Skip to main content
18 votes
Accepted

How can BIOS routines be disassemblied?

In the old days, you could usually dump the high part of the 1MB memory (e.g. E000:0000 to F000:FFFF) to retrieve the copy of your BIOS ROM, but nowadays the BIOS no longer fits into 64K or even 128K ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes
Accepted

BIOS first jump leads to empty memory

You need to load the last 64KB of the ROM at linear address 0xF0000 (0xF000:0000) and create there a 16-bit segment with the base 0xF000. Then all your “low addresses” will line up (they point into ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes
Accepted

Undocumented MSR Machine Specific register

GitHub is a good place to search for such stuff, e.g.: https://github.com/search?q=0x13A+IA32+MSR&type=Code (may require logging in) Produces results like: #define MSR_BOOT_GUARD_SACM_INFO ...
Igor Skochinsky's user avatar
  • 36.7k
4 votes
Accepted

Why BIOS is not asking for HDD password on reboot but only after power off?

Your quote is about the old legacy BIOS (16-bit). Nowadays most BIOSes implement UEFI-compliant firmware, which works in a pretty different way. The Opal specification published by TCG, describes how ...
Igor Skochinsky's user avatar
  • 36.7k
4 votes
Accepted

Passing a (string) argument via the return address?

This technique allows the code to be position-independent, since there are no explicit references to the specific address that holds the string. Instead, the call instruction will push onto the stack ...
peter ferrie's user avatar
  • 4,709
3 votes

Decompress and Analyse VMWARE EFI64 bios

Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using binwalk to scan the file. Here is the signature scan output for your file: $ binwalk ...
julian's user avatar
  • 7,138
3 votes

Disassemble bios code

The text file produced by CPU-Z is dump of the upper 64K of the run-time memory image. That is just a small part of the code which is contained in the flash ROM. The full image (41mts2p2.fa in the ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes

BIOS first jump leads to empty memory

Your disassembly doesn't show enough memory to know if the target is empty memory, but the x86 segmentation model means that the jump target for 0xF000:E205 is 0xFE205 (i.e. the (0xF000 << 4) + ...
peter ferrie's user avatar
  • 4,709
3 votes
Accepted

Undocumented Model-Specific Register on Broadwell Microarchitecture

Details of such low-level registers are often disclosed only to Intel's trusted partners under NDA since they're not intended to be accessed by the general application programmer but only by writers ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes
Accepted

Why are these 0-byte jumps used as a delay?

Here's a fragment from the leaked AWARD BIOS source code (file COMMON.MAC): SIODELAY MACRO ; SHORT IODELAY jmp short $+2 ENDM IODELAY MACRO ; ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

BIOS code failed to check device and run into a infinite loop

This is most likely the Cache-As-RAM (CAR) area, used by the BIOS code before initializing DRAM. The BIOS code is checking that it is usable as RAM (writable and reads back the same value). In ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes
Accepted

Flash ROM has lower max voltage than read device?

The MX25U1635E is designed for 1.8 volt logic, whereas your programmer is designed for 3.3 or 5.0 volt logic. You're going to need a 1.8 volt adapter for the programmer or you will damage the ...
Zman37's user avatar
  • 126
2 votes
Accepted

Where is the legacy BIOS stored on a UEFI system?

The legacy BIOS code is usually stored compressed in the UEFI filesystem. You can find it in UEFITool by looking for the magic string IFE$ (49 46 45 24) - signature of the EFI_COMPATIBILITY16_TABLE ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

Disassemble bios code

You can use a ch341a hardware to read the bios chip (need soldering skills, technicians can do that), the open the bin extracted through the programmer for ch341a on a hex editor. The, dont know what ...
Sergio Salvador's user avatar
2 votes
Accepted

Decompress and Analyse VMWARE EFI64 bios

Most UEFI implementations use a standard ROM layout (FFS - Flash File System), described in the UEFI's PI (Platform Initialization) specification. There are many tools and scripts which can parse this ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

IDA Pro 7, idc script to copy 8KB ROM to F000 Segment?

Although I would still very much like to know the significance of each of the values in the .idc script file I displayed above, and how to edit it for 128 KiB, 256 KiB or even files larger than 512 ...
TheStarman's user avatar
1 vote

Decompress and Analyse VMWARE EFI64 bios

It's not compressed, it's just has some format IDA doesn't recognize, so it makes a wrong assumption that it's code for zilog processor. You should select Meta PC processor instead, and then specify ...
Anton Kukoba's user avatar
  • 1,840
1 vote

Reverse Engineering BIOS (AMI A0.57)

After extracting the ROM image from the update, UEFITool parses it fine for me:
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

Find changes between two UEFI firmware versions?

The dump is likely different due to NVRAM data (basically settings which need to be saved between boots or even BIOS updates, such as boot device, RAM timings, serial number/MAC address and so on). ...
Igor Skochinsky's user avatar
  • 36.7k

Only top scored, non community-wiki answers of a minimum length are eligible