Insyde BIOS modding (dv4,dv5,dv6,dv7 at least)

Hi everyone,

I'm working on modding the Insyde BIOS's included in most of HP's recent laptops. At the moment I have successfully patched the boot logo and ACPI tables. A number of people have mentioned they would be interested in this and in particular patching the BIOS so other PCI devices can be added. If you are interested in this and are willing to experiment (obviously there is some risk attached) please give me a pm. (Also note that the Insyde BIOS's actually have a great bad flash recovery procedure built in so in almost all cases you'll still be okay!). Any questions please ask in this thread.

EDIT: A bit more detail into how I'm doing this. There is a tool called EzH20 (official Insyde tool) that has been leaked. This showed how the BIOS's were compressed - using LZMA comression. Now we can decompress (and recompress) the BIOS. This tool also includes a feature to replace the BIOS logo. The BIOS is split into a number of modules that have unique GUID's. Unfortunatly there is no way to tell what module does what apart from that data in it (which is obviously mostly just randomness!). However there are certain things that can be patched if we know the format. Patching the white list of PCI cards for example, may be possible by searching for the device ID's and then finding which module they occur in.

On a similar topic I have also got a hold of the official HP EEPROM tool used for changing model number, serial number, quickplay settings, etc etc (i.e. all the settings you see when you first go into your PC's BIOS, but are unmoddifiable). If anyone wants this please also give me a PM (is it okay to post this mods?).

 

Could this lead to a patch that would permanently undervolt CPUs? That would be seriously cool (pun intended). If you can patch ACPI tables I should think it's possible?

 

What about dv2? On this machine (AMD Neo) undervolting does miracles...

 

Undervolting would be the only reason i would edit my BIOS, really. And i seriously don't get what you meant by "PCI slot", did these things magically turn into desktops and i didn't know? Or do you mean the mini-PCI-E that the wifi is plugged in? I just googled a bit and have found all the utils on My Digital Life forums. I assume that's where you have gotten them as well?

I'd give them a shot but i no longer have Windows on my DV5.

 

Sorry, yes you're right I ment mini PCI-E slot. I found some of these on mydigitallife, yes.

 

So what exactly can be done with your current knowledge of this software? Can any hidden BIOS options be unlocked? Coz i'd sure wish OEM BIOSes wouldn't be so dumbed down.

 

I'm interested too, but I also am not running Windows any more.

 

Gotta keep track of this thing. Subscribing

 

Danny, I'm all up for helping you out with testing and stuff. I like the idea of being able to populate certain parts of the Bios as my goal is to get that cable card adapter working without having to use a vista loader. With this tool, have you reached out to the MacOSX-on-a-PC forums? I'm sure they would love this stuff and they probably have the most knowledge in trying to get a lot of this working.

 

The best feature, IMO, would be to reconfigure the ACPI tables to allow wake-on-usb devices. That way, I can just tap my usb keyboard's "Power" button to turn it on.

Over/underclocking would be good too. Combined with undervolting, there's plenty of temperature headroom.

 

I have my dv5 CPU undervolted already, you don't need to screw with the BIOS to do that. Just install the appropriate program to run at boot time.

 

It would be nice not to have to mess with those programs, plus I know of no equivalents for Linux.

 

+1.

@ highlandsun, could you please tell me what program do you use? I didn't know that the AMD mobiles could be undervolted as well. Will it work with the Athlon X2 (i have a QL-62 in my dv5) like it works with the Turion? This thing is hot.

As far as Linux goes i might go back to Vista but install 64-bit like on my main computer, or see what's new in the latest Win 7 build. I have spent a couple weeks tweaking Ubuntu to my liking and i succeeded mostly, however i found myself running in XP VirtualBox more than i did native... Funny thing, video playback is better in the virtual XP than in the host. Also, most people over at the Ubuntu forums aren't really helpful and started flaming me when i told them they should consider changing the default fonts (especially when they saw my screenshot with MS fonts and antialiasing disabled).

The stupid antialiased fonts it comes with are a) WAY TOO BIG and B) very hard on the eyes, probably that's why they were set so big. AA in Linux is miles behind ClearType. They said that currently Linux is the only system with the ability to set the font family and size desktop-wide. Well, Firefox renders fonts two sizes bigger than they are set, Opera renders them two sizes smaller. Desktop-wide my ***, i've spent 3 days to get everything to use readable fonts. Font rendering on Linux just plain sucks, and unfortunately i don't see it changing soon.

