2

Recently I got really interested in BIOS RE and I used chipsec to dump the content of SPI Flash ROM of my HP Omen Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty huge (8.4 MB).

The bios image is AMI A0.57 rev A

I have a couple of problems with this BIOS image:

  1. I can't disassemble it correctly. Using radare2 with -b flag, I tried 16,32 and 64 but the file doesn't get disassembled correctly.

  2. Using UEFI Tool, it fails at parsing it correctly.

  3. I googled and google and google. There no resource to solve my problem.

  4. IDA Pro also treats the file as BIOS Image and uses one of its plugins bios_image.py to analyze the file but fails at some point with an error: Cannot relocate segment something at something (some addresses) because it overlap another segment.

Then I thought maybe Chipsec has failed with dumping the SPI Flash and the file is corrupted but I downloaded the BIOS image from HP's website (ftp.hp.com/pub/softpaq/sp81501-82000/sp81781.exe) and the file is the exact same. So, I have no clue and I need help to start learning BIOS reverse engineering.

P.S. I have read BIOS Disassembly Ninjutsu Uncovered; and I can provide the binary if necessary.

Please be as specific as possible in your answer since I googled 100 times and I'm really disappointed. Thanks!

Improve this question
2
  • @SYS_V after downloading the executable, run it, there is an option which you can write the raw binary to a file.
    – LD2
    Commented Jan 6, 2018 at 21:00
  • BIOS are encrypted nowadays....it will be much more work than feeding it raw to a disassembler.
    – Rui F Ribeiro
    Commented Jan 7, 2018 at 15:51

1 Answer 1

Reset to default
1

After extracting the ROM image from the update, UEFITool parses it fine for me:

UEFITool screenshot

Improve this answer
5
  • This parsing seems corrupted in my opinion. If you open each node, you will see they're all padding or empty. It makes no sense. Don't you agree? Or am I missing something?
    – LD2
    Commented Jan 8, 2018 at 8:21
  • There are enough valid modules so it's fine.
    – Igor Skochinsky ♦
    Commented Jan 8, 2018 at 8:22
  • @IgorSkochinsky where is the legacy bios stored before it's shadowed to 0xF0000? It doesn't appear to be in the SPI flash bios region. I thought it might be on the LPC flash but my laptop doesn't appear to have one, plus it looks like you can only send all bios accesses to either LPC or SPI on the chipset and not 0xF0000 to one and 0xFFFF0000 to another. I can't find anything on this. My laptop is booted into legacy bios and has EA at 0xFFFF0 and 90 90 E9 at 0xFFFFFFF0
    – Lewis Kelsey
    Commented Apr 24, 2021 at 0:26
  • @LewisKelsey by “legacy bios” do you mean the 16-bit reset code, or the CSM for legacy OS? You might want to create a new question with more details.
    – Igor Skochinsky ♦
    Commented Apr 24, 2021 at 0:29
  • @IgorSkochinsky Yes, the 16 bit reset code that jumps to the POST entry point at F000:E05B
    – Lewis Kelsey
    Commented Apr 24, 2021 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.