I'm going to summarize my experiences with ADDCC (v3) since I found it hard to figure out what to do and how to do it! (No disrespect to Semi, who has done a great job, but I think there may be a communications barrier -- and I'm not talking about English/German, but "Wise about BIOS" / "Not so much"!).
So, what I was trying to do (and succeeded in doing) was install an Intel 5300 (with an HP 'spare part' number, so probably an HP OEM, and thus fully compatible with HP's "Wireless Enable" switch!) in an HP 8510W. The HP 8510W had an Intel 4965AGN card installed.
The old BIOS string (4965AGN) is
PCI\VEN_8086&DEV_4229&SUBSYS_11008086
but as it turns out you don't need to know that. The new one is
PCI\VEN_8086&DEV_4236&SUBSYS_10118086
(86 80 36 42 86 80 11 10)
So, here's what I did:
Step 1: Download the HP BIOS (F.15) to be used with a Floppy disk drive (and a USB stick, come to that). Create a USB bootable floppy and check that it is bootable, and the BIOS file can be read (I, separately, booted but did not flash the BIOS, and then booted normally and copied everything on the floppy to the hard disk, proving that the system could read the disk).
Step 2: I tested the "emergency recovery" procedure, since I didn't want to be trying to work out how to recover a bricked laptop if it all went wrong! The key for the 8510w is to be pushing the "Windows" + "B" keys before pushing the power button, after which the "Caps Lock" light flashes and it writes the BIOS.
Step 3: Fire up ADDCC, and start the main work. First off, we need to find the white list in the BIOS file, which is called 68MVD.BIN for the 8510w. What we really want to find is the first entry in the table, because the whole thing is compressed so that entry #3 depends on entry #2 which depends on entry #1.
Now, what took me a while to understand was that ADDCC’s “Decompress” feature is a “read only” thing, ideal for finding things, but there’s no corresponding “Compress” feature, so don’t get carried away. Eventually, though, I found that by using the “Decompressed Whitelist” check box and the “Search in” function, I could reliably find the _end_ of the whitelist. It’s at 0x2586, but that’s not what we really want: we want the _start_ of it. BUT… once you know where it ends, you can work backwards looking at the table of (8 byte long) PCI IDs, until you reach something which isn’t one (or isn’t a probable one, such as that of a sound card!).
To help in this, I used the table of PCI IDs from
http://pciids.sourceforge.net/. Turns out that in the HP 8510w, it’s all either Intel or Broadcom cards, and the first card in the list is at (uncompressed) offset 0x24ED and has the hex string
86 80 22 42 3C 10 5B 13
Or PCI\VEN_8086&DEV_4222&SUBSYS_135B103C
… which is the ID of an Intel 3945ABG for a Compaq 6710b or nx9520.
Step 4: Now we have to find that entry in the _Compressed_ file. So I copied the string into the “BIOS Notation” box, selected the “Compressed Whitelist” check box, and clicked “Search In”.
This found something with “50% probability”, namely the 12 byte sequence:
C1 00 86 80 22 42 AF 3C 10 5B 13 83
Looking closely, we can see that all the ID bytes are there, and in the right order! It’s at offset 0x113e8 in the compressed BIOS file, and if we look ahead, to offset 0x11418 we can see a 12 byte sequence:
02 34 10 E4 14 BF 12 43 3C 10 70 13
… which looks like it contains the ID of a Broadcom (“VEN_14E4”) BCM4312 (“&DEV_4312”) card.
So we now know where the table starts!
Step 5: Change the ID. I chose to use the Intel 3945ABG’s entry to replace. The trick here is to take the 12 bytes found (beginning “C1 00 86 80”) and only replace the bytes that correspond to those of the ID, so we get as a replacement string:
C1 00 86 80 36 42 AF 86 80 11 10 83
And now we can successfully click the “Change in File” Button.
Step 6: Now we have to fix the checksum. This is harder than it might appear, because checksums are designed to be good at detecting changes in the same area, and there just aren’t that many bits available to play with, once the compression control words are left out. So the trick here is to find a string that doesn’t get compressed. And that’s where the whole thing gets a bit murky: I don’t know why it worked, but I found a string that didn’t seem terribly important (to me), namely the “F12=Network Boot”, and searched for that in the _compressed_ file, where I found it at offset 0x11e09. Looking ahead in the file, at offset 0x11e10, the “twork” part of “Network” is represented as:
74 77 6F 72 6B F2 A0 25
Checking the boxes under the first five bytes gave me a red, three greens and a red, which means nothing to me, but it gave me a corrected checksum of
2E C1 72 28 2D F2 A0 25
Or, in other words, by mucking around with the “twork” and making it something like “F12=Ne.?H(- Boot”, the checksum of the file remains unchanged.
Selecting the “Correct” button updates the file, and all looks good.
Step 7: Now I exited ADDCC entirely, copied the “patched-68MVD.BIN” file to a new directory, where I renamed it “68MVD.BIN”, and restarted ADDCC. Now when I looked at the first entry in the white list table, it was
86 80 36 42 86 80 11 10
Or PCI\VEN_8086&DEV_4236&SUBSYS_10118086
Which is what was wanted.
Because of the compression approach, the second and subsequent entries have been modified, so instead of being variations of the 3945ABG card, they look like (non-existent) variations of the 5300. But who cares? The first is what I need.
I spent a lot of time worrying about trying to keep as much of the old white list, so that if I wanted to put another card (an old one) in, it would work… but then I realized that was stupid: if I need to change cards, I’d simply flash the stock BIOS and all would be well…
Hope this helps someone!