Add in all the driver issues (Compiz + video playback = FAIL), and you'll understand why i keep going back to Windows every time. Oh and i need FL Studio to run properly, which it does not under Wine, and it is too laggy in the XP virtual machine. Well at least i got UT2k4.

 

Hi,
i'm very interested in insyde bios modding, because every time I try to insert a new wifi mini-pci card instead of the old one, the laptop halts with the ERROR 104. So this bios has a whitelist inside and i would modify this whitelist to allow me to use my broadcom 4311!!! At this moment the bios allows me only to use the Intel 5100agn.
It would be great if you could help me in this, a lot of users are in the same trouble. I tried changing the SPROMM of my broadcom card but it doesn't work. I use the Insyde Bios F16a for an HP DV5t laptop (1030el).
Hoping for an answer,

Nihil

 

Can you post the device id for your intel 5100 card please.. I'm going to try and see if I can find any references to it in the BIOS.

 

hi dannyres,
with lspci -nn in linux:
02:00.0 Network controller [0280]: Intel Corporation PRO/Wireless 5100 AGN [Shiloh] Network Connection [8086:4237]

it's the same on this site ( http://pci-ids.ucw.cz/read/PC/8086/4237 ):
vendor id: 0x8086
device id: 0x4237.
So it's 100% my intel wificard!

here's the link for my bios:
http://h10025.www1.hp.com/ewfrf/wc/...&dlc=en&cc=us&lang=en&os=2100&product=3770495
the latest version (F16a, mine) is here:
ftp://ftp.hp.com/pub/softpaq/sp43501-44000/sp43819.exe

Can you help me to bypass this whitelist? I'm very hopeful!
Thansk,

Nihil

PS: How can i send PM to other users?

 

I don't think it will work with a regular Athlon X2. I'm using TurionPowerControl, from here:

http://forum.notebookreview.com/showthread.php?t=373878&page=4

 

Hello,

It's great to hear that.

Please, can you take a look on my Bios ? and please release or pm the link of the tools, and also the program to change the serial number and so on !!!

HP DV5-1250US

The latest bios is:
http://h10025.www1.hp.com/ewfrf/wc/...&dlc=en&cc=us&lang=en&os=2100&product=3860529

ftp://ftp.hp.com/pub/softpaq/sp43501-44000/sp43870.exe

Thanks a lot.

 

Hi Man ...

Did this topic died !? anychance to release the softwares you use ?!

 

All software is available here: http://forums.mydigitallife.info/showpost.php?p=62768&postcount=1

 

Messing with the bios would be truly nice for puma platform dv5-dv7 machines: maybe we could find the way to enable the internal hd3200 IGP and finally get the f***ed Hybrid crossfire working!

 

Actually there is very slight chances.
Unless you system has a PCI-E slot for graphics car but normally when they provide 3200HD graphics they remove expansion not to mention the lack of space.
Additionally when they compile the BIOS a lot of information is remove to built the full BIOS source therefore even reverse engineering will only provide limited success.

 

well, but me and many others have AMD M780G as a chipset and dedicated HD3450/HD3470 video cards, so it would not be so difficult to find the bit which disables onboard HD3200 in the M780G chipset and turn it off!

 

Does this thing work for HDX16?

Do you have any extra program not founded in My Digital Life link?

Thanks!

 

No everything I have found is on the mydigitallife forums.. sorry I've been extremely busy lately. wienter is right - it is very difficult as this is compiled code. Most things can not be modified unless someone here is a disassembly expert.

 

The BIOS is identical between HD3200 and HD3450 machines, so it's not like a block of missing code on one or the other. However, it's pretty likely that the hardware connections to allow the HD3200 to drive the screen are missing on the HD3450 models. (The two use very different motherboards...)

Also while digging thru HP part lists, I only see references to our motherboard with "RX781" chipset. Dunno if that's identical to M780G or not, it sounds to me like it's a reduced function/reduced cost version. I haven't found any 780 datasheets though, apparently those are still NDA documents.

 

This is great stuff. I am honestly just looking for a way to install any wifi card of my choice. The broadcom card I have in my system works like crap on Linux in all driver variants. I want to install an Atheros card on there instead. I have an HP DV7-1061NR. It uses a broadcom 4321 802.11n. installing any other wifi card results in the system being unbootable with the BIOS telling me the hardware is unsupported and to replace the hardware.

Any chance a howto could be posted on how to edit the bios to allow hardware to be installed with systems using insyde bios? I have been looking and have yet to find one.

