Phoenix NuBIOS (v4.04)/PhoenixPICO BIOS (v4.05) file format

[Slash0r]

Hello,

I have an Boundless Viewpoint TC-200 pc that is silenced, that means it doesn't show any messages during a boot. This is ofcourse very annoying.
I know the code to unsilence the TC-200, but the question is where am i going to put it?

I did some BIOS 'hacking' of my own and have come up with this information:

The BIOS contains 4 compressed parts and an uncompressed part (bootloader and decompressor?).

The compressed parts are LZSS compressed (i've managed to write a c program that can compress and decompress these parts).

The compressed parts have an header that looks like this:
6 bytes: ID (0x42,0x43,0xD6,0xF1,0x00,0x00)
1 byte: headersize (0x12)
1 byte: ? (type ?)
2 bytes: ? (segment ?)
4 bytes: unpacked size
4 bytes: compressed size

These compressed parts are (when uncompressed) 8-bit checksummed to zero.

The 1st compressed piece is the VIDEO ROM, type = 0x04, segment = 0x5000
2nd is a DataLight CardTrick (SSD) ROM, type = 0x05, segment = 0xCC00
3rd is part of the Phoenix BIOS (setup program), type = 0x02, segment = 0x4000
4th is also part of the Phoenix BIOS (mainly boot and error messages), type = 0x09, segment = EBCF

The video and ssd option rom consist of the usual headers (ID=0x55, 0xAA, SIZE=0x?? * 512 bytes, CODE=0x?? etc.)



This is what i did:

I've written an program to unsilence the bios in the option rom format.

The code:
0x55,0xAA (ID)
0x01 (Size * 512 bytes)
0x50 (push ax)
0xB8,0x02,0xD7 (mov ax, D702)
0xCD,0x10 (int 10)
0x58 (pop ax)
0xCB (retf)
This code is checksummed to zero with an 0x1F as the 512th byte.

Then i've compressed it with my own written tool (i used the type and segment of the cardtrick option rom). I pasted these bytes over an empty spot in the bios file (just before the first compressed piece, the video rom) and checksummed the complete bios file to zero.

Burned it to a flash chip and booted the system.

Well no surprise...it didn't work. The system gave me the 1-2-2-3 beep code (BIOS ROM or OPTION ROM checksum error).

THE big question is: what are the 'type' and 'segment' bytes? What value should i give them?

I hope someone can figure this out, tia,
Slash0r

[NickS]

The "Segment" is which page in the memory map to load the code into.

The 8086 memory map adds the "segment" x16 to the address. Thus you have a number of registers - CS (Code Segment), DS (Data Segment) etc - does this ring a bell ?

The "type" I suspect is Phoenix proprietary and probably tells them what type of module this is supposed to be. With an Award BIOS, if you run CBROM with /D the modules in the BIOS are categorised (logo, PCI, awdext, awdeyt, etc) and this may be what the "type" byte identifies.