Gigabyte GA-C1037UN UEFI/BIOS mod: how to load default/optimized settings in case of low CMOS battery

BIOS/UEFI Modding BIOS Modding Guides and Problems
1

Hi everyone :slight_smile: That’s the first time I write on this forum. I’m a beginner in BIOS modding, and I’m stuck in trying to resolve a quite simple problem. Maybe you can help me

I’ve got a motherboard Gigabyte GA-C1037UN (that’s the product page and here the BIOS download link) with an UEFI/BIOS (derived from AMI Aptio one).

Basically, I want to modify two things:
- First (and most important one) after instering or removing battery, I turn on the computer and the UEFI immediatly asks me to choose between: “load optimezed settings and boot” (or something similar), “load optimezed settings and REboot”, “enter BIOS”. I want it to load the default/optimized settings without asking anything
- Second, I want to change the CMOS default/optimized settings with the one I want. This thing seems to be easy to do. I found AMIBCP v4.55.0070 (version 4.53 does not work) and it lets me change the settings I want. So I think that this second point is almost done.

The problem is going on with the first point. First I tried to change the settings in AMIBCP > “Setup Configuration” tab > Recovery. I found the option “Reset NVRAM” (disabled for failsafe settings, enable for optimized settings) and “Main block update” (disabled for failsafe settings, enable for optimized settings too). I really don’t know what are these options. Here’s a screenshot:



Link in case the image does not load: http://imgur.com/Dh9O9D9

I tried to brute-force some of the possible combination (all 4 disabled, all four enable, …) but it always display the message (after insering or removing the battery, I mean).

Then I tried to analyze the firmware with AMI Aptio UEFI MMTool v5.0.0.7 (I found the guide on this forum - I mean this). If I undestood how it works, this tool should let you extract the single modules of the BIOS (already decompressed),you modify the modules you want and then it lets you substitute the default module with the “custom” one. Am I right?
After running the tool, I saved the “report”. It’s this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
 
