How to Enable Intel VT on a Montevina SR,FW,AW Vaio laptop with AMI Aptio BIOS

Ok, thanks for the firefox fix. Only now that I am testing/trying that I realize that I have that stupid InsydeH20 or something BIOS, which seems to be a completely different beast. I guess nobody has any idea what to do in this case?

Best

Norbert

 

You can do what I suggested in the article. If you can dump the BIOS you can upload it to rapidshare.com and give me the link and I will take a look at it when I have time.

 

That is the problem, and the BIOS update Program is not unzip-able, it is a all-in-one executable as far as I see. At least with linux unzip I couldn't do anything. I could look into the actual exe with a hex editor, but the stuff is probably somewhere compressed in the exe file. It is a pain.

Do you have any ideas how to attack the .exe of the bios update program?

 

For getting inside install EXE's you'll need the Universal Extractor.

I've used it a few times to get at updated Bluetooth drivers and other such fun things.

http://www.legroom.net/software/uniextract

 

Thanks yes, sent the link by private mail.

 

Another way to enter exe files is by using Total Commander.

@norbusan:
You have a PM, bad news though, sorry mate, I wish I could be more helpfull.

It is just lame what OEMs are doing to us -- it is as if they keep owning the computer after we buy it.

 

I have tried on my VGN-SR13GN and failed.

It was bricked and does not even wake up after I took out the battery in very difficult way.

Now, I am figuring out to send it to service centre.

What I did was like the follwoing.

1. Download the lastest BIOS update from Sony site
2. Extract with Win-RAR and take the .ROM file
3. Then try flash that .ROM file using GUI version
4. I used program all block and restart after program options

After programed, while verifying, machine hang and I restarted it.
It boot again and load into widows, still no problem.
I check the Viao Control Centre and it shows update was successful and BIOS was the latest one.

Then, I tried the following
3. Patch the latest .ROM with the Patcher and I find patched successful
4. Then flash with the option program all block and restart after programming

After verify, machine hang again. But this time is bad one.
Machine still know power button and I heard DVD spins, but no more Viao screen and thats for all.

I tried taking out the battery which is located in very difficult to reach position. After that, I tried my luck, pack everything agian and fire the power button. My machine still silent.

I have to mention that I tried all those by my own risk and no one to blame.

Just wanna let you all know what was happend to me and to seek some advice.

Thanks to Levicki for showing this method and at least I was able to try.
I wont give up and will try in again until I get VT on my machine in future.

Ted

 

I noticed too that the VGN-Z series has the InsydeH2O BIOS, does that mean we are totally stucked? Wonder why Sony has so many variations of BIOS/firmware vendor.

Please let me know your experience with Z notebook hack.

 

Ted, I am terribly sorry to hear that man!

I have downloaded BIOS update for your notebook to check whether the patch works correctly.

I extracted the ROM file and patched it, and indeed it changes the proper location just as it is supposed to do.

Moreover, your ROM is Aptio just like mine (it is almost the same layout except for the version) so there is no reason for it not to work.

You shouldn't have interrupted the verification!
How have you managed to restart?

You see, when it hangs on shutdown after flashing it doesn't react to power button at all -- at least it didn't for me. That sounds really weird. Did the verification complete successfully this time or there were some blocks in different color?

You see, I believe that the problem on your end was caused by an incomplete flash. For me the verifying process went without hanging and all the blocks were verified as ok both times I flashed it.

Finally, when I said in the article that I have removed battery I meant laptop battery, not CMOS battery. I never had to remove that one.

I have added another item to the checklist in the article on my website, and I am reproducing it here as well just in case:

Uninstall Sony Notebook Utilities completely before attempting flashing just in case. You can create restore point, uninstall them and later restore the system to the previous state if the flashing succeeds.

There is more -- when I flashed my BIOS I didn't check "restart after programming", but when I closed the flash utility and tried to shutdown from the start menu my notebook hanged. Power button didn't work so I had to disconnect the AC and remove the battery to turn it off. I thought that updating the BIOS somehow messes up the shutdown process and that the flash utility has another way to successfully restart but it turns out that "restart after programming" doesn't work either so perhaps it would be better not to check "restart after programming" at all but just close the flash utility, and to power down by disconnecting the AC and removing the battery. I have updated the instructions to reflect that as well.

