In this SSV3 guide we'll mod Gigabyte GA-EP45-UD3P version F8 bios.
In SSV3 the SLIC is written in the system module of the bios.
Programs you'll need are:
- Winhex (You can use a different hex editor but you'll have to find the equivalent commands in your program.)
- WinRar (or similar program) for decompressing .LHA files.
- cbrom or cbrom32
- Calc (comes with windows so you already have it)
Make a folder for the bios and related files.
Make a new text file in here for mod notes. I call mine notes.txt. It's a good idea to save the notes from some of your mods because you can refer to them in the future when you're doing the same kind of mod. Being able to refer to a previous one will mean less typing and not having to remember what the next step is. (You can save the notes.txt included here for SSV3 mods.)
Open a command prompt (Run "cmd")
Run cbrom /d and output the result to a text file. We'll need to know the compressed module sizes in order to select and extract them.
ex: cbrom EP45UD3P.F8 /d > EP45UD3P.txt
When typing file names it's easiest to type the first couple letters and press tab to autocomplete.
******** EP45UD3P.F8 BIOS component ********
No. Item-Name Original-Size Compressed-Size Original-File-Name
===============================================================================
0. System BIOS 20000h(128.00K) 13FFDh(80.00K) EP45UD3P.BIN
1. XGROUP 0E660h(57.59K) 09DB1h(39.42K) awardext.rom
2. ACPI Table 052CFh(20.70K) 01B6Fh(6.86K) ACPITBL.BIN
3. EPA 0168Ch(5.64K) 0030Dh(0.76K) AwardBmp.bmp
4. GROUP ROM[18] 04710h(17.77K) 02F59h(11.84K) ggroup.bin
...
21. OEM0 02AEBh(10.73K) 01FCCh(7.95K) SBF.BIN
22. NOCOMPRESS 11000h(68.00K) 11040h(68.06K) UTS64K.BIN
------------------------------------------------------------------------------------------
We need to extract the first 4 modules-- EP45UD3P.BIN, awardext.rom, ACPITBL.BIN, and AwardBmp.bmp.
Start Winhex and open EP45UD3P.F8. (You can drop the file in the Winhex window.)
Make sure Offsets is set to hexadecimal in the left pane. If it says decimal click in the Offset column to change it.
In this bios the first module begins at offset 0, but that isn't always the case. If it wasn't there you could quickly find it by pressing Control-F and searching for the name of the module (EP45UD3P.BIN).
The third byte of award modules will always be "2D" because of "-lh" in the header. Knowing that makes it easy to select the first byte. The last byte of a module is usually 00.
The system module is followed by a FF byte. (In old Award bioses it is followed by an 8-bit checksum byte instead of FF.) The byte following the system module is included in the size reported by cbrom /d.
Cbrom shows 13FFD as the size of the system module. That means the system module is going to be at 0-13FFB. It looks like 2 less, but that's because it starts with offset 0 not 1, and because of the FF byte after the module. Click Edit-> Define Block and enter 0 for beginning and 13FFB for end. You can see the range and size of the currently selected block in the status bar.
Press Alt-G and put 13FFB to go that offset. You can see the FF following the selection and the third byte of the next module is "2D". Click Edit-> Copy Block -> Into New File. Save the file as EP45UD3P.lha in the folder you made.
Start calc. If it's in Standard mode then click View-> Scientific. Switch from Decimal to Hex.
Enter 13FFC (the byte before the next module). Add 9DB1 (compressed size of awardext.rom). The result 1DDAD will be the last byte of awardext. Press control-c to copy the value. Leave calc running and switch to Winhex.
In Winhex highlight the byte "25" at 13FFD. That is the first byte of awardext. Notice the third byte is "2D". Click Edit-Define Block. 13FFD is already entered in for us since we highlighted the byte first. Click in the End field and press control-v to paste 1DDAD from calc. Using copy/paste is just to avoid typos and save time. You can type the values if you prefer. Notice in the status bar the size of the selection is 9DB1.
