How to > HP BIOS MiniPCI Fix- nc6000/others

[nando4]

Removing the need to match the checksum

There is a patched HPQFLASH tiny.cc/hpqflashmod (copy+paste) that can flash the bios without doing a checksum check. Means altering the whitelist with ADDCCV2 is A LOT easier.

[NetworkPro]

Oh really ?!?! Have you actually tested it? On what models ? Post the patched and tested BIOS files!

Edit: After your Below Post - I see you are a good contributor and I respect you for this. Thank you! Come to Varna and I'll buy you a beer

[nando4]

Oh really ?!?! Have toy actually tested it? On what models ? Post the patched and tested BIOS files!

The patcher, TTAV134's wrote to me on mydigitallife forum

Concerning the white list mod, i suppose you will do it with the help of ADDCC_V2, don't take care of the checksum, the bios can be flash by my moded HPQFLASH V4.30.4.1 or V4.2.53 or by bios recovery method even the checksum is not correct. For your information in my 6910p bios, with or without the help of ADDCC there is no trace of 8680 string.

tiny.cc/hpqflashmod (copy+paste) has the modded HPQFlash.

EMERGENCY BIOS RECOVERY

The bios recovery method involves using a USB *floppy* drive with only the bios file copied onto floppy, power off, then pressing four-arrow keys, OR WIN+B keys and power on and as described here. Ensure the filename is called your bios series, eg: 68DDU.BIN

tiny.cc/rec1 (copy+paste)

Confirmed to work on a 8510P here:

tiny.cc/rec2 (copy+paste)
tiny.cc/rec3 (copy+paste)

(sorry - I can't post links until I've done 10 posts)

2510P/2530P Bios whitelisting

If I use a non-HP wifi card and hotswap it in *after* the bios has booted with a hp wifi card, the card is detected. If I boot with the non-HP wifi card, swapping in the HP wifi card afterwards it *does not* detect it . In both cases the pci-e port2, which is confirmed to map to that mini pci-e slot, is active in Device Manager. The the second mini pci-e (WWAN) won't detect the HP supplied wifi card at all. Though I'm not sure if a WWAN card is really mini pci-e or if it just uses the USB pins on the mini pci-e interface.

It seems the bios is doing something to disable the port in a way that it can't be enabled after bios bootup. It appears HP have selective port whitelisting (ICH8M/ICH9M has up to 6 pci-e ports, externally interfaced as a mini pci-e or expressport). Eg: on my 2510P the wifi card *does not work* in the WWAN mini pci-e slot. Same whitelisting applies to a 2530P *BUT* the expressport can take non-HP cards, eg: ViDock works with the 2530P in the expressport.

There is no "unsupported card detected" message printed either. It's a silent whitelisting operation.

Can anyone confirm that the above is what they are seeing on their HP Whitelisted business notebook, eg: 8710P/8510P/6710b.

[Mitch76]

Hello everyone,

i´m new in this forum. I hope some of you can help me with my problem. I bought a defective nc6000 and fixed it by soldering the maxim power ic. Now i decided to put a braodcom bcm4306kfb card into a nc6000. So I also got the 104 error message on the screen. I can anybody help me with fixing it? my VEN ID is PCI\VEN_14E4&DEV_4320&SUBSYS_00011028&REV_02
Bios Ver F.15

Thanks

[nightalon]

Hi everyone,

Greetings from the US.

I have an EliteBook 8530w, and need to replace the built-in Intel WIFI with a Broadcom chip so that I can get WIFI in MacOS/Snow Leopard.

Everything else in Snow Leopard is working perfectly!

I followed semi's BIOS-patching guide, but unfortunately I still get the 104 error. Note that the 8530w has an HPQ non-Phoenix, apparently non-compressed BIOS.

hxxp:// nightalon. googlepages. com/ROM.CAB is the unpatched (version F.0E) CAB file from the latest BIOS. Note that this BIOS contains EFI.

Also, in searching for the DevID strings, I found 3 references to the Intel WIFI card including their subvendors, and one without the subvendors.


Here is my vendor info:

Goal card: (Broadcom 4322)

\VEN_14E4&DEV_432B&SUBSYS_1380103C&REV_01\A7CB00FFFF59002100
E4142B433C108013


Preinstalled card: (Intel 5300)

\VEN_8086&DEV_4236&SUBSYS_10118086&REV_00\00216AFFFF53D10800
8680364286801110


Thanks for your help!

[nando4]

Semis method appears to not work with the 965PM or PM45 newer HP business systems. I too can confirm three entries in the bios that appear related to wifi but modding them using semi's method doesn't remove the whitelisting. In fact, while booting works, going into bios will freeze some menus. This was as tested on a 2510P (965PM - 68MSP bios).

