How to > HP BIOS MiniPCI Fix- nc6000/others

Don't ask how to hack password. (BIOS Passwords)
BPopilek
New visitors - please read the rules.
Posts: 4
Joined: Tue Dec 29, 2009 6:52 pm

Well, after searching a lot more, I found a obscure video tutorial of the ADDCC v2 software in action, and I was able to get the correct checksum using the following:

6F6F74FF57616B65 = oot.Wake

So instead of starting at the B, I had to move over one character and that solved the problem! I hope this helps anyone else that is trying to get the WiFi card in their TC4200 upgraded! :)

-Brian
nando4
BIOS Rookie
Posts: 46
Joined: Sat Aug 22, 2009 2:44 pm

AlanSpoon wrote:Thanks for your great posts. :D I would like to know if there is a patch or round way working for the pci-whitelisting on HP Compaq 6910p. I have a WWAN module- MC8790 card on hand, but I can't use it on laptop due to bios whitelisting. "
WWAN whitelist editing

WWAN uses a USB 4-byte VID/DID. ADDCCV3 is designed to work with WLAN which uses a 8-byte VID/DID. This means it would be possible to use ADDCCV3 to replace the WWAN string. How?

1/ find existing WWAN USB VID/DID in uncompressed whitelist. See example from a 2510P bios here.
2/ Set ADDCCV3 to search for one of them, but pad it out as a full 8-byte string with the neighbouring data.
3/ replace the found string with 4-bytes matching your WWAN's card USB VID/DID.
4/ correct checksum

I haven't tried it, but in theory it should work.
ctantra
New visitors - please read the rules.
Posts: 2
Joined: Fri Jan 01, 2010 2:44 am

I own HP Compaq 6510b, and I want to upgrade the miniPCI Wireless Card.

My current Wifi Link 4965AG:
Device ID: PCI\VEN_8086&DEV_4229&SUBSYS_10008086&REV_61\4&20869F6A&0&00E1

My new Wifi Link 5100AGN:
Device ID: PCI\VEN_8086&DEV_4232&SUBSYS_12018086&REV_00\00215DFFFF7AF9A200

I tried using ADDCC v3, but I don't understand how to fix the Checksum.

Here the link to the BIOS:
ftp://ftp.hp.com/pub/softpaq/sp42001-42500/sp42314.exe

Anybody can help hacking the F.15B BIOS will be really appreciated. :D
or you can also email me: ctantra@melsa.net.id

Regards,
LimLim
Malcw
New visitors - please read the rules.
Posts: 1
Joined: Mon Jan 25, 2010 12:32 am

I'm going to summarize my experiences with ADDCC (v3) since I found it hard to figure out what to do and how to do it! (No disrespect to Semi, who has done a great job, but I think there may be a communications barrier -- and I'm not talking about English/German, but "Wise about BIOS" / "Not so much"!).

So, what I was trying to do (and succeeded in doing) was install an Intel 5300 (with an HP 'spare part' number, so probably an HP OEM, and thus fully compatible with HP's "Wireless Enable" switch!) in an HP 8510W. The HP 8510W had an Intel 4965AGN card installed.

The old BIOS string (4965AGN) is

PCI\VEN_8086&DEV_4229&SUBSYS_11008086

but as it turns out you don't need to know that. The new one is

PCI\VEN_8086&DEV_4236&SUBSYS_10118086
(86 80 36 42 86 80 11 10)

So, here's what I did:

Step 1: Download the HP BIOS (F.15) to be used with a Floppy disk drive (and a USB stick, come to that). Create a USB bootable floppy and check that it is bootable, and the BIOS file can be read (I, separately, booted but did not flash the BIOS, and then booted normally and copied everything on the floppy to the hard disk, proving that the system could read the disk).

Step 2: I tested the "emergency recovery" procedure, since I didn't want to be trying to work out how to recover a bricked laptop if it all went wrong! The key for the 8510w is to be pushing the "Windows" + "B" keys before pushing the power button, after which the "Caps Lock" light flashes and it writes the BIOS.

Step 3: Fire up ADDCC, and start the main work. First off, we need to find the white list in the BIOS file, which is called 68MVD.BIN for the 8510w. What we really want to find is the first entry in the table, because the whole thing is compressed so that entry #3 depends on entry #2 which depends on entry #1.

Now, what took me a while to understand was that ADDCC’s “Decompress” feature is a “read only” thing, ideal for finding things, but there’s no corresponding “Compress” feature, so don’t get carried away. Eventually, though, I found that by using the “Decompressed Whitelist” check box and the “Search in” function, I could reliably find the _end_ of the whitelist. It’s at 0x2586, but that’s not what we really want: we want the _start_ of it. BUT… once you know where it ends, you can work backwards looking at the table of (8 byte long) PCI IDs, until you reach something which isn’t one (or isn’t a probable one, such as that of a sound card!).

