tag:blogger.com,1999:blog-42594029018248967912011-12-29T20:41:59.272-08:00Welcome to the dark corner of BIOS reverse engineering, code injection and various modification techniques only deemed by those immensely curious about BIOSDarmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.comBlogger331100tag:blogger.com,1999:blog-4259402901824896791.post-78792413640057169782011-11-12T00:21:00.001-08:002011-11-12T00:25:45.009-08:00

Over the past several months, I've been intensively researching BIOS-related binaries. The primary tool I used is still IDA Pro. However, I noted that the speed at which my understanding of the binary evolves still nowhere near what it should be. Therefore, I have been evaluating my method for a while and come-up with these steps: Make sure you know the context at which the certain part(s) of

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com2tag:blogger.com,1999:blog-4259402901824896791.post-39307118608619047662011-11-03T11:30:00.000-07:002011-11-03T11:31:46.362-07:00

It's been "dormant" months on this front for a couple of months. Well, actually I'm working on BIOS and middleware stuff and keeping-up with real life. Now, into the BIOS Disassembly Uncovered 2nd Edition matters. After working on BIOS related research and stuff these last few months I realized that there are a lot of research and works need to be done before I could continue writing stuff

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com2tag:blogger.com,1999:blog-4259402901824896791.post-47359641245691025672011-10-17T00:59:00.000-07:002011-10-17T01:41:16.274-07:00

In this post, I assume the PCI Option ROM is named TEST.ROM. Which is an option ROM not tied to articular hardware The debugging environment consists of two machines, either virtual or physical. In my particular setup, I used two physical machines. The debugging “host” runs Windows 7 64 with IDA Pro as a remote debugger. The “target (gdb server)” runs Linux—with Qemu as the “real” target of

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com2tag:blogger.com,1999:blog-4259402901824896791.post-40742824257670107642011-09-02T13:02:00.000-07:002011-09-02T14:57:11.182-07:00

Well, I should make an article about this later because it doesn't make it to my first edition book. First, let me emphasize that we're looking at the DMI Access Interface from the BIOS execution context, not from within an OS context. The DMI v2.0 specification (www-pc.uni-regensburg.de/hardware/TECHDOK/BIOS_DMI_20.PDF) "vaguely" states that the interface to the DMI from the BIOS execution

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-71943645794081897172011-08-26T12:02:00.001-07:002011-09-02T13:03:09.277-07:00

I haven't had the time to update the copyright notice in the Low Cost Embedded x86 Teaching Tool. However, if you want to use it (and modify it) for your own purposes, you could do so under the Gnu Public License (GPL) version 2 which mandates you to relase your changes. Coreboot project have been using some part of it for their use under the GPL. I'm going to update the license notice in the

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-86292117908292270342011-08-14T20:11:00.001-07:002011-08-14T20:19:22.830-07:00

This is just a dump of the links to download AMD and Intel IOMMU specification. For those of you new to IOMMU, a good introductory is at http://en.wikipedia.org/wiki/IOMMU. Now, the specs: AMD specs: http://support.amd.com/us/Processor_TechDocs/34434-IOMMU-Rev_1.26_2-11-09.pdf and http://support.amd.com/us/Processor_TechDocs/48882.pdf Intel spec: http://download.intel.com/

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-30570154493063130432011-08-06T10:47:00.000-07:002011-08-06T10:53:46.950-07:00

Last wednesday was the second time I fried another USB-to-IDE converter device due to buggy ATA command that was sent to the IDE device (a DVD-ROM Drive). I'm not really sure which command that causes it to happen. But, now is the time to look into ATA command set much deeper. Well, this is just a precaution for guys/girls out there working with *-to-IDE converter device. Be very careful with

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com6tag:blogger.com,1999:blog-4259402901824896791.post-80339047899731010302011-07-30T23:20:00.000-07:002011-07-30T23:28:01.295-07:00

