How to > HP BIOS MiniPCI Fix- nc6000/others

Don't ask how to hack password. (BIOS Passwords)
Xb0xGuru
New visitors - please read the rules.
Posts: 8
Joined: Fri Jul 04, 2008 8:31 am

Okay - just so I'm getting this right...

"add (mathematically) together all original hex numbers what you intend to modify in the BIOS"

That would be:

11 0E E5 00 E6 00 (the original vendor and subsys IDs, omitting the F7)

= 1EA

then
"and also add together all hex numbers what you write in!"

Which are:

4F 14 84 70 88 70

= 24F

"Then subtract from the original sum the new sum. "

So 1EA (original)-24F (new) = FFFFFFFFFFFFFF9B

"If there is a positive number then somewhere at the end of the bios file find a 0 (where seems no live code or data) and modifiy (add) with the result. If there is a negative number then find a FF ( at the end and ..) and also add ( effectively subtract ) and modify with. "

Well it's obviously a negative value - this is where I'm now confused. What do I do from here?

I've never meddled in this stuff before so would appreciate a little help :)
semi
BIOS Rookie
Posts: 35
Joined: Mon Oct 27, 2008 6:17 pm
Contact:

Hey Folks,

this here could perhaps help you…

Awesome Dirty Do Checksum Checker

Cheers Semi

If you need a translation, try this

Yet another translator...
Xb0xGuru
New visitors - please read the rules.
Posts: 8
Joined: Fri Jul 04, 2008 8:31 am

I shall give it a try - many thanks!
edwin
The Hardware Archivist
Posts: 6286
Joined: Wed Mar 20, 2002 7:11 pm
Location: Netherlands
Contact:

@semi: a very nice find. thank you indeed
edwin/evasive

Do not assume anything

System error, strike any user to continue...
semi
BIOS Rookie
Posts: 35
Joined: Mon Oct 27, 2008 6:17 pm
Contact:

@edwin: I did not find it real. I made it! And it´s updated...
With a little "HOW-TO Patch your HPQFlash"

Cheers Semi
Xb0xGuru
New visitors - please read the rules.
Posts: 8
Joined: Fri Jul 04, 2008 8:31 am

What do you input in the bottom section, entitled "uncompressed bytes in compressed bios-file for correction"? I've edited my BIOS file and I've the following data

Original BIOS checksum: AD 8E 43 1B
Patched BIOS checksum: C6 93 C5 D8

Checksum Differences: -19 -05 -82 -BD

My BIOS notation is : 8C1613004F148470

Thanks!
semi
BIOS Rookie
Posts: 35
Joined: Mon Oct 27, 2008 6:17 pm
Contact:

Hey Xb0xGuru,

you have to find the whitelist in your orignal bios file.
Then you will see more than one pci dev ven ID´s, cause
your notebook accept a lot of wireless cards.

Normaly, you only need one of these to change and replace it
with your own ID´s.

-> after the change you get the checksum differences

You mußt correct these differences!! But how?

You only need 4 Bytes to correct it, and from where? From
one of the other ID´s in the whitelist you didn´t need.

The Bios-File is compressed, but not all Bytes are compressed.
Also they are some uncompressed Bytes in a compressed bios file.

I think it´s better to change only uncompressed Bytes, but
sometimes between some bytes there is an "unpack Byte" for the
unpack algorithm, in example "EF" or "FF" or something else. If
you look carefully, you will identify them.

So back, I have spend you 8 Bytes to correct, you can input
8 Bytes from your whitelist, than Make a check to every Byte
that you say it´s allowed to change for the correction.
Be sure, your bytes counted 4-Bytes, otherwise you can´t do a correction.

Replace the correction string with the one you´ve insert, and your
checksum will be fixed. Hopefully ;-)

Cheers Semi

8 uncompressed Bytes marked in a compressed Bios-file

Image

8 compressed Bytes marked in compressed Bios-file

Image

Image
boredwild
New visitors - please read the rules.
Posts: 9
Joined: Fri Nov 07, 2008 10:03 am

The simple procedure worked for me and now a Texas Instruments TNETW1130 based card (from a crappy Linksys VOIP wireless router) works on a nc6000.

