How to > HP BIOS MiniPCI Fix- nc6000/others

[nando4]

Semi - much thank yous for your reverse engineering prowess in providing HP/Compaq owners bios editting ability. I have looked at the decompressed 2510P bios and sure enough, the whitelist is there. Unusually, the 2510P whitelist starts in line 2510 for bios F.0E. Strange synchronisity.


2510P F.0E whitelist. Underlined is the pci-e ID of the 4965ABN card supplied with my system

Let me explain what I am trying to do:
1/ Replace E41411433C106313 (first whitelist entry) with my HD4670 (connected via mPCIe to pci-e adapter) whose details are below:

PCI\VEN_1002&DEV_9490&SUBSYS_22681787
0210909487176822 <- ATI HD4670 external graphics

The first part is easy enough.. I find the first whitelist entry, replace the bytes with the details I need, and fill the other bytes with the original data. The checksum fixing is where the process is not so clear. Rather than use Boot Wake On Lan for checksum correction, as I have unsuccessfully done previously, I've attempted to use another whitelist entry.. since there are heaps. How do I find the compressed bytes for the second whitelist entry??

[tweakertje]

Hey tweakertje,

thats normal. If you checked "search in ... decompressed whitelist" its only
for the detection of the whitelist to watch and know there. If you take 12 Bytes from
the decompressed whitelist for changing it in your compressed bios file, it would
make no sense. Cause you cant find and change them in the compressed file.
Therefore I have removed this feature for this situation.

Take the first entrie from the decompressed whitelist, insert into BIOS notation
and check "search in ... compressed Whitelist". You have to found an ID which is
not compressed to change all your new eight bytes.
->E41411433C106313 -> FEC100E41411433C10635513

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00002510  C3 E4 14 11 43 3C 10 63 13 E4 14 11 43 3C 10 65  Ãä..C<.c.ä..C<.e
00002520  13 E4 14 11 43 3C 10 64 13 E4 14 12 43 3C 10 60  .ä..C<.d.ä..C<.`
00002530  13 E4 14 12 43 3C 10 62 13 E4 14 12 43 3C 10 61  .ä..C<.b.ä..C<.a
00002540  13 86 80 22 42 3C 10 5B 13 86 80 22 42 3C 10 5C  .†€"B<.[.†€"B<.\
00002550  13 86 80 22 42 3C 10 5E 13 86 80 22 42 3C 10 5D  .†€"B<.^.†€"B<.]
00002560  13 86 80 22 42 3C 10 5F 13 86 80 22 42 86 80 05  .†€"B<._.†€"B†€.
00002570  10 86 80 22 42 86 80 34 10 86 80 22 42 86 80 00  .†€"B†€4.†€"B†€.
00002580  10 86 80 22 42 86 80 01 10 86 80 22 42 86 80 02  .†€"B†€..†€"B†€.
00002590  10 86 80 22 42 86 80 03 10 86 80 22 42 86 80 04  .†€"B†€..†€"B†€.
000025A0  10 E4 14 28 43 3C 10 66 13 E4 14 28 43 3C 10 67  .ä.(C<.f.ä.(C<.g
000025B0  13 E4 14 28 43 3C 10 68 13 E4 14 12 43 3C 10 70  .ä.(C<.h.ä..C<.p
000025C0  13 E4 14 12 43 3C 10 71 13 E4 14 12 43 3C 10 72  .ä..C<.q.ä..C<.r
000025D0  13 E4 14 11 43 3C 10 74 13 E4 14 11 43 3C 10 75  .ä..C<.t.ä..C<.u
000025E0  13 E4 14 11 43 3C 10 76 13 86 80 29 42 86 80 00  .ä..C<.v.†€)B†€.
000025F0  10 86 80 29 42 86 80 01 10 86 80 29 42 86 80 02  .†€)B†€..†€)B†€.
00002600  10 86 80 29 42 86 80 03 10 86 80 29 42 86 80 00  .†€)B†€..†€)B†€.
00002610  11 86 80 29 42 86 80 01 11 86 80 29 42 86 80 02  .†€)B†€..†€)B†€.
00002620  11 86 80 29 42 86 80 03 11 86 80 29 42 86 80 04  .†€)B†€..†€)B†€.
00002630  11 66 50 53 51 52 56 57 33 F6 B8 79 EA B3 00 68  .fPSQRVW3ö¸yê³.h


But why you searching for the decompressed whitelist with an ID? The ADDCC v3 found exactly
the position. In 68MSP_FOE_2510P.BIN the whitelist end is at 0x2632

Cheers Semi

Yes he finds it but what must i change en how can i do that 0x2632 is the end of the whitelist
it seems to be starting at 0x2520 16-ansi-hex watching the hex but can i change any of the strings to match my new card ?
i watched the video's and there the bytes where filled in by original bios byte string
the hex editor finds E41411433C106313 at 0x2510 <- ??????