You can still get the wifi card to work by ensuring bootup with a HP wifi card, then suspend the system. swap cards, then resume it and scan for new hardware. HP are doing something very unusual during bootup to effectively disconnect the port if no HP wifi card is found such that I have been unable to reconnect it after bootup . No, suspending/resuming does not re-enable the port. A HP specific card must be present at bios bootup for it to be enabled.

The WWAN port is also not a true mini pci-e port. Electrically it only connects the USB pins. It also has whitelisting applied so that only specific HP WWAN mini pci-e (using only USB pins) works. That is secondary suckful because it could be used as an additional USB port.

I'm hopeful semi can lend some more expertise on this as it appears this thread can only help up to the previous series of business notebooks: nc6000, 8000, etc,

[nando4]

FYI: Broadcomm cards can have the VendorID/Subsys modded on the SPROM to match a whitelisted entry as explained here: tiny.cc/wifisprom (copy+paste).

[semi]

@nightalon

Greetings from veal sausage germany.

I ' am sorry, but your bios typ is completly unknown by me.

I can't help you, and the ADDCC can't too.

There is no me known header or decompress routine. There are
only three time an entry with your complete Preinstalled card: (Intel 5300).

Maybe it works if you change them all, but i wouldn't try this without
enough safeties based on own or trustworthy researches.

If you find some information how to decompress it, please let me know.

Sorry for this bad message.

@nando4,

at first, "my" method dont remove the VEN and SUBSET ID detection.
It's a whitelist modification: Change the original one with yours.

at second, the ADDCC works fine with your bios file, and I'am found
only one whitelist entry. Exactly there where it should be.

Whitelist in the compressed bios with FF's deleted:



Partly uncompressd Whitelist:



I'am strongly advise against doing flashing or editing you onboard eeprom on your wifi card.
Sometimes there is another problem and you want to change it back, your procedure dont work and you have to
desolder it to flash it with an chip-flasher.

Could you please post your ID's?

Good luck

@Mitch76,

this is so much explained in the past. read the tutorial and watch the
videos.

Cheers Semi

[nando4]

Semi - I editted that entry as per instructions and found it did not allow me to avoid whitelisting. My wifi card is as below and it doesn't appear in the ADDDC2 search.

8086 4229 8086 1100 <- From: HP 4965ABN wifi
1002 9490 1787 2268 <- To: ATI HD4670 graphics

I Attempting to add entry for an ATI HD4670 video card (using mini pci-e to pci-e adapter, PE4L) as at hwtools . net . Yes it works.. just need to hotswap it in *after* the bios boots up a "whitelist compatible" mini pci-e card. Otherwise *any* inserted card is not detected at all. It's almost as if the port is electrically disconnected if a whitelisted product is not seen at bootup. Hotswapping it in this manner is quite inconvenient. A bios patch would make it *so much* more pleasurable to setup and use.

If you'd like to supply a candidate bios I can flash and test it. I can do emergency recovery AND my bios is socketted and removable at the HDD bay. What I've discovered is below:

RE: HP Santa Rosa or newer Business Notebooks

Using ( tiny.cc/6910beeprom copy+paste), the 6910p bios (4MB) as saved by an eeprom burner as an example. It has what appears to be the whitelist where the string "FRU" is. If someone can reverse engineer where this is kept in the bios.rom file (eg: altering the eeprom, then saving back to the bios file (Rompaq/HPQFlash) and seeing if it makes a change), then it would appear the only real way of getting rid of whitelisting is to edit the eeprom itself.