+------------------------------------------------------------------------+
| MMTOOL  5.00.0007						         |
| Copyright (c)2014 American Megatrends, Inc.                                 |
+------------------------------------------------------------------------+
| Firmware Image Information                                                  |
+-----------------------------------------------------------------------------+
| Image Size : 400000   PI Specification Level: 1.0                           |
+------+-------------------------------+--------------+-----------+-----------+
|  FV  |            FV TYPE            |   Location   |   Length  |    FFSs   |
+------+-------------------------------+--------------+-----------+-----------+
|  00  |          FFS FV               |   00180000   |  020000   |    001    |
|  01  |          FFS FV               |   001C0000   |  1A0000   |    003    |
|  02  |          Nested FV            |   00000000   |  5CC000   |    171    |
|  03  |          Boot Block FV        |   00360000   |  0A0000   |    041    |
+------+-------------------------------+--------------+-----------+-----------+
| Nested Firmware Volume Information                                          |
+-----------------------------------------------------------------------------+
|  FV  |            Nesting Information       	      |   Length  |    FFSs   |
+-----------------------------------------------------------------------------+
|  02  |  Parent Fv : 01        Parent FFS : 00       |   5CC000  |    171    |
+------+-------------------------------+--------------+-----------+-----------+
| NCB Information                                                             |
+-----------------------------------------------------------------------------+
| NCB No : 0                         Location :  00000000   Length :  180000  |
| NCB No : 1                         Location :  001A0000   Length :  020000  |
+-----------------------------------------------------------------------------+
| Driver Information                                                          |
+-----------------------------------------------------------------------------+
| Firmware Volume : 00               Location :  00180000   Length :  020000  |
+---+---------------+------------------------------------+--------+------+----+
|NO |    FileName   |               GUID                 |Location| Size |Type|
+---+---------------+------------------------------------+--------+------+----+
|000|               |CEF5B9A3-476D-497F-9FDC-E98143E0422C|00180048|01FFB8|RAW |
+---+---------------+------------------------------------+--------+------+----+
| Bytes Free       : 000000 (  0 KB)    Bytes Used       : 020000 (128 KB)    |
+-----------------------------------------------------------------------------+
| Firmware Volume : 01               Location :  001C0000   Length :  1A0000  |
+---+---------------+------------------------------------+--------+------+----+
|NO |    FileName   |               GUID                 |Location| Size |Type|
+---+---------------+------------------------------------+--------+------+----+
|000|               |AE717C2F-1A42-4F2B-8861-78B79CA07E07|001C0048|16AA15|FV  |
|001|               |17088572-377F-44EF-8F4E-B09FFF46A070|0032AA78|020818|RAW |
|002|S3Restore      |EFD652CC-0E99-40F0-96C0-E08C089070FC|0034B290|0025BC|PEIM|
+---+---------------+------------------------------------+--------+------+----+
| Bytes Free       : 0127C8 ( 73 KB)    Bytes Used       : 18D838 (1590 KB)    |
+-----------------------------------------------------------------------------+
| Firmware Volume : 02               Location :  00000000   Length :  5CC000  |
+---+---------------+------------------------------------+--------+------+----+
|NO |    FileName   |               GUID                 |Location| Size |Type|
+---+---------------+------------------------------------+--------+------+----+
|000|IntelSaGopDriver|5C266089-E103-4D43-9AB5-12D7095BE2AF|00000048|001335|DRVR|
|001|IntelIvbGopDriv|5BBA83E6-F027-4CA7-BFD0-16358CC9E123|0000137D|00B104|DRVR|
|002|IntelSnbGopDriv|8D59EBC8-B85E-400E-970A-1F995D1DB91E|0000C481|00AE64|DRVR|
|003|               |17088572-377F-44EF-8F4E-B09FFF46A070|000172E5|020818|RAW |
|004|CpuDxe         |E03ABADF-E536-4E88-B3A0-B77F78EB34FE|00037AFD|0034A1|DRVR|
|005|FileSystem     |93022F8C-1F09-47EF-BBB2-5814FF609DF5|0003AF9E|007EC1|DRVR|
|006|               |DAC2B117-B5FB-4964-A312-0DCC77061B9B|00042E5F|00955D|FRFM|
|007|               |9221315B-30BB-46B5-813E-1B1BF4712BD3|0004C3BC|0006F1|FRFM|
|008|CORE_DXE       |5AE3F37E-4EAE-41AE-8240-35465B5E81EB|0004CAAD|16EB41|DXEC|
|009|Runtime        |CBC59C4A-383A-41EB-A8EE-4498AEA567E4|001BB5EE|0125E1|DRVR|
|010|ReFlash        |70E1A818-0BE1-4449-BFD4-9EF68C7F02A8|001CDBCF|00332D|DRVR|
|011|PciBus         |3C1DE39F-D207-408A-AACC-731CFB7F1DD7|001D0EFC|00DDD9|DRVR|
|012|AmiBoardInfo   |9F3A0016-AE55-4288-829D-D22FD344C347|001DECD5|00B9C9|DRVR|
|013|EBC            |13AC6DD0-73D0-11D4-B06B-00AA00BD6DE7|001EA69E|0037D9|DRVR|
|014|It8728SmmFeatur|078485F1-0C1F-4B1B-AFB3-4A09C0EF87A1|001EDE77|0020C9|DRVR|
|015|IT8728SioAcBack|AA893E19-A641-4819-AD23-011B7C24250D|001EFF40|0013AD|DRVR|
|016|CpuInitDxe     |62D171CB-78CD-4480-8678-C6A2A797A8DE|001F12ED|00E4A1|DRVR|
|017|SmmRelocDxe    |7FED72EE-0170-4814-9878-A8FB1864DFAF|001FF78E|000F69|DRVR|
|018|SmmRelocPeim   |ABB74F50-FD2D-4072-A321-CAFC72977EFA|002006F7|000BAD|PEIM|
