[Guide] How to Modify a Polaris (Radeon RX Series) GPU

[bigguygeo]

Hi! I’m working on app for rebuilding modules in vbios. And early method working fine. But I stuck with vbios signature verification. I compare all modules of four vbioses and find out that PowerPlayInfo includes some different two bytes 3125, 3025, 4626, 6326… etc… so possibly they are signatures.

[img]

[/img]


Then i tried to understand Vbios header, and that is what i made:

55 AA FILE MASK
7F E9 FILE SIZE

A1 02 OFFSET TO “MP” FILE INSIDE VGA FIRMWARE ???

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

44 02 OFFSET TO PCIR (0x0244)

00 00 00 00

49 42 4D IBM (ASCII)

04 CRC-8 FileChecksum (Based on Filesize E97F)

3A 88 OFFSET TO PFR IMAGE ???

00 00 00 00 00 00 00 00 00 00 00

04 20

37 36 31 32 39 35 35 32 30 761295520

00 00 00 00 00 00

99 02 OFFSET TO VGA FIRMWARE (0x0299)

00 00 00 00 00 00

20 02 OFFSET TO ATOM SIGNATURE (0x0220) (ATOM)

00 00 00 00 00 00

31 32 2F 30 32 2F 31 36 2C 31 30 3A 31 34 3A 30 30 12/02/16,10:14:00 - RELEASE DATE (loc 0x0050) (ASCII)

00 00 00 E9 A7 03 00 E9 B1 03 00 00 00 F4 00 00 15 00 00 00 D0 01 00 AA 01 21 E1 02 80 7E 00 22 0F 44 02 12 00 00 00 00 00 00 3C 40 0E 02 07 3C 01 1A 00 04 00 00 00 EE A0 FF 06 00 08 30 40 0E 01 00 00 00 00 00 00 14 03 00 00 00 00 00 00 BE 7E 11 00 B9 07 1A D6 50 2C 00 00 00 00 00 00 00 00 00 00 0C 40 41 43 00 00 00 00 10 00 00 00 42 00 00 00 80 7E 06 00 20 00 20 00 12 00 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 52 30 31 30 39 30 2E 30 30 31 00 46 47 4C 20 42 41 46 46 49 4E 4D 00 50 43 49 5F 45 58 50 52 45 53 53 00 47 44 44 52 35 00 0D 0A 48

50 20 56 61 75 67 68 6E 20 47 31 2D 35 30 20 47 44 44 52 35 HP Vaughn G1-50 GDDR5 (Product Name) (ASCII)

20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

0D 0A 00 0D 0A 20 0D 0A 00

28 43 29 20 31 39 38 38 2D 32 30 31 30 2C 20 41 64 76 61 6E 63 65 64 20 4D 69 63 72 6F 20 44 65 76 69 63 65 73 2C 20 49 6E 63 2E (C) 1988-2010, Advanced Micro Devices, Inc. (ASCII)

00

41 54 4F 4D 42 49 4F 53 42 4B 2D 41 4D 44 ATOMBIOSBK-AMD (ASCII)

20

56 45 52 VER (ASCII)
30 31 35 2E 30 35 30 2E 30 30 30 2E 30 30 30 2E 30 30 31 30 39 30 015.050.000.000.001090 (BIOS VERSION) (ASCII)

00 42 52 30 31 30 39 30 2E 30 30 31 20 00 31 33 34 38 38 34 37 20 00 33 36 38 31 32 34 20 20 00 20 20 20 20 20 20 20 20 00 48 50 5F 42 41 46 46 49 4E 4D 5F 47 4C 50 52 4F 5F 56 41 55 47 48 4E 5F 47 44 44 52 35 5F 4D 58 4D 5C 63 6F 6E 66 69 67 2E 68 00 00 00 90



ATOM ($…ATOM.АЕКiк….<ХЂD†‹,Њ .)
24 00 FileSize (0024)
01 01 Version (0101)
41 54 4F 4D ATOM (ASCII) (Atom Magic) uaFirmWareSignature[4]
00 C0 OFFSET TO BIOS Runtime Segment Address (0x00C0)
C5 03 OFFSET TO ProtectedModeInfo (0x03C5) (PM IMAGE)
CA 01 OFFSET TO ConfigFileName (0x01CA) BR01090.001 (ASCII)
69 02 OFFSET TO CRC_Block (0x0269) (HEX = B7 28 39 10)
1E 01 OFFSET TO BiosBootupMessage (0x011E)
EA 03 OFFSET TO (0x03EA) Int 10
00 00 PCI Bus Device Init Code
00 00 IO Base Address
3C 10 SUBVENDOR ID (HP)
D5 80 SSID (80D5)
44 02 OFFSET TO PCIR (0x0244)
86 8B OFFSET TO COMMAND TABLE (0x8B86)
2C 8C OFFSET TO DATA TABLE (0x8C2C)
A0 Extended Function Code
00 Reserved



PCI CONFIG

50 43 49 52 PCIR (ASCII)
02 10 VENDOR ID
E8 67 DEVICE ID
00 00
18 00
00 00
00 03
7F 00
32 0F
00 00
00 00
41 4D
44 20
41 54 4F 4D 42 49 4F 53 AMD ATOMBIOS (ASCII)
00 B7 28 39 10 00 CRC_Block
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

So vbios has two checksums:
CRC-8 for check spi rom for faulty. If this value is Ok - then Gpu core will load firmware
CRC-32 is based in PCI config, and probably checking data and command tables for checksum ok.

Also i compared this value with 4 gpus

PCI CONFIG CRCs

VAGUHN
02 10 E8 67 00 00 18 00 00 00 00 03 7F 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
B7 28 39 10
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

PEGATRON
02 10 E8 67 00 00 18 00 00 00 00 03 74 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
79 01 BC 40
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

DELL 4150
02 10 E8 67 00 00 18 00 00 00 00 03 76 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
9C 45 55 0D
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


DELL 4130
02 10 E8 67 00 00 18 00 00 00 00 03 73 00 32 0F 00 00 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
EB FE 56 86
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


Apple Falcon 560X
02 10 EF 67 00 00 18 00 00 00 80 03 74 00 32 0F 00 80 00 00 41 4D 44 20 41 54 4F 4D 42 49 4F 53 00
BF 57 F4 2D
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

If you know the location of signature in vbios or driver, or how to bypass this on linux-windows, it could be very useful, thanks!