[FreeStyler]

@all
Some here are ahead of you with some stuff, but it looks like they are holding information, think they want to delay the project until Vista Sp1 comes out

found some stuff in the public domain that might shine some light on things, With a little help from babelfish you should find your way
http://www.crfans.co...log59/1961.html
http://blogxp.org/ArticleShow/81255
http://bios.net.cn/Article/wzpd/BIOSJS/bio...0060608978.html

Quote

I like your new app, would it be possible to also do a dump of the address range to possibly give a hint towards the area it’s located. Ie: bios header, DMI, etc. Maybe subtracting 20h from the address. IE: Gateway @ F000:E840 run 'D F000:E820' in debug. It’s not critical.

@xehqter
Thats not really needed, we seem to be able to find the exact range for specific slp locations (check the chinese sites above)

@xehqter
Can you help Siginet to makes his tool pass wintrust as well?

LG added thx, nadav
[fs]

This post has been edited by FreeStyler: 19 September 2006 - 09:42 AM

[vpn-user]

Bezalel, on Sep 18 2006, 09:45 PM, said:

vpn-user, on Sep 18 2006, 05:17 AM, said:

@Bezalel: I am asking about the rapidshare folder because you are also missing some common files. At least "Acer Travelmate" notebooks are sold very well and widely spread but your repository misses the files.

I have all non-obsolete filesets in my RapidShare folder. I will upload obsolete files upon request (if nobody downloads them, RapidShare will drop the files).

Ah that explains it, thank you! And also thank you for re-uploading some files

[Siginet]

FreeStyler, on Sep 19 2006, 03:57 AM, said:

@xehqter
Can you help Siginet to makes his tool pass wintrust as well?

I think it would be a good idea for us to team up and put our ideas together. So the wintrust... this will actually make it so the files are protected by WFP?

@Everyone can someone with the ability to read chinese grab that OEM XP tool and begin recording the areas of the bios that we need for each manufacturer? Then maybe post your findings somewhere to help us out?

BTW Why would someone want to wait for vista before releasing something like this? Were you kidding FreeStyler? Or are you serious? lol. We need a tool like this asap. My job is so much easier now that I don't have to activate over the phone so much.

[xehqter]

@Siginet
As best I can see OEM XP Tool saves an image of the BIOS (0xF0000-0xFFFFF), Display’s your XP CD KEY / Product ID, and gives you a list of known OEMBIOS Address lists. It doesn’t detect the address OEMBIOS uses. Then again I can’t read Chinese. I’ll PM you the list. Is AutoIT capable of making Win32 API Calls?

[FreeStyler]

@xehqter
Use Button #1 [1aAT1/4o+-o] (first button, first tab) and select each one of your OEMBIOS.SI_ or OEMBIOS.SIG files.
For the LG set it returned some chinese characters which after using babelfish read something like:

LG OEM, BIOS E000 - E200 'LG Electronics'

It only seems to recognize oembios sets which it already knows the values for, seems hardcoded

Siginet, on Sep 19 2006, 06:34 PM, said:

So the wintrust... this will actually make it so the files are protected by WFP?

Yes, this wil fix issue with sfc /scannow & wfp, even better....there is no trace in "setuperr.log" after installation, xehqter great job!

This post has been edited by FreeStyler: 19 September 2006 - 03:19 PM

[Siginet]

Yeah that is very cool!

[severach]

>So allot of trail and error to get that range.

You're insane, Goldmember!

What a devilishly clever divide and conquer technique that makes the range clear in a fairly short time.

>So the wintrust... this will actually make it so the files are protected by WFP

These files are all trusted on one system or another so they definitely can be protected by WFP. Somehow you need to twiddle the API to get the new ones trusted before copying them like a service pack or hotfix does. To prevent crashes from damaged media, bad, hacked, or mismatched sets, you could check if the files are trusted before copying.

http://support.micro....com/kb/222193/

This post has been edited by severach: 19 September 2006 - 03:54 PM

[xehqter]

severach, on Sep 19 2006, 04:41 PM, said:

These files are all trusted on one system or another so they definitely can be protected by WFP. Somehow you need to twiddle the API to get the new ones trusted before copying them like a service pack or hotfix does. To prevent crashes from damaged media, bad, hacked, or mismatched sets, you could check if the files are trusted before copying.
http://support.micro....com/kb/222193/

twiddling the API

WinTrust.DLL
CryptCATAdminAcquireContext
CryptCATAdminAddCatalog
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext

Got it from disassembling / on demand debugging signtool.exe

This post has been edited by xehqter: 19 September 2006 - 04:03 PM

[Bezalel]

What methods are you all using to read from the BIOS. I'm keep getting an Access Voilation error with the following code.

int CmpStrToMem(char* Str,char* Mem)
{
	int i;
	if(!*Str) return 0;
	if(!isprint(*Mem)) return 2;		 /* This line is causing the Access Violation */
	if(tolower(*Str)-tolower(*Mem)) return 1;
	i=CmpStrToMem(Str++,Mem++);
	if(i>1) i++;
	return i;
}

[MGadAllah]

very smart indeed

[xehqter]

OEMScan v1.21
http://www.msfn.org/...showtopic=82638

Validates the OEMBIOS.BIN/SIG/DAT files against the .CAT file before copying. If they're mismatched it won't copy them over.
Copies OEMBIOS.BIN/DAT/SIG to DllCache

Many thanks to severach for the help.

This post has been edited by xehqter: 19 September 2006 - 09:21 PM

[severach]

Good. Maybe we can run KeyUpdateTool out of town. It seems to be only good for 3 things: checking WinTrust, telling you can't make a change that should be legal, and making your computer never boot again.

http://www.neowin.net/forum/lofiversion/in...hp/t496774.html

[FreeStyler]

xehqter, on Sep 20 2006, 04:07 AM, said:

Validates the OEMBIOS.BIN/SIG/DAT files against the .CAT file before copying. If they're mismatched it won't copy them over.

Can we run this from commandline to test files "off disc" ?

[Randy Rhoads]

Nice tool.

This post has been edited by Randy Rhoads: 20 September 2006 - 10:48 AM

[xehqter]

@FreeStyler
I knew someone would ask that.. Give me a week, I’m working on a new project OEMBIOS project, if it doesn’t work out I’ll add a command line argument that will do a dry-run without copying the files.

[FreeStyler]

I am pretty sure my current files are ok, but you never know...in the future

[llm]

@Bezalel

Hello,I am zl's friend.

Thanks to severach...

This post has been edited by llm: 20 September 2006 - 11:15 PM

[FreeStyler]

llm, is your OEMBIOS.CAT CRC "89799F58" ?

[severach]

Bezalel, please upload to Rapishare these obsolete files.

eMachines 1B7F1F55
Equus_Computer_Systems 397A095A
NEC_&_Packard Bell 82D4D6A4

>Have you got panasonic's OEMBIOS.

Bezalel doesn't update Rapidshare right away. Panasonic will be there soon.

This post has been edited by severach: 20 September 2006 - 08:21 PM

[llm]

@FreeStyler
oembios.bin de14112c
oembios.cat 89799f58
oembios.dat 002d6594
oembios.sig 9f10320f
We got the same files.

@severach
eMachines 1B7F1F55 is already in Rapidshare
i need
Equus_Computer_Systems 397A095A
NEC_&_Packard Bell 82D4D6A4

OEMBIOS for 2k3
c20d8ff5 dell
cc6cb12c hp
is there any other version?

This post has been edited by llm: 21 September 2006 - 12:26 AM