|019|SmmBaseRuntime |5552575A-7E00-4D61-A3A4-F7547351B49E|002012A4|004F6D|DRVR|
|020|SmmDisp        |9CC55D7D-FBFF-431C-BC14-334EAEA6052B|00206211|0056C1|DRVR|
|021|SmmThunk       |8D3BE215-D6F6-4264-BEA6-28073FB13AEA|0020B8D2|000CD5|DRVR|
|022|CpuPolicyDxe   |15B9B6DA-00A9-4DE7-B8E8-ED7AFB88F16E|0020C5A7|00158D|DRVR|
|023|MicrocodeUpdate|F3331DE6-4A55-44E4-B767-7453F7A1A021|0020DB34|0058A1|DRVR|
|024|CpuSmmSaveRes  |326E7ACE-2133-1BA2-800A-B9C00ACCB17D|002133D5|001ACD|DRVR|
|025|CpuSpSMI       |116E1ACF-2533-4CC2-820A-BBC10A2AB07C|00214EA2|001595|DRVR|
|026|SBDXE          |B7D19491-E55A-470D-8508-85A5DFA41974|00216437|007E35|DRVR|
|027|SBRun          |E23F86E1-056E-4888-B685-CFCD67C179D4|0021E26C|0025BD|DRVR|
|028|               |22046D50-F390-498C-92E5-5BA4F8E7F8B6|00220829|00020E|FRFM|
|029|SmmChildDispatc|753630C9-FAE5-47A9-BBBF-88D621CD7282|00220A37|0032C9|DRVR|
|030|SmmChildDispatc|E53734A3-E594-4C25-B1A2-081445650F7F|00223D00|0047E9|DRVR|
|031|AcpiModeEnable |750890A6-7ACF-4F4F-81BD-B400C2BEA95A|002284E9|002411|SMM |
|032|SleepSmi       |6298FE18-D5EF-42B7-BB0C-2953283F5704|0022A8FA|002715|DRVR|
|033|SBSMI          |7B8DB049-C7C7-4D3B-809F-926DEE47CCA2|0022D00F|0032F1|DRVR|
|034|PchSpiWrap     |B716A6F8-F3A1-4B8E-8582-5A303F1CDD64|00230300|000E29|DRVR|
|035|WdtAppDxe      |CE366D33-B057-4C03-8561-CAF17738B66F|00231129|0012F5|DRVR|
|036|SataDriver     |91B4D9C1-141C-4824-8D02-3C298E36EB3F|0023241E|02DDF9|DRVR|
|037|ActiveBios     |BFD59D42-FE0F-4251-B772-4B098A1AEC85|00260217|000909|DRVR|
|038|IoTrap         |2374EDDF-F203-4FC0-A20E-61BAD73089D6|00260B20|0017E1|DRVR|
|039|IntelLegacyInte|C1C418F9-591D-461C-82A2-B9CD96DFEA86|00262301|000515|DRVR|
|040|PchInitDxe     |DE23ACEE-CF55-4FB6-AA77-984AB53DE823|00262816|00BA2D|DRVR|
|041|PchSmiDispatcher|B0D6ED53-B844-43F5-BD2F-61095264E77E|0026E243|005E55|DRVR|
|042|PchPcieSmm     |ACAEAA7A-C039-4424-88DA-F42212EA0E55|00274098|002681|DRVR|
|043|PchReset       |BB1FBD4F-2E30-4793-9BED-74F672BC8FFE|00276719|001785|DRVR|
|044|PchS3Peim      |271DD6F2-54CB-45E6-8585-8C923C1AC706|00277E9E|0016DC|PEIM|
|045|PchS3Support   |08F2C63B-08DE-4CCD-8670-ACFE644A1C48|0027957A|000D45|DRVR|
|046|SataController |BB65942B-521F-4EC3-BAF9-A92540CF60D2|0027A2BF|001A29|DRVR|
|047|PchSerialGpio  |FC1B7640-3466-4C06-B1CC-1C935394B5C2|0027BCE8|000DED|DRVR|
|048|SmartTimer     |90CB75DB-71FC-489D-AACF-943477EC7212|0027CAD5|000909|DRVR|
|049|PchSmbusDxe    |E052D8A6-224A-4C32-8D37-2E0AE162364D|0027D3DE|001A19|DRVR|
|050|SmmControl     |A0BAD9F7-AB78-491B-B583-C52B7F84B9E0|0027EDF7|000C29|DRVR|
|051|PchSpiSmm      |27F4917B-A707-4AAD-9676-26DF168CBF0D|0027FA20|0025E5|DRVR|
|052|PchSpiRuntime  |C194C6EA-B68C-4981-B64B-9BD271474B20|00282005|002E8D|DRVR|
|053|PchSmbusSmm    |59287178-59B2-49CA-BC63-532B12EA2C53|00284E92|001459|DRVR|
|054|WdtDxe         |5AAB83E5-F027-4CA7-BFD0-16358CC9E453|002862EB|000BE1|DRVR|
|055|NBDXE          |E4ECD0B2-E277-4F2B-BECB-E4D75C9A812E|00286ECC|0054A1|DRVR|
|056|NBSMI          |D933DEDE-0260-4E76-A7D9-2F9F2440E5A5|0028C36D|001E3D|DRVR|
|057|MiscSubclassDxe|16271FCA-55D9-4A33-93FC-5A3EB128DE21|0028E1AA|001125|DRVR|
|058|UpdateMemoryRec|24CCD374-3DF6-4181-86F6-E3C66920A145|0028F2CF|001BF5|DRVR|
|059|LegacyRegion2  |FE6F8ACD-55A6-4C6B-B448-64E659DE94B3|00290EC4|000D9D|DRVR|
|060|AtaCtlrDriver  |262A5367-7775-4518-A3EC-84981AD4A1C0|00291C61|001B45|DRVR|
|061|AtaCtlrDxe     |004E431F-3E44-43AC-89B9-F79708BD3C09|002937A6|001E89|DRVR|
|062|AtaCtlrSmm     |53888A04-B140-4B2C-AA9C-C89E1F90CCD0|0029562F|001499|DRVR|
|063|OnboardControll|1601E050-BE0C-41B7-8F96-9F48F72B7E26|00296AC8|001ABD|DRVR|
|064|AsUndiDxe      |603DC12F-BF47-4683-9D56-C8893C638A88|00298585|009A85|DRVR|
|065|RtkUndiDxe     |2851E234-20FD-4D1E-9041-DCB8F3025CAE|002A200A|0161D1|DRVR|
|066|PciExpressDxe  |A89EC8E0-0BA1-40AA-A03E-ABDDA5295CDE|002B81DB|002BA1|DRVR|
|067|PciHostBridge  |8D6756B9-E55E-4D6A-A3A5-5E4D72DDF772|002BAD7C|002AED|DRVR|
|068|SmBiosMemory   |EDA39402-F375-4496-92D3-83B43CB8A76A|002BD869|002A75|DRVR|
|069|SmmAccess      |1323C7F8-DAD5-4126-A54B-7A05FBF41515|002C02DE|000D55|DRVR|
|070|               |27E569D5-0AFC-4D8F-8C90-783AC4A318AB|002C1033|00009F|FRFM|
|071|SaInitDxe      |DE23ACEE-CF55-4FB6-AA77-984AB53DE811|002C10D2|0060F5|DRVR|
|072|BdatAccessHandl|6DB9486F-6AF6-4090-984D-238482CE3EA4|002C71C7|0008E9|DRVR|
|073|SaLateInitSmm  |2D1E361C-7B3F-4D15-8B1F-66E551FABDC7|002C7AB0|003C01|DRVR|
|074|               |878AC2CC-5343-46F2-B563-51F89DAF56BA|002CB6B1|0010D1|RAW |
|075|               |0F729F33-25C1-41A7-86B2-23A737A91823|002CC782|0010D1|RAW |
|076|PciTestAdapter |3F79BEE2-6B14-4B5E-916B-101D8F7E15BE|002CD853|0012F1|DRVR|
|077|ACPI           |16D0A23E-C09C-407D-A14A-AD058FDD0CA1|002CEB44|00984D|DRVR|
|078|S3Save         |26A2481E-4424-46A2-9943-CC4039EAD8F8|002D8391|003249|SMMD|
|079|S3Restore      |EFD652CC-0E99-40F0-96C0-E08C089070FC|002DB5DA|0025BC|PEIM|
|080|CryptoDxe      |20D8FFFE-15C3-4EA9-9D28-CFE2745D78F3|002DDB96|0111D5|DRVR|
|081|AHCI           |8F5A2E02-538C-4D59-B920-C4786ACBC552|002EED6B|006915|DRVR|
|082|AINT13         |67820532-7613-4DD3-9ED7-3D9BE3A7DA63|002F5680|001C31|DRVR|
|083|AhciSmm        |BC3245BD-B982-4F55-9F79-056AD7E987C5|002F72B1|002951|DRVR|
|084|BDRDXE         |5E06E249-3A4C-49B5-8A37-02058CC12691|002F9C02|004151|DRVR|
|085|BDRSMM         |ACA87EA5-D839-4F41-BCCE-9E19E9F2C2AD|002FDD53|004235|DRVR|
|086|DualBiosDxe    |C74D1B0B-91B1-484A-A038-FE7A0847AA07|00301F88|005889|DRVR|