 

Hey thanks for the software!!!

Are you sure we're not gonna participate in a giant ChineseBotNet now?

 

Cool im going to have to check this out

 

Just made some great progress! There is in fact a hidden section in the BIOS. While I have not been able to enable it, all the settings can be modified by editing the BIOS directly (this is safe - it is exactly what the BIOS does when it changes settings). I've attacted the settings file for my dv5t. As you can see there are alot of things that are very interesting!

Note: All credit goes to the great guy at http://marcansoft.com/blog/ - he developed the tools that I used to get this info

 

"Oooh, kinky!" That looks more like a BIOS. One little correction for you though - when the BIOS changes settings it saves them to the CMOS not in the flash memory directly. The flash is never altered by regular use, unless you are upgrading the BIOS.

What kind of language is the BIOS coded in? Is it regular x86 ASM? I'm not that good but i could try and have a hack at it.

 

Sorry yes you're right. I believe it is coded in C (++?). I've attached the setup utility. As you can see it is just a regular PE file (I've renamed it to .txt so the forum will let it upload). You really need to look at it alongside the EFI documentation to understand alot of it.

EDIT: I should mention we cannot just change that SetupUtility as it is compressed inside the BIOS and would end up altering alot of things. Perhaps there is a bit somewhere that can be flipped to hide certain options that can be turned on and off easily.

 

I think you might find you are wrong to assume this. Sure, there are some settings in cmos but having had to hack the Insyde BIOS to enable native IDE as HP seemed to have decided AHCI was good enough for everybody and didn't need to have the option in BIOS to change it, the setting was not found in CMOS.

 

The setting was not found because it was hidden to begin with. You confuse the setup utility with the actual CMOS memory.

 

Well, confused now I am LOL.

Perhaps I'm missing something here, after all it was late last year that I last played with the InsydeH2O BIOS.

To my mind cmos is the battery backed up memory that normally is accessed by port 0x70/0x71. On my system I also have an extended cmos area on port 0x72/0x73 which stores the cmos passwords in plain text BTW.

Changing most of the setup settings does not change the cmos memory. Changing AHCI to IDE once set survives a cmos reset.

The actual settings live under a section called "setup", there may be several of these as each time changes are made in the BIOS IIRC it updates with a new section until the block is full then it erases them and starts over with a new "setup" section. Don't expect offsets to remain constant. There is also a "custom" section but I don't know how that works but it looks similar to the "setup" layout.

At the time it was a case of mapping the functions that were available in the setup utility by turning them on and off and checking which bytes changed in the "setup" section and seeing how the checksum worked. After this I went through each of the bytes that were unknown but set to 01 and set them to 00 one at a time, adjusted the checksum, re-flashed and tried to check what had changed. My theory being it was safer to turn things off, that AHCI was set to "on" by 01 and there weren't so many bytes set to 01. As luck would have it I eventually found the byte that caused the machine to boot with AHCI or Native IDE, and that was that.

The section that contains the "custom" and "setup(s)" plus a few other things, can be found easily enough, at least on my machine, by using IIRC "flash it.exe /pq" (no space between sh & it) which lists the protected areas, specifically "type 2: variables". This section wont always be in the same place with different BIOS versions ie going from f.12 to f.13.

I only have experience with this on my own notebook so it could very well be a bit different for others but I would hope there is at least some similarity.

I think it should be possible to update just one or two blocks of the BIOS but not being sure how to do it I just went ahead and re-flashed the lot. There is even a "variable" option with the flash utility which sounds interesting but again I have no idea how it works.

Now that you guys have some real tools to use hopefully a lot more can be done.

 

0.0 that is some great insight. I had also noticed a whole bunch of Setup sections but didn't realize that they rotated around like that. Everything you have said it correct. Now that we have the right tools you can simply look up which offset is ment for which setting (as shown in the bottom of the txt file I posted a few posts up). How did you tell which Setup section to modify? Or did you mod them all? My understanding is that the Custom section is actually the default setting so if you change the setting there it will continue to be set when you choose reset to defaults in the BIOS. As for updating just a few blocks of the BIOS you are correct that this is possible. The people here - http://marcansoft.com/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/ - in the comments section have said they have got this working. A more full solution appears to be in the pipeline.

EDIT: And I have also tried playing with the switches on fla for writing variables with no luck though.

 

I don't know if this is of any relevance to the topic under discussion; however, it appears that some of the BIOS settings may actually be saved to the BIOS chip itself rather than to a separate NVRAM memory (i.e., what I believe is being referred to as the CMOS memory).

