How to > HP BIOS MiniPCI Fix- nc6000/others

[slingr]

First and foremost, I would like to credit all the knowledge to Rich_at_richud_dot_com for his research and work. Please see his credits as well.

Rich has a great tutorial found at http://www.richud.com/HP-Pavilion-104-Bios-Fix/
While you don't necessarily need to digest everything there, it is a requirement in order understand my brief how-to. His tutorial is great for those who need to decompile and edit their BIOS. In my case, with the nc6000, the BIOS comes uncompressed so all of the hard work is done for us.


If you are reading this your probably know that HP "whitelists" certain MiniPCI cards to work with their systems. It does this by comparing the Vendor ID, Device ID, and SubSystem ID of the inserted card to the ones listed in the BIOS. In order to successfully use your non-HP-approved minipci card in you HP laptop, you have to have your minipci's information in the BIOS.

so lets skip right to the goods.

You will need:
1) a USB floppy drive
2) a NEW 1.44mb floppy diskette (you can use an old one... if thats a risk you are willing to take)
3) Editpad Pro or your favourite hex editor
4) Another non-HP/IBM laptop to install your new miniPCI card into... or some other way of finding out what the SubSys ID is of your specific card.
5) basic knowledge on how to use a hex editor and how to follow directions.

I originally downloaded the Windows-based flash from the HP site. Within this was a ROM.CAB and within the cab was ROM.BIN and ROM.SIG.

I was able to make the suggested changes found at Rich's site, however, when I would try and run the flash utility it would give me a signature error and wouldn't actually flash.

So by downloading the "ROMPaq for HP Notebook System BIOS (68BDD ROM) - DOS Bootable Diskette" from the hp site, I was able to edit the 68BDD.BIN file (exact same as ROM.BIN) and save it back to the floppy. HP's DOS flashing utility does not perform any file checks.

http://h20000.www2.hp.com/bizsupport/Te ... 830-107601

This is F.14, which is what is refered to in rich's tutorial.

1) Open the rom.exe and write the BIOS flash image to the new 1.44mb floppy diskette.
2) copy the 68BDD.bin to a working directory on your computer. For simplicity i will label it as c:\hpfix


Open the 68BDD.bin in Editpad or your favourite hex editor.

Firstly are 2 Atheros based cards
MB22ag_01, PCI\VEN_168C&DEV_0013&SUBSYS_00E50E11 (HP WLAN 802.11a/b/g W500)
MB22g_01, PCI\VEN_168C&DEV_0013&SUBSYS_00E60E11 (HP WLAN 802.11b/g W400)


Secondly are 2 Intel 2100 802.11b wireless cards
PCI\VEN_8086&DEV_1043&SUBSYS_25228086 ; Intel 2100 mPCI 3B - RoW
PCI\VEN_8086&DEV_1043&SUBSYS_25278086 ; Intel 2100 mPCI 3B - MoW

Thirdly is a solitary Broadcom b/g 43xx wifi card.
BCM43XGT, PCI\VEN_14E4&DEV_4320&SUBSYS_12F4103C



Now the mini pci card I am installing into my laptop is a generic Atheros AR5005 chipset.

PCI\VEN_168C&DEV_0013&SUBSYS_7084144F ; My Generic Atheros AR5005-based card
PCI\VEN_168C&DEV_0013&SUBSYS_7088144F ; My Generic Atheros AR5005-based card

If you company my generic Atheros card to the HP W400/W500 Atheros cards you will see some similarities.

Atheros Vendor ID = 168C
Atheros Device ID = 0013

We only need to change the SubSys ID's.

So what I am gonna do is edit the HP WLAN W400/W500 block since they are already Atheros-based

Here's the edited product.


1) Save the 68BDD.bin and put it back on the floppy
2) Reboot and flash the bios
3) Install your new minipci card and enjoy

Again, a prerequisite is to read Rich's information at: http://www.richud.com/HP-Pavilion-104-Bios-Fix/ so you can understand it this.

[slingr]

Also,


the reason for using the DOS bootdisk is that the HP rompaq.exe doesn't CRC-check the 68BDD.bin image. Almost everything in this tutorial can be done from windows, however, all of the HP windows flashing utils will reject the modified image due to a signature error

[Renna]

Great job slingr!!

