Phoenix NuBIOS (v4.04)/PhoenixPICO BIOS (v4.05) file format
Posted: Sat Sep 18, 2004 8:07 pm
Hello,
I have an Boundless Viewpoint TC-200 pc that is silenced, that means it doesn't show any messages during a boot. This is ofcourse very annoying.
I know the code to unsilence the TC-200, but the question is where am i going to put it?
I did some BIOS 'hacking' of my own and have come up with this information:
The BIOS contains 4 compressed parts and an uncompressed part (bootloader and decompressor?).
The compressed parts are LZSS compressed (i've managed to write a c program that can compress and decompress these parts).
The compressed parts have an header that looks like this:
6 bytes: ID (0x42,0x43,0xD6,0xF1,0x00,0x00)
1 byte: headersize (0x12)
1 byte: ? (type ?)
2 bytes: ? (segment ?)
4 bytes: unpacked size
4 bytes: compressed size
These compressed parts are (when uncompressed) 8-bit checksummed to zero.
The 1st compressed piece is the VIDEO ROM, type = 0x04, segment = 0x5000
2nd is a DataLight CardTrick (SSD) ROM, type = 0x05, segment = 0xCC00
3rd is part of the Phoenix BIOS (setup program), type = 0x02, segment = 0x4000
4th is also part of the Phoenix BIOS (mainly boot and error messages), type = 0x09, segment = EBCF
The video and ssd option rom consist of the usual headers (ID=0x55, 0xAA, SIZE=0x?? * 512 bytes, CODE=0x?? etc.)
This is what i did:
I've written an program to unsilence the bios in the option rom format.
The code:
0x55,0xAA (ID)
0x01 (Size * 512 bytes)
0x50 (push ax)
0xB8,0x02,0xD7 (mov ax, D702)
0xCD,0x10 (int 10)
0x58 (pop ax)
0xCB (retf)
This code is checksummed to zero with an 0x1F as the 512th byte.
Then i've compressed it with my own written tool (i used the type and segment of the cardtrick option rom). I pasted these bytes over an empty spot in the bios file (just before the first compressed piece, the video rom) and checksummed the complete bios file to zero.
Burned it to a flash chip and booted the system.
Well no surprise...it didn't work. The system gave me the 1-2-2-3 beep code (BIOS ROM or OPTION ROM checksum error).
THE big question is: what are the 'type' and 'segment' bytes? What value should i give them?
I hope someone can figure this out, tia,
Slash0r
I have an Boundless Viewpoint TC-200 pc that is silenced, that means it doesn't show any messages during a boot. This is ofcourse very annoying.
I know the code to unsilence the TC-200, but the question is where am i going to put it?
I did some BIOS 'hacking' of my own and have come up with this information:
The BIOS contains 4 compressed parts and an uncompressed part (bootloader and decompressor?).
The compressed parts are LZSS compressed (i've managed to write a c program that can compress and decompress these parts).
The compressed parts have an header that looks like this:
6 bytes: ID (0x42,0x43,0xD6,0xF1,0x00,0x00)
1 byte: headersize (0x12)
1 byte: ? (type ?)
2 bytes: ? (segment ?)
4 bytes: unpacked size
4 bytes: compressed size
These compressed parts are (when uncompressed) 8-bit checksummed to zero.
The 1st compressed piece is the VIDEO ROM, type = 0x04, segment = 0x5000
2nd is a DataLight CardTrick (SSD) ROM, type = 0x05, segment = 0xCC00
3rd is part of the Phoenix BIOS (setup program), type = 0x02, segment = 0x4000
4th is also part of the Phoenix BIOS (mainly boot and error messages), type = 0x09, segment = EBCF
The video and ssd option rom consist of the usual headers (ID=0x55, 0xAA, SIZE=0x?? * 512 bytes, CODE=0x?? etc.)
This is what i did:
I've written an program to unsilence the bios in the option rom format.
The code:
0x55,0xAA (ID)
0x01 (Size * 512 bytes)
0x50 (push ax)
0xB8,0x02,0xD7 (mov ax, D702)
0xCD,0x10 (int 10)
0x58 (pop ax)
0xCB (retf)
This code is checksummed to zero with an 0x1F as the 512th byte.
Then i've compressed it with my own written tool (i used the type and segment of the cardtrick option rom). I pasted these bytes over an empty spot in the bios file (just before the first compressed piece, the video rom) and checksummed the complete bios file to zero.
Burned it to a flash chip and booted the system.
Well no surprise...it didn't work. The system gave me the 1-2-2-3 beep code (BIOS ROM or OPTION ROM checksum error).
THE big question is: what are the 'type' and 'segment' bytes? What value should i give them?
I hope someone can figure this out, tia,
Slash0r