Phoenix BIOS and embedded Video BIOS modification

inconel · Fri Sep 10, 2004 8:57 am

Hello everyone,
I'm currently trying to edit my graphics card Device ID on a notebook using Phoenix BIOS v4.0 Revision 6. I have the modified Video BIOS prepared, checksum corrected, compressed, and inserted in the System BIOS. The BIOS is flashed, and when I check the Option ROM with PCI Scope, it shows that all the changes have been made to the Video BIOS. Seems like everything went okay, but when I check the registry entries, the IDs never change (Even after a complete format and reinstallation of the OS).
My current line of thinking right now is that the new BIOS is not being written to ROM because the Video BIOS is shadowed, so perhaps it only resides in RAM and Windows is checking the ROM for Device info. Unfor tunately my BIOS setup does not have any shadowing options I can disable, so I can't test this idea.
So at this point I'm trying to figure out how I can unshadow my Video BIOS. Any ideas?
I've downloaded many Phoenix BIOSes trying to find one that has the option to enable and disable shadowing in setup, but I haven't come across one yet. If anyone has a motherboard that uses Phoenix BIOS and has this option please let me know. I'd like to disassemble that BIOS to see if I can add that bit of code to my BIOS so I can disable shadowing.
Thanks in advance to anyone who can help with some ideas.

ruelnov · Fri Sep 10, 2004 7:38 pm

Video BIOS shadowing can be turned off, but not advisable because your display would become garbled when the OS tries to use the area of RAM reserved for Video BIOS.

Also, the Device ID of onboard video cannot be changed because it is protected by the chipset to be "Read Only" (even if you modify the embedded Video BIOS).

inconel · Sat Sep 11, 2004 12:10 pm

Thank you for the reply ruelnov,
I've been working at this for quite some time now. I wanted to unshadow the Video BIOS just for a few flashes so that the modified Video BIOS would be written to the ROM and not to RAM. After the flash, I could flash again with a BIOS that allows shadowing.
The card itself has already been modified by relocation of the resistor to change its Device ID.
Any suggestions how to temporarily unshadow the Video BIOS? It may not be the answer, but it could be one more step I can eliminate as a problem. Could the ROM chip be wiped completely, or would I need an eprom burner to flash it again at that point. If I'm heading in the wrong direction with this, please let me know.
Thanks again.

maman · Sat Sep 11, 2004 3:44 pm

inconel wrote:Hello everyone,
I'm currently trying to edit my graphics card Device ID on a notebook using Phoenix BIOS v4.0 Revision 6. I have the modified Video BIOS prepared, checksum corrected, compressed, and inserted in the System BIOS. The BIOS is flashed, and when I check the Option ROM with PCI Scope, it shows that all the changes have been made to the Video BIOS. Seems like everything went okay, but when I check the registry entries, the IDs never change (Even after a complete format and reinstallation of the OS).
My current line of thinking right now is that the new BIOS is not being written to ROM because the Video BIOS is shadowed, so perhaps it only resides in RAM and Windows is checking the ROM for Device info. Unfor tunately my BIOS setup does not have any shadowing options I can disable, so I can't test this idea.
So at this point I'm trying to figure out how I can unshadow my Video BIOS. Any ideas?
I've downloaded many Phoenix BIOSes trying to find one that has the option to enable and disable shadowing in setup, but I haven't come across one yet. If anyone has a motherboard that uses Phoenix BIOS and has this option please let me know. I'd like to disassemble that BIOS to see if I can add that bit of code to my BIOS so I can disable shadowing.
Thanks in advance to anyone who can help with some ideas.

this is quite complicated, but there are several possible explanations come to my mind :

The BIOS is already flashed (the mainboard and the embedded VGA Bios).
In most cases, today's VGA chipset drivers don't depend on the VGA BIOS at all. They completely read/write the chipset configuration values from/to the hardware directly, i.e. the VGA chipset in its PCI configuration space registers . This explains why the register value i.e. device ID (that's very possibly read by the driver), never change, since it's a hardwired value in the PCI configuration space of the corresponding VGA chipset.

that's my 2 cents

ruelnov · Sat Sep 11, 2004 6:49 pm

Since you are working on a Notebook, my presumption of your graphics card is the onboard vga, and when you say ROM you are referring to the Flash ROM chip (or the BIOS chip). Correct me if my presumptions are wrong.

