The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    [Question] ECS E11IS1 bios mods

    Discussion in 'Other Manufacturers' started by cocus, Mar 22, 2012.

  1. cocus

    cocus Newbie

    Reputations:
    0
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    5
    Hello! Im new by here.
    Well, lets begin. I have a Intel OLPC Netbook (it's really a ECS E11IS1, rebranded by EXO; a local brand), because I've finished the middle-grade studies.
    Specs:
    * Atom N455 1.6GHz
    * Intel NM10 Express chipset

    Those models come with a BIOS code that checks the TPM inside, to see if the netbook is unlocked, stolen, etc. Of course, I have mine unlocked.
    As far as I've investigated, when you have it unlocked, in reality, you have the "remaining boots until lock" set to a maximum value (5000000).
    Since the begin, I didn't liked this system.
    And now, I would like to remove it completly from the Bios.

    Because im not a professional bios reverse engineer, Im here asking for help.

    Ok, what I know about it:
    The bios is a Phoenix SecureCore. The mother comes with a TPM attached to the chipset LPC bus (Winbond, IO space: FED4-0000 to FED4-0FFF).
    Actually, the bios is taking some I/O to it, reading the NVRAM contained in the TPM chip, and decreasing 1 the "boot count".
    The NVRAM of the TPM has actually 24 bytes, and there is stored:
    bootticks [3 bytes], boot count [3 bytes], expiry date [6 bytes], hard id [12 bytes].
    However, its not so relevant.
    Ive also unpacked the bios, and found some interesting things. In the file "BIOSCOD04.ROM" you can find a string, "TCOPP.BIN".
    That file is used to update some public keys in the TPM, in case of the server chages it. (its readed from a FAT16/FAT32 usb key drive when the "lock screen" appears).

    Ive tried to open it with IDA, but I dont have idea on how to use it (Im not expert in using ida).

    Well, you can find the main bios file here (also, unpacked):
    net k.rar

    PS: Sorry for my bad english!

    Thanks in advance!
     
    cocus, Mar 22, 2012
    #1
  2. markitoxx

    markitoxx Newbie

    Reputations:
    0
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    5
    Could you get the bios without the blocking thing ?
    I also have an Exo 355 and a I searched a clean bios and could not find it :s
     
    markitoxx, May 8, 2012
    #2
  3. cocus

    cocus Newbie

    Reputations:
    0
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    5
    Nah, 0 progress. I can't find anything usefull. Neither in the disasm. (just strings and stuff).
    However, I've found the Theft Deterrent Server for Windows, tried to update the public key with my own one, and it doesn't get locked again. Its just unlocked forever, no matter if you change the keys (because I've finished the school, the status is "unlocked").
     
    cocus, May 8, 2012
    #3
  4. markitoxx

    markitoxx Newbie

    Reputations:
    0
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    5
    Ooh good idea, can you give me the link of the theft deterrent server ?
    And also i have a unlocked netbook (of my older sister) and i wanted to extract the bios and i think it doest have the blocking thing and then put it in my netbook
     
    markitoxx, May 12, 2012
    #4