Page 1 of 1
EFI BIOS Reverse Engeneering
Posted: Fri Apr 07, 2006 12:31 pm
by alxdef
Hi there!
I'm looking for information about topic subject. Now the agenda is AMI's Aptio 8. For example, I see File System objects inside of raw firmware image but I can't determine main File System structures - no such values or signatures defined by Intel's Framework Specs. May be someone got into this damn too?
Posted: Wed Apr 12, 2006 3:32 am
by maman
I have no specific help for you, just a hint though. Have you gone to tianocore webite?
https://www.tianocore.org/
btw, I'm not sure yet, but possibly it's a modification of FAT32 file system.
Posted: Sun Jul 23, 2006 3:07 am
by bofors
People at the OSx86Project are also interested in this. Intel is supposed to be using "AMIBIOS Desktop Core 8.0" with its D945, P965 and D975X boards:
http://www.intel.com/design/motherbd/nt ... yspecs.htm
http://www.intel.com/design/motherbd/lt ... yspecs.htm
http://www.intel.com/design/motherbd/bx ... yspecs.htm
Like Aptio, AMIBIOS8 is an EFI based BIOS.
We have been able to load an Apple .efi module to read HFS+ file system from the EFI Shell on such systems.
For information see this:
http://forum.insanelymac.com/index.php?showforum=74
Posted: Thu Jul 27, 2006 8:48 am
by apple_rom
>Like Aptio, AMIBIOS8 is an EFI based BIOS.
AMBIOS8 is BIOS, not EFI.
Posted: Fri Jul 28, 2006 5:34 am
by bofors
This description of AMIBIOS8 implies it is EFI firmware:
http://www.ami.com/support/doc/AMIBIOS8-Desktop.pdf. Note that the "Highlights" section on the first page states "Extensible Firmware Interface (EFI)".
But I guess this AMI Press Release sums it up much better, AMIBIOS8 is a BIOS based firmware that can be converted into EFI compliant firmware:
Monday: February 25, 2002
INTEL DEVELOPER FORUM (IDF), SAN FRANCISCO, California (Monday, February 25, 2002) American Megatrends Inc. (AMI), a leader in storage and computing innovations worldwide, presents a number of Extensible Firmware Interface (EFI) products at Intel Developer Forum (IDF) Spring 2002, booth 607 (February 25-28, Moscone Center, San Francisco, Ca).
EFI support is available with AMIBIOS8™, Enterprise64™, AMIDiag® and other software utility product lines.
...
AMIBIOS8, a leading edge solution for 32-bit based BIOS development, also offers EFI firmware support. AMIBIOS8 uses snap-in expansion modules, called ''eModules'', to facilitate new technologies. The EFI eModule can be added to any AMIBIOS8 solution. ''The AMIBIOS8 modular architecture easily supports new technology to benefit the OEM and ODM,'' said Mike Shields, AMI Software Sales Manager.
''AMI’s implementation of EFI on 32-bit platforms is designed to facilitate the transition from the legacy PC interface to a fully compliant EFI platform. Our EFI module operates side-by side with the legacy BIOS,'' added Brian Richardson, BIOS Sales Engineer.
http://www.ami.com/news/pressshow.cfm?PrID=102
Posted: Fri Jul 28, 2006 7:52 am
by maman
hmm.. this eModules. It's interesting, I wonder where I can download one of the BIOS binary image (AMIBIOS8 with eModules).
The press release says that it's an expansion module. It's possible that it's implemented just like an expansion ROM, but takes a quite different approach in the way to execute it.
It reminds me to the etBIOS module

Posted: Fri Jul 28, 2006 8:19 am
by bofors
maman wrote:hmm.. this eModules. It's interesting, I wonder where I can download one of the BIOS binary image (AMIBIOS8 with eModules).
How about an Intel BIOS update for the D945GNT:
http://downloadfinder.intel.com/scripts ... bmit=Go%21 ?
It supposed to be an AMIBIOS8 with the EFI eModule.
Posted: Fri Jul 28, 2006 3:30 pm
by stonecoldtx
Well, apparently not all Intel boards are using this type of BIOS/Firmware on their implementations.
I have one of the new Shuttle X100 machines, and it has an Intel 945GM board in it, which uses a Phoenix BIOS.
EDIT: I may have misunderstood your post; if you were referring to Intel-built motherboards, then it may be true, but apparently if the vendor is *not* Intel, it could be pretty much anything . . . unless Phoenix/Award has merged with AMI!

Posted: Sun Jul 30, 2006 4:03 am
by bofors
That's right, I am just talking about retail EFI motherboards sold by Intel.
Posted: Fri Aug 17, 2007 11:41 am
by pipomolo42
Hello,
You can find full details about the firmware image in the "UEFI Platform Initialization Specification 1.0" available at uefi.org
Please note that some of the EFI images provided by intel do not correctly follow the specs: they add no padding between files (which are then no longer aligned on a 8 byte boundary)
People at
http://forum.insanelymac.com/index.php? ... 917&st=300 have built a tool that extracts and uncompresses files from an EFI image
I have created a parser for EFI images for the hachoir.org project (in parsers/misc/pifv.py)
For the reverse engineering part, you might want to have a look at the EFI/UEFI spec itself: each EFI application and driver's entrypoint is called with a structure of pointers to the EFI API functions as second argument, so there's a lot of calls to esp+offset. Also, if someone can point to a tool that can automate this lookup, it could also help me a lot.
Posted: Tue May 27, 2008 4:22 pm
by prostar
EFI based bios image format is FFS which stands for Firmware File System.
Every EFI bios image is devided into at least 3 FVs. Here FV means firmware volume. FV is just looks like disk partitions for firmware device.
There are so many modules or files stored on each FV. These files, or eModules which AMI called, can be anything. Every file has a GUID.
But some FV is compressed. And EFI spec allows OEM/IBV use their own compress routine. So it's diffcult to decompress these FVs.
Posted: Tue May 27, 2008 6:21 pm
by pipomolo42
Well, as far as I know, the default compression/decompression algorithm is detailed in the specification, and you can even get sample code on
http://edk2.tianocore.org .
I used this sample to build some compression & decompression binaries, you can find the details here:
http://themacelite.com/forums/viewtopic ... ight=#4603 .
Also, I think I missed the part of the spec telling that third parties were allowed to use some other algorithms ... And it would still require some coordination between the EFI vendor and the device vendor.
Posted: Wed May 28, 2008 2:48 am
by prostar
Hi, pipomolo42
I works for a EFI bios vendor. I know Apple use default algorithm, but we don't. Intel also use customized version fot its own board.
AMI use default on some engineering sample bios, but use customized one in its product bios.