Code: Select all

000343a0h: 6E 76 2E 66 72 75 2E 74 61 62 6C 65 FF FF FF 88 ; nv.fru.tableÿÿÿˆ
000343b0h: 03 00 01 00 00 00 1C 00 10 03 07 00 00 00 14 00 ; ................
000343c0h: 00 00 01 00 00 00 86 80 00 2A 0C 00 00 06 3C 10 ; ......†€.*....<.
000343d0h: C1 30 00 00 00 00 07 00 00 00 14 00 00 00 01 00 ; Á0..............
000343e0h: 00 00 86 80 01 2A 0C 00 04 06 FF FF FF FF 08 00 ; ..†€.*....ÿÿÿÿ..
000343f0h: 00 00 07 00 00 00 14 00 00 00 01 00 00 00 86 80 ; ..............†€
00034400h: 04 2A 0C 00 80 07 FF FF FF FF 18 00 00 00 07 00 ; .*..€.ÿÿÿÿ......
00034410h: 00 00 14 00 00 00 01 00 00 00 86 80 06 2A 0C 85 ; ..........†€.*.…
00034420h: 01 01 FF FF FF FF 1A 00 00 00 07 00 00 00 14 00 ; ..ÿÿÿÿ..........
00034430h: 00 00 01 00 00 00 86 80 07 2A 0C 02 00 07 FF FF ; ......†€.*....ÿÿ
00034440h: FF FF 1B 00 00 00 07 00 00 00 14 00 00 00 01 00 ; ÿÿ..............
00034450h: 00 00 86 80 49 10 03 00 00 02 3C 10 C1 30 C8 00 ; ..†€I.....<.Á0È.
00034460h: 00 00 07 00 00 00 14 00 00 00 01 00 00 00 86 80 ; ..............†€
00034470h: 34 28 03 00 03 0C FF FF FF FF D0 00 00 00 07 00 ; 4(....ÿÿÿÿÐ.....
00034480h: 00 00 14 00 00 00 01 00 00 00 86 80 35 28 03 00 ; ..........†€5(..
00034490h: 03 0C FF FF FF FF D1 00 00 00 07 00 00 00 14 00 ; ..ÿÿÿÿÑ.........
000344a0h: 00 00 01 00 00 00 86 80 3A 28 03 20 03 0C FF FF ; ......†€:(. ..ÿÿ
000344b0h: FF FF D7 00 00 00 07 00 00 00 14 00 00 00 01 00 ; ÿÿ×.............
000344c0h: 00 00 86 80 4B 28 03 00 03 04 FF FF FF FF D8 00 ; ..†€K(....ÿÿÿÿØ.
000344d0h: 00 00 07 00 00 00 14 00 00 00 01 00 00 00 86 80 ; ..............†€
000344e0h: 3F 28 03 00 04 06 FF FF FF FF E0 00 00 00 07 00 ; ?(....ÿÿÿÿà.....
000344f0h: 00 00 14 00 00 00 01 00 00 00 86 80 41 28 03 00 ; ..........†€A(..
00034500h: 04 06 FF FF FF FF E1 00 00 00 07 00 00 00 14 00 ; ..ÿÿÿÿá.........
00034510h: 00 00 01 00 00 00 86 80 47 28 03 00 04 06 FF FF ; ......†€G(....ÿÿ
00034520h: FF FF E4 00 00 00 07 00 00 00 14 00 00 00 01 00 ; ÿÿä.............
00034530h: 00 00 86 80 30 28 03 00 03 0C FF FF FF FF E8 00 ; ..†€0(....ÿÿÿÿè.
00034540h: 00 00 07 00 00 00 14 00 00 00 01 00 00 00 86 80 ; ..............†€
00034550h: 31 28 03 00 03 0C FF FF FF FF E9 00 00 00 07 00 ; 1(....ÿÿÿÿé.....
00034560h: 00 00 14 00 00 00 01 00 00 00 86 80 32 28 03 00 ; ..........†€2(..
00034570h: 03 0C FF FF FF FF EA 00 00 00 07 00 00 00 14 00 ; ..ÿÿÿÿê.........
00034580h: 00 00 01 00 00 00 86 80 36 28 03 20 03 0C FF FF ; ......†€6(. ..ÿÿ
00034590h: FF FF EF 00 00 00 07 00 00 00 14 00 00 00 01 00 ; ÿÿï.............
000345a0h: 00 00 86 80 48 24 F3 01 04 06 FF FF FF FF F0 00 ; ..†€H$ó...ÿÿÿÿð.
000345b0h: 00 00 07 00 00 00 14 00 00 00 01 00 00 00 86 80 ; ..............†€
000345c0h: 11 28 03 00 01 06 3C 10 C1 30 F8 00 00 00 07 00 ; .(....<.Á0ø.....
000345d0h: 00 00 14 00 00 00 01 00 00 00 86 80 50 28 03 8A ; ..........†€P(.Š
000345e0h: 01 01 FF FF FF FF F9 00 00 00 07 00 00 00 14 00 ; ..ÿÿÿÿù.........
000345f0h: 00 00 01 00 00 00 86 80 29 28 03 01 06 01 FF FF ; ......†€)(....ÿÿ
00034600h: FF FF FA 00 00 00 07 00 00 00 14 00 00 00 01 00 ; ÿÿú.............
00034610h: 00 00 02 10 88 71 00 00 00 03 3C 10 C1 30 00 01 ; ....ˆq....<.Á0..
00034620h: 00 00 07 00 00 00 14 00 00 00 01 00 00 00 80 11 ; ..............€.
00034630h: 76 04 B9 00 07 06 FF FF FF FF 30 02 00 00 07 00 ; v.¹...ÿÿÿÿ0.....
00034640h: 00 00 14 00 00 00 01 00 00 00 80 11 76 04 B9 00 ; ..........€.v.¹.
00034650h: 07 06 FF FF FF FF 31 02 00 00 07 00 00 00 14 00 ; ..ÿÿÿÿ1.........
00034660h: 00 00 01 00 00 00 80 11 32 08 03 10 00 0C FF FF ; ......€.2.....ÿÿ
00034670h: FF FF 32 02 00 00 07 00 00 00 14 00 00 00 01 00 ; ÿÿ2.............
00034680h: 00 00 80 11 22 08 20 00 05 08 FF FF FF FF 33 02 ; ..€.". ...ÿÿÿÿ3.
00034690h: 00 00 07 00 00 00 14 00 00 00 01 00 00 00 80 11 ; ..............€.
000346a0h: 43 08 10 00 80 08 FF FF FF FF 34 02 00 00 07 00 ; C...€.ÿÿÿÿ4.....
000346b0h: 00 00 14 00 00 00 01 00 00 00 86 80 29 42 61 00 ; ..........†€)Ba.
000346c0h: 80 02 FF FF FF FF 00 10 00 00 00 00 00 00 00 00 ; €.ÿÿÿÿ..........