You wouldn't need to turn off video bios shadowing to be able to write your modified video bios to the flash ROM. Flash utilities or eprom burners wouldn't care about that, but would happily burn into your bios whatever file you specify. I mean, your modified video bios embedded in the system bios is certainly written to ROM, even if video bios is shadowed.

And when your system boots with your modified video bios, it is always copied or shadowed to RAM starting at C000:0000h memory address for faster execution, and for the fact that video ROMs are never executed in place. Then that area of memory is write-protected by the system bios after POST (or just before the OS is loaded) so that the video bios could not be written to or modified anyhow, and also to reserve that area of memory for the video bios.

But if you still would want to pursue unshadowing the video bios, you simply write a few lines of assembly code (then compile it as COM file) for execution at DOS prompt. First step is to clear the write protection of the video bios memory area, then overwrite with zeros the video rom signature from C000:0000h to C000:0001h.

inconel · Sun Sep 12, 2004 11:23 am

Thanks again for replies.

maman,
Is it possible to edit these PCI configuration space registers? At current stage of testing, graphics card driver is never installed, when Device ID is edited in Video BIOS result is a black screen after flash.

ruelnov,
All presumptions are correct. Today I run a few more tests and successfully change the SubSystem ID and SubVendor ID. It required a change in two locations in the OPROM0.ROM file (Video BIOS) and another two locations in the ROMEXEC0.ROM file (Which I had not modified before today). I gives more evidence to your suggestion that shadowing is not a problem during flashing.

I should go into greater detail of exactly what I am trying to accomplish. Trying to convert a Mobility Radeon 9600 (Device ID : 4E50) to a Mobility FireGL T2-128 (Device ID : 4E54). It is a successful conversion for non-mobility cards by relocation of one of the three resistors on the chip controling device identification. Aside from resistor positioning, mobility chips are said to be identical to the chips on desktop cards.
After relocation of the resistor Windows welcomes me with "Found new Device.. Mobility Radeon 9600" I had not edited the Video BIOS to read "Mobility FIREGL T2-128" yet, so I expected it would say it was same card, but Windows does recognize the card has changed.
Since the Mobility FireGL T2-128 is available in some IBM notebooks, attempts are also made to modify the SubSystem and SubVendor IDs to allow easy installation of the latest WHQL certified drivers available. I believe this has been accomplished today.

So now after about two months of learning how to do modification and checksum correction of the Video BIOS and learning how to manipulate Phoenix BIOS Editor Demo in the command prompt to allow re-assembly of the modified BIOSes, which is not available in the GUI, I seem to be down to just one halfbyte. Trying to change that 0 to a 4 in 4E50. There is some conflict somewhere.
Thanks again for suggestions and any more ideas you may have. I'm not sure of what I have overlooked or what I should try next.

lomax · Sun Sep 12, 2004 3:44 pm

inconel, maybe it would be a good idea if you wrote down what you did, or some sort of (small) tutorial about this subject.
Might be interesting for others as well.

inconel · Sun Sep 12, 2004 7:43 pm

lomax,
I agree, but until all issues can be resolved, I'm not comfortable writing a tutorial that begins with moving resistors but has no ending. I'm getting close, close to success, or close to saying it may not be possible.

Anyone is welcome to pm me if they think I may have stumbled across anything that may help one of their own projects.

inconel · Thu Sep 16, 2004 5:50 am

Over the weekend I ran another test using the SubSystem and SubVendor IDs from Hewlett Packard's NW8000 notebook. The graphics drivers for this computer allow installation of 4E50 (RADEON 9600) and 4E54 (FireGL T2-128) Device IDs. FireGL is optional for the NW8000.
Ever since I had modified my graphics chip by relocating the resistor, I've had to manually install the graphics driver made for my notebook. Trying to install FireGL drivers also results in an inf error. However, the drivers for the NW8000 installed the libraries for the Radeon 9600 automatically without any errors.
Since FireGLs share many of the Catalyst librarys, it seems that any Device ID checking that occurred was satisfied by 4E54 on the chip and 4E50 in the Video BIOS.
This may prove that altering the resistor position does effectively change the Device ID even on mobility cards. Unfortunately there still seems to be some other area where 4E50 is still specified. Hopefully not another hardwired location.
On a side note, does anyone know the compression scheme used for IBM notebook BIOSes? I'd really like to take a closer look at the Video BIOS for the T42P and others that are available only with FireGL cards, just to make sure additional edits are not needed for the Video BIOS.
Thanks again for the help.