Insyde BIOS bootblock recovery- some new info - some queries

Don't ask how to hack password. (BIOS Passwords)
stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

Using some insyde/systemsoft decompression code I managed to split out the BIOS for my Benq laptop (dead from a failed bios flash), and it includes a CRISIS.ROM

Dissasembling that a bit, it looks for a file named BIOS.ROM on a connected floppy drive, reads in something like 64KB of the file, and then executes some code to jump to a flash utility

It turns out that you can enter the Insyde bootblock recovery process on my laptop by turning it off, holding down the backtick key ( the ` key with ¬ and ¦ on it on my UK keyboard just below the ESC key) and turning the laptop on with this key still held down. It will take a few seconds, but if you have a USB floppy drive connected while you turn the laptop on in this way, and that floppy disk contains a file named BIOS.ROM, then the floppy will be accessed on boot, and then the laptop shows the flashing text:

"Loading Flash Utility
Please Wait..."


Unfortunately ... after that it seems to do nothing, just please waits forever. My guess is BIOS.ROM cannot be a regular rom bios update (I took the bios update from Benq's website, put it on a floppy and renamed it to BIOS.ROM). But given that the bios code only seems to load 64KB from my rough IDA disassembly, that doesn't seem right, so my guess is that BIOS.ROM is actually some flash utility provided by Insyde


Does anyone have any information on what files must go onto the Insyde crisis recovery floppy here? What should the BIOS.ROM file be and/or do I need to put additional files on the floppy to actually kick off the emergency re-flashing processes?
stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

Actually, what the Insyde bios bootblock code really seems to be doing is:

1. Look for a file named BIOS.ROM. Load some of it. (Possibly also extract the VGABIOS from it and apply it, but not completely sure)

2. If we got this far, show the flashing message "Loading Flash Utility\r\nPlease Wait..."

2. Then just execute the floppy MBR *but* executes address 0000:7C80 instead of the usual 0000:7C00

So it would seem that the recovery procedure involes a custom boot record on floppy. Which isn't so surprising I suppose. To confirm that I guess I'll have to create a floppy with a customized MBR. Anyone happen to have a copy of an Insyde bios recovery floppy image?
stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

Patching a floppy disk boot sector so that the entry point is at 7c80 actually works - I tried it with a Caldera DR-DOS floppy image. My Benq laptop (joybook 5000u, insyde MobilePro bios version 4, intel ICH4 mobo) gets as far as the "Loading Caldera DR-DOS" message (indicating the floppy boot sector has been executed and loaded the system from floppy!) - but then it stalls. So my next guess is that a lot of BIOS services are not yet available when getting here from the bios bootblock crisis recovery mode. Not a regular BIOS boot so programs that rely on regular BIOS services might not work

So what I think I *really* need is a 16-bit bios flasher that doesn't need any bios services other than Int13h and Int10h, and doesn't need any DOS services either
stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

I got a message back from Insyde , when I queried them to see if any of the recovery files are available. They say that they don't produce BIOSes, they just provide source code to manufactures who can integrate as they see fit. Suggesting that Insyde crisis recovery is perhaps not a one-size-fits-all method and maybe different manufacturers have a different approach. Sigh.
They also suggested that I might be able to find the recovery floppy details "on the internet - good luck". Which surprised me. I'm imagining that I can only get them from BenQ, and only if I pay them.
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

So the first and foremost important question is: did you contact BenQ yet to see if you have to pay for that file? There are manufacturers out there that do allow one to get it for free provided they seem to know what they are doing.
edwin/evasive

Do not assume anything

System error, strike any user to continue...
stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

I contacted BenQ who said that they do not stock any such recovery floppy, and they also denied all knowledge of a crisis recovery mode. They also suggested I phone their premium support line. So - they didn't really say I would have to pay for that file, but I would imagine I would spend a lot of $ on premium support phone call to get any real answer :(
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

That was BenQ crossed off my list for any future computer equipment. Right with that sorted, is there a bios upgrade floppy/file available for this laptop? We might be able to craft a crisis thingy from there.
edwin/evasive

Do not assume anything

System error, strike any user to continue...
stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

The bios upgrade is just the usual stuff - dos-based flasher and .rom file. upgrade instructions are 'boot to dos and run update.bat'.

e.g.:
http://benq.co.uk/support/downloads/dri ... 09%252ezip

Let me know your ideas on how to craft a crisis thingy from this - my best guess is to reverse engineer then recompile the flasher to run without any dos ints being available (i.e. just int10 and int13), and then craft a floppy boot sector that can load and executes the flasher.
levicki
New visitors - please read the rules.
Posts: 1
Joined: Sat Feb 07, 2009 3:14 am

stripwax,

1. Could you share the decompression code?

2. Have you been able to find a DOS flasher at all?

3. Have you tried booting linux since it can be made not to rely on BIOS functionality?
DoZe2
BIOS Newbie
Posts: 19
Joined: Wed Dec 21, 2005 1:13 am

stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

Doze2: That's correct, although the links on that site are dead ends - I got mine from the wayback machine. I will upload a mirror to some webspace too if it helps others out too. This link via archive.org points to a dated mirror
http://web.archive.org/web/200510180707 ... index.html
And this seems to be a working archive.org mirror of the insydeco software for DOS and for Linux

Booting linux - is a very fine idea - is it trivial to make a floppy linux boot that doesn't rely on bios calls (and with a bootblock that has a different entrypoint than usual :) ? I think you're right, that's probably the only sane way forward, provided there is a compatible linux flasher too. Happy to investigate this route, although any pointers greatfully received

Leviki: My previous post had a link to BenQ's DOS-based flasher, if that's useful at all
stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

Updated list of laptops with identical Insyde CRISIS bios sections

So, not much of an update. BenQ tech support redirecting me around the houses on both phone and email support, failing to acknowledge any crisis recovery mode whatsoever. Their repair centre seems to be unable to understand the problem at this point (they came back and wanted to know what version of Windows I needed).

However: running the insydeco over a number of other Bios files I've discovered that the Acer Aspire models below have the same kind of Insyde bios structure with the same CRISIS section and the same floppy entry point of 0x7c80.

So if ANYONE has any details on crisis recovery for those models of laptops that would be applicable to this BenQ model too as far as I can tell.
However I suspect nobody has any sort of crisis recovery information for any of the below, either.

Acer
Acer Aspire 1300
Acer Aspire 1310
Acer Aspire 2010
Acer Aspire 2020
Acer Extensa 2900

Non-Acer
Compal CL56
Packard-Bell Easynote M5 series (e.g.
Last edited by stripwax on Sun Oct 04, 2009 11:41 pm, edited 4 times in total.
stripwax
New visitors - please read the rules.
Posts: 13
Joined: Sat Nov 29, 2008 6:41 pm

I've uploaded a copy of the windows insydeco decompressor (command-line) tool to my local webspace, for those that have been having trouble downloading

wimsbios isn't letting me post the link (as I don't have 10 posts yet). But it's at www dot beermex dot com forwardslash insydeco.0.1.zip
maman
Master Flasher
Posts: 173
Joined: Sun Mar 31, 2002 2:08 pm
Location: Taka Bonerate National Park, Indonesia
Contact:

Hello stripwax,

Your work seems to be very interesting. IIRC, the biosgfx was owned by Anton Borisov. I'll ask him if he still keep the code around or perhaps has an updated version.
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

The original insydeco page:
http://biosgfx.narod.ru/insydeco/

The downloadlink is dead though. Your zip-file is corrupt, fix that first before I can put your downloadlink online.
edwin/evasive

Do not assume anything

System error, strike any user to continue...
Post Reply