|087|DualBiosSMM    |88B468B3-A48B-4B87-ABE2-8E56DFFDAF8D|00307811|0002DD|DRVR|
|088|Slp10          |8E477676-55FD-48CF-9210-15A99B27D740|00307AEE|000EA9|DRVR|
|089|SlpSupport     |4C494E55-5849-5342-4554-544552212121|00308997|000FB9|DRVR|
|090|KbcEmul        |3B24F79D-91A0-46FF-BE29-458AE211FAC5|00309950|004115|DRVR|
|091|CSMCORE        |A062CF1F-8473-4AA3-8793-600BC4FFE9A8|0030DA65|040B85|DRVR|
|092|               |A08276EC-A0FE-4E06-8670-385336C7D093|0034E5EA|000435|FRFM|
|093|BIOSBLKIO      |25ACF158-DD61-4E64-9A49-55851E9A26C7|0034EA1F|0033F5|DRVR|
|094|CsmVideo       |29CF55F8-B675-4F5D-8F2F-B87A3ECFD063|00351E14|004735|DRVR|
|095|               |60AC3A8F-4D66-4CD4-895A-C3F06E6665EE|00356549|0000D6|FRFM|
|096|iFfsDxe        |B6B9295F-CABF-4CEC-BB14-FE4246F2173A|0035661F|001C89|DRVR|
|097|iFfsSmm        |43172851-CF7E-4345-9FE0-D7012BB17B88|003582A8|001A05|DRVR|
|098|iFfsDxePolicyIn|DDB412A6-E3F3-4E9E-90A3-2A991270219C|00359CAD|001035|DRVR|
|099|HeciDxe        |55E76644-78A5-4A82-A900-7126A5798892|0035ACE2|002FC1|DRVR|
|100|HeciSmm        |921CD783-3E22-4579-A71F-00D74197FCC8|0035DCA3|001AD5|DRVR|
|101|PlatformReset  |9A9A912B-5F53-4586-8820-704485A29D21|0035F778|000DFD|DRVR|
|102|MdesStatusCodeD|DF5CD25A-8E55-46BA-8CDA-BC7DB7BF9C64|00360575|000C85|DRVR|
|103|MePlatformPolicy|BA67550C-3628-4137-A53E-42660E081604|003611FA|00148D|DRVR|
|104|MePciPlatform  |459C70C3-9344-4484-9F93-7822530D0D11|00362687|0007CD|DRVR|
|105|IccPlatform    |14257B56-BDA2-4FAF-8E4F-C885DF75583C|00362E54|00174D|DRVR|
|106|IccOverClocking|5BBA83E5-F027-4CA7-BFD0-16358CC9E123|003645A1|0049D1|DRVR|
|107|Smbios131      |2B341C7B-0B32-4A65-9D46-E1B3ABD4C25C|00368F72|000EE5|DRVR|
|108|MERecoveryDxe  |F1FCD66F-8966-441E-909C-77F211AB9C3E|00369E57|00442D|DRVR|
|109|               |821D110C-D0A3-4CF7-AEF3-E28088491704|0036E284|040025|FRFM|
|110|MouseDriver    |C7A7030C-C3D8-45EE-BED9-5D9E76762953|003AE2A9|004009|DRVR|
|111|OemActivation  |76D5CF91-0C55-434E-97C2-D2825C82E610|003B22B2|001D85|SMMD|
|112|AcpiPlatform   |8B5FBABD-F51F-4942-BF16-16AAA38AE52B|003B4037|003161|DRVR|
|113|AcpiPlatformSmi|DFD8D5CC-5AED-4820-A2B6-5C55E4E640EF|003B7198|001A91|DRVR|
|114|PlatformInfo   |1314216C-CB8D-421C-B854-06231386E642|003B8C29|00100D|DRVR|
|115|SMBIOSUpdateData|B98999A4-E96F-475A-99FC-762126F50F5A|003B9C36|000AA5|DRVR|
|116|               |FB045DB2-598E-485A-BA30-5D7B1B1BD54D|003BA6DB|0001A7|FRFM|
|117|FastBootOption |A58C5D1D-C22B-4845-90BC-8C94FCE96457|003BA882|001BE1|DRVR|
|118|PowerManagement|8C783970-F02A-4A4D-AF09-8797A51EEC8D|003BC463|004D1D|DRVR|
|119|               |299141BB-211A-48A5-92C0-6F9A0A3A006E|003C1180|000937|FRFM|
|120|AmiPpmPolicy   |1CE12314-AFBC-11F0-8A3E-AB44B8EE3120|003C1AB7|00197D|DRVR|
|121|QFlash         |132EC73B-3025-4FBF-B193-8ACB50EFBD89|003C3434|007B99|DRVR|
|122|EzFileBrowser  |56B70419-7103-4D0E-83F4-F3546BD21E40|003CAFCD|00400D|DRVR|
|123|SecureBootMod  |A95C1D60-CB9F-4BD8-A030-3F1C4A185156|003CEFDA|00179D|DRVR|
|124|               |FBF95065-427F-47B3-8077-D13C60710998|003D0777|001159|FRFM|
|125|               |9D7A05E9-F740-44C3-858B-75586A8F9C8E|003D18D0|00064D|FRFM|
|126|CmosManagerSmm |6869C5B3-AC8D-4973-8B37-E354DBF34ADD|003D1F1D|0037C1|DRVR|
|127|GenericComponen|199FD111-0785-4132-A9B3-1F66573F0060|003D56DE|01CB5D|DRVR|
|128|SMBiosBoard    |CEF68C66-06AB-4FB3-A3ED-5FFA885B5725|003F223B|001A89|DRVR|
|129|SMBios64       |B13EDD38-684C-41ED-A305-D7B7E32497DF|003F3CC4|006349|DRVR|
|130|SmbiosGetFlashD|DED7956D-7E20-4F20-91A1-190439B04D5B|003FA00D|000F2D|DRVR|
|131|               |DAF4BF89-CE71-4917-B522-C89D32FBC59F|003FAF3A|0019F1|FRFM|
|132|SmbiosDMIEdit  |E2A74738-8934-48F5-8412-99E948C8DC1B|003FC92B|003805|DRVR|
|133|SMIFlash       |BC327DBD-B982-4F55-9F79-056AD7E987C5|00400130|005A19|DRVR|
|134|SmiVariable    |BE216BA8-38C4-4535-A6CA-5DCA5B43ADDF|00405B49|001D49|DRVR|
|135|AMITSE         |B1DA0ADF-4F77-4070-A88E-BFFE1C60529A|00407892|08535D|DRVR|
|136|               |A59A0056-3341-44B5-9C9C-6D76F7673817|0048CBEF|0000A7|FRFM|
|137|               |63819805-67BB-46EF-AA8D-1524A19A01E4|0048CC96|004EBD|FRFM|
|138|               |EFCB2FDB-0662-4A59-A5D7-03033EA97CAE|00491B53|0104C9|FRFM|
|139|SmmRuntime     |A56897A1-A77F-4600-84DB-22B0A801FA9A|004A201C|001479|DRVR|
|140|DpcDxe         |399CF3A7-82C7-4D9B-9123-DB11842986D3|004A3495|0008B9|DRVR|
|141|ArpDxe         |8DD91798-EE87-4F0E-8A84-3F998311F930|004A3D4E|002F59|DRVR|
|142|SnpDxe         |3DD7A87B-D5BD-44AF-986F-2E13DB5D274C|004A6CA7|0037F9|DRVR|
|143|MnpDxe         |C30B94E3-C8F2-4AB0-91AB-FA8DF621B1C9|004AA4A0|004B59|DRVR|
|144|UefiPxeBcDxe   |0EF8A3B1-388A-4B62-8BE6-C7877D50AEDF|004AEFF9|00D025|DRVR|
|145|NetworkStackSet|0029DE6A-E024-4EB8-A91D-9F23AA1F4E92|004BC01E|000C19|DRVR|
|146|TcpDxe         |B1625D3C-9D2D-4E0D-B864-8A763EE4EC50|004BCC37|00BB59|DRVR|
|147|Dhcp4Dxe       |8DD9176E-EE87-4F0E-8A84-3F998311F930|004C8790|006F1D|DRVR|
|148|Ip4ConfigDxe   |8F9296EF-2880-4659-B857-915A8901BDC8|004CF6AD|0047C5|DRVR|
|149|Ip4Dxe         |8F92960F-2880-4659-B857-915A8901BDC8|004D3E72|008BD9|DRVR|
|150|Mtftp4Dxe      |61AFA223-8AC8-4440-9AB5-762B1BF05156|004DCA4B|0056BD|DRVR|
|151|Udp4Dxe        |10EE5462-B207-4A4F-ABD8-CB522ECAA3A4|004E2108|005719|DRVR|
|152|Dhcp6Dxe       |8DD9176D-EE87-4F0E-8A84-3F998311F930|004E7821|00689D|DRVR|
|153|Ip6Dxe         |8F92960E-2880-4659-B857-915A8901BDC8|004EE0BE|010459|DRVR|
|154|Mtftp6Dxe      |61AFA251-8AC8-4440-9AB5-762B1BF05156|004FE517|00565D|DRVR|
|155|Udp6Dxe        |10EE54AE-B207-4A4F-ABD8-CB522ECAA3A4|00503B74|0053D9|DRVR|