From a little poking around, it appears that Insyde has been working with SST on parts of their new EFI/UEFI-compliant BIOS, and from an Insyde powerpoint I d/l'd from Intel I found a reference to an Intel reference board using the Insyde H2O BIOS (the ppt was primarily discussing the "benefits" to debugging firmware using Insyde's software), which included an image of the SST chip that was used as the Firmware Hub. In the image, that chip was the SST-49LF004B.

Digging further along those lines, I came across the datasheet for the SST49LF00xA family of chips, which refers to these chips as "Firmware hubs for Intel 8xx chipsets." Now for the relevant bit - these chips do incorporate the ability to erase and reprogram small sections of the chip rather than the entire chip, and also incorporates a faster write method than alternative flash memories. Thus, it is entirely possible that some of the settings in the Insyde EFI/UEFI BIOS are being written back to the BIOS chip itself rather than being saved to a separate CMOS-based NVRAM. Considering that one of the "benefits" of the EFI paradigm is the ability to have modular drivers that get started up faster, it's possible that the AHCI/IDE switch is actually being saved to part of the code/data for the hard drive driver that would be incorporated into the EFI portion of the Insyde BIOS, and thus would not have to be saved into the traditional CMOS-based NVRAM at all.

At any rate, if the better-informed are of the view that this is nice, but utterly irrelevant, then I extend my apologies prospectively.

EDIT: A little more poking (and realizing that I was being dsylexic again and flipping letters ), and I found the EOL datasheet for the SST-49LF004B (the chip referred to in that ppt image I found) here. The "B" series was, apparently, the successor to the "A" series (given that the "B" series datasheet discusses backward compatibility with the "A" series), and also refers to the faster flash mechanism as "superflash."

 

Shyster that is very interesting indeed! It is great to see this is all finally coming together.

 

dannyres, AFAIK the last "setup" section is the one currently used, you may have 5 or 6 of these before BIOS erases them and starts a new one. As mentioned changing a setting in the BIOS setup, not that there are that many to change, for instance mine has Fan Always on, you can see the change in the last "setup" and of course the checksum. I'll see if I can find an old file where I put some of the settings down and see if it lines up with your file. IIRC I tried modifying the "custom" file but it didn't work as expected or maybe I got something wrong, don't really remember that well, but yes loading defaults in BIOS would undo the settings made in "setup". I just keep a backup which includes the setting I made so if ever I need to do it again it is just a quick re-flash.

I would imagine the blocks for writing just small parts would be something like 4KB but I'm only taking a wild guess.

shyster1 FWIW it sounds to me like your on the right track

 

I had another look at the "custom" file and the bit that was set to zero in the "setup" file to enable Native IDE is already set to 0, maybe that's why I couldn't see how to get the thing to work. Maybe the setup.txt is for the "custom" file as there seems to be a couple of things that don't line up. Not too sure

This is what I have got from my notes compared to the setup.txt file you posted. Hope I wasn't suffering from dyslexia when I made them

Code:

Setup.txt  |                       |    My setup
-------------------------------------------------
0x39       |    AHCI / Native IDE  |    0x39
0x74       |    Lan boot enable    |    0x74
           |    HDA Enable         |    0x91
           |    Boot devices 1-6   |    0x9A-9F
           |    Language           |    0x84
0x1AD      |    VT                 |    0x1AD
0x1B4      |    C6 states          |    0x1B4
0x214      |    F10 & F12 delay    |    0x214
0x215      |    CDROM Boot         |    0x215
0x216      |    Floppy Boot        |    0x216
0x258      |    Button sound       |    0x218
0x25C      |    Fan always on      |    0x258

EDIT: My bad, I must have jotted the offset down incorrectly, enable AHCI is at offset 0x39 on my BIOS not 0x37.

 

Hmm that's strange about the Custom section. As for the bits matching (or not) I'm not surprised as it is quite dependant on the BIOS release. Can you link me to the BIOS you used when you did this? I can run the same tools on your BIOS and post the output..

 

Here is the info extracted from your BIOS 0.0. It seems most of the offsets now match up to what you discovered.. a couple don't though so I'm not sure what is up with that... I guess either the tool used to generate that file is wrong or you made a mistake..

 

Ok people who were wanting to patch that BIOS whitelist, I've just found out exactly where it happens so we are getting close. However I don't know much about patching PE files (i.e. disassembly). Anyone here have any expertise?