I don't understand how and where i can change

[semi]

@tweakertje,

is it really soo complicated? If Yes, I'am Sorry. Ok I will it explain it once again, "only" for you!

Its right, The end of the whitelist could be found with ADDCC v3, here at 0x2632. I repeat, the end of the whitelist.
The beginning is anywhere above. with the method of "charp seeing" will you find it.

but can i change any of the strings to match my new card ?

principled YES. BUT, with the first Entrie from the whitelist it is the easiest way. It is the "root". all other are only derived from this
entry cause some bytes are repeat. So its easier to change only the first entry, that is not
compressed in the original file. Watch the axplanation below. I will show it exactly.

@nando

How do I find the compressed bytes for the second whitelist entry??

Please take a look in the ADDCC PDF on the chapter: The Source Code of the Decompresser Routine
-> The compressed data Struct -> Instruction bytes

There is all explained. I will show you with your example.

How we know, the first decompressed whitelist entry is: E41411433C106313
If we search for it in the compressed whitelist, we will get this: FEC100E41411433C10635513

It is obvious, that the 55 is an instruction byte. Ok lets check this more precisely with a look in this hex area.

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00011400  70 62 00 86 FE C1 00 E4 14 11 43 3C 10 63 55 13  pb.†þÁ.ä..C<.cU.
00011410  83 00 65 84 00 64 00 01 12 80 01 F5 60 84 00 62  ƒ.e„.d...€.õ`„.b
00011420  04 01 61 13 86 80 5F 22 42 3C 10 5B 84 00 5C 04  ..a.†€_"B<.[„.\.
00011430  01 D5 5E 84 01 5D 04 02 5F 82 02 86 80 AB 05 10  .Õ^„.].._‚.†€«..
00011440  83 00 34 84 00 00 04 01 01 EA 84 01 02 04 02 03  ƒ.4„.....ê„.....
00011450  84 02 04 10 E4 4B 14 28 00 09 66 00 09 81 00 67  „...äK.(..f....g
00011460  84 00 55 68 04 09 70 84 09 71 04 0A 72 84 0B 55  „.Uh..p„.q..r„.U
00011470  74 04 0C 75 84 0C 76 80 0A 29 04 07 80 81 00 01  t..u„.v€.)..€...
00011480  07 01 01 01 07 81 01 01 07 02 02 11 D4 04 02 84  ............Ô..„
00011490  00 02 04 01 03 84 01 04 11 FD 66 90 42 52 56 57  .....„...ýf.BRVW
000114A0  33 F6 B8 EF 79 EA B3 00 C5 61 66 83 FB BF 00 74  3ö¸ïyê³.Åafƒû¿.t
000114B0  03 83 CE 02 60 01 BB DC F0 7D 7C 01 04 B0 52 F6  .ƒÎ.`.»Üð}|..°Rö


The 55 have to interpret binary -> (MSB) 01010101 (LSB) To read from right to left.
A byte is always presentably in 8 Bits -> ergo, they are always 8 operations per instruction byte.
After this eight operations, there is the next instruction byte.

1 means, copy the next byte
0 means, take the next two bytes in revers order, the left 3 nibbles are the reading ptr position in the wordbook, and the right nibble + 3 is the counter for the copy loop.

The wordbook = the decompressed file. Ok we dont know the history of this file at the moment,
but maybe we can use the decompressed file in this case to help us out.
Here the POI's. Points of interest.

