2

Recently I got really interested in BIOS RE and I used chipsec to dump the content of SPI Flash ROM of my HP Omen Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty huge (8.4 MB).

The bios image is AMI A0.57 rev A

I have a couple of problems with this BIOS image:

  1. I can't disassemble it correctly. Using radare2 with -b flag, I tried 16,32 and 64 but the file doesn't get disassembled correctly.

  2. Using UEFI Tool, it fails at parsing it correctly.

  3. I googled and google and google. There no resource to solve my problem.

  4. IDA Pro also treats the file as BIOS Image and uses one of its plugins bios_image.py to analyze the file but fails at some point with an error: Cannot relocate segment something at something (some addresses) because it overlap another segment.

Then I thought maybe Chipsec has failed with dumping the SPI Flash and the file is corrupted but I downloaded the BIOS image from HP's website and the file is the exact same. So, I have no clue and I need help to start learning BIOS reverse engineering.

P.S. I have read BIOS Disassembly Ninjutsu Uncovered; and I can provide the binary if necessary.

Please be as specific as possible in your answer since I googled 100 times and I'm really disappointed. Thanks!

  • "I downloaded the BIOS image from HP's website and the file is the exact same" - include the link – julian Jan 6 '18 at 20:42
  • @SYS_V here's the link: ftp.hp.com/pub/softpaq/sp81501-82000/sp81781.exe – LD2 Jan 6 '18 at 21:00
  • @SYS_V after downloading the executable, run it, there is an option which you can write the raw binary to a file. – LD2 Jan 6 '18 at 21:00
  • BIOS are encrypted nowadays....it will be much more work than feeding it raw to a disassembler. – Rui F Ribeiro Jan 7 '18 at 15:51
1

After extracting the ROM image from the update, UEFITool parses it fine for me:

UEFITool screenshot

  • This parsing seems corrupted in my opinion. If you open each node, you will see they're all padding or empty. It makes no sense. Don't you agree? Or am I missing something? – LD2 Jan 8 '18 at 8:21
  • There are enough valid modules so it's fine. – Igor Skochinsky Jan 8 '18 at 8:22
  • Don't ask people to teach you.... You aren't paying them what they would be worth. – Qndel Jan 8 '18 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.