That type of BIOS cannot be patched using this method. Please do not even attempt to do it. Rather return the notebook to the store and ask for a full refund if you really need VT and buy a notebook from a more respectable manufacturer who has VT option available in BIOS.

 

Some good and some bad news:

1. I have figured out a permanent patch
2. I got another report of a bricked notebook

I have updated the article to reflect that.

What I really don't understand is how people manage to screw it up. I have flashed the BIOS on mine at least 10 times while developing and testing the patch. Now my VGN-FW190E has VT permanently enabled.

 

Yeah, I have also checked everything before patching and found all fit.
So, I went ahead.

I haven't interrupted, but the machine is hang about 5~10 mins, so I assume, it is totally hang. No, Ctrl+Alt+Del , not even power button can help it. So, I took out battery and power adapter.

One thing though, for the first time I flashed BIOS update without patching, machine hang while verifying. While, blocks color turn to Green place by place.

Also, I realized that not every block are programmed.
The first 8 blocks and last 24 blocks were left untouched, although I checked program all blocks.

Next time, when I flash with patched BIOS version, I realized that all blocked has been erased and programmed. Then verification also went well until the last block and then, at last all blocks turned green and it hanged.

I waited about 5 mins and feel like it happened as before and unplugged adapter. (this time no battery attached in my laptop)

Yeah, may be my OS or power management problem or some driver cause the problem as I am using Win Vista Ultimate 64bit on my baby.

I have tried both as trying for my luck removing CMOS battery.
... It very difficult to take out.

 

Hi Levicki.

Thanks for sharing your effort and making the tools available. Unfortunately mine is also bricked.

I use your unpatch tool on FW bios R1091Y0. I compared both the before and after image and only one byte was changed at location 001D9500 from 00 to 01. It seemed fine to me so I went ahead with the flash. I am running Vista Ultimate 64-bit by the way, and had flashed the BIOS before without problem.

I still have the before and after BIOS image, if you are interested I can email them to you.

I have access to another FW that is running BIOS R2050Y0 but I didn't try to patch this one.

Do you think perhaps the byte that need to be changed is in different location for different BIOS version?

 

pkuok,

Sorry for reading your message wrong. You said you bricked it.

I am really not sure what could be the problem though.

No.

The byte may be in a different location but the patcher is looking for a certain sequence of bytes (a signature).

That signature should appear only once in a BIOS, so it should always patch the right byte.

Perhaps I just got lucky, and my BIOS didn't have a checksum but your does?

 

I have two FWs. The one with R1091Y0 is bricked.

That could be it. Although if that's the reason then Sony is just too evil, and newer Sony bios would be much harder to tweak.

Has anybody else had any luck with either the R1091Y0 or R2050Y0 bios?

 

That should not have happened if you checked Program All Blocks. It seems that you have only had Program Main BIOS image checked.

It should not have hanged but allowed you to close the program. Most likely some Sony Utilities component made some BIOS call as soon as the flashing finished and that caused the hang.

I am sorry for not remembering to tell you to uninstall Sony Notebook Utilities -- it simply didn't occur to me because I didn't have them installed in Windows XP SP3 which I used for flashing. Hope that you will recover your notebook soon.

@all:

Procedure is risky. Even Sony asks you to accept an agreement before downloading the BIOS update as even with the unpatched BIOS the update process can still fail. There are many factors that may cause the failure, that is why I advise everyone not to try unless they have it under warranty and they don't mind going to the service center.

 

I already got my one back.
I have to give good credit to their service team for this.

At least, they show respect for the price I pay for.

 

Would you like to try again?

I have one success story to share, this is the email I have received today:

He has Vaio FW21Z with Intel T9400 CPU and R1091Y0 Aptio BIOS.

The patch he applied is my new permanent one. He flashed the BIOS from DOS using AFUDOS file.rom /P /B /N /E.

 

Yes, I do, Please.
I even sent an email to you regarding permanent patch request 3 days ago.

Still no reply

 

This is a really interesting thread. Thanks for the hard work levicki. As soon as I find where service centers are, I might give this a shot. I am running the R1090Y0 BIOS on an FW290, and there does not seem to be a BIOS update on Sony's eSupport website. It does not seem as if anyone who has reported in the thread uses this setup, so it should be interesting.

 

Dumped the BIOS using AFUDOS. I think that using AFUDOS would be better because there is less stuff to interfere with the flashing process. Maybe those that have tried it before used AFUWIN, and something interfered with the process (like the Sony Notebook Utilities or something else entirely). I am not saying that AFUWIN guarantees that the BIOS will be corrupted, but I think that the likelihood is higher.

