rw-r-r- 1 rafael rafael 65K Feb 13 18:39 four rw-r-r- 1 rafael rafael 1.5M Feb 13 18:39 five Which leaves us with this: /tmp/BIOS/Inspiron_3537_A09 $ ls -lh

This allows us to split the executable into sections: /tmp/BIOS/ $. We will use the script from here to extract the different sections. Consider the following section Dell-only.ĭownload the BIOS upgrade of your choice (in this case Inspiron_3537_A09.exe). I have only tried this for my specific BIOS, so the steps for yours might differ. Sadly, this can't be used to generate a full backup ( yet.) but is still nice to have. We can use this to dump pr0 and pr1 which is usually most of the BIOS (without Intel ME). Which allows us to specify the exact region flashrom should operate on: /tmp/BIOS # flashrom -p internal -l rom.layout -image pr0 -r bios.bin

To dump the other regions we could use a ROM layout description file: /tmp/BIOS # cat rom.layout It turns out that 0x00000000-0x00000fff is the Flash Descriptor and 0x00001000-0x003fffff is the Intel ME region, flashrom attemps to dump the whole ROM but due to the locked (read-protected) region of the Intel ME this is not possible. At least some flash regions are read protected. tmp/BIOS # flashrom -p internal -r bios.bin See manpage for more details.įound Winbond flash chip 'W25Q64.V' (8192 kB, SPI) mapped at physical address 0x00000000ff800000.Īs we can see, there is an internal programmer but due to the Intel Management Engine being active, we can't dump the whole ROM. For write operations, you'llĪdditionally need the -noverify-all switch. Layout and include only accessible regions. PR1: Warning: 0x00402000-0x006a1fff is read-only.Īt least some flash regions are read protected. Not all flash regions are freely accessible by flashrom. Warning: Setting Bios Control at 0xdc from 0x22 to 0x01 failed.įREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.įREG2: Management Engine region (0x00001000-0x003fffff) is locked. Warning: BIOS region SMM protection is enabled! On my Dell Inspiron 3537, flashrom detects the following: /tmp/BIOS # flashrom -p internalįound chipset 'Intel Lynx Point LP Premium'. Note: Most of this article assumes the use of Linux Dumping the BIOS ROM The problem with these modded BIOS ROMs is that you have to flash them, oftentimes with an external programmer due to the BIOS image region being locked or the manufacturer updaters having a checksum which doesn't allow flashing custom images. IntroductionĪ quick Google query will return tons of results for modded BIOSes for laptops that unlock additional advanced and dangerous options like 'Advanced' and 'Power' tabs.īut how do they do it - and more importantly - how can we do it ourselves? Ristovski Posts Resources About RSS Inside the InsydeH2O BIOSĭisclaimer: Don't blindly follow this 'guide', bricking your BIOS is easy, recovering it is not.

Insyde flash firmware tool dell