Memory management during POST in "legacy" BIOS is not well known to most system programmers. Probably, only a handful knows that this kind of routine even exists. Perhaps, you would ask why would anyone need a memory manager in BIOS level? Well, as you know, memory space in 16-bit environment is scarce. Moreover, BIOS modules are getting bigger and if all of them loaded at the same time to the 1

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com2tag:blogger.com,1999:blog-4259402901824896791.post-88833762800217247492011-07-30T23:16:00.000-07:002011-07-30T23:19:09.192-07:00

Hi guys, Facebook commenting is now enabled in this blog. I hope this enables better communication with the blog audience. Another news is that I'm going to do cross-referencing to Pinczakko Official Website from here. I'm back to writing articles now that it has been several years dormant. The last article I wrote was on the DLL support in Award BIOS. Well, it has been a long time ago.

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-16337089577015753872011-07-20T13:01:00.000-07:002011-07-20T13:16:18.494-07:00

Hi guys. It's been a very long silence since March. Well, real life got in the way. I was busy with a middleware project and the need to learn from scratch made it very difficult to allocate time for the BIOS research. Well, now I'm back researching BIOS again full-throttle at least 3 days per week. Therefore, the book content would be coming in the coming weeks hopefully. I have several

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com4tag:blogger.com,1999:blog-4259402901824896791.post-60023489575511673392011-03-09T19:55:00.000-08:002011-03-09T19:59:22.754-08:00

Hello guys. First I would like to apologize for the very late delivery of the book. I've been dragging my feet with other works over the past few months and hadn't been able to do considerable work on the book. Anyway, I have discussed everything with my publisher and co-author Luis Miras and we decided that we should push forward much more aggressively. Well, I decided to do a "restart"

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com20tag:blogger.com,1999:blog-4259402901824896791.post-45277187235739736042011-01-09T06:40:00.000-08:002011-01-09T06:49:49.796-08:00

Hi Guys. First I'd like to say Happy New Year to you all. About BIOS Disassembly Ninjutsu Uncovered 2nd Edition, I want to apologize because I couldn't finish the book last year despite my best effort. It's not a vaporware :P, as I've worked on several chapters already. It's too bad that I was very busy last year and couldn't allocate enough time to finish it. However, there was one positive

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com4tag:blogger.com,1999:blog-4259402901824896791.post-38232573597097648962010-10-07T12:13:00.000-07:002010-10-07T12:28:28.404-07:00

The ACPI specification is a huge documentation. Especially ACPI v4.0 spec. It's 727 pages. The how to read it? It depends. For now, I'd like to focus from the perspective of someone who read ASL (ACPI Source Language) source code. Reading ASL code is particularly rather frustrating for beginners. Here's how to do it: If you're total newbie to ACPI, read Chapter 1. Otherwise, proceed to step 2

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-28141511621945320602010-10-07T12:08:00.000-07:002010-10-07T12:13:04.127-07:00

OK. First, I'd like to apologize because of the very lengthy delay on the BIOS Disassembly Ninjutsu Uncovered 2nd Edition. I've got the got to go sign from No Starch Press, but I'm still waiting for my co-author (Luis Miras) to be ready. For sure, you'll get more computer-security-related stuff in the second edition. I have finished the materials for several hardware oriented chapters but they

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com8tag:blogger.com,1999:blog-4259402901824896791.post-13153001057623905232010-10-07T12:04:00.001-07:002010-10-07T12:08:11.122-07:00

It's been ages since I update this blog. Sorry guys. Anyway, I gave a BIOS Security Training a while ago in Europe and I'd like to inform you that if you are interested about such a training, you can contact me by email and we can talk about it. I prefer it to be a small class when giving a training so that the interaction will be more engaging and you can get the most out of it.

