[PROBLEM] How to open/modify/flash an Intel mainboard BIOS?


Yeah, I suspected that since my extracted image ended with one less byte at the end to make a full 16-byte row. That’s why I told you to check another v6 oROM.

As I said, first open the bios with PhoenixTool v2.59 and after everything is dumped, reconstruct it without any change. The hash (SHA-1, md5 etc) should be the same. Otherwise, I don’t think you should even attempt such a mod.

If the hash is the same you can proceed with the mod. Find a latter oROM that can fit at 61KB (the exact size of the oROM and maximum available space). Make sure your new oROM has a length of 0xF400 and overwrite 4A538818-5AE0-4EB2-B2EB-488B23657022_254.rom file from 0x38ADD to 0x47EDC. If the length of the new oROM is smaller (doubt it), add some FF padding at the end before CA (0x47EDC).

PhoenixTool has a "No SLIC" option at Advanced Settings. If you select this it won’t require any SLIC modification. You may also select to extract all modules from there as it might also extract the oROM directly. But even if it does not, replacing the code via hex is not hard.

Again, before doing any of that make sure that PhoenixTool can properly reconstruct the image.

This is the content:

IntelBIO.png



Unfortunately, Intel is using a strange packing, GUID 4A538818-5AE0-4EB2-B2EB-488B23657022 has some volumes and files inside. Maybe another time will have a better look.


Yeah, I suspected that since my extracted image ended with one less byte at the end to make a full 16-byte row. That’s why I told you to check another v6 oROM.

As I said, first open the bios with PhoenixTool v2.59 and after everything is dumped, reconstruct it without any change. The hash (SHA-1, md5 etc) should be the same. Otherwise, I don’t think you should even attempt such a mod.

If the hash is the same you can proceed with the mod. Find a latter oROM that can fit at 61KB (the exact size of the oROM and maximum available space). Make sure your new oROM has a length of 0xF400 and overwrite 4A538818-5AE0-4EB2-B2EB-488B23657022_254.rom file from 0x38ADD to 0x47EDC. If the length of the new oROM is smaller (doubt it), add some FF padding at the end before CA (0x47EDC).

PhoenixTool has a "No SLIC" option at Advanced Settings. If you select this it won’t require any SLIC modification. You may also select to extract all modules from there as it might also extract the oROM directly. But even if it does not, replacing the code via hex is not hard.

Again, before doing any of that make sure that PhoenixTool can properly reconstruct the image.




No problem, i verified the MD5 and with SHA-256, the bios is rebuilded by Phoenixtool perfectly !
But when i try another bigger module this is the response of phoenixtool : "insufficient space to manipulate modules"
@Plutomaniac : which later version please ? thanks for your reply !


Obviously, I told you that your new oROM should be of the same or smaller size than your current at 61KB. If it’s smaller add padding at the end before the last byte.

I don’t know which oROM to insert, you should research that. The only thing I found after a search at bios-mods.com that could fit and is a latter version is v7.5.0.1017. I don’t know which file of the two you must choose. Since both of them are slightly smaller than 61KB you need to add some padding before inserting.

hi !

i try to replace the module (and fill it with “FF” before the last “1F” in the module, (“1F” @ 0x47EDC))

but when it’s finished, i obtain this error (in nag screen) "Error 9 - L’index se trouve en dehors du tableau"

in phoenix log screen "End count, module (254) at 0 replaced, Module checksums corrected"

and i can’t get my final .bio

What’s the problem ?

Modification of BIO files is futile, because they have digital signature that will be broken after any modification, but there are no signatures in actual BIOS (unless BootGuard is used, but there is not a case here), so all you need is to dump you BIOS using SPI flasher, modify the dump they way you need and flash it back with the same flasher. Only this way you could achive anything besides "Verification failed".

It is known that BIO images are not editable, extractable but not editable. I said that at my first reply: "Also, since Intel .BIO images are not really editable by current tools I don’t know if the reconstructed image will be ok."


That explains why at the Intel release notes it states: ROM Image Checksum: 0xcb74. If it’s just a checksum and not a signed signature with keys, can’t the checksum be fixed after modification of the oROMs?

Capture.PNG

Checksum can, but those cerfiticates can’t:

signature.png

I see, alright. Maybe in-windows dumping might work as well since before 5-series the flash descriptor implementation (restrictions) was optional. But since this is Intel’s own BIOS we are talking about, this is probably not valid as well. So only way is by dumping your BIOS first with an external programmer.

Ok ! i desolder the eeprom and dump it. Stay tuned…

Like i promise, this is the hard dump on the EEPROM

Checksum by my prommer : 152EADA9

(Winrar 5.21, the eeprom is 25X16VSIG, dump and compare to avoid read error or mismatch)

eeprom.rar (1.15 MB)

Neat compression method for DXE volume, needs reverse engeneering to be able to unpack it.

there is a possibility to have a futur version of UEFITooL with Intel particular DXE method ?

i know reverse engineering is a hardwork, but it will be useful for .Bio from intel

Hi,
Is it possible to update Intel nuc mainboards?
Got a D54250WYKH were I’m unable to update the bios.
Regards

EDIT by Fernando (dated 04/22/2015):
Since there are a lot of different threads with the topic “How to mod an Intel mainboard BIOS?”, I have merged them all into a new stickied thread.
This may help the Forum visitors to find all topic related advices and solutions (if there are any).

@ Exciter:
Welcome at Win-RAID Forum!

Probably yes, if you mean the BIOS of such model, but maybe not by using the UBU tool.

If the UBU tool is not able to open the previously extracted BIOS, you cannot use it. Intel has always done its own way to prevent an easy BIOS modification done by the users.

By the way: I have moved your post into the correct thread.

Regards
Dieter (alias Fernando)

Hmm, well I have here the .BIO file, but if i Try to update via Intels possibilities, the system turns crazy.
I also unsoldered the chip and read a dump, but I’m unable to extract the bios from the BIO file to
Reflash it onto the chip.
Is there a tool to get the bin file from the
Actual bio file, so I can flash it with my programmer?

@ Exciter:

You should better search >here< for help, if you want to open and modify an Intel .bio file.

BIOS Intel has a digital signature, and after the modification, you can not flash the BIOS.

But is it not possible to download Intels stock ".bio" bios file and flash it via ubu without modification?

No, the UBU tool is an UEFI BIOS Updater and not a BIOS Flashing tool.