How to > HP BIOS MiniPCI Fix- nc6000/others

[outrage_uk]

I have come to the conclusion that the BIOS file is compressed.

Playing around with the excellent program "Awesome Dirty Do Checksum Checker V3" (Thank you semi) - I loaded the BIOS file and chose Decompress. This leaves me with the file: "02_POST_00020100_Rom.dec" in the ADDCC_V3 folder.



Opening this I can clearly see my original Wireless Card's ID in the Hex:

PCI\VEN_8086&DEV_4222&SUBSYS_135C103C Hex: 868022423C105C13



So can I just edit the "02_POST_00020100_Rom.dec" file?

If I do, how do I 're-compress' this back into a BIOS file that can be reprogrammed?

Also, I am lost with the changing the Checksum. What options would I need to select to create a new checksum for the new BIOS file to work properly?

[nando4]

I have come to the conclusion that the BIOS file is compressed.

Playing around with the excellent program "Awesome Dirty Do Checksum Checker V3" (Thank you semi) - I loaded the BIOS file and chose Decompress. This leaves me with the file: "02_POST_00020100_Rom.dec" in the ADDCC_V3 folder.
..
So can I just edit the "02_POST_00020100_Rom.dec" file?

If I do, how do I 're-compress' this back into a BIOS file that can be reprogrammed?

Also, I am lost with the changing the Checksum. What options would I need to select to create a new checksum for the new BIOS file to work properly?

SUCCESS.. at last. There was a comment earlier by someone who had success with ADDCCV3 by altering the start position of their checksum bytes which I used to figure a solution though is somewhat tedious:

1. Let ADDCCV3 find the wifi VID/DID (or other bytes of interest)
2. Alter the bytes AND do checksum correction one byte at a time. Eg: change one wifi byte, note the + or - difference use the throwaway string eg: "WAKE ON LAN", - or + to one of those bytes, save file compare against original checksum, load a backup if got a miss and try next throwaway string byte until correct checksum. Repeat until have done this for all your new wifi cards's bytes.
3. [optional] decompress the modified bios binary and compare against the decompressed stock bios ascii files to see if you have altered the wifi strings successfully, with no other side effects.
4. Save and flash and away you go.

I found ADDCCV3's checksum correction just would not work for me and I was hopelessly plugging numbers in for a solution.

The steps above have today brought me my first success. I was able to do dual-IDA mod AND altered my fan speed control bytes in the DSDT table on the latest F.0F 2510P bios to quieten the bugger down. The DSDT mod required an additional checksum byte in the DSDT table to get it add up to zero. Once you know what your doing it's not too bad.

I hope this helps someone. ADDCCV3 is a great tool. I only wish the checksum fixing could effectively do the same thing that I am doing manually so as to guarantee success.

Resultant bios file see: Modified HP 2510P BIOS

[outrage_uk]

Sorry to post on the same subject again. I have spent along time reading the ADDCC tutorial and am still stuck for ideas and require help if possible.

@Semi :

I am confused on Pages 6 / 7 /8 of your Tutorial. I have found the Whitelist in the uncompressed "02_POST_00020100_Rom.dec" file no problem (as my last post).

The problem I am having is finding which entry to edit in the compressed file. I press the "Search in..." button and this shown:



I used the "One Byte Step" option, and forward once. I then edited the "Own BIOS ID Byte String" with the new Wireless N card Hex valve:



I have tried this - and it is incorrect. After patching the BIOS then decompressing it, the Whitelist is wrong and 4 bytes are missing:

Original Decompressed Whitelist:



Patched Decompressed Whitelist:



There is obviously some problem along this line of Hex...



although it starts off well ( 86803642 ) where has the 11 11 11 11 come from, and where have the missing 4 bytes gone?

This makes me believe I am putting the "Own BIOS ID Byte String" in wrong - although I am not far off.

If possible Semi, could you explain in your Tutorial, on page 7, you say:
"with a complete entry,the first, from decompressed Whitelist is it so much easier to find the Whitelist in the compressed BIOS. In this case by searching manual with “86 80 20” → “8680204286800127”
– the position bye shifting is with respect to four byte order for a correct checksum fixing
– the Whitelist is found, the position is good for patching it with another PCI\VEN ID
– this ID is found completely "

I can not see a relation between “8680204286800127” and your decompressed whitelist file.

My question is how can I use the decompressed whitelist to find where in the compressed BIOS file to start editing Own BIOS ID Byte String.
I have obviously got it in the wrong place .