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com1tag:blogger.com,1999:blog-4259402901824896791.post-28658358600072356542010-04-26T07:41:00.000-07:002010-04-26T07:59:03.335-07:00

I've made some fixes to the AMI BIOS Reverse Engineering article. The fixes mostly deal with the interpretation of the "headers" of the component in the decompressed AMI System BIOS module a.k.a AMI 1B module (near the end of section 4.4 until the end of the article). I have add some new information regarding the structure of AMI system BIOS as well. Anyway, I built 2 utilities to work with the

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com8tag:blogger.com,1999:blog-4259402901824896791.post-29196198504791886292010-03-15T22:14:00.000-07:002010-03-15T22:21:16.721-07:00

Just finished new article which reveal the inner working of DLL "support" in recent Award BIOS: Pinczakko's Guide to Reversing Award BIOS DLL "Support".

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-68222182591818554982010-03-12T23:59:00.000-08:002010-03-13T00:16:49.690-08:00

You can use the wineconsole application to run a console BIOS utility such as modbin6 in Linux. Wineconsole is part of Wine. Now, let's see an example. Let say, I have installed Wine and I want to run modbin6 from my home directory (which should already contain the modbin6 executable), I would invoke it like this: pinczakko@opusera:~/$ wineconsole MODBIN6.EXE This is how the snapshot of the

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-16026692868909469352010-02-07T11:36:00.000-08:002011-03-11T09:53:30.057-08:00

Hello all. I just want to inform about the latest status of the manuscript. It'll be considerably longer than the previous one and the chapter count will increase rather dramatically because I decided to divide the "monster" chapters in the previous edition into smaller chapters which hopefully easier to understand. I didn't realize about the really huge (read: hard to grasp) chapters prior to

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com43tag:blogger.com,1999:blog-4259402901824896791.post-62609836120055260002009-12-12T12:13:00.001-08:002009-12-12T12:32:53.017-08:00

I've just signed up with No Starch Press. And after discussing the last state of the original book, I decided to just go ahead and make a new edition because I considered the coverage in todays bus protocol implementation in the original book lacking so much. I will try to give enough coverage on HyperTransport and PCI Express. QPI will have a section devoted for it but probably not too deep

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com6tag:blogger.com,1999:blog-4259402901824896791.post-4489005598976515682009-12-07T03:13:00.000-08:002009-12-07T03:25:51.595-08:00

Another indispensable BIOS modification tool is Hexworkshop. Well, there are lots of binary file editor in Linux but none of them lives up to Hexworkshop feature sets and ease of use yet (at least based on my experience).  Fortunately, it works just fine under wine albeit sometimes with noticeable--but not distracting--slowdowns. Here is the screenshot of Hexworkshop  Anyway, the difference

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com1tag:blogger.com,1999:blog-4259402901824896791.post-91260306631723761222009-12-07T02:46:00.000-08:002009-12-07T03:26:17.791-08:00

Since I have a rather weird 3G modem that doesn't work correctly in Windows, I have to use Linux (x86_64) to get online. This is a drawback when I want to do some BIOS modification, until just now. I experimented with Windows AMI BIOS tools recently in my Slamd64 Linux installation with wine. The result is promising. The BIOS binary produced by the AMI BIOS tools runs just fine, equal to

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-67405498880595736742009-11-22T09:58:00.000-08:002009-12-05T05:16:00.800-08:00

After a short glimpse over several mainstream BIOS binaries from several different motherboards, I came to conclusion that the move to UEFI is basically a slow incremental process. I think that most mainstream BIOS binaries at least still have the "compatibility mode code", which is a code path to "legacy BIOS" code, i.e. the BIOS code used in say Award 6.00PG or early AMIBIOS 8 base code. On

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com4tag:blogger.com,1999:blog-4259402901824896791.post-32979971227495180112009-11-04T15:33:00.000-08:002009-12-05T05:14:58.420-08:00

My AMI BIOS Reverse Engineering article is available online now: http://sites.google.com/site/pinczakko/pinczakko-s-guide-to-ami-bios-reverse-engineering-1 Might want to read it Anyway, it's much more condensed than the Award BIOS RE article. Well, this is part of my English edition book. I decided to release it because the NDA has been lifted. Note: Some of today's AMI BIOS binary used

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-29451629876767248832009-09-24T22:00:00.000-07:002009-12-05T05:14:58.420-08:00

