[xehqter]

OEMScan v1.21
http://www.msfn.org/...showtopic=82638

Validates the OEMBIOS.BIN/SIG/DAT files against the .CAT file before copying. If they're mismatched it won't copy them over.
Copies OEMBIOS.BIN/DAT/SIG to DllCache

Many thanks to severach for the help.

This post has been edited by xehqter: 19 September 2006 - 09:21 PM

[severach]

Good. Maybe we can run KeyUpdateTool out of town. It seems to be only good for 3 things: checking WinTrust, telling you can't make a change that should be legal, and making your computer never boot again.

http://www.neowin.net/forum/lofiversion/in...hp/t496774.html

[FreeStyler]

xehqter, on Sep 20 2006, 04:07 AM, said:

Validates the OEMBIOS.BIN/SIG/DAT files against the .CAT file before copying. If they're mismatched it won't copy them over.

Can we run this from commandline to test files "off disc" ?

[Randy Rhoads]

Nice tool.

This post has been edited by Randy Rhoads: 20 September 2006 - 10:48 AM

[xehqter]

@FreeStyler
I knew someone would ask that.. Give me a week, I’m working on a new project OEMBIOS project, if it doesn’t work out I’ll add a command line argument that will do a dry-run without copying the files.

[FreeStyler]

I am pretty sure my current files are ok, but you never know...in the future

[llm]

@Bezalel

Hello,I am zl's friend.

Thanks to severach...

This post has been edited by llm: 20 September 2006 - 11:15 PM

[FreeStyler]

llm, is your OEMBIOS.CAT CRC "89799F58" ?

[severach]

Bezalel, please upload to Rapishare these obsolete files.

eMachines 1B7F1F55
Equus_Computer_Systems 397A095A
NEC_&_Packard Bell 82D4D6A4

>Have you got panasonic's OEMBIOS.

Bezalel doesn't update Rapidshare right away. Panasonic will be there soon.

This post has been edited by severach: 20 September 2006 - 08:21 PM

[llm]

@FreeStyler
oembios.bin de14112c
oembios.cat 89799f58
oembios.dat 002d6594
oembios.sig 9f10320f
We got the same files.

@severach
eMachines 1B7F1F55 is already in Rapidshare
i need
Equus_Computer_Systems 397A095A
NEC_&_Packard Bell 82D4D6A4

OEMBIOS for 2k3
c20d8ff5 dell
cc6cb12c hp
is there any other version?

This post has been edited by llm: 21 September 2006 - 12:26 AM

[llm]

bacb9a77 fujitsu 2002.8.27
it seems not in our list

[severach]

If you see a CRC you don't have just download it and see what it is.

Did anyone notice that you can no longer disable the download of KB905474?

[edit] False alarm. The checkbox is still available for Custom install.

This post has been edited by severach: 21 September 2006 - 05:41 PM

[Bezalel]

severach, on Sep 20 2006, 02:05 PM, said:

Bezalel, please upload to Rapishare these obsolete files.

eMachines 1B7F1F55
Equus_Computer_Systems 397A095A
NEC_&_Packard Bell 82D4D6A4

>Have you got panasonic's OEMBIOS.

Bezalel doesn't update Rapidshare right away. Panasonic will be there soon.

I've uploaded the Matsus***a set as well as the NEC and Equus sets. The eMachines set was already in RapidShare. (I'm using the names Matsus***a and NEC because these names are a closer match to the SLP Strings)

[llm]

I saw your OEMBI0S.DATs
zl didn't tell me it's provided by Bezalel or severach.
I guess Bezalel did.
It's lack of amoi,fujitsu1,fujitsu siemens1,greatwall,lg,panasonic
6 at all.

[RogueSpear]

severach, on Sep 20 2006, 11:34 PM, said:

Did anyone notice that you can no longer disable the download of KB905474?

I just disabled it from downloading today.

[FreeStyler]

llm, on Sep 21 2006, 03:52 AM, said:

OEMBIOS for 2k3
c20d8ff5 dell
cc6cb12c hp
is there any other version?

Got a additional set from NEC here, carying CRC:5B988ABF

[fs]

[xehqter]

The SLP Strings for Gateway CRC set A04597C6 are ‘Gateway’ and ‘Gateway, Inc’

I think multiple SLP entries refer to the number of different locations the string could be located. Here’s a partial list for gateway (CSI is on), I tested a few of them and they worked. Ohh and the region scanned is E000:0000 - F000:FFFF not F000:0000 - F000:FFFF

These are the 32Bit addresses.
000fe840 = F000:E840 (16bit address)


... Censured myself never know how that data could be used.

This post has been edited by xehqter: 21 September 2006 - 11:34 PM

[Bezalel]

xehqter, on Sep 21 2006, 08:36 PM, said:

The SLP Strings for Gateway CRC set A04597C6 are ‘Gateway’ and ‘Gateway, Inc’

I think multiple SLP entries refer to the number of different locations the string could be located. Here’s a partial list for gateway (CSI is on), I tested a few of them and they worked. Ohh and the region scanned is E000:0000 - F000:FFFF not F000:0000 - F000:FFFF

These are the 32Bit addresses.
000e46c0 = E000:46C0 (16bit address)
000fe840 = F000:E840


List of addresses removed

The 23 SLP strings in the A04597C6 set are all "Gateway", "Gateway,Inc" does not appear in the set. Some of the addresses you listed are valid and some are not.

The actual region scanned is whatever the set specifies. The A04597C6 set searches through 2 256B regions and 21 32B regions. Since the regions are specified as 16 bit addresses any set that searches both the E000 and F000 offsets will have the same string listed twice (000EFFFF+1=000F0000 but E000:FFFF+1=E000:0000).

This post has been edited by Bezalel: 22 September 2006 - 12:00 AM

[xehqter]

@Bezalel
Guess I’ll dig deeper into MGADiag’s code because the results you’re describing are different then mine. Sounds like you’ve been down this road before, any hint’s you’d like to throw?

[Bezalel]

xehqter, on Sep 21 2006, 10:45 PM, said:

@Bezalel
Guess I’ll dig deeper into MGADiag’s code because the results you’re describing are different then mine. Sounds like you’ve been down this road before, any hint’s you’d like to throw?

The OEMBIOS sets contain records protected by multiple methods of encryption and validated with mutiple signatures. I'm not going to explain how it is encrypted or post the unencrypted records. Instead I will post the records from one of the sets with the SLP string masked.

fe00,0010,7,XXXXX
f000,ff00,0100,XXXXX
f000,8000,6000,XXXXX
f000,0000,FFFF,XXXXX

Each entry represents a range to search in and a string to search for (in this case all the strings are the same). There exist versions of this set with only the first 2 and 3 entries. I beleive that the first entry contains an entry error (Offset FE00) and no systems were produced with just the first entry. You can see from this example that manufacturers just append information to existing sets so their newer sets would still work on older systems.

This post has been edited by Bezalel: 22 September 2006 - 12:51 AM