Posts: 4
Threads: 1
Joined: May 2016
Reputation:
0
05-25-2016, 06:39 AM
(This post was last modified: 05-25-2016, 06:47 AM by mrwell.)
Hello everybody.
I have a very specifical device known as Intel Harris Beach ultrabook, it's a devkit and it has more than enough customized features. There's a link to detailed overview: Intel Harris Beach ultrabook overview
Here's the main BIOS window screenshot:
There's full access to all possible options, full set of menus.
So, here's the problem: Intel has locked the CSM feature because of this ultrabook was created for windows 8 developers.
And yes, secure boot option is disabled, but anyway, no CSM.
What was done: I extracted a DXE module with "CSM Control" text called "setup", tried to extract IFR from it with "universal IFR extractor" by donovan6000 and with perl script from Falseclock, but it can't find a IFR signature in extracted setup file. There's some other files, like bsddxe, where I can find IFR with that tools, but obviously no CSM Control variables in it.
Here's the bios dump: Intel Harris Beach SDS bios dump
And Here's the extracted setup DXE: extracted setup DXE
So, question is - what am I doing wrong? And how can I enable this option?
Posts: 1,594
Threads: 3
Joined: Jan 2015
Reputation:
70
Hello!Yes, it is possible to unlock this option but i'm not sure if CSM enabled works.
However, you may need SPI Programmer+Pomona SOIC 8 Clip to flash mod.
Anyway, run this tool as Admin and upload results
https://www.sendspace.com/file/x64ra8
After that i can say more abot flashing process.
Regards!
Please,do not post requests me in PM.Bios modding is very dangerous work.If i provide you confirmed modded bios, please donate for my dangerous work https://goo.gl/98BgtO.Thank you!
Posts: 6,345
Threads: 0
Joined: Jul 2015
Reputation:
155
05-25-2016, 01:23 PM
(This post was last modified: 05-25-2016, 02:33 PM by DeathBringer.)
Look at this:
Code: Subtitle: Boot Configuration
Checkbox: BootTime Log, Variable: 0x0, Var Store:BootTime(10E2)
Setting: CSM Control, Variable: 0x5D6
Option: Always ON, Value: 0x0
Option: Always OFF, Value: 0x1
Setting: Display Boot Mode, Variable: 0x5
Option: Normal Boot, Value: 0x0 (default)
Option: Quiet Boot, Value: 0x1
Option: Silent Boot, Value: 0x2
Setting: Fast Boot, Variable: 0x0
Option: Disabled, Value: 0x0 (default)
Option: Enabled, Value: 0x1
Setting: Fast Boot WDT, Variable: 0x1
Option: Disabled, Value: 0x0 (default)
Option: Enabled, Value: 0x1
Setting: Skip Setup HII Update, Variable: 0x2
Option: Disabled, Value: 0x0 (default MFG)
Option: Enabled, Value: 0x1 (default)
Checkbox: Enable Lazy ConIn, Variable: 0x8
Setting: Console Input Behavior, Variable: 0x3
Option: PS/2 Console, Value: 0x0 (default)
Option: Reconnect Last Good Input Consoles, Value: 0x1
Option: Windows 8 Console, Value: 0x2
I think it helps you.
BTW: if variable 0xE from Var Store:SetupVolatileData(100B) equals 0x1 then CSM Control setting is grayout and is shown as "Always OFF", even CSM Control is enabled.
Posts: 4
Threads: 1
Joined: May 2016
Reputation:
0
(05-25-2016, 12:57 PM)Da Vinci Code Wrote: Hello!Yes, it is possible to unlock this option but i'm not sure if CSM enabled works.
However, you may need SPI Programmer+Pomona SOIC 8 Clip to flash mod.
Anyway, run this tool as Admin and upload results
https://www.sendspace.com/file/x64ra8
After that i can say more abot flashing process.
Regards!
Hello. BIOS programming is not a problem, this ultrabook was bricked some time ago and I flashed a rom image with SPI Programmer (CH341A), now it works. I flashed ROM from my first message without any modifications and it works.
Posts: 4
Threads: 1
Joined: May 2016
Reputation:
0
05-26-2016, 01:47 AM
(This post was last modified: 05-26-2016, 02:07 AM by mrwell.)