E41411433C106355138300658400640001128001F5

The next instruction byte is the F5

8300 -> 008 3 -> 008 (3+3=6) Loop-counter = 6
8400 -> 008 4 -> 008 (4+3=7) Loop-counter = 7
0001 -> 010 0 -> 010 (0+3=3) Loop-counter = 3
8001 -> 018 0 -> 018 (0+3=3) Loop-counter = 3

The decompressed part look principal like this:
E41411433C106313XXXXXXXXXXXX65XXXXXXXXXXXXXX64XXXXXX12XXXXXX

So lets find out where the wordbook ptr shows. 008 is to substract from the actual write position in the wordbook. The last written byte was the 13.
From this it follows that the read ptr is at the E4, and to write are 6 bytes.
E41411433C106313E41411433C1065XXXXXXXXXXXXXX64XXXXXX12XXXXXX

The next is once again 008, and its to subtract from the last written byte position, the 65.
From this it follows that the read ptr is at the 13, and to write are 7 bytes.
E41411433C106313E41411433C106513E41411433C1064XXXXXX12XXXXXX

The next one is 010, and its to subtract from the last written byte position, the 64.
From this it follows that the read ptr is once again at the 13, and to write are 3 bytes.
E41411433C106313E41411433C106513E41411433C106413E41412XXXXXX

The next one is 018, and its to subtract from the last written byte position, the 12.
From this it follows that the read ptr is at the 43, and to write are 3 bytes.
E41411433C106313E41411433C106513E41411433C106413E41412433C10

Puhh so much stuff at once, but it is, "the same procedure". Ok lets shortly check if its right!?
Compare it with the compressed one and its identical.

I think its enough? The next instruction byte is the F5 -> (MSB) 11110101 (LSB)

With this knowledge, you will find out any instruction byte, and any byte that you can change as you want.
Maybe you can modifie the bytes so individual as you want. But you dont have to change the
filesize or the byte positions.

F5608400620401611386805F22423C105B84005C0401D55E84015D04025F82028680AB0510830034840000040101EA84010204020384020410E44B14280009660009810067840055
next instruction byte is the 5F -> (MSB) 01011111(LSB)
next instruction byte is the D5 -> (MSB) 11010101(LSB)
next instruction byte is the AB -> (MSB) 10101011(LSB)
next instruction byte is the EA -> (MSB) 11101010(LSB)
next instruction byte is the 4B -> (MSB) 01001011(LSB)
next instruction byte is the 55 -> (MSB) 01010101(LSB)

Hope this helps!?

Cheers Semi

[nando4]

@tweakertje,

is it really soo complicated? If Yes, I'am Sorry. Ok I will it explain it once again, "only" for you!

tweakertje/semi,

I proceeded to edit the 2510P F.0E bios to add my HD4670, using the first whitelist entry as I posted a few posts back, and "boot wakeup LAN" string for CRC correction with a resultant 2510P-F0E-HD4670-patch.bin. The decompressed whitelist now has replaced the E4 14 strings with my HD4670 pci-id strings, true to semis description above. Flashing this file resulting in a system that booted to a black LCD with no activity. I resorted to Emergency recovery (with floppy disk) which salvaged me back into action. While I do have a whitelist workaround in place as documented earlier in this thread by saving/loading pci-e configurations space, it would be great to see if the bios does anything special when a HD4670 is detected by it. Eg: a HP Pavilion DV2000 will send it's bios output to the external graphics. So semi's solution has application to those wanting to use newer or non-HP wifi cards as well as the DIY ViDock HP users.

Semi - can you perhaps consider providing a step-by-step solution here from beginning to end as an example?

[semi]

Hey nando,

I'am belied from you!

You dont think its a little bit shameless and shamelessly from you?

How much Step-by-Step examples should I explain too?

There is an unwritten rule in this world.
If you don't get it, it is not to be also!

it would be great to see if the bios does anything special when a HD4670 is detected by it

I can't understand why you personal force so small is ,if the "anything" should be so great special!?

Sure, I can only speek for my self: If I really want it, I get it!

Ok its enough, but it must be said.

Anyway, I have compared you files.

The original Byte-String is:
57 61 6B 65 20 4F 6E FF
W a k e _O n ÿ

You have change it to:
80 57 2B 8A 7F 56 2A 89
€ W + Š . V * ‰

I cant count it, how much I've said, DONT CHANGE the decompressen bytes.
Muha, and exactly this was your fault and your last question.

I am not sure, but this could be the problem.
Or your engine generelly not supports a graphical out
via mini PCI.