I'm so happy i found this... months ago i read everything on rich's site and on topic on the hp support forum.. (http://forums12.itrc.hp.com/service/for ... dId=567021)

but i couldn't do it because, as you mentioned, the standard hp utility to flash bios on nc6000 won't let you flash the modified bios...

then yesterday i found this topic, and know i'm writing you from my atheros card

I'll just make some notes here that i think can be usefull:

1)to read the id of your card, i found the simplest way is to turn your laptop into standby, pull off the power chord for safety, and open the minipci slot and insert the card (remember cables: white = main, black = aux).
When you come back from stanby the computer won't pass through the bios check. You should find your card in Device Manager - remember to refresh for new hardware (this in xp, i have no idea in vista) and in the properties window, in the "details" tab you should fine all the ids of your card

2) Remember first of all to enter the bios setup (f10 on startup) and check if the floppy drive is first in boot order than your hard drive... otherwise when you attempt to start the ROMpaq utility your computer will simply bypass it and start from your hard drive

3) a freeware hex editor is Cygnus.

4) Be careful when editing the hex of your bios and, for safety, install the ROMpaq utility on a second floppy too and that keep it UNMODIFIED, so if you fail something and your computer won't startup up you may use that floppy to reinstall a working bios

5) don't buy hp anymore and encourage others to do so

renna


Edit - Removed errant [/url] tag. KW

[ovof]

I've got an NC6400,

i try to hack the bios to change intel 3945gb > broadcom 4311 (DELL 1390),

i downloaded the bios image for dos flash, 68ycu.bin

@offset 10be2, i found :

86(7F)80 2242 3C10 5B13 -> Intel 3945gb
-> 8086:4222 Intel 3945gb
-> 10C3 : HP subsytem
-> 135B : high subsys

then several bytes later,

E414(5F) 1243 3C10 6084 -> Broadcom Wifi 4312
-> 14E4:4312 Broadcom Wifi 4312
-> 10C3 : HP subsystem
-> 8460 : high subsys


I think its really the whitelist, but i'm scared.

I know flashing under dos will bypass the CRC check.

But does the bios check CRC at power on ? Otherwise, it will fail ?

[woof]

I've to a NC4010 and I bought an Atheros card (AR5006x) and got annoyed with the 104-error.

What I gathered reading forums is that I need to patch my BIOS since my wificard has protected eeprom. So has anyone done this with the NC4100 bios, v.F30 (68BAS.BIN)?

the card's id is: VEN_168C&DEV_001B&SUBSYS_132910CF

Would really appreciate all help I can get.

Thanks

Frank

[woof]

ok so I tried to edit the bios but after I flashed it, it doesn't boot anymore.
fortunally the pc i tried it on was a pc going to scrapping so it didn't matter.

would be great if someone could help me out.

Thanks

[woof]

tried on two more nc4010 replaced different cards with my AR5006x. Also tried with older firmware. still no luck

Can't see what I do wrong.

for example I replaced a Intel PRO/Wireless 2200 (PCI\VEN_8086&DEV_4220&SUBSYS_12F5103C):
86 80 20 42 3C 10 F5 F4 3F DF F6 12
with
8C 16 1B 00 CF 10 29 F4 3F DF F6 13

didn't work.

I must be missing something but can't see what.

please if anyone still read this thread and got any info regarding my problem I would be grateful for any help.

thanks

[b-earl]

Hello

@ovof

What hex editor do you use and which of the biosfiles have you downloaded?
Because when I download the dos flash file and open the Rom.bin file from the 68ycu folder all I see are F's in the hexfile.

Thanks

[cquilliam]

I attempted this on my NC6400 (RB519UA), and when I go to apply the bios, i get an error after about 20 seconds:

"Error in file content read from disk. Please try recreating file or disk."

I've tried several different floppies to rule out defective media, the only thing I can think of is that I did the bios wrong.