Finally, I have finished moving all of the BIOS related articles which were written in English to the new site: http://sites.google.com/site/pinczakko. This is to anticipate the closing down of Geocities next month. Now, you can read the BIOS articles in the new site, including the venerable Award BIOS Reverse Engineering article. Cheers :D

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-51061166233685505932009-08-07T06:38:00.000-07:002009-12-05T05:14:58.420-08:00

I'm in the process of moving all of the contents in my geocities website to http://sites.google.com/site/pinczakko/. It's a work in progress and hopefully completed in the end of September this year. About a month away from the goecities closing date. The website has been a corner stone of my work since 2002 and it's a very memorable learning path for me. Below is the screenshot of the

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-1186512854964503442009-06-30T10:08:00.000-07:002009-12-05T05:15:37.468-08:00

After much waiting finally I received the contract termination document for the English edition of BIOS Disassembly Ninjutsu Uncovered. I plan to print the book in Indonesia and make it available again for those interested. The book will differ a bit from the book published by A-List in which it will contain a tad more materials because the original (unedited) manuscript actually a bit more than

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com22tag:blogger.com,1999:blog-4259402901824896791.post-1571790320009547742009-06-08T09:23:00.001-07:002009-12-05T05:14:58.421-08:00

0. Side Note It's very time consuming to relocate this article from the old Geocities website to this blog. Therefore, I opted to relocate it to Google sites. You can read it at: http://sites.google.com/site/pinczakko/pinczakko-s-guide-to-award-bios-reverse-engineering This blog post is a work in progress. This reminder will be removed once this lengthy detailed post is completed. A more

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com3tag:blogger.com,1999:blog-4259402901824896791.post-20853193827109530302009-04-21T13:17:00.000-07:002009-04-21T13:45:36.855-07:00

I didn't realize it until just now that Vim actually has a quite neat binary file editing mode. Let's have a quick look into this mode. First, you have to start Vim and tell it explicitly that you want to edit a binary file. This is important because if you don't do it, the file is guaranteed to be tampered by Vim in a way that you don't expect it to. To do it, open the file by using the '-b'

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com2tag:blogger.com,1999:blog-4259402901824896791.post-47096711292245781772009-04-02T00:37:00.000-07:002009-06-08T09:05:17.836-07:00

With all the fuss around BIOS rootkit in CanSecWest, I have to say that it's already a long known fact. In 2006 I presented the possibility in AI3 Meeting in ITB (Bandung Institute of Technology). These are the presentation contents: [+/-] Read Details

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-76653215266434516172009-02-17T12:44:00.000-08:002009-02-17T12:54:40.668-08:00

This is a quick post. Will be updated later. Just being here to remind me (haven't write it anywhere yet). The Fujitsu-Siemens BIOS binary distributed in its website is not a plain BIOS binary which you can flash directly to their motherboard without using its propietary tool. The BIOS file structure is quite peculiar from other vendors. Here it is: +--------------------------------+ | Some

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-76331368590356646422009-02-08T08:08:00.000-08:002009-02-08T08:26:18.647-08:00

The BIOS File Structure in its purest form will look like this: +---------------------------+ | Bootblock | +---------------------------+ |Compressed BIOS components | +---------------------------+ The bootblock code responsible for decompression of the compressed BIOS components and to do a very early platform initialization, just enough to make the BIOS decompression

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0tag:blogger.com,1999:blog-4259402901824896791.post-8276097447722235822009-02-08T08:00:00.001-08:002009-02-08T08:24:56.435-08:00

I started this blog in order to organize all of my rumblings on BIOS which are still hosted in www.geocities.com/mamanzip right now. Moving them into a blog will reduce the "pain" when I want to add new information regarding the x86 BIOS materials. As such, this blog will be focused on the x86 BIOS things, particularly: reverse engineering, code injection and modification in general. That's it

Darmawan Salihunhttp://www.blogger.com/profile/16192437872942077146noreply@blogger.com0