What was your Checksum diffenrences?
My was (-03 -84 -51 88).

And if I take the same byte from above, I get this:
57616B65204F6EFF -> 3A1644F63A1644F6

How could this be?

Anyway, take a HEX editor and try this:

Replace:
1.FEC100E41411433C10635513
2.FEC100021090948717685522

And this to fix the checksum:
1.0401611386805F22423C105B
2.0401109B831C5F22421C105B

Good luck.

Semi

[nando4]

Anyway, take a HEX editor and try this:

Replace:
1.FEC100E41411433C10635513
2.FEC100021090948717685522

And this to fix the checksum:
1.0401611386805F22423C105B
2.0401109B831C5F22421C105B

Good luck.

Semi

Semi - thank you for this info. I've done the changes, noting the two strings are both in the uncompressed whitelist. It required TTAV134's modified hpqflash from here to be able to successfully flash the modified ROM.CAB, with system booting and fully functional afterwards. My result being:

* the HD4670/mPCIe port is still not enabled by the bios. This would indicate the bios is doing some additional checking to confirm it is a wireless card before the mPCIe port is enabled. Having it plugged in never ever resulted in the 104 error noted below.

* when I put the HP supplied 4965AGN back into the system with this modified F.0E bios I get now get an error:

104-Unsupported wireless network device detected. System Halted. Remove device and restart.

So enabling the HD4670's VID/DID buggered up the 4965AGN's VID/DID. So flashing back to my previous bios so the 4965AGN wifi card works without the 104 error and studying pinout differences between the 4965AGN and my PE4L-PM3N as shown here, schematic here to try to make the PM3N present as a wireless card to the bios. Glad I still have my workaround via DOS pci-e configuration dump/reload in place.

Even though the HD4670 was not successfully recognised, the procedure followed above and evaluation of the uncompressed whitelist would suggest to me that the 2510P BIOS CAN be modded to accept non-HP wifi cards.

WWAN USB Device ID



The uncompressed bios file also shows:

- HP HS2300 (Sierra MC8775) WWAN card ID:03F0 1E1D
- HP EV2200 (Sierra MC5720) WWAN card ID:03F0 1B1D
- HP EV2210 (Sierra MC5725) WWAN card ID:03F0 211D

Semi - you may consider providing a facility to mod those values as well to add non-HP WWAN card into that list. Your reverse engineering providing a bonanza of modding possibilities previously not possible

[semi]

Hey Nando,

Semi - you may consider providing a facility to mod those values as well to add non-HP WWAN card into that list. Your reverse engineering providing a bonanza of modding possibilities previously not possible

Thanks for the flowers, but I'am only standing on the shoulders of giants!

slowly I think, I understand you.

You think, the WLAN -> WWAN check is only one check, from two or more follow checks!?
And you hope, that the USB VID and PID is the second check, and if you change this
smart, your enginge will be boot as you wish!?

Hm, nice thought. Ok lets get some information about this...

I have searched for this devices.

- HP HS2300 (Sierra MC8775) WWAN card ID:03F0 1E1D
- HP EV2200 (Sierra MC5720) WWAN card ID:03F0 1B1D
- HP EV2210 (Sierra MC5725) WWAN card ID:03F0 211D

It looks like, that Sierra Wireless Inc. has a contract with HP, ok. But there are no
drivers on their website. But HP has it. Ok I have extracted the installers and take
a look in the drivers .inf files. Oh wow. There exactly this entries in it.

Code: Select all

%DEVICEHS2300.SWNETWORK% = SWPORT, SWMUXBUS\SW_NET_0_VID_03F0&PID_1E1D
%DEVICE1EV2000HP.SWMODEM% = SWMODEM, SWMUXBUS\SW_MODEM_1_VID_03f0&PID_1b1d
%DEVICE1EV2210HP.SWMODEM% = SWMODEM, SWMUXBUS\SW_MODEM_1_VID_03f0&PID_211d
%DEVICE0MC5720.SWNETWORK% = SWPORT, SWMUXBUS\SW_NET_0_VID_03f0&PID_1b1d
%DEVICE0MC5725.SWNETWORK% = SWPORT, SWMUXBUS\SW_NET_0_VID_03f0&PID_211d

Very nice, this fakt underpins your theory.
As I'am understand it, the Sierra MC8775 WWAN cards are two devices in one.
The wireless transreciever plus the simcard modul.