Press Alt-G and paste again 1DDAD. Notice the last byte is 00. Notice the third byte following the selection is "2D". Click Edit-> Copy Block -> Into New File. Save the file as awardext.lha.
Copy the compressed size "1B6F" of the next module ACPITBL.BIN from the cbrom report. Go back to Calc. It should still have 1DDAD displayed. Click add and paste 1B6F. Copy the result 1F91C. Leave calc running and switch to Winhex.
In Winhex highlight "24" at 1DDAE which is the first byte of ACPITBL.BIN. Click Edit-Define Block. 1DDAE is already entered in for us since we highlighted the byte first. Click in the End field and press control-v to paste 1F91C from calc. Notice the size of the selection in the status bar is 1B6F.
Press Alt-G and paste again 1F91C. Notice the last byte is 00. Notice the third byte following the selection is "2D". Click Edit-> Copy Block -> Into New File. Save the file as ACPITBL.lha.
Check the size (30D) of AwardBmp.bmp in cbrom report. Switch back to calc. It should still display 1F91C. Add 30D and copy the result 1FC29. We're done with calc so you can close it.
In Winhex highlight "25" at 1F91D which is the first byte of AwardBmp.bmp. Click Edit-Define Block. 1F91D is already entered in for us since we highlighted the byte first. Click in the End field and press control-v to paste 1FC29 from calc. Notice the size of the selection in the status bar is 30D. Scroll down a bit to check the end of the selection. (No need to jump to an offset this time since the selection is so small.) Notice the last byte is 00. Notice the third byte following the selection is "2D". Click Edit-> Copy Block -> Into New File. Save the file as AwardBmp.lha (or epa.lha if you prefer).
We don't need to copy out the next module ggroup.bin, but make a note that it begins at 1FC2A.
You can close EP45UD3P.F8 in Winhex and close or minimize the program.
------------------------------------------------------------------------------------------
Next let's edit the EPA logo to make it more compressible.
Right-click AwardBmp.lha, click WinRar -> Extract here.
Drop AwardBmp.bmp into WinHex.
We are going to keep the header (first 7 bytes) and the footer (from "RGB" to the end) and zero out the rest.
Scroll to the end of the file and highlight a random zero byte before RGB. Click Edit -> Define Block. The ending address is filled in for us. Put "E" for beginning address. You can scroll up to see what you've selected.
If Winhex is in Read-only mode, right-click on the left pane, Click Select Mode, and choose Default Edit Mode.
Click Edit -> Fill Block. In "Fill with hex values" box enter 00 and click OK.
Save (click floppy icon and toolbar) and close AwardBmp.bmp. Close or minimize WinHex.
Next we have to recompress the new AwardBmp.bmp.
For that we'll use a dummy bios. Copy empty.bak to dummy.bin.
At the Command Prompt type:
cbrom dummy.bin /epa AwardBmp.bmp
(Remember you can just type "aw" TAB.)
Rename the new file bios.rom to AwardBmpmod.lha (or epamod.lha if you prefer).
Delete AwardBmp.bmp and dummy.bin.
Drop AwardBmp.lha and AwardBmpmod.lha into Winhex and make a note of the file size for each.
old epa size: 781
new epa size: 94
Close those 2 files now.
------------------------------------------------------------------------------------------
Now that we've done the grunt work of extracting the modules and compressing the EPA things will get more interesting.
For Award BIOS approximately the second half of the BIOS can be found in RAM.
Let's check the system module for a place to put the SLIC.
Right-click EP45UD3P.lha, click WinRar -> Extract here
Note: Sometimes the uncompressed system file has the same name as the whole bios file. In that case double-click the .lha and drop the .BIN into a different folder to work with it. Or you could rename the whole bios file. Don't change the names of any of the uncompressed modules.
Open EP45UD3P.BIN in Winhex.
Press Alt-G, put 1E000.