To help in this, I used the table of PCI IDs from http://pciids.sourceforge.net/. Turns out that in the HP 8510w, it’s all either Intel or Broadcom cards, and the first card in the list is at (uncompressed) offset 0x24ED and has the hex string

86 80 22 42 3C 10 5B 13
Or PCI\VEN_8086&DEV_4222&SUBSYS_135B103C

… which is the ID of an Intel 3945ABG for a Compaq 6710b or nx9520.

Step 4: Now we have to find that entry in the _Compressed_ file. So I copied the string into the “BIOS Notation” box, selected the “Compressed Whitelist” check box, and clicked “Search In”.

This found something with “50% probability”, namely the 12 byte sequence:

C1 00 86 80 22 42 AF 3C 10 5B 13 83

Looking closely, we can see that all the ID bytes are there, and in the right order! It’s at offset 0x113e8 in the compressed BIOS file, and if we look ahead, to offset 0x11418 we can see a 12 byte sequence:

02 34 10 E4 14 BF 12 43 3C 10 70 13

… which looks like it contains the ID of a Broadcom (“VEN_14E4”) BCM4312 (“&DEV_4312”) card.

So we now know where the table starts!

Step 5: Change the ID. I chose to use the Intel 3945ABG’s entry to replace. The trick here is to take the 12 bytes found (beginning “C1 00 86 80”) and only replace the bytes that correspond to those of the ID, so we get as a replacement string:

C1 00 86 80 36 42 AF 86 80 11 10 83

And now we can successfully click the “Change in File” Button.

Step 6: Now we have to fix the checksum. This is harder than it might appear, because checksums are designed to be good at detecting changes in the same area, and there just aren’t that many bits available to play with, once the compression control words are left out. So the trick here is to find a string that doesn’t get compressed. And that’s where the whole thing gets a bit murky: I don’t know why it worked, but I found a string that didn’t seem terribly important (to me), namely the “F12=Network Boot”, and searched for that in the _compressed_ file, where I found it at offset 0x11e09. Looking ahead in the file, at offset 0x11e10, the “twork” part of “Network” is represented as:

74 77 6F 72 6B F2 A0 25

Checking the boxes under the first five bytes gave me a red, three greens and a red, which means nothing to me, but it gave me a corrected checksum of

2E C1 72 28 2D F2 A0 25

Or, in other words, by mucking around with the “twork” and making it something like “F12=Ne.?H(- Boot”, the checksum of the file remains unchanged.

Selecting the “Correct” button updates the file, and all looks good.

Step 7: Now I exited ADDCC entirely, copied the “patched-68MVD.BIN” file to a new directory, where I renamed it “68MVD.BIN”, and restarted ADDCC. Now when I looked at the first entry in the white list table, it was

86 80 36 42 86 80 11 10
Or PCI\VEN_8086&DEV_4236&SUBSYS_10118086

Which is what was wanted.

Because of the compression approach, the second and subsequent entries have been modified, so instead of being variations of the 3945ABG card, they look like (non-existent) variations of the 5300. But who cares? The first is what I need.

I spent a lot of time worrying about trying to keep as much of the old white list, so that if I wanted to put another card (an old one) in, it would work… but then I realized that was stupid: if I need to change cards, I’d simply flash the stock BIOS and all would be well…

Hope this helps someone!
hirnburned
New visitors - please read the rules.
Posts: 2
Joined: Sat Jan 30, 2010 4:07 pm

I tried to use ADDC to unlock a DELL 5530 WWAN card for my compaq 2710p notebook, but with no success.
it is blocked by BIOS with the message "... unsupported WWAN card detected ... "

Nando proposed to use ADDCC although for WWAN minipcie cards, which are actually USB connected.

So i tried to Patch BIOS of my compaq 2710p .
(availibe at: http://h20000.www2.hp.com/bizsupport/Te ... ob-66839-1)

ADDCC was able to decompress it.
The uncompressed USB whitelist contains two Sierra WWAN cards "F0031D1BF0031D1E" which i searched for.
I replaced the matching bytes of one Sierrra card in compressed with my DELL 5530 card "3C414781".

Speaking in ADDCC:
orig BIOS ID: F85E72D5F0031D1B40001E80
relplace: F85E72D53C41338140001E80

checksum: 61FF6B65204F6E20
replace: 9BFF62109A11610F

Flashed modified BIOS, booted, but WWAN card is still "unsupported". :-((

What went wrong? Has anybody an idea?

Anyway, thanks for programming ADDCC!
Two little issues:
1. What means red and green in checksum correction bytes?
2. I had problemes that sometimes the patched file was not modiefied - Button "change in file" remains gray
and Checksum Differences were not calculated. Finialy it worked, maybe it was the long Path to the File.
hirnburned
New visitors - please read the rules.
Posts: 2
Joined: Sat Jan 30, 2010 4:07 pm

Success! Modified BIOS with ADDC and have now working DELL 5530 WWAN card in Compaq 2710p.

Used Methology like described in my previous post, but now with correct bytes ( messed up a byte in changed PID/VID).

Installed Drivers from DELL and now seeking for a generic connection manager software....

Regards.
ptarmu
New visitors - please read the rules.
Posts: 2
Joined: Mon Feb 01, 2010 7:16 pm

hirnburned wrote:Success! Modified BIOS with ADDC and have now working DELL 5530 WWAN card in Compaq 2710p.

