flat assembler
Message board for the users of flat assembler.

Index > Heap > Physical location of NVRAM on motherboard

Author
Thread Post new topic Reply to topic
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
Anyone here knows where is the NVRAM chip physically located on motherboard? Is it a separate chip, so that NVRAM can be modified with external tools?

Specifically, I am talking about Intel DG33BU board (11MB pic here: http://cache-www.intel.com/cd/00/00/36/20/362044_362044.jpg)
Post 26 Aug 2011, 09:03
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17287
Location: In your JS exploiting you and your system
revolution
Usually the NVRAM chip is near the 32768Hz crystal and the coin cell battery since the RTC is also in the same chip. Follow the connections from the crystal or battery (if you can) to see where it goes.

For your board my guess would be either U9BV or U2LB.
Post 26 Aug 2011, 09:49
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4238
Location: 2018
edfed
search with chip have a SDRAM reference.

U2LB seems to be the bios ROM because it is amovible.

maybe the NVRAM is in the southbridge or in the BIOSROM controler.
because the rom seems to be a serial eeprom, the controler seems to be the square chip up the crystal (the one with the reference impossible to read), like a usb pen use a memory + a little chip to convert to usb.

the NVRAM is probably integrated in some circuit. a BIOS don't need a lot of NVRAM bytes to remember the configuration.
Post 26 Aug 2011, 10:00
View user's profile Send private message Visit poster's website Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
Quote:
search with chip have a SDRAM reference.

I don't understand what you mean.

The thing is, I am trying to understand where the EFI non-volatile variables are located. They are sometimes called "NVRAM variables", but I think they are not located in the usual CMOS memory. Based on EFI code I saw, it seems to me as if they are flashed into BIOS ROM (at least routines for reading them seem to read from ROM image, but I am not 100% sure about that). I might be able to confirm this by creating EFI non-volatile variable and then checking BIOS ROM memory range for its contents, but that might still have many gotchas. I will try this in future. I still would like to be able to externally read/write BIOS ROM externally (and/or NVRAM chip that holds EFI vars), for cases when I render board useless by ROM manipulation.

Some docs:

DG33BU specs: http://downloadmirror.intel.com/15063/eng/DG33BU_TechProdSpec.pdf
I/O controller hub 82801IH (ICH9, southbridge) specs: http://www.intel.com/content/dam/doc/datasheet/io-controller-hub-9-datasheet.pdf

ICH9 family apparently uses "SPI Flash" for BIOS ROM, connected to ICH9/southbridge. Chapter 5.23 in ICH9 specs talks about it.

This document might be also interesting. It appears to discuss migration to SPI Flash from older Firmware Hub (FWH) standard: http://download.intel.com/design/chipsets/datashts/320572.pdf

There appear to be some "SPI Flash programmers" available, but I'll probably have to learn what exact SPI Flash chip I have, and whether it's feasible to access its data externally. Any ideas how to get further in this?
Post 26 Aug 2011, 11:34
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
I noticed that in Intel Q965 Express chipset, the U2LB is indeed the SPI Flash: http://www.intel.com/design/intarch/manuals/315664.pdf. My DG33BU board is G33 Express chipset, not Q965, and it has 1MB instead of 2MB SPI Flash size.
Post 26 Aug 2011, 11:49
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
Madis731



Joined: 25 Sep 2003
Posts: 2141
Location: Estonia
Madis731
...so it must be an 8-legged creature Smile
Post 26 Aug 2011, 13:20
View user's profile Send private message Visit poster's website Yahoo Messenger MSN Messenger Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
I never played with this sort of stuff yet, but Isn't the U2LB pictured on DG33BU (link in 1st post, next to leftmost hole) removable, eg. not soldered on? That should mean I would be able to remove it and stick into into some "programmer" device, right?
Post 26 Aug 2011, 14:25
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
Madis731



Joined: 25 Sep 2003
Posts: 2141
Location: Estonia
Madis731
Your theory has got depth Smile
Post 29 Aug 2011, 07:31
View user's profile Send private message Visit poster's website Yahoo Messenger MSN Messenger Reply with quote
Enko



Joined: 03 Apr 2007
Posts: 678
Location: Mar del Plata
Enko
If its the U2LB for me, in the picture it seems removable.
But, even if you cant remove it, there is always a posibility of attaching some sort of special testpoint cable to program it.
Like soldering some wires.

How do you program it? JTAG? TX/RX with serial interface?
Post 29 Aug 2011, 12:34
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
That's open question too. These guys http://www.dediprog.com/home appear to be making some devices for programming these chips. Something like this: http://www.dediprog.com/SPI-flash-offline-engineering-programmer/SF200

One of "SO8" interfaces it has adapters for seems to be a likely candidate. But I am not sure about it yet.
Post 29 Aug 2011, 13:19
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
HyperVista



Joined: 18 Apr 2005
Posts: 691
Location: Virginia, USA
HyperVista
vid - it's hard to tell from that photo of the MB because Intel erased all the chip markings on it. On your motherboard, check for a chip with one of the following markings:

DS1225
X22C10
X22C12

My bet is on U9BV.
Post 03 Sep 2011, 16:31
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.