Basically i'm trying to get my notebook to recognize a Wireless N card that I have. Here are the old and new devices:

old: PCI\VEN_8086&DEV_4222&SUBSYS_135B103C&REV_02\4&4878531&0700E1
new: PCI\VEN_8086&DEV_4229&SUBSYS_11008086&REV_61\4&4878531&0&00E1

So, I thought I would just replace the old entries with the new entries. Here is the relavant part in the hex editor:

Before:


After:



Does this look right to everyone else?

[woof]

it looks right to me but I've tried on several nc4010 and all of them got bricked. Would be great to have some more that have succeded modding the bios on this thread.

[cquilliam]

Yes, it would be good to have more success stories

I'm just so mad at HP for doing this. This is a business line notebook and you should be able to upgrade the wireless card to keep up with changing infrastructures. The card i'm replacing with is an HP part, so its rediculus that in order for me to take advantage of new wireless N that I have to purchase a whole new notebook when the part itself is an FPU. I called HP, but they pretty much acted dumb and told me to "Google search 'quick specs nc6400'" to find out what cards are support. Of course, wireless G cards are the only one supported. You would think they would release a bios update which would open the door to a new standard, even if they do just limit it to HP approved cards only.

On a side note, my notebook comes with two extra antannas under the keyboard that lead up to the LCD which look like they're for EV-DO cards. If i do successfully get my wireless N card to work, would i be able to use one of these antannas as the 3rd antanna for the N card?

[kopetnik]

Hi, Anybody succeded with moding of HP Compaq nc6120 notebook?
I found that some people killed their laptops (NC4000, nw8000). Dont's see any confirmation of success with non Phoenix BIOS.

Is it true that the BIOS is checking its CRC upon every boot?

Thx, Kopetnik

[faqu]

more bad news guys I tried the procedure on an nc6000 and it is now totally dead

[Xb0xGuru]

more bad news guys I tried the procedure on an nc6000 and it is now totally dead

I registered here purely to post in this thread.

I tried the above with my NC6000 (before reading this) and can confirm it doesn't work. It looks to be some kind of CRC check as apart from the power light, fan and DVD-ROM firing up, nothing else happens.

Luckily I had a programmer - I've since removed the flash chip and fitted a PLCC32 socket in its place. I repogrammed the chip from F15 and we're all working again now.

Since I have an unbreakable BIOS, if anyone has any ideas I might try with this to get it working, I'm open to suggestions!

Just to explain what I've already tried:

I have an Atheros card with the exact same ID as above - PCI\VEN_168C&DEV_0013&SUBSYS_7084144F

Therefore I changed the values at 0x6151 from:

11 F7 0E E5 00

to

4F F7 14 84 70

I also changed at 0x6159 from

E6 00

to

84 70

This let me reboot, but it started to load XP with my Atheros card in place (I thought I'd cracked it at this point). The whole thing just shut down halfway through XP.

After reflashing the BIOS, I tried again but left the stuff at 0x6159 to see what would happen. Dead from power on.

What I'll try next is what I did on the first attempt: changing the two subsys IDs, but I'll choose another subsys ID for the second part

ie @ 0x6159

E6 00

to

85 70

Maybe having them both the same Subsys IDs flagged a problem.

I'll try this tonight and post my results.

Update:

Instead of 85 70 for 0x6159, I changed it to 88 70 to match the two subsys IDs of 7084 and 7088

Again, after reboot it seemed to work. I got the machine to the BIOS screen. However, once I removed the battery and AC adaptor only to find it dead again. Oh well, reprogrammed again and onto the next plan: Try using the F14 BIOS as described here. I've been trying this on F15 and didn't really think it would make that much difference....

Update #2: F14 has the same result as F15. Dead. Unless someone has any ideas for this, I'll put this to bed for now.

[cszoli]

hi

Try this CRC trick:

add (mathematically) together all original hex numbers what you intend to modify in the BIOS and also add together all hex numbers what you write in.
Then subtract from the original sum the new sum.
If there is a positive number then somewhere at the end of the bios file find a 0 (where seems no live code or data) and modifiy (add) with the result. If there is a negative number then find a FF ( at the end and ..) and also add ( effectively subtract ) and modify with.
With this trick the BIOS CRC check will not notice the changes

Please report if it is succeded!!!