EDIT: Figured out how to patch it!! Anyone keen to give it a go? I need your old device ID and the device ID of your new wireless card.. Also I suggest you make sure you know how to use the Insyde BIOS recovery procedure (though I'm quite sure this wont be nessesary)..

 

Thanks dannyres, that's really cool.

It's very possible that when I noted down the ACHI enable offset in my excitement at finding it I got it wrong by a word and it should be 0x39 not 0x37. This would explain why the "custom" file did not work too which incidentally has byte 0x39h set

Once I had AHCI disabled and backed up the settings I didn't test much more than that, a bit sloppy on my part. As for the other settings such as HDA enable, they are just things I noticed while changing settings from 1 to 0. IIRC the HDA enable was a result of checking the function disable register in the ICH9 after setting 1 to 0 in the "setup" and finding HDA disabled.

I've just finished putting some new thermal paste in the laptop and while wanting to test temperatures have got a bit carried away at finding some extra readings on the machine but I will go and test that byte again as I feel fairly confident now that I wrote it down wrong.

 

Great let me know how it goes.. (also with the 'Custom' section.. I am very interested in seeing if this corresponds to the "defaults").

 

Interesting post here:

http://feature-enable.blogspot.com/2009/07/enable-vt-on-insydeh2o-based-sony-vaio.html

Seems there is a bit that we can flip to enable the advanced menus in the BIOS itself.

 

Ok Danny it was 0x39 and not 0x37, my bad, and the custom section appears to be the settings used when selecting "use defaults" in the BIOS. Also I noticed it used the first stored setup section without wiping the others. Either my memory is shot, or I'm going mad, I seem to recall them growing by one each time a new setting was made in the BIOS from 1 to 5 or 6 then erasing the setup sections when full and starting with just one section again. Sorry for bum information.

If there is a bit that can be set to enable the advanced features I feel that would be the best way to go. Since the VT 0x1AF doesn't line up I'm not to sure about the "Advanced Menu" bit being right for HP comp's.

Here's my guess of a setup section layout


These are only guesses and so may be wrong.

1. The start of a section seems to begin with 0x55AA.
2. Not sure what the 0x7F or 0x07 is but valid sections seem to have 0x7F while invalid sections have 0x7C.
3. Name length is the number of bytes of the section name including the zero termination. In the above example the zero terminated unicode string for Setup has 12 bytes (0x0C).
4. Datalength is the number of bytes of actual data . In the above example there are 700 bytes (0x2BC) of data.
5. GUID, EFI seems to thrive on GUIDs. In the above example A04A27F4-DF00-4D42-B5B2-39511302113D. Not sure why they are twisted, maybe it's more efficient to read that way.
6. It appears the checksum is such that when all the words from 0x55AA to the end of data modulo 65536 are added together the answer is 0. Note that unused setup sections seem to use invalid checksums such that the result is -3.
7. Data, well it seems you've got quite a bit of that worked out already

EDIT: Any idea what "opcode 0x27" is

 

Opcode 0x27 is EFI_IFR_VARSTORE_DEVICE_OP (first hit on google shows a bit of info). Take a look at the file attached here. It is extracted using marcans vardump utility. You are right, according to pheonix here (see the bottom of the comments section):

http://marcansoft.com/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/

He says just ignore all sections that don't have 0x7f.

Good work by the way! We now have confirmation that the 'Custom' section is for defaults. But on a clean firmware there is not even any Custom section which makes me wonder where they actually come from...

I still need someone with an extra mini pci-e wlan card to test out my mod.. everyone was very keen before but now they all seem to have disapeared.



EDIT: And I'm sure your original observations regarding the many Setup sections were correct.. perhaps it was the way you were flashing your BIOS? It can sometimes clear the VSS..

 

Ah I think I am on the same track as you.. it seems all of the options we want are suppressed if .... well something to do with opcode 0x27! It seems 0x27 means it wants to access some other storage so I guess the setting for this is somewhere else...

Btw I actually hacked in support for opcode 0x27 to marcans tool myself which is why it doesn't work very well. The tool wasn't working on HP BIOS's because his tool didn't understand opcode 0x27. I know almost no python so unfortunatly I can't do anything better at the moment..

 

Umm, I wouldn't say that, although the settings in the custom section seem to line up with defaults I thought I'd better check by setting 0x39 from 1 to 0 in the custom section which should enable native IDE when loading defaults but it doesn't. Sorry for misleading you to believe otherwise.