Many thanks for your time

[nando4]

My question is how can I use the decompressed whitelist to find where in the compressed BIOS file to start editing Own BIOS ID Byte String.
I have obviously got it in the wrong place .

Many thanks for your time

The whitelist entry @0000ea: 86 80 22 42 3C 10 5B 13 has seen you set 3c=86, 10=80, 5B=11. The 13 has not been set to your desired 10. Instead you've changed 84=10. The 84 is probably some control byte as it doesn't appear in the whitelist.

The corrective action is to NOT set 84=10. Instead find a 13 near this uncompressed string and set 13=10, save and see if the uncompressed whitelist is OK. If so, then proceed to do checksum fixes.

[pokerface]

Hello everyone,

I`m new here, and I read the whole topic.
I have two Compaq nc4200, and 1 Intel and 1 Atheros wifi card.
The Intel card works in both notebooks, but the Atheros card do not.
So I was trying to fix de Broadcom string (E4 14) in the whitelist for the Intel card.
But the problem is, that I can only fix 7 byte`s in the string of 8 byte`s.
So howe can I fix the last byte of that string?

For outrage_uk.
I have to a compaq nc6320.
On that notebook I was been testing to get a Intel card working (5100AGN)
You can try the Broadcom string (E4 14) in the whtelist.
I found a string in the whitelist where 8 byte`s are present.
This gave me a original BIOS byte string.
Then I entert my own byte string in ADDCC.
This gave a Checksum error.
I have tryed to fix this with the string wake on lan.
That doesn`t work for my (maybe for you).
Then I have tryed a other string.
This gave me good Checksum.
So far so good, but when I Decompress the new patch file is gave me 2 files.
The first one is 01_POST_00020000 file (1kb).
The second one is 02_POST_00020100 file (54kb).
when Iverifying the file, the string in the whitelist was good.
But I can`t find the Ascii string that I used for the Checksum error.
So I don`t know if the patch file is correct.
I do not want to brick my notebook, so I don`t try this patched file.
Maybe I have give you the right direction to try it for your wifi card.

Sorry for my English, its not my native language.

Regards.

[outrage_uk]

Thank you Nando you pointed me in the right direction, and with abit of playing around, finally got the correct BIOS Notation in the compressed ROM



Hopefully on the last lap now, with 1 last problem before I try the programming

I have tried for hours with the checksum correcting - I seem to have no luck at all with modifying an uncompressed PCI\VEN SUBSYS key, - even if this shows correct checksum - if I reload the file and try to decompress the problem crashes.

When I try to modify the "Wake On LAN" string then the checksum is not what I need:

Original Checksum : 2212FA9E

Required Checksum : 1BC842DC

Checksum Differences : -48 -3E 06 4B



New Patched ROM Checksum : D38A4927

I've tried what you have suggested, Nando, in your step by step instructions but do not follow ... and not sure if it is relevant to the NC6320 BIOS?

Thank you once again

[nando4]

I have tried for hours with the checksum correcting - I seem to have no luck at all with modifying an uncompressed PCI\VEN SUBSYS key, - even if this shows correct checksum - if I reload the file and try to decompress the problem crashes.

When I try to modify the "Wake On LAN" string then the checksum is not what I need:

I just modifed the 2510P's (old) 3945ABG entries adding 5100AGN as shown here. I noted that 3945ABG was 86 80 22 42 and 5100AGN was 86 80 32 42, so I just changed the first 22 to 32, did a decompression and then looked for subvendor IDs that might match my 86 80 21 13 that I needed. There was a unique "86 80 13 05" was already there so all I needed to do was change the "10 05" to be my required "21 13". So it was 5 bytes for the modification: 3 whitelist bytes and 2 checksum correction bytes.

Once you've been successful it's actually pretty straight forward. Good luck.

[outrage_uk]

After playing around and experimenting with ADDCC, I think I may have cracked it

Could someone give a quick decompress / compare on the BIOS files I have come up with, and see what you think before I give it ago and flash?

HP_NC6320_BIOS.zip

Am I correct in thinking that this laptop has inbuilt protection from a corrupt BIOS file and I would beable to re-flash with Windows Key + B with an external USB floppy drive?

Has anyone successfully attempted this? Not that I am worried or anything ...

[nando4]

After playing around and experimenting with ADDCC, I think I may have cracked it

Could someone give a quick decompress / compare on the BIOS files I have come up with, and see what you think before I give it ago and flash?