(05-25-2016, 01:23 PM)DeathBringer Wrote: Look at this:
Code: Subtitle: Boot Configuration
Checkbox: BootTime Log, Variable: 0x0, Var Store:BootTime(10E2)
Setting: CSM Control, Variable: 0x5D6
Option: Always ON, Value: 0x0
Option: Always OFF, Value: 0x1
Setting: Display Boot Mode, Variable: 0x5
Option: Normal Boot, Value: 0x0 (default)
Option: Quiet Boot, Value: 0x1
Option: Silent Boot, Value: 0x2
Setting: Fast Boot, Variable: 0x0
Option: Disabled, Value: 0x0 (default)
Option: Enabled, Value: 0x1
Setting: Fast Boot WDT, Variable: 0x1
Option: Disabled, Value: 0x0 (default)
Option: Enabled, Value: 0x1
Setting: Skip Setup HII Update, Variable: 0x2
Option: Disabled, Value: 0x0 (default MFG)
Option: Enabled, Value: 0x1 (default)
Checkbox: Enable Lazy ConIn, Variable: 0x8
Setting: Console Input Behavior, Variable: 0x3
Option: PS/2 Console, Value: 0x0 (default)
Option: Reconnect Last Good Input Consoles, Value: 0x1
Option: Windows 8 Console, Value: 0x2
I think it helps you.
BTW: if variable 0xE from Var Store:SetupVolatileData(100B) equals 0x1 then CSM Control setting is grayout and is shown as "Always OFF", even CSM Control is enabled.
Wow! Great! Can I ask about how you extracted this and from what DXE file?
And that's another problem, this book can't boot modified grub shell, it just hangs. I think that I must rebuild a rom with modified settings and then flash it to SPI flash
UPD: Solved. I changed BOOTX64.efi to patched from thist thread and all works now, successfully change CSM Control to "Always ON" and successfully boot! So, now the only question is about how extracted this and from what DXE file?
Posts: 6,345
Threads: 0
Joined: Jul 2015
Reputation:
155
05-26-2016, 02:10 AM
(This post was last modified: 05-26-2016, 03:10 AM by DeathBringer.)
Some binary tricks with DXE file and standard "universal IFR extractor".
I replaced bytes:
Code: 7F 03 00 B4 1C 03 04 31 00 00 00 31
with
Code: B7 1C 03 04 34 00 00 00 34 00 00 00
And replaced bytes:
Code: 00 00 00 01 00 65 6E
with
Code: 01 00 65 6E 2D 55 53
Posts: 4
Threads: 1
Joined: May 2016
Reputation:
0
05-26-2016, 02:19 AM
(This post was last modified: 05-26-2016, 03:30 AM by mrwell.)
(05-26-2016, 02:10 AM)DeathBringer Wrote: Some binary tricks with DXE file and standard "universal IFR extractor". Thanks a lot! I hope that this will be helpful to other bios modders.
Posts: 1
Threads: 0
Joined: May 2018
Reputation:
0
(05-26-2016, 02:10 AM)DeathBringer Wrote: Some binary tricks with DXE file and standard "universal IFR extractor".
I replaced bytes:
Code: 7F 03 00 B4 1C 03 04 31 00 00 00 31
with
Code: B7 1C 03 04 34 00 00 00 34 00 00 00
And replaced bytes:
Code: 00 00 00 01 00 65 6E
with
Code: 01 00 65 6E 2D 55 53
Hello guys!
Sorry for bumping up this old discussion but I need to do a very similar thing and I didn't understand this passage: where did u find these bytes that you replaced? whats their meaning and how did you choose the new ones?
What i need to do to is changing the "BOM Config" value from GMIN to Windows on a similar UDK II efi.
I parsed the efi with Intel FCE and was able to obtain the address where it is stored. Using setup_var I was also able to change the value but on reboot the efi resets to the original value (only this value is reset not the others).
I would like to undestand how i can "degray" the option to see if changing it in an official way fixes the issue.
The bios file and the output of Intel FCE is here: https://1drv.ms/f/s!Alyj7iEkDR6pg4tgCddapWqJQDPL7A
|