Excellent suggestion about putting the laptop in standby and installing the card. The laptop comes out of hibernation just fine, installs the card, and allows you to read the relevant info in device manager.

Downloaded the HP bios flash disk for this unit (v1.5), extracted the bios file with Winimage, modified the .bin with Hex Workshop, and wrote it back to the image. No modified CRC or anything like that, just the basic parameters of vendor, device, and subsys.

Mounted the image to a virtual floppy drive (VMWare), and used HP's USB flash disk utility to make a USB flash drive into a bootable drive using the modified floppy image.

Set the bios to boot from a USB HDD, and it runs the HP bios flash utility from startup.

Just to see, I tried to save the bios before replacing, but the utility encountered a write error. I suspect that there was no room on the usb because it was formatted as a 1.44MB floppy.

Anyway, I pulled the trigger and wrote the new .bin.

Shut down the computer and installed the TI card, restarted, and all was good. New card works excellent.

Thanks for the great tips here.

Bit scary that there seems to be no "easy" bios recovery if something goes wrong though...
Last edited by boredwild on Fri Nov 07, 2008 11:55 am, edited 1 time in total.
boredwild
New visitors - please read the rules.
Posts: 9
Joined: Fri Nov 07, 2008 10:03 am

First 2 reboots worked fine. Now it doesn't get past the "power on" light...
Any ideas on a bios recovery?
Xb0xGuru
New visitors - please read the rules.
Posts: 8
Joined: Fri Jul 04, 2008 8:31 am

What notebook do you have?
boredwild
New visitors - please read the rules.
Posts: 9
Joined: Fri Nov 07, 2008 10:03 am

It's a nc6000.
semi
BIOS Rookie
Posts: 35
Joined: Mon Oct 27, 2008 6:17 pm
Contact:

hey boredwild,

if you want to reflash your bios without your notebook powerd on,
there are only a few ways.

1. Let HP do the work
2. or Do it by your self!!

look at Services Media Library from HP.
And then look at your model nc6000 -> buttonboard
NC6000 Services Media Library

You can see that your bios chip is on the buttonboard.
So you can disassamble the notebook and desolder the bios
chip from the buttonboard. than clean the pads an solder an plcc32 smd socket on it.

than you can buy a flasher, like Willem EPROM Programmer or something else, and reflash your bios chip with a running flashfile.

if you want, you can send me your buttonboard (to germany) and
i could do this for you. but i think it's cheaper if do it by your self.
or you buying a crashed notebook with a working buttonboard.

Hope this help!?

Cheers Semi
Xb0xGuru
New visitors - please read the rules.
Posts: 8
Joined: Fri Jul 04, 2008 8:31 am

I did exactly this with my nc6000 and I'm surprised you actually tried it after reading this thread!!

At least now mine's socketed and worst case scenario I can just remove the PLCC32 and reflash.
boredwild
New visitors - please read the rules.
Posts: 9
Joined: Fri Nov 07, 2008 10:03 am

Hey Xb0x, did you get the nc6000 to accept the bios change long-term using semi's correction? To fix mine , I'll be socketing my bios chip. I have had success programming the 49-series flash by hotswapping into a booted-up desktop motherboard that has a socketed PLCC bios. Let you know how it goes...
Xb0xGuru
New visitors - please read the rules.
Posts: 8
Joined: Fri Jul 04, 2008 8:31 am

To be honest, no!

I'm not stupid by any means and one thing which frustrates me more than anything is not understanding something! I've tried following semi's advice on what bytes to use as the correction area and I'm not getting anywhere with it. If you get it to work, let me know what you did as since you have the same laptop, the data in the BIOS should be at the same addresses.
Post Reply