BIOS Disassembly Ninjutsu Uncovered (Uncovered series)
Award BIOS model 6.00PG dated November 11,2005. the dimensions of the BIOS is four Mb/512 KB. S.I.I. AWllrd BIOS dossier constitution An Award BIOS ftle contains numerous parts. a few of them are LZII level-l compressed. you could realize them by way of taking a look at the - 1h S- signature initially of that part through the use of a hex editor. An instance is gifted in Hex unload 5.1. Hex sell off 5.1. Compressed Award BIOS part pattern ASCII ooooooe 2SF? 2D6C 6815 D8 lAGO OO~O '700 0000 ,.-lh5-., . .. w.
Ebx :;00 es.i , 10000b mov edi , 180000h mov ecx , 8000h :;00 e::;.i , redi] I dword ptr (esi] 1'OOO : E4DD F_seg to 18 0000h-19 FFFFh . FOOO : E4E4 mov and cax , erG a1 , OFEh erO , cax tUOO : ~4~1 ; replica E_seg- r'OOO : E4i::6 mov FOOO : E4E9 'UlfJ .shULL $+2 FOOO : E4ED jrnp tar ptr boot_bloek_in_KAM 000 : E4FO boot hlock in RAM : xor ax , ax 2000 : ~4FO 2000 : E4F2 mov 2000 : E4F4 2000 :E4F4 2000 : E4F7 suppose ss :nothing mov name fifty five , ax sp , DEOOb. ; s _IJpnll; np.
suppose es : 12000 000:A444 8000 : A44B mcv si, OF349h ax , es rnov mov ds , ax imagine ds : decomp_block 8000 : A44B mov ax , ROOO : 1'.44E mov mov edi , ROOO : A447 BOOO : A449 OOO : A452 lsi + 2J [si + 4J ccx, (si + eighty one ds ax cs ~ header size edi - vacation spot addr ccx - decompression engine byte count number 8000 : A152 8000 : M5C aspect to decompr~~s1on engine si , ax movzx esi, ~i ; replica rep movs byte ptr es : [edij, byte ptr [es11 decompression ; phase 1352h. 8000:A45P xor.
isn't really functioning, i.e., its thirty first bit is nol set. hence, no new code should be relocated into it. To relocate the BIOS modules during this specific AMI BIOS binary, i am utilizing the IDA professional script proven in directory 5.42. directory 5.42. BIOS Modules Relocation Script * relocat~ hello os module~ . idc Simulation uf Lelocate bios modUle strategy at lJ>2h:OOAlh 1352h : Ol58h / #lnclude
different memory-mapped units. one of the motherboard chipsets, the northbridge is chargeable for the program address-space association, fairly its reminiscence controller half. The reminiscence controller makes a decision the place to ahead a learn or write request from the CPU to a certai n reminiscence handle. This operation might be fo"varded to RAM, memory-mapped VGA RAM, or the southbridge; it depends upon the method configuration. If the northbridge is embedded contained in the CPU itself, like within the AMD Athlon.