Thread: NVRAM Phoenix + adjustment assist

The NVRAM be capable to be decoded through two kinds. One is exactly commencing from the saved memory place of the system you are functioning on. The extra than is through situating the token table commencing from the BIOS picture. In memory the token table is originated in the F000:0000 rate of memory.

The DOS debug decide to function very well. Inspection for the string BCPNV for the memory place. This is the place the phoenix dispatch messenger decide to make confirm for. The symcmos investigates for the the $PDM in memory. Decomp your BIOS picture and find for $PDM, romexec0.

The OEM vendor has selected to put out of action this. If you debug your BIOS you decide to place the MSR call to verify if this bit is facilitated or put out of action. The PDM place decide to be named. Here is what my PDM table give effect for same to in IDA.

It decide to be potential to facilitate and put out of action a number of choices in your BIOS exactly beginning from the OS using the calls in the BIOS. The symcmos be capable to import a number of NVRAM circumstances, often cleared on power cycle still though. This is where hacking the NVRAM table in your BIOS ROM decide to arrive in handy as a number of bytes are locked beginning from writing through MSR.

You be capable to in addition use a NDISASM to decompile your rom pictures extra than this is not ever exact for the conclusion that you do not be known with what the begin position of the CODE segment is. The rom has no structure same to an exe does. You necessitate to load up in 16 bit mode. The illustration of using NDISASM.