NVRAM Phoenix plus Setup help

[Molony]

I am decoding the NVRAM commencing from the Phoenix BIOS ROM image / Mod your Phoenix Setup menu. Initially this is just presently a long make a note on where the positions are and a number of decoding for learning regarding the phoenix bios. This information in sequence determine to position you in the right way additional than bottom line messing commencing from side to side the bios be able to brick your apparatus. Do not go messing if you have encompassed no idea what building or modding is. Need some help on NVRAM Phoenix plus Setup help.

[Miguel Reyes]

The NVRAM be able to be decoded by two methods. One is directly commencing from the stored memory position of the system you are working on. The additional than is by locating the token table commenicng from the BIOS image. In memory the token table is originated in the F000:0000 range of memory. You be able to utilize a tool similar to symcmos or code something yourself to search and dump the tables.

[Himalayan]

The DOS debug determine to work extremely well. Inspection for the string BCPNV for the memory positions. This is the location the phoenix dispatch messenger determine to make sure for. The symcmos investigates for the the $PDM in memory. Decomp your BIOS image and search for $PDM, romexec0.

[Battista]

The OEM vendor has chosen to put out of action this. If you debug your BIOS you determine to locate the MSR call to verify if this bit is facilitated or put out of action. The PDM locations determine to be called. Here is what my PDM table give impression for similar to in IDA.

[Ramona19]

It determine to be possible to facilitate and put out of action a number of options in your BIOS directly commencing from the OS utilizing the calls in the BIOS. The symcmos be able to import a number of NVRAM settings, often cleared on power cycle even though. This is where hacking the NVRAM table in your BIOS ROM determine to come in handy as a number of bytes are locked commencing from writing by MSR.

[Munishi3]

In the few roms I have encompassed and given impression for at the $PDM has been originated in the ROMEXEC0.ROM file. The complete BCP table structure be able to be originated below the $PDM entry. The PDM call positions for me is in the BIOSCOD02.ROM file. I loaded up my ROM in IDA and accommodated it to acquire the correct offsets. To acquire your actual offsets determine to require forcing the memory positions when loading in IDA.

[GadhadharY]

You be able to in addition utilize a NDISASM to decompile your rom images additional than this is not always accurate for the reason that you do not be familiar with what the start location of the CODE segment is. The rom has no structure similar to an exe does. You necessitate to load up in 16 bit mode. The illustration of utilizing NDISASM. NVRAM: NVRAM holds the complete token table assigned by Standard Defaulting Table and Manufacture Defaults Table.

[Cain]

This is similar pattern commencing from side to side numerous of the table structures. You have ot observe below romexec and memory. The 1F is the length commenicng from BCPNV to end. The bytes with the intention of follow are the positions stored in endian format. 32,66 is memory location F000:6632. If you utilize dos debug. cmd prompt. type in DEBUG. screen be supposed to have encompassed the blinking cursor. d F000:6632 < - utilize your memory location not mine.

[Quasim]

The media table characterize the max amount bits be able to be stored in to facilitate table. Media 0 starts 00. Media 1 starts at 400h so 3FFh is the most recent bit of media 0. Converting the complete range into binary might result in 3FF entries of 1's 0's. So most of them have encompassed two sets of bits 3FFh wide.

[Geniee]

The table necessitate to broken down into what holds what media position in bytes. The 400h bits be able to be represented by our bytes table by disjunctive it into 8 bits. The 400h / 8h = 80h Media 1 starts at 80h. So 0 - 7F is Media 0, 80h - FFh is Media 1. 100h starts Media 2 additional than is 15 bytes len for the reason that Media 3 starts 08A8.

[jamiejohn]

With the intention of is break down of the token table. At present to locate out what token represents what value. IE originated out what token 0C, at start position 334, in media 1, is represented at location E6 through the value of 39. The easiest method is to utilize SYMCMOS tool commencing from Phoenix.

[Petula]

Here in this you have to take this tool and your strings.rom and template.rom and you have encompassed the entire map of your system. This in addition permits you to map out your BIOS Setup to facilitate alternatives in your BIOS. It is not the merely method, you be able to do it manually or parse the file through your own code to dump it.