I use the section of zeroes above 1E000 for putting the SLIC. In some bioses data in 1DF00-1DFFF may get changed in RAM so to be safe always leave a 100h buffer between the bottom of the SLIC and 1E000. Since there's limited space in this BIOS and we'll need to write more data underneath it (approximately a second SLIC's worth) lets use 1DC40 for SLIC location. That still gives us a couple rows of buffer zeroes abvoe the SLIC.
Note: There's also a section of FF's above offset 10000 that would probably work but I haven't used it yet. Once it's been tested working that may be a better location.
Now we need to calculate the pointer.
System file offset + E0000 = RAM location
1DC40 + E0000 = FDC40 = 00 0F DC 40
Reverse the order of the bytes to make the pointer.
Pointer = 40 DC 0F 00
Close EP45UD3P.BIN for now.
------------------------------------------------------------------------------------------
Next we'll edit ACPITBL.BIN.
Right-click ACPITBL.lha, click WinRar -> Extract here
Drop ACPITBL.BIN into Winhex.
The number after "RSDT" is the size. You need to add 4h.
In this case change the value from "40" to "44".
Change the oem id & table id to match the SLIC that you're using.
In this case change "GBT " to "_ASUS_" and "GBTUACPI" to "Notebook"
Next we need to paste 4 bytes at the end of RSDT and enter the pointer.
Click on offset 40h. (It corresponds to the "F" in FXCP.)
Click Edit-> Paste Zero Bytes. Put 4 and click OK.
Change the new bytes (40h-43h) to the pointer address "40 DC 0F 00"
Note: It's vital that the pointer address be correct or the computer may not boot. No pressure ;)
Save ACPITBL.BIN and close the file.
Before:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 52 53 44 54 40 00 00 00 01 00 47 42 54 20 20 20 RSDT@.....GBT
00000010 47 42 54 55 41 43 50 49 31 2E 30 42 47 42 54 55 GBTUACPI1.0BGBTU
00000020 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 46 58 43 50 74 00 00 00 46 41 43 50 74 00 00 00 FXCPt...FACPt...
After:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 52 53 44 54 44 00 00 00 01 00 5F 41 53 55 53 5F RSDTD....._ASUS_
00000010 4E 6F 74 65 62 6F 6F 6B 31 2E 30 42 47 42 54 55 Notebook1.0BGBTU
00000020 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 40 DC 0F 00 46 58 43 50 74 00 00 00 46 41 43 50 @?.FXCPt...FACP
Now we need to compress ACPITBL.BIN
Copy empty.bak to dummy.bin
At the command prompt type:
cbrom dummy.bin /acpi ACPITBL.BIN
Remember you can just type "ac" TAB.
Rename the newly created "bios.rom" to "acpimod.lha"
Delete ACPITBL.BIN and dummy.bin
Drop ACPITBL.lha and acpimod.lha into Winhex to check the file sizes and note the increase.
Old acpi size: 7,023 bytes
New acpi size: 7,043 bytes (20 byte increase)
------------------------------------------------------------------------------------------
Next we need to calculate how much space is left over after shrinking the EPA and increasing the ACPI.
Whatever amount is left is what the compressed system needs to increase by.
781 old epa size
- 94 new epa size
- 20 increased acpi
---
667 bytes left
Drop EP45UD3P.lha into Winhex to check its size and then close it.
Old compressed system: 81,916
Add 667 to the old size.
New compressed system needs to be: 82,583
------------------------------------------------------------------------------------------
Now that we know what size the compressed system needs to be, we're ready to edit the system file.
Drop EP45UD3P.BIN in Winhex.
Press Alt-G and put 1DC40
Drop ASUS.BIN into Winhex
With the ASUS.BIN tab press Control-A to select all and Control-C to copy it.
Click the EP45UD3P.BIN tab. You should still be at offset 1DC40.
If Winhex is in Read-only mode, right-click on the left pane, Click Select Mode, and choose Default Edit Mode.