EDIT: I may have been incorrect about the info above about FRU list. Google tells me:

Inv_AMT_FRU : FRU, or Field Replaceable Unit, data is stored directly in the AMT NVRAM. This can be utilized even when the system is in a powered off state. The purpose of this data is to eliminate desk-side visits by accessing the inventory remotely to identify the various details about the unit so that a replacement can be ordered without requiring a visit to the system to obtain part numbers and other applicable information requested from the vendor.

* Vender ID
* Device ID
* Revision ID
* Proglf
* SubClass
* BaseClass
* Subvender ID
* Subsystem ID
* Device Location
* Row_ID

[semi]

Or nando4,

it would me realy wondered if you do it all so right as you talk about it.

once again at first,
your HP 4965ABN wifi Id is wrong. This could not be the right one.
The order is wrong. And if you have take a look
in the drivers inf from hp website for your model, than you have
seen it.

the right one is:
8680294286800011 -> PCI\VEN_8086&DEV_4229&SUBSYS_11008086

NETw5x32.inf:
; GEN_4965_AGN
%NIC_MPCIEX_4965AGN% = Install_MPCIEX_GEN_4965_AGN_XP_MOW1 , PCI\VEN_8086&DEV_4229&SUBSYS_11008086 ; MOW1

Muha what a silly mistake.

And once again, the whitelist is there as shown above. And there are principal two ID's to change it with your own.

1st: E4 14 11 43 3C 10 63 55 13 (dont change the 55)
PCI\VEN_14E4&DEV_4311&SUBSYS_1363103C

bcmwl5.inf:
%BCM430G_DeviceDesc% = BCM43XG11_NT60, PCI\VEN_14E4&DEV_4311&SUBSYS_1363103C

2nd: 86 80 5F 22 42 3C 10 5B (dont change the 5F), (the missing 13 is the last byte from the 1st)

ETw5x32.inf:
; HP_3945_ABG
%NIC_MPCIEX_3945ABG% = Install_MPCIEX_HP_3945_ABG_XP_MOW1 , PCI\VEN_8086&DEV_4222&SUBSYS_135B103C ; MOW1

The situation is perfect. You can use the one to change it with yours,
and the other to fix your checksum.

A question. Have you read all the posts before? I'am sure there is a
post that exactly explained the same.

Cheers Semi

[nando4]

Semi - yes, I have read the posts and watched the 4 videos. The resultant bios I created booted the system, did not allow my HD4670 to be recognised. Furthermore when I went into the bios some of the menus would freeze.

If you can help to make with this it would be great as it would prove the newer Santa Rosa series uses such a whitelist and are not just legacy items from the previous series. You can see from my previous post that the 6910p eeprom dump suggests the whitelist is near the "FRU" string requiring eeprom saving, editing, then flashing using a burner.

