Page 2 of 18

Posted: Thu Aug 28, 2008 5:47 pm
by Xb0xGuru
Okay - just so I'm getting this right...

"add (mathematically) together all original hex numbers what you intend to modify in the BIOS"

That would be:

11 0E E5 00 E6 00 (the original vendor and subsys IDs, omitting the F7)

= 1EA

then
"and also add together all hex numbers what you write in!"

Which are:

4F 14 84 70 88 70

= 24F

"Then subtract from the original sum the new sum. "

So 1EA (original)-24F (new) = FFFFFFFFFFFFFF9B

"If there is a positive number then somewhere at the end of the bios file find a 0 (where seems no live code or data) and modifiy (add) with the result. If there is a negative number then find a FF ( at the end and ..) and also add ( effectively subtract ) and modify with. "

Well it's obviously a negative value - this is where I'm now confused. What do I do from here?

I've never meddled in this stuff before so would appreciate a little help :)

Posted: Mon Oct 27, 2008 6:26 pm
by semi
Hey Folks,

this here could perhaps help you…

Awesome Dirty Do Checksum Checker

Cheers Semi

If you need a translation, try this

Yet another translator...

Posted: Mon Oct 27, 2008 6:39 pm
by Xb0xGuru
I shall give it a try - many thanks!

Posted: Tue Oct 28, 2008 10:29 am
by edwin
@semi: a very nice find. thank you indeed

Posted: Tue Oct 28, 2008 11:56 am
by semi
@edwin: I did not find it real. I made it! And it´s updated...
With a little "HOW-TO Patch your HPQFlash"

Cheers Semi

Posted: Tue Oct 28, 2008 3:23 pm
by Xb0xGuru
What do you input in the bottom section, entitled "uncompressed bytes in compressed bios-file for correction"? I've edited my BIOS file and I've the following data

Original BIOS checksum: AD 8E 43 1B
Patched BIOS checksum: C6 93 C5 D8

Checksum Differences: -19 -05 -82 -BD

My BIOS notation is : 8C1613004F148470

Thanks!

Posted: Tue Oct 28, 2008 6:11 pm
by semi
Hey Xb0xGuru,

you have to find the whitelist in your orignal bios file.
Then you will see more than one pci dev ven ID´s, cause
your notebook accept a lot of wireless cards.

Normaly, you only need one of these to change and replace it
with your own ID´s.

-> after the change you get the checksum differences

You mußt correct these differences!! But how?

You only need 4 Bytes to correct it, and from where? From
one of the other ID´s in the whitelist you didn´t need.

The Bios-File is compressed, but not all Bytes are compressed.
Also they are some uncompressed Bytes in a compressed bios file.

I think it´s better to change only uncompressed Bytes, but
sometimes between some bytes there is an "unpack Byte" for the
unpack algorithm, in example "EF" or "FF" or something else. If
you look carefully, you will identify them.

So back, I have spend you 8 Bytes to correct, you can input
8 Bytes from your whitelist, than Make a check to every Byte
that you say it´s allowed to change for the correction.
Be sure, your bytes counted 4-Bytes, otherwise you can´t do a correction.

Replace the correction string with the one you´ve insert, and your
checksum will be fixed. Hopefully ;-)

Cheers Semi

8 uncompressed Bytes marked in a compressed Bios-file

Image

8 compressed Bytes marked in compressed Bios-file

Image

Image

nc6000 success with TI wifi card

Posted: Fri Nov 07, 2008 10:30 am
by boredwild
The simple procedure worked for me and now a Texas Instruments TNETW1130 based card (from a crappy Linksys VOIP wireless router) works on a nc6000.

Excellent suggestion about putting the laptop in standby and installing the card. The laptop comes out of hibernation just fine, installs the card, and allows you to read the relevant info in device manager.

Downloaded the HP bios flash disk for this unit (v1.5), extracted the bios file with Winimage, modified the .bin with Hex Workshop, and wrote it back to the image. No modified CRC or anything like that, just the basic parameters of vendor, device, and subsys.

Mounted the image to a virtual floppy drive (VMWare), and used HP's USB flash disk utility to make a USB flash drive into a bootable drive using the modified floppy image.

Set the bios to boot from a USB HDD, and it runs the HP bios flash utility from startup.

Just to see, I tried to save the bios before replacing, but the utility encountered a write error. I suspect that there was no room on the usb because it was formatted as a 1.44MB floppy.

Anyway, I pulled the trigger and wrote the new .bin.

Shut down the computer and installed the TI card, restarted, and all was good. New card works excellent.

Thanks for the great tips here.

Bit scary that there seems to be no "easy" bios recovery if something goes wrong though...

Not so fast...

Posted: Fri Nov 07, 2008 11:16 am
by boredwild
First 2 reboots worked fine. Now it doesn't get past the "power on" light...
Any ideas on a bios recovery?

Posted: Fri Nov 07, 2008 11:23 am
by Xb0xGuru
What notebook do you have?

Have now added that to my original post

Posted: Fri Nov 07, 2008 11:56 am
by boredwild
It's a nc6000.

Posted: Fri Nov 07, 2008 1:43 pm
by semi
hey boredwild,

if you want to reflash your bios without your notebook powerd on,
there are only a few ways.

1. Let HP do the work
2. or Do it by your self!!

look at Services Media Library from HP.
And then look at your model nc6000 -> buttonboard
NC6000 Services Media Library

You can see that your bios chip is on the buttonboard.
So you can disassamble the notebook and desolder the bios
chip from the buttonboard. than clean the pads an solder an plcc32 smd socket on it.

than you can buy a flasher, like Willem EPROM Programmer or something else, and reflash your bios chip with a running flashfile.

if you want, you can send me your buttonboard (to germany) and
i could do this for you. but i think it's cheaper if do it by your self.
or you buying a crashed notebook with a working buttonboard.

Hope this help!?

Cheers Semi

Posted: Fri Nov 07, 2008 6:04 pm
by Xb0xGuru
I did exactly this with my nc6000 and I'm surprised you actually tried it after reading this thread!!

At least now mine's socketed and worst case scenario I can just remove the PLCC32 and reflash.

Does semi's CRC correction work?

Posted: Sun Nov 09, 2008 4:55 am
by boredwild
Hey Xb0x, did you get the nc6000 to accept the bios change long-term using semi's correction? To fix mine , I'll be socketing my bios chip. I have had success programming the 49-series flash by hotswapping into a booted-up desktop motherboard that has a socketed PLCC bios. Let you know how it goes...

Posted: Sun Nov 09, 2008 9:43 am
by Xb0xGuru
To be honest, no!

I'm not stupid by any means and one thing which frustrates me more than anything is not understanding something! I've tried following semi's advice on what bytes to use as the correction area and I'm not getting anywhere with it. If you get it to work, let me know what you did as since you have the same laptop, the data in the BIOS should be at the same addresses.