|156|GbtCustomizeBut|4DCBF9BA-DEC1-42B0-8A09-01555694F6CF|00508F4D|0013AD|DRVR|
|157|RTCWakeup      |534A6A34-CF78-4A56-BEDB-CB49A8D8060C|0050A2FA|001739|DRVR|
|158|UHCD           |580DD900-385D-11D7-883A-00500473D4EB|0050BA33|00BF71|DRVR|
|159|USBRT          |04EAAAA1-29A1-11D7-8838-00500473D4EB|005179A4|011B61|SMM |
|160|USBINT13       |4C006CD9-19BA-4617-8483-609194A1ACFC|00529505|001A45|DRVR|
|161|SmartFanCtrlDXE|D8AAB432-93CC-48D2-9F34-3496CAF92185|0052AF4A|0015E1|DRVR|
|162|OemLOGO        |7D1686A9-1EE3-446C-825C-5A26F449CE52|0052C52B|001061|DRVR|
|163|MyOemLogo1     |86EE84E1-3375-41A1-AFBA-847BD29663AA|0052D58C|000A98|FRFM|
|164|MyOemLogo2     |86EE84E2-3375-41A1-AFBA-847BD29663AA|0052E024|00011B|FRFM|
|165|OEMDXE         |BFE205C9-5B17-4F8F-9375-89614AF8E199|0052E13F|000E55|DRVR|
|166|Setup          |899407D7-99FE-43D8-9A21-79EC328CAC21|0052EF94|054465|DRVR|
|167|               |7BB28B99-61BB-11D5-9A5D-0090273FC14D|005833F9|044C8D|FRFM|
|168|CRBDXE         |16271FCA-55D9-4A33-93FC-5A3EB128DEB6|005C8086|000C91|DRVR|
|169|CRBSMI         |221F1D4F-034C-4BEA-B2BB-B7A9672B06D7|005C8D17|0013A1|DRVR|
|170|CspLibDxe      |CD84562C-6864-40A3-A081-C8D35E82B920|005CA0B8|000275|DRVR|
+---+---------------+------------------------------------+--------+------+----+
| Bytes Free       : 001CD3 (  7 KB)    Bytes Used       : 5CA32D (5928 KB)    |
+-----------------------------------------------------------------------------+
| Firmware Volume : 03               Location :  00360000   Length :  0A0000  |
+---+---------------+------------------------------------+--------+------+----+
|NO |    FileName   |               GUID                 |Location| Size |Type|
+---+---------------+------------------------------------+--------+------+----+
|000|MemoryInit     |3B42EF57-16D3-44CB-8632-9FDB06B41451|00360048|02C8D2|PEIM|
|001|UsbBotPeim     |8401A046-6F70-4505-8471-7015B40355E3|0038C920|00196A|PEIM|
|002|Recovery       |E008B434-0E73-440C-8612-A143F6A07BCB|0038E290|003969|PEIM|
|003|CRBPEI         |0D1ED2F7-E92B-4562-92DD-5C82EC917EAE|00391C00|00097A|PEIM|
|004|WdtPei         |1D88C542-9DF7-424A-AA90-02B61F286938|00392580|000796|PEIM|
|005|CORE_PEI       |92685943-D810-47FF-A112-CC8490776A1F|00392D18|01E2B2|PEIC|
|006|IT8728SioAcBack|F5042177-1D29-45C5-BA4D-4D0EB2E88575|003B0FD0|0002A0|PEIM|
|007|CpuInitPei     |01359D99-9446-456D-ADA4-50A711C03ADA|003B1270|001C4E|PEIM|
|008|CpuS3Peim      |C866BD71-7C79-4BF1-A93B-066B830D8F9A|003B2EC0|001590|PEIM|
|009|SmmBasePeim    |8B8214F9-4ADB-47DD-AC62-8313C537E9FA|003B4450|000560|PEIM|
|010|CpuPolicyPei   |0AC2D35D-1C77-1033-A6F8-7CA55DF7D0AA|003B49B0|000762|PEIM|
|011|CpuPeiBeforeMem|1555ACF3-BD07-4685-B668-A86945A4124D|003B5118|0006E0|PEIM|
|012|CpuPei         |2BB5AFA9-FF33-417B-8497-CB773C2B93BF|003B57F8|00160E|PEIM|
|013|SBPEI          |C1FBD624-27EA-40D1-AA48-94C3DC5C7E0D|003B6E08|003938|PEIM|
|014|AcpiPlatformPei|333BB2A3-4F20-4C8B-AC38-0672D74315F8|003BA740|00087C|PEIM|
|015|SmBusPei       |9EA28D33-0175-4788-BEA8-6950516030A5|003BAFC0|0013CA|PEIM|
|016|WdtAppPei      |0F69F6D7-0E4B-43A6-BFC2-6871694369B0|003BC390|00052C|PEIM|
|017|PchInitPeim    |FD236AE7-0791-48C4-B29E-29BDEEE1A838|003BC8C0|003960|PEIM|
|018|PchResetPeim   |FF259F16-18D1-4298-8DD2-BD87FF2894A9|003C0220|000962|PEIM|
|019|PchSmbusArpDisa|643DF777-F312-42ED-81CC-1B1F57E18AD6|003C0B88|000BA0|PEIM|
|020|PchSpiPeim     |AA652CB9-2D52-4624-9FAE-D4E58B67CA46|003C1728|0015BE|PEIM|
|021|PchUsb         |6B4FDBD2-47E1-4A09-BA8E-8E041F208B95|003C2CE8|00036E|PEIM|
|022|NBPEI          |79AA6086-035A-4AD9-A89A-A6D5AA27F0E2|003C3058|0028B8|PEIM|
|023|SmmAccessPeim  |6ECFCE51-5724-450C-A38A-58553E954422|003C5910|000884|PEIM|
|024|SaInitPeim     |FD236AE7-0791-48C4-B29E-29BDEEE1A811|003C6198|005036|PEIM|
|025|CryptoPei      |D6D2FBA6-EF60-4C38-A83E-6769814D23B0|003CB1D0|002AC0|PEIM|
|026|BDRPEI         |90E9D266-C229-4474-8D18-AAF3745F3EAA|003CDC90|000546|PEIM|
|027|               |56E14F88-234B-4C34-B204-299670447247|003CE1D8|00046C|FRFM|
|028|DualBiosPei    |97BB442B-F9FE-45E3-8A28-439EEDCD1813|003CE648|000420|PEIM|
|029|Capsule        |FAC2EFAD-8511-4E34-9CAE-16A257BA9488|003CEA68|000998|PEIM|
|030|iFfsPei        |53F019E9-BB0C-424B-870A-1FAF10B1CB4C|003CF400|004170|PEIM|
|031|HeciPei        |9CF30325-DC5C-4556-A8B0-74215C5F7FC4|003D3570|000C18|PEIM|
|032|PchMeUma       |8C376010-2400-4D7D-B47B-9D851DF3C9D1|003D4188|00080E|PEIM|
|033|MePeiPolicyInit|12C67BE1-AD2E-4F13-A95F-6EDC2C4392DE|003D4998|000538|PEIM|
|034|PeiRamBoot     |08EFD15D-EC55-4023-B648-7BA40DF7D05D|003D4ED0|001082|PEIM|
|035|               |CC0F8A3F-3DEA-4376-9679-5426BA0A907E|003D5F58|0004A5|FRFM|
|036|               |9FE7DE69-0AEA-470A-B50A-139813649189|003D6400|00092C|FRFM|
|037|               |FD44820B-F1AB-41C0-AE4E-0C55556EB9BD|003D6D30|000828|FRFM|
|038|               |0DCA793A-EA96-42D8-BD7B-DC7F684E38C1|003D7558|0000A4|FRFM|
|039|               |3FD1D3A2-99F7-420B-BC69-8BB1D492A332|003D7600|0000A4|FRFM|
|040|               |1BA0062E-C779-4582-8566-336AE8F78F09|003FF140|000EC0|SECC|
+---+---------------+------------------------------------+--------+------+----+
| Bytes Free       : 027A98 (158 KB)    Bytes Used       : 078568 (481 KB)    |
+-----------------------------------------------------------------------------+
| Total Bytes Free : 03A260 ( 232 KB)   Total Bytes Used : 3C5DA0 (3863 KB)   |
+-----------------------------------------------------------------------------+
 



