;---------------------------------------------------------------------------------
;---------------------------PCI ROM Header----------------------------------------
;---------------------------------------------------------------------------------

        VENDOR_ID       equ 10ECh       ; PCI Vendor ID (must match your ethernet vendor id)
                                        ; exp: 10DE = nVidia
        DEVICE_ID       equ 8168h       ; PCI Device ID (must match your ethernet devicie id)
                                        ; exp: 0057h = nforce4 CK804 NIC
ROMStart:
        db 0x055, 0x0AA                 ; ROM Header 55,AA -> Bootable rom
        db (ROMEnd - ROMStart)/512      ; ROM Size in 512byte
        jmp MAIN

        db      0                       ; checksum, to be filled in later
        TIMES   18h-($-$$) DB 0         ; padding zeros to offset 18h
        DW      PCIHDR                  ; pointer to PCI Header
        DW      PNPHDR                  ; pointer to PnP Expansion Header

PCIHDR: DB      'PCIR'                  ; PCI data structure signature
        DW      VENDOR_ID               ; vendor ID                     (must match real PCI device)
        DW      DEVICE_ID               ; device ID                     (must match real PCI device)
        DW      0                       ; pointer to vital product data (0=none)
        DW      18                      ; PCI data structure length     [B]
        DB      0                       ; PCI data structure revision   (0=PCI 2.1)
        DB      2,0,0                   ; PCI device class code         (2=network ctrlr,0=eth.)
        DW      (ROMEnd - ROMStart)/512       ; ROM size in 512B blocks
        DW      0                       ; revision level of code
        DB      0                       ; code type                     (0=x86 compitable)
        DB      80h                     ; last image indicator
        DW      0                       ; reserved

PNPHDR: DB      '$PnP'                  ; PnP data structure signature
        DB      1                       ; PnP structure revision
        DB      2                       ; PnP structure length          (in 16B blocks)
        DW      0                       ; offset to next header         (0-none)
        DB      0                       ; reserved
        DB      0x4b                     ; PnP structure checksum
        DD      0                       ; device identifier
        DW      0                       ; pointer to manufacturer string
        DW      0                       ; pointer to productname string
        DB      2,0,0                   ; device class code    (2=network ctrlr,0=eth.)
        DB      0xe4                     ; device indicators (64h - shadowable,cacheable,not
                                        ; only for boot,IPL device)
        DW      0                       ; boot connection vector        (0-none)
        DW      0                       ; disconnect vector             (0-none)
        DW      0                       ; bootstrap entry vector        (0-none)
        DW      0                       ; reserved
        DW      0                       ; static resource info vector   (0-none)

MAIN:
        pushfd
        pushad 
        push ds 

debug_step1:                            ;print int13 vector 
        mov ebx,00000000h 
        mov eax, [fs:ebx+4ch] 
        mov ecx, eax 
        mov dx, 25/2 
        mov ax, 80/2 - 8/2 
        call print_hex

        mov ah, 00h                      
        int 16h                         ; key press wait
        cmp al, 0dh                     ; Enter key 
        je debug_step2                  ; Handle  
        jne debug_step1 

debug_step2:                            ;print disk number BDA 
        mov ebx,00000000h 
        mov eax, [fs:ebx+474h] 
        mov ecx, eax 
        mov dx, 25/2 
        mov ax, 80/2 - 8/2 
        call print_hex 

        mov ah, 00h
        int 16h                         ; key press wait
        cmp al, 0dh                     ; Enter key 
        je ccc                          ; Handle  
        jne debug_step2 

ccc:                                    ;set ES:DI to PnP install check 
        mov ax,0f000h
        mov es,ax
        mov di,0e2d0h
        mov bx,-1
        mov dx,-1
        mov ax,4
        ; call far 0D000h:1391h
        call far 0cf00h:02d1h

debug_step3:                            ;print int13 vector 
        mov ebx,00000000h 
        mov eax, [fs:ebx+4ch] 
        mov ecx, eax 
        mov dx, 25/2 
        mov ax, 80/2 - 8/2 
        call print_hex

        mov ah, 00h                      
        int 16h                         ; key press wait
        cmp al, 0dh                     ; Enter key 
        je debug_step4                  ; Handle  
        jne debug_step3 

