Hi,
I had to use flashrom and my raspi to reflash my bios chip after it got
corrupted. Now I compare the original Firmware (XH170V00.200) I flashed
into the Chip with the file I read (flash.bin).
I found the MAC Address in the File read (at 0x1000), so of course, the
flash.bin is different from the original.
The descriptors look somewhat different from the information found in
the log- here it is not overlapping
--- Details ---
Region 0 (Descr.) 0x00000000 - 0x00000fff
Region 1 (BIOS ) 0x00200000 - 0x007fffff
Region 2 (ME ) 0x00003000 - 0x001fffff
Region 3 (GbE ) 0x00001000 - 0x00002fff
Region 4 (Platf.) is unused.
Should I upload you flash.bin somewhere?
Regards,
Michael!
On 3/23/2017 10:36 PM, Nico Huber wrote:
On 23.03.2017 20:26, Michael Fuckner wrote:
Hi,
I got a file, 8MB in size and it contains data. md5sum is not identical
to original file and binwalk looks different on the beginning.
Not sure, what an "original" file would be. The flash contains data that
is specific to your device like serial numbers, the MAC address etc.
Also, at least two of the firmwares in your flash are self-modifying
(ME, UEFI).
The original file starts with 0x258988, so this
is the area for ME and
Ethernet Config?
What is 0x258988 supposed to mean? an offset? I doubt that binwalk can
give any thorough report of the flash image though.
Let's have a look at your log:
=== Region Section ===
FLREG0 0x00000000
FLREG1 0x07ff0200
FLREG2 0x005a0000
FLREG3 0x5a000000
FLREG4 0x00000000
--- Details ---
Region 0 (Descr.) 0x00000000 - 0x00000fff
Region 1 (BIOS ) 0x00200000 - 0x007fffff
Region 2 (ME ) 0x00000000 - 0x0005afff
Region 3 (GbE ) 0x00000000 - 0x01a00fff
Region 4 (Platf.) 0x00000000 - 0x00000fff
This is part of the Firmware Descriptor, the first part of any modern
Intel flash image. Beside many other things it contains this partition
table. It looks very odd, with overlapping regions. I haven't looked
into changes in the descriptor for Skylake yet, maybe it's not decoded
correctly.
However if you want to verify your image you can try to decode the read
descriptor:
$ make -Cutil/ich_descriptors_tool/
$ util/ich_descriptors_tool/ich_descriptors_tool -f flash.bin
It should give you the same output that you can find in your log.
Thanks again for testing and your log, it's nice to see things working!
;)
Nico