I thought I could find the module I want, disassebly that and find the point where it asks you to choose the three choices. Do you think that's possible? And what techniques do you use for recognizing the modules? I mean it easy with names like "MemoryInit", but that's not my case. It could be "Recovery", maybe. I really can't disassembly and try all of them because I'm not fluent enough with asm and each one takes me a loooot of time.

Quite messy, don't you think?
However, any help or suggestion or everything is appreciated.
Thank you in advance
2

I investigate a little.

The module that manages the optimized/default values is AMITSE (GUID: B1DA0ADF-4F77-4070-A88E-BFFE1C60529A|00407892). I extracted it “as-is” in MMTool.

Guess what’s at offset 00064590? B.I.O.S. .h.a.s. .b.e.e.n. .r.e.s.e.t. .-. .P.l.e.a.s.e. .d.e.c.i.d.e. .h.o.w. .t.o. .c.o.n.t.i.n.u.e…L.o.a.d. .o.p.t.i.m.i.z.e.d. .d.e.f.a.u.l.t.s. .t.h.e.n. .b.o.o.t…L.o.a.d. .o.p.t.i.m.i.z.e.d. .d.e.f.a.u.l.t.s. .t.h.e.n. .r.e.b.o.o.t…E.n.t.e.r. .B.I.O.S.
That’s the message I don’t want it to show.

I think I can open this module in Ida Pro, then looking to the parts where it prints this string, and the block of code I need to modify should be near this, right?

Do you guys have any suggestion about how to proceed?
Thank you very much

3

@ incud:
Welcome at Win-RAID Forum!

I am sorry, but I cannot help you, because I have never modified such System BIOS modules.

Regards
Dieter (alias Fernando)

4


Thank you very much :slight_smile:


Maybe, if you have some time, you can help me with the disassembly.

I opened the whole BIOS file with Ida PRO. Ida recognizes the start point and a few subroutine, but most of the bytes are confused data (because these data is the LZH compressed modules?) Then I tried to open the extracted module (AMITSE "as-is"). I choose "meta-pc" mode, 32bit.

I can find my string with Binary Search -> "bios has been reset" (unicode string), it’s at offset 000645AFh (as the hex editor said). Now, I would like to find the point in the code where it prints/displays this string (address 000645AFh). Unfortunately, the string windows does not say anything (it reports only a few ascii string).

I try to set the default string encoding (Alt+A keys, "Set default encodings" at the bottom of the dialog) to UTF (both UTF8 and UTF16). Then I close and re-open the string windows. UTF16 mode lets me display over 2300 strings in chinese (I don’t know if they have sense or not), UTF8 mode displays 2400 strings with no sense. I really can’t make my string compare in the string window.

I try another thing: I search for the sequence of bytes "00 06 45" (the first part of the address of my string) to check if it appears somewhere. I use again the Binary search -> 000645 (without quotes this time). Nope. Then I check again with "45 06 00" (i forgot about endianness). Nope again.

Any suggestion? If you guys wants, I can upload the BIOS file + the module file + the .idb ida package
Thank you very much in advance

5

This is not a matter of time. I don’t have the required knowledge about what you are going to try.

If you want to modify any BIOS module, you should extract it "uncompressed" and not "as is".

6


Ok


Clear. Thanks anyway :slight_smile: Can you recommend me someone I can contact who deal with these things?

7

Our Forum members CodeRush and lordkag know much more about the BIOS modding than me, but I am unsure, if they have the time to help you.

