGA   6A 000006F7
SLOT1  04 00010660| SLOT1  5D 000006F2| SLOT1  82 000006F9| SLOT1  43 00010661
SLOT1  BA 000006FB| SLOT1  A4 000006FD| PPGA   BA 000006FB| SLOT1  06 00010671
SLOT1  04 00010674| SLOT1  0F 00010676| SLOT1  0B 0001067A| PPGA   06 00010671
PPGA   04 00010674| PPGA   0F 00010676| PPGA   0A 00010677|
Improve this answer
0
2

You can use a ch341a hardware to read the bios chip (need soldering skills, technicians can do that), the open the bin extracted through the programmer for ch341a on a hex editor. The, dont know what to do afterwards.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.