debug_step4:                            ;print disk number BDA 
        mov ebx,00000000h 
        mov eax, [fs:ebx+474h] 
        mov ecx, eax 
        mov dx, 25/2 
        mov ax, 80/2 - 8/2 
        call print_hex

        mov ah, 00h                      
        int 16h                         ; key press wait
        cmp al, 0dh                     ; Enter key 
        je zzz                          ; Handle  
        jne debug_step4 

zzz:                                    ;choose exit type retf or int18 
        mov ah, 00h 
        int 16h                         ; key press wait
        cmp al, 0dh                     ; Enter key 
        je ggg                          ; Handle 
        jne ddd 
ggg: 
        pop ds 
        popad 
        popfd
        ret 

ddd: 
        pop ds 
        popad 
        popfd 

        int 0x18 

print_hex: ; DX = Row ; AX = Col ; ECX = NUMBER (Assuming 80x25 mode) 
        pushad 
        push    es 

        push    $B800 
        pop     es 

        imul    di, dx, 80 
        add     di, ax 
        shl     di, 1 

        mov     edx, ecx 
        mov     ecx, 8 
        mov     ah, 7 ; GRAY FONT; BLACK BACKGROUND 

.writeNibble: 
        rol     edx, 4 
        mov     si, dx 
        and     si, $F 
        mov     al, [cs:.lut+si] 
        stosw 
        loop    .writeNibble 

        pop     es 
        popad 
        ret 
.lut db '0123456789ABCDEF' 
      TIMES   100 DB 0         ; padding zeros to offset 18h
;__________________________________________________________________________________________________________________

;raidrom:      file "raid700.rom"



        times ((ROMEnd - ROMStart)-$) db 0 ; use 00h as the padding bytes until we
                                        ;reach the ROM size 

        ; The last byte (512th) will be the patch_byte for the checksum 
        ; patch_byte is calculated and automagically inserted below 
        PREV_CHKSUM = 0 
        repeat $ 
        load CHKSUM byte from %-1 
        CHKSUM = (PREV_CHKSUM + CHKSUM) mod 0x100 
        PREV_CHKSUM = CHKSUM 
        end repeat 
        store byte (0x100 - CHKSUM) at ($-1)  ; store the patch_byte 
ROMEnd:
    

Sorry if you said this already but couldn't find it in your other posts: Where are you placing this binary so the BIOS can find it?

I think you mentioned this is a laptop, so I'm wondering where is this laptop letting you inject a ROM.

@acp: Thank you but I didn't understand. However I had an idea and it's almost working. I have disassambled the misc.bin and permanently activated the esc-key sequence. This seems to work and bios boot and it's shows the splash and then the post screen. Now I want to try to activate the ctrl-f key to open the raid menu because my patch seems to delete the raid menu, too!? Maybe you can help? http://ebook.pldworld.com/_eBook/dosref33/

Since you are using IDA you might find this tutorial useful: https://www.hex-rays.com/products/ida/support/tutorials/debugging_gdb_qemu.pdf

It may help you debug why your bios hangs and track down what wrong you are doing.

Do you know how I can debug my bios with qemu? I have read the pdf but it doesn't show how to debug a bios?

phpdevpad wrote:

Do you know how I can debug my bios with qemu? I have read the pdf but it doesn't show how to debug a bios?

It is quite simple assuming you had installed qemu and IDA connected to it successfully. You have to edit segments in IDA just as it is described in mentioned document. Then you can covert data to code using "C" key and single step though BIOS code using all debugger features like Step Into (F7) or Step Over commands and setup breakpoints. For example you can setup a breakpoints in your code or in code which should be calling your code etc. You can also enable "Instruction tracing" (assuming you have IDA 6.x version) and run the BIOS code (just ensure your tracing buffer is big enough) and wait till it crash or returns error so you can trace back the execution flow.

I didn't read about how to debug my updated bios? I want to use qemu with my bios image. Is this explained somewhere? Thank you!

Update: I have installed qemu but I'm a bit lost. Where can I put my option rom?

phpdevpad wrote:

I didn't read about how to debug my updated bios? I want to use qemu with my bios image. Is this explained somewhere? Thank you!

Update: I have installed qemu but I'm a bit lost. Where can I put my option rom?

You just pass it as parameter to qemu. Here is another tutorial link with all the details - please note that it is based on coreboot but just use your bios images instead: http://bioshacking.blogspot.com/2011_10_01_archive.html You can skip coreboot compiling part unless you want to test your option rom using it.