At the moment I'm using hotswap techniques to get around the bios whitelist as the mini pci-e port appears to be disconnected if a whitelist compatible device is not found during the bios bootup. See pic on HD4670 in the port (hotswapped in) tiny.cc/2510Pports

For those that have such whitelist, can you confirm if this applied to port1 or port2? On my system the wifi card is mini pci-e port2, and WWAN mini pci-e port only has the USB pins active and it applies whitelisting to the USB VID/DID. Arhh!! Here's the detail:

68MSP.bin (2510P F.0E bios) tiny.cc/68MSP (copy+paste)

Supposed Whitelist
============
PCI\VEN_8086&DEV_4222&SUBSYS_335B103C
868022423C105B33 <- Some Intel Wifi

PCI\VEN_14E4&DEV_4311&SUBSYS_1363103C
E41411433C106313 <- Some Broadcom Wifi

Required device
==========
PCI\VEN_1002&DEV_9490&SUBSYS_22681787
0210909487176822 <- ATI HD4670 external graphics

PCI\VEN_8086&DEV_4229&SUBSYS_11008086
8680294286800011 <- HP supplied 4965AGN Wifi that I cannot see in the whitelist but was supplied with the system and works fine. This entry is in the 6910b "FRU" list of my previous posting.

Semi - your help here would be appreciated. Others too will want the hwtools . net PE4L/PM3N to connect external pci-e devices. This whitelisting is restricting this activity on HP Business systems.

Nando

[Minskaya]

Hi guys,

I decide to post a request because after having read several threads in this forum and others i don't even find my wifi Id in the bios.
Here is the facts:
I 've a tabletPC HP2710p with an Intel 4965ABG pciExpress card
\VEN_8086&DEV_4229&SUBSYS_10018086&Rev61 (the wifi N is disabled)
-> 8680294286800110

And i want to install this card
Intel 5300
\VEN_8086&DEV_4236&SUBSYS_10118086
->8680364286801110

But when i use ADDCC_V2 to find the white list it says 'the specified string was not found' even with a partial string like 86802942
I have looked each string beginning by 8086 in the 00020100 file and found nothing interessant

I 've read that some one in the forum was in the same case : this card is sold with its pc but is not in the white list (but this member 's question was different and i neither have a FRU string)

So what can i do ?

Thanks for any help in advance because i 'm looking for a solution since a long time

- Mins -


[/b]

[nando4]

Hi guys,

I 've a tabletPC HP2710p with an Intel 4965ABG pciExpress card
\VEN_8086&DEV_4229&SUBSYS_10018086&Rev61 (the wifi N is disabled)
-> 8680294286800110]

Your bios has the same whitelisting as the 2510P has. See the post 1 above yours to see the *two* entries (Broadcomm and Intel) that are in the bios upon which you can then apply ADDDC2. I'm curious to know if you can successfully add the new wifi card as I am trying to do something similar on the 2510P.

For those interested, the addition of HD4670 or other ATI cards using the mini pci-e card will also require their addition to the whitelist or otherwise need to hotswap in the adapter after bios bootup with wifi card installed.

See DIY ViDock - My experiences so far tiny.cc/DIYViDock (copy+paste)

[guybrush]

Hello to everyone! I'm new here and first of all I'd like to thank semi for his great work and how well he has documented it.
I'm trying to patch the F3.0 bios for my HP NC4010 to make two wireless cards that aren't in the current whitelist

PCI\VEN_8086&DEV_4220&SUBSYS_27318086&REV_05\3&61AAA01&0&48
PCI\VEN_8086&DEV_4220&SUBSYS_27418086&REV_05\3&61AAA01&0&48

be accepted but I've some serious problems.

I've downloaded the latest bios package, taken the bios file and discarded the rest,

configured ADDCC (as hex editor I use winhex while as decompressors the ones included in the ADDCC package),

opened the bios file,

found the whitelist searching for the little endian converted PCI\VEN_14E4&DEV_4312&SUBSYS_1361103C string,

shifted three positions forward and copied the 868020423C10F5F43FDFF612 bytes

but, when I try to decompress the bios to search for the pattern in my hex editor, ADDCC freezes. I've noticed that, even if I simply try to open the bios file with my hex editor, the hex editor is correctly called but it complains about a wrong path to the file (the path is only "c:\documents" while it should obviously be "c:\documents and settings...") but this time the hex editor isn't even called, ADDCC freezes when I click on 'Decompress'.
What's wrong? I can't bear buying a new wireless card when I have two of them sitting on a shelf because of HP unacceptable marketing techniques and I hope that someone could help me. Thanks in advance to everyone!

[guybrush]

I reply to myself... I was wondering if ADDCC could have some kind of issue when dealing with paths with spaces that need to be absolutized and I've moved everything in a folder on the root of the hard drive: now I don't get that error anymore. I hope that my experience could be useful to someone else and I would post here the results that I hope to gain going on with the patching process.