an x86 BIOS reverse engineering article

[Pinczakko]

Probably some of you already read the article, I really sorry for posting this here on that case. And I wish this post is not considered as spamming :(. Here's the link :
_http://www.geocities.com/mamanzip/Articles/Award_Bios_RE/Award_Bios_RE_guide.html
snippet of the contents :


Table of Contents



* ** Foreword

* ** Prerequisite

* * * * *o PCI BUS

* * * * *o ISA BUS

* ** Some Hardware "Peculiarities"

* ** Some Software "Peculiarities"

* ** Our Tools of Trade

* ** Award BIOS File Structure

* ** Disassembling the BIOS

* * * * 1. Bootblock

* * * * 2. System BIOS a.k.a Original.tmp


It is actually my work on my computer's Award BIOS this last one month. I hope it would be beneficial to some who might need it.

Regards,

Pinczakko

[Devine9]

I'm sure it will be interesting. I'll be reading it later.
Thanks,

Devine Right [RET]

[Pinczakko]

I've been adding quite significant stuff into the article this last several months (years?) :P

Table of Contents (New)

* 1. Foreword
* 2. Prerequisite
o 2.1. PCI BUS
o 2.2. ISA BUS
* 3. Some Hardware Peculiarities
o 3.1. BIOS Chip Addressing
o 3.2. Obscure Hardware Port
o 3.3. "Relocatable" Hardware Port
o 3.4. Expansion ROM Handling
* 4. Some Software Peculiarities
o 4.1. Call Instruction Peculiarity
o 4.2. Retn Instruction Peculiarity
* 5. Our Tools of Trade
o 5.1. What do we need anyway?
o 5.2. Intro to IDA Pro Techniques
+ 5.2.1. Introducing IDA Pro
+ 5.2.2. IDA Pro Scripting and Key Bindings
* 6. Award BIOS File Structure
o 6.1. The Compressed Components
o 6.2. The Pure Binary Components
o 6.3. The Memory Map In The Real System (Mainboard)
* 7. Disassembling the BIOS
o 7.1. Bootblock
+ 7.1.1. "Virtual Shutdown" routine
+ 7.1.2. Chipset_Reg_Early_Init routine
+ 7.1.3. Init_Interrupt_n_PwrMgmt routine
+ 7.1.4. Call To "Early Silicon Support" Routine
+ 7.1.5. Bootblock Is Copied And Executed In RAM
+ 7.1.6. Call to bios decompression routine and the jump into decompressed system bios
# 7.1.6.1. Enable FFF80000h-FFFDFFFFh decoding
# 7.1.6.2. Copy lower 128KB of BIOS code from ROM chip into RAM
# 7.1.6.3. Disable FFF8_0000h-FFFD_FFFFh decoding
# 7.1.6.4. Verify checksum of the whole compressed BIOS image
# 7.1.6.5. Look for the decompression engine
# 7.1.6.6. Decompress the compressed BIOS components
* 7.1.6.6.a. The format of the LZH level-1 compressed bios components
* 7.1.6.6.b. The location of various checksums
* 7.1.6.6.c. The key parts of the decompression routine
# 7.1.6.7. Shadow the BIOS code
# 7.1.6.8. Enable the microprocessor cache then jump into the decompressed system BIOS
o 7.2. System BIOS a.k.a Original.tmp
+ 7.2.1. Entry point from "Bootblock in RAM"
+ 7.2.2. The awardext.rom and Extension BIOS Components (lower 128KB bios-code) Relocation Routine
+ 7.2.3. Call to the POST routine a.k.a "POST jump table execution"
+ 7.2.4. The "segment vector" Routines
+ 7.2.5. "chksum_ROM" Procedure
+ 7.2.6. Original.tmp Decompression Routine for The "Extension_BIOS Components"
+ 7.2.7. Microcode Update Routine
* 8. Rants and Raves
* 9. Closing

Happy reading ;)

[haggar]

Wow, that i more a book than just an arcticle. I sow your post long ago on crackmes.de. Nice to see that you still work on this.

[Pinczakko]

I'm working on it in the weekend. It's fun.

Anyway, it will be more fun when I'm done with something more interesting BIOS stuff ;).

Thx for the appreciation.