Curious, to date i thought ever only USB devices has this VID and PID
id bytes. Hm. There must be an integrated USB device inside!

If I take a look in your posted "schematic" there is USB+D and USB-D pin,
renamed to DP and DN. And goes to a Diffpair. Ok, it could be possible.

My question, why dont you change the VID and PID IDs in the bios file, to the
Sapphire HD4670 ones?

Or have you already try it?
I think the position of the compressed VID PID Bytes are at 0x116E00, or search for this byte string CFF0031DD51B4000

unfortunately I cant find any drivers .inf file in the extracted drivers package.9-11_xp32-64_xcode_633941782788848750.zip
How can you get this VID PID ID's from your card?

It required TTAV134's modified hpqflash from here to be able to successfully flash the modified ROM.CAB, with system booting and fully functional afterwards. My result being:

What is with the Freedos Flashversion?

Eg: a HP Pavilion DV2000 will send it's bios output to the external graphics.

Hey this is a Phoenix BIOS, not a HP Compaq. Why dont say this?

What's your next step?

[gatsu_1981]

Curious, to date i thought ever only USB devices has this VID and PID
id bytes. Hm. There must be an integrated USB device inside!

Indeed, WWAN mini PCI-E cards are really USB only devices.
A while ago, I was going to buy an integrated ALIX board for turning it into a powerful x86 router, so I studied something about the magic PCI-E slot.
And on the manual it reported that the integrated mini pci-e slot could be only used with WWAN card, since it's USB only.

And, usually, on a laptop equipped with 2x mini pci-e slots, you can't deliberately swap WWAN with WIFI card.
Since WWAN PCI-E is pre-made to be usb-only, and it will activate the sim holder that's already on a WWAN-equipped notebook.

Another confirmation of this theory is that most Sierra Wireless devices exist not only as a mini-pci-e card, but as external usb card too.
And some years ago, buying an external usb device was a cheaper method for getting an internal WWAN card, since most Sierra external modem are just usb adapters for mini pci-e WWAN card.

Read the second post here:

http://old.nabble.com/Sierra-Wireless-m ... 36856.html

[rclarksworld]

Guys,

I've read so much of this information but I am afraid I'm going to brick this if I attempt to perform the edits to the BIOS myself, as I am not that experienced in HEX editing. I have an nc6000 that came without wireless and I have taken an Atheros AR5004G from a defunct Toshiba. Of course, error 104 abounds. I did the method involving popping the card in in sleep mode, and these are the hardware IDs I get:

PCI\VEN_168C&DEV_0013&SUBSYS_7064144F&REV_01
PCI\VEN_168C&DEV_0013&SUBSYS_7064144F
PCI\VEN_168C&DEV_0013&CC_020000
PCI\VEN_168C&DEV_0013&CC_0200

The card works beautifully when inserted and drivers are installed, but this is a tedious endeavor. Is there anyone here who may have happened to have made an update for this card already?

Thanks,
Rick

[nando4]

The card works beautifully when inserted and drivers are installed, but this is a tedious endeavor. Is there anyone here who may have happened to have made an update for this card already?

If just have the error-104 and the card works if you put it in after bios bootup, but before OS load, then consider a tiny switch to disconnect/reconnect one of the mPCIe pins TX/RX (23/25/33/35). Turn off so that card isn't seen by the bios and doesn't halt with an error-104, turn on before OS loads. A bios solution would be better but requires some skill.

What's your next step?

Continuing on with the mPCIe workaround. The ADDCC V3 mod isn't going to help HP mPCIe systems run a DIY ViDOCK setup, since the bios does some further checking to ensure it's a wifi card. So I've checked the original workaround, finding it can be simplified to simply saving/load mPCIe port config details (4kb) and define the memory window. The port is then unlocked and works fine with the HD4670 on my 2510P. Will do some more testing and update that post. Now that I know the error-104 halts the system with non-HP wifi I know that workaround will not correct non-HP wifi use.

If bios compression was available it would give incentive to attempt bios patching to skip the whitelisting checks altogether.The cleanest solution.

[sugark]

Hi Semi,

I have done the mods as you show me, but still the same. New Wifi works well after several reboots too, but when I completely power off the PC never boots up again.
Idea? See my screenshot!



