Hello,
I've recently got a new laptop from Acer (Predator Helios 300) and I tried to dump its BIOS from a separate PC running Kali linux with flashrom v1.1. I used a BusPirate SPI programmer and a SOIC-8 clip on the BIOS chip after carefully removing (clipping) it from the mobo.
Unfortunately the chip was not recognized, and the process failed to read anything. I tested the connections by placing a spare Winbond chip into the clip, and it read perfectly fine.
The laptop BIOS chip was labeled "XMC QH128AHIG" I did some googling for this name and apparently there are some new SPI NOR Flash chips on the market by a chinese company called XMC. My specific chip was actually called "XM25QH128A", but there are whole series available.
Datasheet for my chip: http://www.xmcwh.com/cn/Uploads/2019-08-26/5d63754eed501.pdf
Product pages: http://www.xmcwh.com/index.php?s=/cms/list/61.html http://www.xmcwh.com/index.php?s=/cms/list/62.html http://www.xmcwh.com/index.php?s=/cms/list/63.html
Flashrom bus pirate log: https://pastebin.com/c2c2tmj0
Regards, D
Hello again,
I mapped the various device identifiers for current XMC chips according to the datasheets. The Manufacturer ID for XMC (XMC_ID) appears to be the same as ST25P (ST_ID). First byte of device ID is memory type, second byte of device ID is memory size.
#define XMC_ID 0x20 /* same as ST_ID */ #define XMC_XM25QH256B 0x6019 #define XMC_XM25QH128A 0x1708 #define XMC_XM25QH128B 0x6018 #define XMC_XM25QH64A 0x7017 #define XMC_XM25QH64B 0x6017 #define XMC_XM25QH32B 0x4016 /* 0x6016 for QPI mode */ #define XMC_XM25QH16B 0x4015 #define XMC_XM25QH80B 0x4014 #define XMC_XM25QH40B 0x4013 #define XMC_XM25QU256B 0x7019 #define XMC_XM25QU128B 0x5018 #define XMC_XM25QU64A 0x3817 #define XMC_XM25QU64B 0x5017 #define XMC_XM25QU40B 0x5013 #define XMC_XM25QU20B 0x5012
Here's the entry flashchips.c for XM25QH128A https://pastebin.com/XWJbFsJA
I don't want to mess with my only BIOS chip at the moment so I ordered some spare XM25QH128A chips from Aliexpress. Once they arrive, I'm going to try to test them with various functions (PREW) and report back.
Cheers!
Hello,
I've recently got a new laptop from Acer (Predator Helios 300) and I tried to dump its BIOS from a separate PC running Kali linux with flashrom v1.1. I used a BusPirate SPI programmer and a SOIC-8 clip on the BIOS chip after carefully removing (clipping) it from the mobo.
Unfortunately the chip was not recognized, and the process failed to read anything. I tested the connections by placing a spare Winbond chip into the clip, and it read perfectly fine.
The laptop BIOS chip was labeled "XMC QH128AHIG" I did some googling for this name and apparently there are some new SPI NOR Flash chips on the market by a chinese company called XMC. My specific chip was actually called "XM25QH128A", but there are whole series available.
Datasheet for my chip: http://www.xmcwh.com/cn/Uploads/2019-08-26/5d63754eed501.pdf
Product pages: http://www.xmcwh.com/index.php?s=/cms/list/61.html http://www.xmcwh.com/index.php?s=/cms/list/62.html http://www.xmcwh.com/index.php?s=/cms/list/63.html
Flashrom bus pirate log: https://pastebin.com/c2c2tmj0
Regards, D _______________________________________________ flashrom mailing list -- flashrom@flashrom.org To unsubscribe send an email to flashrom-leave@flashrom.org
Hey again.
I was advised there was a typo in my chip list.
Here: #define XMC_XM25QH128A 0x1708 Should be: #define XMC_XM25QH128A 0x7018
Anyhow, I have downloaded flashrom master, patched it with this data and recompiled it. I'm reporting that the probing and reading appears to be working for XM25QH128A. BIOS is now dumped. I'll test writing/erasing once I get the spare chips.
*On a side note:* Be sure to connect all chip pins to their respective terminals. For example, I originally believed this XMC chip was unsupported because it failed to probe/read while the Winbond one worked fine with the same setup. I left the /WP and /HOLD pins unconnected in my setup, but after connecting them both to Vcc via a 4k7 resistor the reading worked perfectly.
See yas!
#define XMC_ID 0x20 /* same as ST_ID */ #define XMC_XM25QH256B 0x6019 #define XMC_XM25QH128A 0x1708 #define XMC_XM25QH128B 0x6018 #define XMC_XM25QH64A 0x7017 #define XMC_XM25QH64B 0x6017 #define XMC_XM25QH32B 0x4016 /* 0x6016 for QPI mode */ #define XMC_XM25QH16B 0x4015 #define XMC_XM25QH80B 0x4014 #define XMC_XM25QH40B 0x4013 #define XMC_XM25QU256B 0x7019 #define XMC_XM25QU128B 0x5018 #define XMC_XM25QU64A 0x3817 #define XMC_XM25QU64B 0x5017 #define XMC_XM25QU40B 0x5013 #define XMC_XM25QU20B 0x5012
Update: Spare XM25QH128A chips just arrived from China. Successfully flashed a chip with Bus Pirate SPI and patched flashrom. Writing works fine. Laptop boots normally.
Hey again.
I was advised there was a typo in my chip list.
Here: #define XMC_XM25QH128A 0x1708 Should be: #define XMC_XM25QH128A 0x7018
Anyhow, I have downloaded flashrom master, patched it with this data and recompiled it. I'm reporting that the probing and reading appears to be working for XM25QH128A. BIOS is now dumped. I'll test writing/erasing once I get the spare chips.
*On a side note:* Be sure to connect all chip pins to their respective terminals. For example, I originally believed this XMC chip was unsupported because it failed to probe/read while the Winbond one worked fine with the same setup. I left the /WP and /HOLD pins unconnected in my setup, but after connecting them both to Vcc via a 4k7 resistor the reading worked perfectly.
See yas!
#define XMC_ID 0x20 /* same as ST_ID */ #define XMC_XM25QH256B 0x6019 #define XMC_XM25QH128A 0x1708 #define XMC_XM25QH128B 0x6018 #define XMC_XM25QH64A 0x7017 #define XMC_XM25QH64B 0x6017 #define XMC_XM25QH32B 0x4016 /* 0x6016 for QPI mode */ #define XMC_XM25QH16B 0x4015 #define XMC_XM25QH80B 0x4014 #define XMC_XM25QH40B 0x4013 #define XMC_XM25QU256B 0x7019 #define XMC_XM25QU128B 0x5018 #define XMC_XM25QU64A 0x3817 #define XMC_XM25QU64B 0x5017 #define XMC_XM25QU40B 0x5013 #define XMC_XM25QU20B 0x5012
-
qwrd