 

hey guys,

saw this thread as i came back to the forum again and was studying the last hours igors work on bios reengineering.. (interesting intel page..)
i'm glad to hear that u found out a way to backup the bios (new afu version)- will try that tomorrow..

you are probably meaning the command box, right? its because i dont know a good way to get sata working under dos - and booting from usb seems to be impossible without changing settings at a service center (as u wrote)

well, as far as i can remember, vista is going more deeper with acpi-bios control - changing power profiles for example (including brightness) is different to the older xp-way - that deeper controldesign is probably a reason why the flash with the windows tool interferes with some bios requests from vista itself.. - but please dont blame me if i am wrong

and under xp of course everybody should better stop the sony services (event service, sony setting utilities, battery checker).. in my opinion its not neccessary to unstall the tools at all, just deactivate them under services or rename the shared library dlls (the services can't load without on the next reboot).. but deinstalling and rebooting is the easiest way..

 

oh and i forgot to ask, which things did you changed with the new release, igor?
another one byte?

i am really wondering why there is no checksum at all..

 

Which model do you have? I was able to boot off of a USB drive and dump my BIOS using AFUDOS. If I decide to flash the patched BIOS, I will boot to USB and use AFUDOS.

You could also boot from a bootable CD with AFUDOS and the patched BIOS loaded on it, and do it that way. The only problem with using a CD is that you will not be able to dump the BIOS unless you have SATA drivers (to dump to the hard drive) or USB drivers (to dump to a flash drive).

 

The lack of a checksum is interesting to me. I wonder what the /D option does, because it says that /D performs "Verification test of given ROM File without flashing BIOS." I wonder what it is verifying if it is not using some sort of checksum. Perhaps it is looking for a specific signature or something.

 

its just looking if your given rom file is identical to the burned one - there is no checksum for the file itself necessary. but modern systems tend not to accept any bios flash files without the right signature checksum (look for example at the cellphone flash files).. especially because of sonys drm politics its a wonder the vaios are still accepting everything..

 

Ahh - thanks for the clarification.

 

Send me a pm with your email. Perhaps it didn't get through.

You are right, using AFUDOS is better if you don't have a clean Windows XP SP3 install like I had when I was testing this.

No, not command prompt, pure DOS from a bootable floppy or a USB key if your BIOS supports it (mine doesn't but I heard that some do).

As for Vista/XP/Utilities, I guess that the safest way is to not have utilities installed and in that regard whether you use Vista or XP should not matter.

Nope, two other bytes instead of that one.

Will get back to you tomorrow, need some rest.

 

I was using AFUWIN to flash the R1090Y0 BIOS that resulted in my bricked FW. Hi Rascal, was that what you used as well?

Levicki, do you mind putting your patch on-line again? Perhaps just put a JavaScript prompt as a final warning. After all we knew what we were getting into, and all the FW are still under warranty so there's no (permanent) harm done. In fact it's better trying it now than later.

 

I tried the patch, and the process went fine. I used AFUDOS as opposed to AFUWIN. Thanks again levicki!

 

Thank you very much for your work, too. Worked with AFUDOS on VGN-FW21M BIOS R1090Y0. KVM on Linux works now!

 

No. I used AFUWINGUI and my BIOS version is R0280Y1.
I was running Win Vista Ultimate 64bits with tweaked and extracted drivers from other models. So Vaio Control Centre was also highly unstable.

 

i am sorry guy, my clarification was wrong - i have to correct my statement, because i had some time today to check things with afuwin..
the tool itself is taking any file with the /D option, without checking the machines bios. it is just checking for some special things like file.rom's size and a signature combination inside the file. but its not calculating a md5 like checksum for the file itself - that efi stuff is new to me, so please calm down..

igor: which tool are you using to debug the efi dumps (ollydebug for example)? i guess you dont dissamble it at all, because its written in a c like style..

 

Sorry, but I do mind.

I will not put it back until I have time to write a better worded procedure.

I am also considering writing a pure DOS utility which will check whether VT is supported, invoke AFUDOS to dump the .ROM file, patch it, and flash it back using AFUDOS in one go.

I agree, but as I said above I have a better idea then just letting you mess around on your own. Unfortunately, I am extremely busy right now with a very sick dog so I kindly ask for your patience. It is not like your warranty will expire in a few days anyway.