It's easy for you to do it yourself. Eg:

I create a directory \bios and \bios\patch, copied ADDCCV3 into both, run ADDCCV3 in \bios, deselect "delete unnecessary" and do a decompress. I then run ADDCCV3 from the \bios\patch directory, deselect "delete unnecessary" and decompress the patched bios. I copy and run compare.bat from in \bios\patch. I evaluate the diff.out to see which files differ. If it's *SMM2* then it's only the whitelist that's been altered. So then I use ultraedit to view the resultant *SMM2* decompressed patched file and compare against the original to see if the whitelist has the entries I require.

compare.bat

Code: Select all

@echo off
echo. > diff.out
for  /f %%a IN ('dir /b *.dec') do fc /B %%a ..\%%a >> diff.out
echo results are in diff.out
notepad diff.out

Hope that helps.

[marian23]

hello , i want to change wmi to my laptop, HP530 with the great program ADDCC_V3_HP_COMPAQ_DECO_SOURCE_CODE , i finaly succed to change corectly my whitelist with my PCI card ID , done with the checksum too, after many lost days... but i don`t understand how to patch the HPQFLASH to work with my Rom.bin
The HPQFlash_No_Rom.sig_check_patched by Semi dosen`t work with mi bios http://h20000.www2.hp.com/bizsupport/Te ... nvOID=2096 # 120

Please help me to understand how to patch HPQFLASH ,The HPQFlash_No_Rom.sig_check_patched by Semi dosen`t work with any of original of my bios versions
all the time with modified bios, and with the original one it`s give me the folowing error:


Error code= 0xFA (IOCTL_FAILED).

[pmgcosta]

Can some one upload the 2710p firmware with GTM382 unlocked?

USB\VID_0AF0&PID_7601&REV_0000


please

I tried to use ADDC to unlock a DELL 5530 WWAN card for my compaq 2710p notebook, but with no success.
it is blocked by BIOS with the message "... unsupported WWAN card detected ... "

Nando proposed to use ADDCC although for WWAN minipcie cards, which are actually USB connected.

So i tried to Patch BIOS of my compaq 2710p .
(availibe at: http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=321957&prodSeriesId=3355644&prodNameId=3355645&swEnvOID=2096&swLang=8&mode=2&taskId=135&swItem=ob-66839-1)

ADDCC was able to decompress it.
The uncompressed USB whitelist contains two Sierra WWAN cards "F0031D1BF0031D1E" which i searched for.
I replaced the matching bytes of one Sierrra card in compressed with my DELL 5530 card "3C414781".

Speaking in ADDCC:
orig BIOS ID: F85E72D5F0031D1B40001E80
relplace: F85E72D53C41338140001E80

checksum: 61FF6B65204F6E20
replace: 9BFF62109A11610F

Flashed modified BIOS, booted, but WWAN card is still "unsupported". (

What went wrong? Has anybody an idea?

Anyway, thanks for programming ADDCC!
Two little issues:
1. What means red and green in checksum correction bytes?
2. I had problemes that sometimes the patched file was not modiefied - Button "change in file" remains gray
and Checksum Differences were not calculated. Finialy it worked, maybe it was the long Path to the File.

[gabris[LT]]

Hello, i have nc6000 tried to make my laptop to work with 2200bg, and I failed when adding my card to whitelist now the laptop won't turn on(except cd-rom and power led activity) can anyone help? laptop came without wireless adapter and the adapter i tried to insert is:
PCI\VEN_8086&DEV_4220&SUBSYS_27028086
I'm student so laptop is almost my whole life maybe someone can help with pacthing the bios or patch it because I'm thinking to somehow patch the bios and then to go to local service centre and ask them to write it help with patching would be apreciated btw firmware was F.0F but I was trying to write patched F.15.

[kfg]

Hi guys.
I got a HP 2530p, the bios is F.12.I want to change 'HP' Intel Wifi Link 5100 to 'non-HP' AR9287, but i got the "104" error message.
How can i remove/modify the whitelist or wlan card's ven_id/p_id/subsystem_id?

Thank you very much.

[outrage_uk]

now the laptop won't turn on(except cd-rom and power led activity)

You would need a USB floppy drive with a disk with the latest BIOS on. While powering on, press the Windows Key + B together and it should flash a working BIOS

[gabris[LT]]

bios was flashed with programmer, now works and I got HP branded intel 2100 card, but it supports only 5.5, 11mb/s, but I have non HP branded card(2200bg(up to 54mb/s)) that won't work in my laptop so still waiting for help