8


@lordkag @CodeRush I wait for your words of wisdom

However, the real problem is my lack of experience with Ida PRO. It should be easy to find the place where AMITSE display the string "Bios has been reset - …", but I can’t find it.
In addiction, neither me nor Ida PRO do not recognize the starting point of the code, so I cannot use features like the wonderful graph :frowning:

I don’t know if there’s a way to debug the execution of the BIOS. I know that in certain point of the code, the software prints "checkpoints" on I/O port 80, but I cannot find a way they could be userful to me.
Well, there’s a way: I can buy one of the PCI port-80 board, and look at the last checkpoint/word it prints on IO port 80 before if displays the message. If in the code there’s a "out 80h, DISPLAYED_CODE", I could start to investigate from there, right? There are a couple of routines like this one:

1
2
3
4
5
6
7
8
9
10
11
 

seg000:00037B7C sub_37B7C
seg000:00037B7C       proc near   ; CODE XREF: seg000:00029D6Dp
seg000:00037B7C                        ; sub_2E958+9Dp ...
seg000:00037B7C       mov     al, dl
seg000:00037B7E       mov     dx, cx
seg000:00037B81       out     dx, al
seg000:00037B82       retn
seg000:00037B82 sub_37B7C
seg000:00037B82       endp
 
 

Maybe I can follow the point where the software calls sub_37B7C. PS: The code is from an autoanalysis performed by Ida PRO. I still don't know if it's a piece of code or just data that Ida interpreted for unknown reason. However, this snippet seems to have sense.

Guys, you have much much (much) more experience than me. Do you think that what I'm trying to achieve is possible?

EDIT1: I forgot to say that if you need/want access to my dropbox folder where I have all my files (about this project, I mean) I can post the link
9

I just have pretty much no time now, but I will return to this question tomorrow or in 2 days. Please standby. :slight_smile:

10

My official reaction to this international crisis is: WAT? And I’m replying in the nicest way possible, no offence intended. You mention of “low CMOS battery” in the title, then move on with saying “after inserting or removing battery”. I’m trying to wrap my head around your issue and all I can see is either a search for the most complicated solution or a self-made problem. Maybe I need to spin my head faster. If the CMOS battery is failing, just replace the damn thing! It is a simple CR2032 battery, can be found at any decent electronics store, for the price of a loaf of bread. By looking at the pictures of your board, there is nothing complicated in replacing it. Listen to the Jedi motivational master, Just Do It! If you are removing the battery for any other reason, may I ask what it is? Do you place it in your pocket when you leave home, do you wash it daily, do you… ? Sorry for the slightly amusing/offensive tone, but I see no reason for removing the CMOS battery, apart from the obvious - reset CMOS. It is my impression that this action also forces the main BIOS chip to be flashed with the content of backup chip, yet another reason to avoid unnecessary physical degradation.

If nothing from above applies and you want to force a selection whenever you reset CMOS, to me it sounds like you are trying to create a non-existent issue: it is offering you a choice, not enforcing one. The string is placed in AMITSE, but AMITSE is made of several sections and IDA can only disassemble the first PE32+ section. There is no direct link (I think) between sections, the code uses a reference to the handlers. You may hunt this “issue” as much as you please, but I’m not interested in spending a single second. Like I said, I fail to see what the issue is, we are on different sides of the bug/feature coin.

11


I swear I heard in my head Ode To Joy while reading your comment :slight_smile: thank you very much


Sorry about that. My fault. I will explain it better later


You completely missed the point.

This BIOS mod is a part of a larger project that has as an objective to obtain a very reliable machine. This machine - which is supposed to be always on and locked in a closet - must be able to restart in case of an unexpected shutdown (eg. when the power runs out). Most of the time, this machine is able to restart correctly. Other times (eg. CMOS battery low) it appears this prompt ("bios has been…") that prevents my machine from booting without human intervention. Changing the CMOS battery is not a solution because always requires human intervention.

When I’m at home, I simulate the run down of the battery/CMOS reset by removing and inserting again the battery. That’s primary because I don’t want to wait 10 years every time a run a test.


Maybe after reading this explanation you will change your mind.
If you won’t, no problem :slight_smile: I know a man must choose his battles wisely.


I read all your posts and I suppose you worked a lot on AMITSE. If you are interested in spending literally a second on this thread, linking me a resource that goes deep in the module would be beyond my wildest imagination :slight_smile:

12

The difference between your first post and this one is like between night and day. Yes, for your situation it makes perfect sense to skip that screen and boot without a key press. But try to read it from my side, it sounded like you are either the laziest or the most complicated person alive. Maybe I will look into this in the next days. But don’t expect any miracles, in the case of ME reflash I knew what to search and where, it was more or less easy to patch all three variations of ME recovery/reflash. In your case it might be difficult, as I believe only the handler is invoked and I can’t even be sure if it is from inside AMITSE. Given how this system is important enough to be locked, have you considered Battery Backups/UPS Units? It should at least give you the time or the option to gracefully shutdown the system if the power is cut for longer periods, or to supply the system for short periods of time. Having the BIOS load the defaults and boot without human intervention is the next (not so) best thing. At least the board has DualBIOS, it should recover from any bad patching.

Just to be clear: Gigabyte GA-C1037UN is the board that needs to be patched? And what BIOS version: F2 from rev1.0 or FA from rev2.0? Because the code can change between versions and revisions. Lastly, will you be able to flash any modded BIOS and more than once if needed?

13


Sorry. My fault. I thought it wasn’t necessary to explain the whole context.


It won’t resolve the problem because there are other cases where the machine has to reboot. For example (but that’s not the only one) when the software freezes, there’s a watchdog timer that forces a reboot.


1. Yes
2. F2 from rev1.0
3. Absolutely. As many times as you want

However, here’s the news:
I found (I know you guys found it long before me) the Aptio source code. In Ivy-Bridge > 018s.zip > Core > EM > AMITSE there’s a sort of documentation in .chm format. Maybe I can get some ispiration from it.

14

Ok, I tried to make a simple modification to the AMITSE module, changing the string “bios has been…” with another of the same length (actually, I changed “BIOS has” with “INCUDhas”). When I try to replace the module in MMTool, it says “invalid .ffs file”. That’s because I forgot to change something else? It should be MMTool the one that has to change all the checksum, right?
I tried both Insert (“compressed”) and replace (in replace there’s no “as is” and “compressed” options).

I found a PCI Port 80 board. I know that AMI Aptio prints breakpoints while executing the bios.
I forces a CMOS reset, the last breakpoint displayed is 0xAB. According to >this document<, it should be in DXE phase, “Setup Input Wait”. It makes sense.
Here’s the screenshots:
The code displayed by the Port80 PCI board
The famous message shown
PS: I post the link because the images are very big, the width exceeds 1280px
I really don’t know if this will help me. However, “melius abundare quam deficere” says latins.