Well, just as I said in my article -- you could probably flash a dead cat into your BIOS without the flash utility noticing it.

The reason behind this is because flasher is unified and BIOSes are customized by the OEM so the flasher cannot know what is right checksum if the layout or content is different. The responsibility of checking for correct BIOS is passed onto the notebook vendors.

No. I am using a small utility I wrote myself to extract EFI drivers (which are PE executables) and then use IDA to disassemble those. I am not touching main (compressed) BIOS image.

@all:
As I said, please give me more time and I will provide a better solution.

 

they could insert the checksum at the end of the rom file itself and using it to check the rest of the bytes before.. but they didnt
do u have any format descriptions of these packed rom files?

sorry igor, i already knew your tool (thanx ) and used it to split the rom file to the mini-PEs - but i was wondering if you are using a runtime debugger to analyse them.. because there is no virtual sandbox for it..

IDA Pro okay

 

Who are "they"? AMI? Or OEMs? AMI doesn't care, and OEMs control BIOS distribution so there is no point of doing it.

1. If BIOS update you download from Sony is corrupted it won't self-extract so you won't be able to apply it.

2. If it isn't corrupted but it gets corrupted on extraction and/or during flashing due to broken RAM or HDD then it may even verify as OK but then it really doesn't matter if you brick the notebook because it was already ripe for servicing.

No. Try uefi.org, and try Mac hacking community, they seem to have a load of hand-made tools for EFI hacking.

I didn't bother with the packed part because I knew that the code I was after wasn't in there. Furthermore, the packed part is most likely protected by some sort of checksum so tampering with it is a 100% reliable way to brick the notebook.

Well I guess you could use some emulator (like Bochs or something with some heavy modifications) but it is not worth the effort. First you would have to fix those files because they aren't valid PE files -- IDA loads and disassembles them but Windows won't load them meaning they are most likely incomplete in one way or another. They are only good for studying and that is what I have done.

If you want to see what I am patching look at mini-PE #9 (search for binary string 6A 3A from the beginning of the file and look at the code below).

 

I used AFUWIN on Vista Ultimate x64. I wonder if the others bricked were also flashed from x64 Win directly.

Have you tried the permanent unlock patch with AFUDOS?

Thanks. Really appreciate you doing this.

For those interested and where supported, to enable boot from USB or external floppy, you need to go into BIOS and "enable external device" in the boot configuration, AND set 1st priority to external device.

 

Not yet. But I got everything in my hand and ready.

I am waiting for a moment as I got important things to do first.

Beside, I got my notebook back within this week and if anything goes wrong again, just dont want to go back service again and it will be sound like too strange for them.

 

Wow guys! This is really impressive! I'm glad to see someone with a FW21M successfully patches his BIOS already. I have an FW21E (which has a different processor, but is mainly the same machine, I think), so maybe in the future I can run with VT enable too!

On the downside: I don't think we have a service center in Holland, so bricking this thing would mean me driving to Brussels (which is a long way form here) to get it fixed... I'm not sure I want to try that yet...

The DOS utility sounds great, because it would save me from installing Windows. The idea of just booting from USB, patching the BIOS and running KVM almost makes me drool. I said it on the Intel forum and I'll say it here: I appreciate what you are doing trememdously and I hope I will be able to use your tool in the future too!

 

Yeah, KVM works great on my FW21M as VT is working now. The flashing process isn't that hard if you got the instructions and the patched file from Levicki. It booted FreeDOS from a USB flash drive, but booting from UBCD into DOS and loading the flash fileand AFUDOS from a different CD should also work fine. So, good luck.

 

Hi folks!

I just wanted to share my success, and express my gratitude to Mr. Levicki.
Last week I contacted him by mail with the question if my Vaio was possible to patch for enabling VT. My notebook is a FW21Z with bios R1091Y0. He checked my bios and said it can be patched since corresponding bios module is one like he had already dealt with.
I followed his instructions for how to patch the bios file, after that I used AfuDos to flash the rom from a bootable usb stick with plain DOS.
Everything just worked fine. I could run 64 bit OS in virtual. Even sleep mode and hibernating the host works while running virtual computers.

Very fine job, thank you a lot!

 

Guys, the tool for automated patching is out, get it from my website Downloads section:
http://www.levicki.net/

Bear in mind that I haven't tested it (my notebook is already patched so I would have to unpatch it first) so I cannot guarantee that it will work. Read the included readme.txt very carefully if you decide to try it out.