Yes, thank you for your help. I got my option rom working. Last time when I checked ida and qemu debugging didn't work. I have downloaded the binary from your link and followed the instructions but I use Windows 8 64-bit? Can this be a problem?

Okay, thank you. I'm not so fast and still learning. Why do I need to map the memory anyway? Is this because of this Extended Memory and A20 Gate thing? I have read about it here http://ebook.pldworld.com/_eBook/dosref33/. Looks totally fishy to me.

phpdevpad wrote:

Okay, thank you. I'm not so fast and still learning. Why do I need to map the memory anyway? Is this because of this Extended Memory and A20 Gate thing? I have read about it here http://ebook.pldworld.com/_eBook/dosref33/. Looks totally fishy to me.

You're welcome

No, the memory map option in IDA is not in any way related to how A20 gate or Extended Memory works. The only relations is memory segmentation in real mode and its memory addressing limits from 8086 times (which in turn was a reason for providing A20 gate - BTW how many other systems used keyboard controller line to enable memory access?). Anyway back to the topic: you need to define segments (in IDA terms) in memory for IDA, so the disassembler and debugger provides you with correct information. One aspect of segments definition in IDA is bitness of the segment (16/32) which is crucial for proper disassembly and automatic code analysis. Secondly you will not be able to follow JuMPs larger than short (+/-128 bytes) and usually BIOS entry point at FFFF:FFF0 starts with JMP FAR. Secondly segments allows you to define which memory areas should be injected back to disassembler and saved as part of your IDA database. You obviously don't want 4gb address space dump

To recap: do not mix up IDA segments with real/unreal/protected mode segments of x86. While those can be connected they are completely different entities.

Make sure your qemu is the same bitness as IDA. Weird things can happen when you try 32bit apps with 64bit apps in this settings. I would assume your qemu is compiled as 32bit app.

REM Start qemu on windows.
@ECHO OFF

REM SDL_VIDEODRIVER=directx is faster than windib. But keyboard cannot work well.
SET SDL_VIDEODRIVER=windib

REM SDL_AUDIODRIVER=waveout or dsound can be used. Only if QEMU_AUDIO_DRV=sdl.
SET SDL_AUDIODRIVER=dsound

REM QEMU_AUDIO_DRV=dsound or fmod or sdl or none can be used. See qemu -audio-help.
SET QEMU_AUDIO_DRV=dsound

REM QEMU_AUDIO_LOG_TO_MONITOR=1 displays log messages in QEMU monitor.
SET QEMU_AUDIO_LOG_TO_MONITOR=0

REM PCI-based PC(default): -M pc 
REM ISA-based PC         : -M isapc
REM -M isapc is added for NE2000 ISA card.

qemu-system-x86_64.exe -L . -m 128 -hda linux.img -soundhw sb16,es1370 -localtime -M pc -s -S
    

  bytes   pages size description
--------- ----- ---- --------------------------------------------
   262144    32 8192 allocating memory for b-tree...
    65536     8 8192 allocating memory for virtual array...
   262144    32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
   589824            total memory allocated

Loading processor module C:\Program Files (x86)\IDA Pro Advanced Edition v6.1\procs\pc.w32 for metapc...OK
Autoanalysis subsystem has been initialized.
Can not set debug privilege: Dem Aufrufer wurden nicht alle angegebenen Berechtigungen und Gruppen zugewiesen.
Flushing buffers, please wait...ok
Unloading IDP module C:\Program Files (x86)\IDA Pro Advanced Edition v6.1\procs\pc.w32...
Can not reset debug privilege: Dem Aufrufer wurden nicht alle angegebenen Berechtigungen und Gruppen zugewiesen.
Can not set debug privilege: Dem Aufrufer wurden nicht alle angegebenen Berechtigungen und Gruppen zugewiesen.
    

Since I don't have any machine with Windows 8 installed I can't replicate your problem. Assuming you are using administrative privileges and looking into error messages I would guess there is a problem with Windows Debug Privileges so my suggestion is to contact HexRays and let them know about the problem. They reply pretty quickly.

hi, thank you for the fast response, of course I have asked them before I post here, they told me to reinstall ida and windows and also to format sector 0 and also hidden system partition with dd. Isn't there another way how can I solve my problem?