Finally, the source code fact. I don’t know if I’m totally blind, but I can’t see anything interesting regarding AMITSE. I did not hoped to find the string “bios has been reset” hardcoded in the source (accordingly to the fact that AMITSE is one of the modules customized by the OEMs). Finding an “out 80h, 0xAB” would have been perfect. Then I realized that they’re all C sources. However, I still hope to find that out instruction somewhere.
I uploaded the AMITSE documentation in .chm format >here<, in case someone want to see it. Just told me if it’s a problem and I’ll remove it.

15

You probably have to correct the Checksum-8 of the FFS file.
For comparison purpose you should check the checksum-8 of the extracted original FFS file.

16

@incud2

I tried finding some solid ground for the patch, but I can only find bits and pieces. It is as I suspected, there is no pointer/offset to those strings. You can use AMIBCP to remove or add chars from them (thus changing the offset of all following strings), there are no other changes to AMITSE apart from size and checksums. This proves that only a handler will be used, with those 4 strings having the handlers 80h-83h. I am seeing a function where they are all involved, but no proof and no way of knowing what to patch. That AB checkpoint is produced by CORE_DXE, with a generic function:

mov al, cl
out 80h, al ; manufacture’s diagnostic checkpoint (POST code)
out 90h, al

Not much you can use or patch. I have found the place from where the checkpoints are loaded, but the same messy situation. I don’t see an easy way out, not even if you would donate your board for the research cause. The only way I could step further is to have more details. Can you check what are the printed message before and after that selection? I have seen some messages in AMITSE executable section that might be related to this issue, having a solid hook could point me in the right direction.

17

Hello again

First of all, @lordkag @CodeRush thank you very much for your effords. I really really - really - appreciate that.

Here’s the news: a friend of mine is helping me with the task. He has much more experience than me, and he noticed that if I remove the first bytes until the “MZ” character, my module becomes a PE32+ (Windows 64bit) executable. It makes perfectly sense because UEFI specification were written (also) by Microsoft. I opened it in Ida PRO, and it can start its autoanalysis.

Now the problem is this: the analysis truncates the executable at address 63000 insted of address 85330. The truncated part contains the string “bios has been reset…”. I found on the net that sometimes Ida truncates the file. But that’s not the case: watch the PE Header:

1
2
3
4
 
dd 4CAA0h               ; Size of code
dd 160C0h               ; Size of initialized data
...
dd 62E00h               ; Size of image
 

Size of the image = 0x62300. That differs from the size of the module. I thought that maybe the last part containing the strings in unicode was a sort of resource file. However, there is no segment .rsrc (according both to Ida and to the PE header). Do you have any idea about how to adjust this things?

[quote="lordkag, post:16, topic:31112"]
This proves that only a handler will be used, with those 4 strings having the handlers 80h-83h.
I am seeing a function where they are all involved, but no proof and no way of knowing what to patch.
[/quote]
Sorry but I didn't understand these sentences. Could you explain it in a simplier way?

[quote="lordkag, post:16, topic:31112"]
That AB checkpoint is produced by CORE_DXE, with a generic function:
[/quote]
In your opinion, is there the possibility that the part of the BIOS that displays the message is in CORE_DXE? It could be possible, right?

[quote="lordkag, post:16, topic:31112"]
Can you check what are the printed message before and after that selection?
[/quote]
If you mean printed on the screen, nothing is displayed apart the Gigabyte logo.
If you mean the checkpoint printed on port80, tomorrow I'll write here the ordered list of printed checkpoint.

Thank you very much in advance
18

This is what I was saying in the first message. If you open your BIOS file in UEFITool and search for AMITSE in Unicode, you will see that the file has several sections. This is a standard for AMI, not a special case for your board. From those sections, only the body of PE32 can be analysed by IDA, there is no direct link to the others. From IDA point of view, the rest is just padding/garbage. To reference them, AMITSE is using (I guess) the handler of the string. To find this connection, you have to search for 80h, 81h, 82h, 83h - nothing more than that to use. You can use AMIBCP to alter the length of the strings, nothing will change in the code, evidence that only the handler is used for referencing. If you search for hex E609E497C14CD91181F6000000000000 (the GUID that stores your message), only CORE_DXE seems to load it. But there are more than one sections with that GUID, not sure which one is loaded.

Yes, it is my guess that CORE_DXE has a part in displaying that message and will be involved in patching. What I really need is the messages displayed on screen. Try to disable all UEFI options, leave it to legacy and slow Boot, to have the POST messages. There has to be something printed, besides that reset message.

19


1. I realize it just right now
2. Handler = address of the string?
3. How did you find that numbers?
4. Did I understand something wrong, or each string has a GUID? How can I find it?
5. I can see it. CORE_DXE, Reflash, AMITSE, Setup (category: DXE driver) and another unnamed (category: freeform). Maybe, I should extract and give a look at all of them
6. Surely I will.

EDIT (about point 6):
Just a note: it I force a CMOS battery fault, shouldn’t it ask me to load defaults BEFORE showing the POST? In this case, isn’t it probably that POST considers the "CMOS battery fail" resolved (I decided to load the defaults) and won’t display anything?

20
  1. When you open the file in AMIBCP, each string has a handle (Setup Configuration) or a token (BIOS Strings). Your desired strings are in the range B2h-B5h when all setup strings are concatenated and displayed by AMIBCP. If you use the options “Extract Strings”, they will be in range 80h-83h. I’m thinking that AMITSE will only deal with the strings it contains, thus 80h-83h seems more likely. AMIBCP can extract this handle/token from file, it can also display the setup strings in the right visual order, even though the tokens and strings are stored in a different order. I’m guessing that AMIBCP can access these values from a table or something that contains the handles/tokens. If this is not the case, then I don’t know what else to follow.
    3. See above.
    4. The strings are placed in a GUIDed section. That GUID is 97E409E6-4CC1-11D9-81F6-000000000000 or E609E497C14CD91181F6000000000000 in hex.
    6. I don’t know what your system does or displays. That is why I asked you to look into the messages. Having a message that can be traced by IDA could narrow the field of search.
    7. Please understand that my time is limited, I have no obligation to help you, I’m not a patient man. Asking questions that have no relevance in solving this problem are only taking from the time I dedicate to your issue. We haven’t even located the responsible code, wasting time with small details is wasting time. Providing the details to my request (nr 6.) is the most (and only) lucrative approach.