Click Edit -> Clipboard Data -> Write
Note: It's important to use Write, not Paste since we want to overwrite the zeroes with the SLIC, not insert new bytes.
One SLIC won't be enough to increase the compressed system to the size we need, but 2 SLIC's should be about right.
Drop HP.BIN into Winhex.
In the HP.BIN tab press Control-A to select all and Control-C to copy it.
Click the EP45UD3P.BIN tab.
Click the byte at offset 1DDD0 (a couple rows below the Asus SLIC).
Click Edit -> Clipboard Data -> Write
If I'm editing the system file anyway I usually add some SLP names for XP activation.
You could type ASUS_FLASH after one of the SLIC's but I usually put names in the IBM Trademark message.
Scroll down a bit so 1E000 is near the top of the window.
Click on the "I" in INTERNATIONAL at 1E127. Press the space bar through the "P" in CORP.
At the beginning of the spaces put ASUS_FLASH and Hewlett-Packard. You can combine them to ASUS_FLASHewlett-Packard.
If you want to add SLP for Dell you can type "Dell System" beginning at offset 1E061. (It has a more restrictive range so it can't go in the trademark message.) I'll skip Dell for this mod.
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
0001E110 20 49 42 4D 20 49 53 20 41 20 54 52 41 44 45 4D IBM IS A TRADEM
0001E120 41 52 4B 20 4F 46 20 41 53 55 53 5F 46 4C 41 53 ARK OF ASUS_FLAS
0001E130 48 65 77 6C 65 74 74 2D 50 61 63 6B 61 72 64 20 Hewlett-Packard
0001E140 20 20 20 20 20 20 20 20 20 20 20 2E 55 8B EC 56 .U뗭V
Save EP45UD3P.BIN but keep it open because most likely it will require further editing.
Let's see what it compresses to.
Copy empty.bak to dummy.bin
At the command prompt type:
cbrom dummy.bin /other 5000:0 EP45UD3P.BIN
Drop bios.rom into Winhex to check the size. It is 82,576 bytes. Close bios.rom.
Delete bios.rom and dummy.bin.
We need the new system to be 82,583 so we need it to increase 7 more bytes.
In Winhex add "LENOVO1" after "Hewlett-Packard" in the trademark message and save EP45UD3P.BIN again.
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
0001E110 20 49 42 4D 20 49 53 20 41 20 54 52 41 44 45 4D IBM IS A TRADEM
0001E120 41 52 4B 20 4F 46 20 41 53 55 53 5F 46 4C 41 53 ARK OF ASUS_FLAS
0001E130 48 65 77 6C 65 74 74 2D 50 61 63 6B 61 72 64 4C Hewlett-PackardL
0001E140 45 4E 4F 56 4F 31 20 20 20 20 20 2E 55 8B EC 56 ENOVO1 .U뗭V
Copy empty.bak to dummy.bin
At the command prompt type:
cbrom dummy.bin /other 5000:0 EP45UD3P.BIN
Note: You can press the UP arrow once to bring up the last command you typed.
Drop bios.rom into Winhex to check the size. It's now 82,583 bytes. Not bad for second try.
Close everything that's open in Winhex.
Rename bios.rom to systemmod.lha
Delete EP45UD3P.BIN and dummy.bin
------------------------------------------------------------------------------------------
All our modules are done, so we're ready to rock and roll and write them into the bios!
Drop EP45UD3P.F8 in Winhex.
We need to write the modules in the same order as in the original BIOS. (Refer to cbrom /d report.)
Drop in systemmod.lha
On the systemmod.lha tab, press Control-A to select all and Control-C to copy.
Click the EP45UD3P.F8 tab
If Winhex is in Read-only mode, right-click on the left pane, Click Select Mode, and choose Default Edit Mode.
You should already be at offset 0.
Click Edit-> Clipboard Data -> Write
The block is automatically selected. In the status bar you can see it is 0-14296.
Press Alt-G, and put 14297
Change the byte at 14297 to FF. (This is only done after the system module.)
