Forum RSS Feed Follow @ Twitter Follow On Facebook

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Latest Threads
[REQUEST] HP Pavilion G42-272BR Whitelis...
Last Post: eepromm
Yesterday 01:55 AM
» Replies: 0
» Views: 95
[REQUEST] Lenovo G710 BIOS Whitelist Rem...
Last Post: voyageur
11-21-2024 04:33 PM
» Replies: 475
» Views: 167247
[REQUEST] Acer Aspire 5738(G,Z): CPU Upg...
Last Post: DeathBringer
11-21-2024 03:44 PM
» Replies: 49
» Views: 32879
[REQUEST] HP Mini 110-4100 BIOS Unlock
Last Post: DSI INF
11-21-2024 09:24 AM
» Replies: 7
» Views: 244
[REQUEST] Lenovo IdeaPad U310 & U410 (65...
Last Post: Dudu2002
11-21-2024 03:11 AM
» Replies: 1780
» Views: 494661
Lenovo ThinkCentre M715q 2nd Gen & AMD R...
Last Post: Elmurley
11-20-2024 09:37 PM
» Replies: 2
» Views: 1292
[REQUEST] Lenovo Y50-70 (9ECNxxWW) White...
Last Post: SWZSSR
11-20-2024 09:34 PM
» Replies: 1775
» Views: 553867
[REQUEST] Lenovo Thinkpad X240 (GIETxxWW...
Last Post: Dudu2002
11-20-2024 04:58 PM
» Replies: 337
» Views: 143515
Unlock bios insyde
Last Post: Matox3140
11-19-2024 03:40 PM
» Replies: 0
» Views: 213
Whitelist WIFI card removal Lenovo Yoga ...
Last Post: Dudu2002
11-19-2024 12:58 PM
» Replies: 1
» Views: 219
[REQUEST] H310 MSI Gaming Infinite S (MS...
Last Post: awittyusername
11-19-2024 09:21 AM
» Replies: 10
» Views: 136
[REQUEST] Gigabyte GA-B85M-HD3 Rev 2.0 u...
Last Post: Maduli
11-19-2024 02:22 AM
» Replies: 0
» Views: 164
[REQUEST] Lenovo Ideapad 330-15ICH BIOS ...
Last Post: Dudu2002
11-18-2024 01:25 PM
» Replies: 8
» Views: 1908
[REQUEST] Lenovo ThinkPad Edge E330 (H3E...
Last Post: Dudu2002
11-18-2024 01:23 PM
» Replies: 640
» Views: 221183
[Request] Unlocked Bios for Asus TUF FX5...
Last Post: FlT4ever
11-18-2024 01:05 PM
» Replies: 1
» Views: 427
[REQUEST] Lenovo ThinkPad Edge E125(v1.1...
Last Post: kamome74
11-18-2024 10:43 AM
» Replies: 0
» Views: 207
[REQUEST] Xpg 15g 4070 2023ver InsydeH20...
Last Post: MireVelli
11-18-2024 07:26 AM
» Replies: 2
» Views: 204
Please help me recover my bios
Last Post: FuryOP
11-17-2024 12:37 PM
» Replies: 0
» Views: 220
[Request-Camilo] Sony Vaio SA/SB/SC/SD/S...
Last Post: edit
11-17-2024 12:13 PM
» Replies: 107
» Views: 136965
[REQUEST] Lenovo Thinkpad Edge E440 & E5...
Last Post: Dudu2002
11-17-2024 06:50 AM
» Replies: 196
» Views: 92038

Search for Trinity Boostlock
#1
I've decompressed an Insyde BIOS for a trinity laptop, and am trying to find where the boostlock bit is set. It is bit 31 in D0F4x15C.

If this bitlock could be found and removed, trinity laptops could then be forced to run maximum multiplier at all times for a 15%+ frequency boost. It may also be responsible for locking out IGP overclocking.

I've tried looking for code that writes to D0F4x15C specifically. I've looked for code that performs a set of bit 31, then outputs to a PCI config register. I've also searched the BIOS for what and how registers must be set to write to D0F4x15C. I've found a lot of writes to PCI config space, but have identified none for D0F4x15C.

Instead of sticking to one method for writing to PCI config space, the BIOS uses literally every possible method. This has made it difficult to search for where the bit is set, and I'm hoping someone here might have an idea of what to search for in the BIOS files.

Below are the basic methods to write to this register that I am aware of:


1. "out" instruction to write to IO ports 0xcf8 and 0xcfc.

0xcf8 is the PCI config space port address register, and 0xcfc is the data register. The "out" instruction must be used twice, first to set the address, then to set the data. The code "out dx,eax" preforms the config space writing. Prior to setting the address, the dx must be 0xcfc, and the eax must be 0x8100c45c. The dx must be 0xcfc prior to writing the data. The eax must be 0x80000080 for the final data write to D0F4x15C.

2. "outs" instruction to write to IO ports 0xcf8 and 0xcfc.

Similar to "out" usage. The dx register is still used to set the port address, but the data to write now comes from a memory address referenced by the DS register.

3. Direct write to D0F4x15C's MMIO address 0xF80C415C.
This method bypasses the PCI config IO ports and writes directly to the MMIO location. Code for this is along the lines of "mov [qword 0xF80C415C],reg", where the value of the register in the 2nd operand is the data to write (0x80000080).

I have found many instances of "out" and "outs" use to write to PCI config space. I have only found a few places where the direct write method was used.

Usually for "out" the bios does "mov dx,0xcf*" to set the IO port address. There will be some variations like clearing the eax then using "add" instead of "mov", or the DX will have 4 added to it to get to the data port from the address port. Sometimes the BIOS is very nice and has a blatant "mov eax,0x8*00****" for setting the eax, but of course they can't stick to this easy to understand method. The big problem is understanding where and what data is written when functions are used. There are several generic functions (call (d)word 0x****) for writing to PCI config space. They usually use the edx for the device, function, and standard offset, the ecx for data, and the eax for the extended offset, but I saw at least 1 version where this was mixed around (using "pop eax" instead of "mov eax,ecx" for data). When trying to trace back the function calls I'll get lost after 2-3 jumps and still not know where or what data was sent.

I'm pretty lost on understanding the "outsd"s since that requires following indexed pointers, then finding that those values were set by registers and not immediate values, then trying to backtrack those registers...

The few instances of direct MMIO writes are easy to understand, but the fact that I've found so few makes me think that there's also another method used to write them that I just haven't found yet.

I've found a few "bts eax,0x1f"s, "or eax,0x80000000"s, and 16 bit equivalents, but have ruled out all I have found for D0F4x15C. "or eax,0x80000000" is actually used quite often to set 0xcf8 for IO to be routed to the PCI config space instead of other IO. This is very annoying since I also expect this type of operation for setting the boostlock bit, and it is used all the time for the majority of PCI config writes. There are many variants such as "bts ecx,0x1f", and these are difficult to rule out for being used to set eax later on.


I'm getting to the point where it looks like I'll have to try out decompilers in attempt to trace back what many data and addresses are written to. I'm hoping you guys have some advise on what to look for.

BIOS file:
http://www.mediafire.com/?xm96l67qqvbh8vp

Some Trinity documentation:
http://support.amd.com/us/Processor_Tech..._Guide.pdf

I've been using PhoenixTool 2.05 with NASM in cygwin to decompress. Been roughly following the old C2D EIST unlock guide.
find
quote


Forum Jump:


Users browsing this thread: 1 Guest(s)