Bye,
Krisztian

[AlanSpoon]

Hi Guys,

Thanks for your great posts. I would like to know if there is a patch or round way working for the pci-whitelisting on HP Compaq 6910p. I have a WWAN module- MC8790 card on hand, but I can't use it on laptop due to bios whitelisting.

Thank you for your great help.
These are my system bios information as follows.

"Field Value
BIOS Properties
BIOS Type Compaq
BIOS Version 68MCD Ver. F.13
Compaq BIOS Ownership Tag Unknown
Compaq BIOS UUID Unknown
System BIOS Date 02/20/08
Video BIOS Date 05/25/07

BIOS Manufacturer
Company Name Hewlett-Packard Company
Product Information http://www.compaq.com
"

[zi_exnium]

sorry 4 my english

@semi:
ADDCC_V3 do not works on hp 2530p bios.
it pop up a error message like this:

QQ截图未命名.jpg

error info

(122.26 KiB) Downloaded 299 times

2530p bios file "68PSU" size 1.7M Byte.

[BPopilek]

Hello all! I am looking for some help! I have tried following this thread from page 1 to 12 (current page) and am having no success. This has been a 2 day project already, and I am just getting frustrated! hehe....

I have a HP TC4200 Tablet PC that came pre-installed with an Intel Pro/Wireless 802.11 a/b/g wifi card. I am trying to upgrade this card to a new TP-Link (Atheros Chipset) Wireless N card. The info I have gathered thus far is this:

Original Intel WiFi card: PCI\VEN_8086&DEV_4220&SUBSYS_12F5103C
New TP-Link Wifi card: PCI\VEN_168C&DEV_0023&SUBSYS_2079168C

I have tried using ADDCC v3, and I can open the original 68DTH.bin BIOS file. From there it asks if I want to patch it. I click on no and then open my 68DTH_New.bin file. In this one I have changed the HEX code for the original card to the ID of the new card. I am using HEX Workshop, and when I compare the two files, the only changes it detects are from the Intel Card to the TP-Link card. (See image)



From there I add the additional info for the Checksum Correction into ADDCC and this is where I am stuck. I use the following:

Original BIOS ID: 16C3868020DF423C10F51283
Own BIOS ID: 16C38C1623DF008C16792083
Checksum Difference: -09 7C 2E 1A

I have tried over and over to figure out what I need to be using here to get the correct checksum. At one point something I put into it did take, and it allowed me to save the updated file. However, after I booted into DOS and flashed this new file, it almost bricked my laptop! It would only turn on and the fan ran continuously. I luckily was able to recover it back to the stock BIOS and get it booting again by inserting a USB floppy disk with the original .bin file only, and holding Windows Key + B while powering it on. I don't want a repeat if at all possible, so that is why I am looking for advice. Exactly what do I need to use to get the BIOS checksum corrected so it will flash and boot successfully? Here is a screenshot of where I am sitting now. Thanks in advance!

-Brian

[BPopilek]

To elaborate a bit further, as I have continued to play with this. I have been trying to understand the tutorial more, but it just isn't very clear because the pictures and example code does not line up.

I have tried searching for some ASCII text in the uncompressed & compressed files that was the same. I was able to find the following:

Uncompressed: 426F6F7457616B65 = BootWake
Compressed: 426F6F74FF57616B = Boot.Wak

But when I make the changes my checksum changes from A1B02F7C to 1DDE4973, which does not match the original file checksum of 992C5D96.



I have tried to flash the resulting file with no success. I then tried using some of the HEX code immediately following my new device ID, as the tutorial says.

If I enter: 00F6127FE4142043, then the resulting file ends up with a matching Checksum.



The only problem is that after I flash the BIOS with the new file, it almost bricks it and I have to do an emergency repair from a floppy disk to bring it back to life. Apparently I just need to find the right section of code to change so that the resulting file gets a matching checksum and flashes and boots properly.

Here are the original & modified device ID BIOS files if someone if able to use them to help me get this figured out.

Original BIOS http://home.comcast.net/~bpopilek/bios/68DTH.bin
Modified BIOS http://home.comcast.net/~bpopilek/bios/patched_68DTH.bin

Any and all help is greatly welcomed! Thanks!

-Brian