Remember -- I did my best to make it easy and safe even though I was under a lot of stress lately. If it still doesn't work for you, then I am afraid that there is nothing more I can do.

 

Thanks Levicki, I will try it when I get my FW back and let you know how it turns out. Sorry about your dog.

 

Hi,
First of all thanks for your great work levicki. So my question is had anybody tried the patch on a european Vaio Z11? Did it even work? At the boot it says H2O Bios. It ist the same like the AMIaptio?

Regards
PHils

 

You are welcome. At least writing those 11.5 KB of C code kept me distracted from sorrow for a few hours last night.

It has already been downloaded 8 times, yet no one has tried it and reported back.

I have mentioned in the readme file that there is a hidden command line option (-p, -P, /p, /P) which turns on the so called PRETEND mode -- everything is done including the BIOS dumping and patching, except for the actual flashing. You may use it to get a chance to verify the patched BIOS file by hand and to see how the program works in general.

I have tested everything except flashing on my notebook while developing it but since I am only calling AFUDOS.EXE to flash the BIOS it should be safe.

Program is doing very extensive checking for pre-requisites (CPU, VT support, flash size, BIOS, etc).

The only part that might have problems is DMI table parsing which is to be completely honest pain in the a** to code, not to mention the possibility that the table can be malformed. In that case program will most likely error out, and won't even let you dump the BIOS, or it may hang or crash, again without causing any damage.

If that happens you can use DMIDUMP.EXE to get DMITABLE.BIN, and post it somewhere for me to check it out (but note that your notebook serial number will be in there so you might want to archive it with a password which you will send to me via PM).

@PHils:
You have an answer to that question few posts above. It is not the same and there is no patch nor it will ever be as far as I am concerned because the biggest chunk of the BIOS image is compressed, and most likely has a checksum, not to mention completely different layout and code.

 

I found it thanks...
Another question does anybody ever tried to aply the BZ11 or BZ12 Bios Update to run on Z11? It has also H2O Bios.

 

Igor,
I do feel sorry for your faithful friend. RIP for her.

I still havent try the patch, and I will let everyone know the outcome when I get a chance to try.

 

Guys!

Listen to me, I did it, I did it.
My god. It works now.

After been so desperate, I finally cannot live any longer with the restrictoin and I tried again using Igor's the latest fully auto patch.

It works like a charm and I feel like the dream comes true.

Thanks a million times, Igor Levicki. If I would live close to you, I will surely bring you out for a decent dinner with a full package.

For those of you who wanna try, here is my info.
My box is SR VGN-SR13GN with AMI Aptio BIOS version R0280Y1.
I have bricked once while flashing from Win Vista 64bits.

Trust me, it was a thrilling moment for me to try again within a week.
But this time, with Igor's auto patch and flash, it work like a charm.

Now, I love my box more than ever I did. (Who could resist being VT enabled on their stylish VAIO?)

If you guys wanna see more about this success story, just take a look at these screenshots.

 

I patched successfully my VGN-FW11LR with BIOS R1091Y0!
A huge thank you, Levicki!!!

 

Another success on VGN-SR11M. Flashed from USB bootable FreeDOS key. At the end of 3rd flash phase a message "unexpected switch to real mode" from DOS extender hanged the process but... BIOS was properly patched.
VT enabled on both cores
Thank you very much indeed Levicki.

 

That might or might not work depending on the hardware involved.

Furthermore, BIOS may have certain modules (for example integrated VGA BIOS if you have VGA on board) and another one might not have that, etc.

One has to be extra carefull when attempting cross-flashing.

Good to know that something like that can happen and even better that it didn't brick your notebook. Was that message after AFUDOS has exited/finished or before that? It is very important to know.

Just in case, everyone with the same model should use pretend mode (-p) and then after answering "Y" to all questions flash the BIOS manually by typing:

Code:

AFUDOS VTPATCH.ROM /P /B /N /E

That will greatly reduce the risk of extender interfering with the flash.

@all:
Please let me know if you have also experienced the same problem, perhaps it is fixable or if it isn't it might be better for me to remove the flashing part and let you flash it manually as I described above.

EDIT:
I also need to know which version of DOS you were using -- both those who had problems and those who hadn't, as well as were there other memory managers (HIMEM.SYS/EMM386.EXE) loaded or not.