Used Methology like described in my previous post, but now with correct bytes ( messed up a byte in changed PID/VID).

Installed Drivers from DELL and now seeking for a generic connection manager software....

Regards.
Hi!

Can You give me some advice...
What version ADDCC You used? I need to do same work.. I have Option GTM 378 WWAN card get working in Compaq 2710p...
ptarmu
New visitors - please read the rules.
Posts: 2
Joined: Mon Feb 01, 2010 7:16 pm

All OK. Option GTM 378 with GPS is working in HP 2710p! :D Wireless Assistant turn wwan on and off! :) I afraid, that Assistant couldn't do this....
romeool
New visitors - please read the rules.
Posts: 1
Joined: Thu Feb 11, 2010 9:37 pm

Hi guys,

Could someone please help me with a HP TC4400.
I have this bios : http://h20000.www2.hp.com/bizsupport/Te ... ob-63517-1

And i would like to put this card (Intel 4965AGN or BCM4321) instead of my old Intel 3945ABG.

My current Wifi Intel 3945ABG:
Device ID: PCI\VEN_8086&DEV_4222&SUBSYS_135B103C

My new Wifi Link 4965AGN:
Device ID: PCI\VEN_8086&DEV_4229&SUBSYS_11008086

Or my WiFi BroadCom BCM4321:
Device ID: PCI\VEN_14E4&DEV_4328&SUBSYS_1366103C

Thank you very much for your help.

Edit: Would it be possible to remove the whitelist. I do not know exactly but I tried with ADDCC but I am not a good bios editor.

I would really Appreciate some help.

Edit 2: I managed to update the IDs, but not to fix the Checksum.
The ADDCC app froze. I use Win7 x64.

Edit 3 : I used WinXP but I am not able to fix the checksum. Could someone please help me ?

Edit 4 : I bricked my TC4400, the Checksum was right, flash ok, but no boot. Power led and HDD led on, FAN on, and that's it.

Please help.

Regards
Last edited by romeool on Wed Feb 17, 2010 11:30 pm, edited 2 times in total.
miloniu
New visitors - please read the rules.
Posts: 4
Joined: Sun Feb 14, 2010 10:14 am

Hello,
I Have a HP Compaq NC6400 notebook and his bios is blocked. When I install miniPci Card (WWAN HSDPA Modem by Option) I have this:
104-Unsupported wireless network device detected. System Halted. Remove device and restart.
What can I do?? Please, help me.
Regards.
Milos.
michalflasz
New visitors - please read the rules.
Posts: 1
Joined: Wed Feb 17, 2010 4:07 pm

Hello user
I Have a HP 2710p tablet and his bios is blocked. When I install miniPci Card (WWAN HSDPA Modem by Option GT M351) I have this:
104-Unsupported wireless network device detected. System Halted. Remove device and restart.
What can I do?? Please, help me.
best
Michał

ps
Modem info vid_0AF0&pid_6500

USB\VID_0AF0&PID_6500&MI_00\6&52D0EC2&0&0000
USB\VID_0AF0&PID_6500&MI_01\6&52D0EC2&0&0001
USB\VID_0AF0&PID_6500&MI_02\6&52D0EC2&0&0002
USB\VID_0AF0&PID_6500&MI_03\6&52D0EC2&0&0003
Trinitron
New visitors - please read the rules.
Posts: 1
Joined: Sun Mar 07, 2010 9:03 am

Hello all.
Can anybody fix bios for my nx6110?
bios
old card PCI\VEN_14E4&DEV_170C&SUBSYS_099C103C&REV_02\4&AD1B67F&0&70F0
new card PCI\VEN_168C&DEV_001A&SUBSYS_04181468&REV_01\4&AD1B67F&0&20F0
Thank for all, sorry for my english....
miloniu
New visitors - please read the rules.
Posts: 4
Joined: Sun Feb 14, 2010 10:14 am

Hello... Can You Help Me,In my problem with HP NC6400 please????????????
amerrigan
New visitors - please read the rules.
Posts: 1
Joined: Thu Mar 18, 2010 12:32 am

ptarmu wrote:All OK. Option GTM 378 with GPS is working in HP 2710p! :D Wireless Assistant turn wwan on and off! :) I afraid, that Assistant couldn't do this....
Don't suppose you want to share your bios-mod, I'm also trying to get my 2710p to show a GTM 378.

---
Tony
nightalon
New visitors - please read the rules.
Posts: 3
Joined: Fri Sep 04, 2009 10:34 pm

Anyone have any success on an EliteBook 8530w/8540w/8430w/8440w?

In the market, but I'd like to be sure that I can use the 3G modem and WIFI card that I want. (to run MacOS properly)

As for Core i5/i7 notebooks, I might look at the T510 or W510 ThinkPads, but the only modified available BIOSes are for last generation. Maybe I'll just stick with my last-gen Precision M4400. Dells are only great in that they have no BIOS lock on WWAN or WIFI!
Post Reply