Press ESC to unselect the previous block
Drop awardext.lha in Winhex.
On the awardext.lha tab, press Control-A to select all and Control-C to copy.
Click the EP45UD3P.F8 tab
Click in 14298 if you aren't there already.
Click Edit-> Clipboard Data -> Write
The block is automatically selected. In the status bar you can see it is 14298-1E048.
Press Alt-G, and put 1E049
Press ESC to unselect the previous block
Drop acpimod.lha into Winhex.
On the acpimod.lha tab, press Control-A to select all and Control-C to copy.
Click the EP45UD3P.F8 tab
Click 1E049 if you aren't on it already.
Click Edit-> Clipboard Data -> Write
The block is automatically selected. In the status bar you can see it is 1E049-1FBCB
Press Alt-G, and put 1FBCC
Press ESC to unselect the previous block
Drop AwardBmpmod.lha in Winhex.
On the AwardBmpmod.lha tab, press Control-A to select all and Control-C to copy.
Click the EP45UD3P.F8 tab
Click 1FBCC if you're not there already.
Click Edit-> Clipboard Data -> Write
The block is automatically selected. In the status bar you can see it is 1FBCC-1FC29.
Scroll down a little so you can see the end of the block. You can see the next module ggroup.bin begins at 1FC2A as expected and the third byte is "2D".
We're done writing modules so save EP45UD3P.F8 and close everything in Winhex!
------------------------------------------------------------------------------------------
The only step left is to add & release a module with cbrom to correct the checksum.
This bios has a UTS64K.BIN module at the end. Modules added after UTS64K.BIN won't work correctly in a bios, but since we're releasing the module that we're adding anyway it doesn't matter.
Before using cbrom on the new bios I like to make an extra copy of it to compare the changes cbrom makes.
Click EP45UD3P.F8 and press Control-C to copy and press Control-V to paste. At the end of the file name "Copy of EP45UD3P.F8" you can add "before cbrom".
At the command prompt type:
cbrom EP45UD3P.F8 /isa iasus.bin
cbrom EP45UD3P.F8 /isa release
(Remember for the second command you can press UP arrow and just change the last word.)
You can delete the extra files cbrom made: bios.rom, FILE_BUF.STV, original.tmp
------------------------------------------------------------------------------------------
Now to double check the changes made.
Drop "Copy of EP45UD3P.F8 before cbrom" into Winhex.
Next drop "EP45UD3P.F8" into Winhex.
Click Tools -> File Tools -> Compare
Click OK.
Compare 0 bytes automatically changes to 1048576 bytes, the size of the files.
Click OK again to start the compare. Click OK again to view the report in notepad.
The bytes that changed: EBFFE, EBFFF, EE000, and EE001 are checksum bytes surrounded by FF blocks, so those changes are OK. Some blocks of 00/FE pattern were changed to FF which is fine too. (It would be OK if they changed from FF to 00/FE pattern as well.) We just don't want bytes of actual code to change.
One other double check I do is cbrom /d on the new BIOS file to compare the report to the original.
ex: cbrom EP45UD3P.F8 /d > EP45UD3P.txt
If you already have a EP45UD3P.txt in the directory rename it to "EP45UD3P old.txt" first so it doesn't get overwritten.
All the same modules should be listed. The only difference will be the original size of ACPITBL.BIN (since we added 4 bytes), and the compressed size of EP45UD3P.BIN, ACPITBL.BIN, and AwardBmp.bmp. A program you can use to quickly compare 2 text files is ExamDiff Pro. Any differences will be highlighted.
That's all, the mod is complete!
If uploading the mod for someone else I like to include:
- The .XRM-MS file that matches the SLIC I used.
- The original unmodded BIOS
- The final modded BIOS
- The flash utility (if any) that came with the original BIOS.
- I also include my notes if it's an oem/ssv3 mod, but that's up to you.
After uploading the file make a note of the "delete" link if provided with one in case there's a problem with the mod. That way you could remove it so more people don't use it. | |
