RSS Feed twitter airdump.cz Follow RemoteSec on the Facebook
Remote Security Random Tips
News & Ads

Hewlett-Packard BIOS hacking

Hewlett Packard logo Guide for bios hack of HP laptops in 1.0 :: What´s it about? HP as well as IBM have ona notebooks Whitelist block in bios. That means that if you change the original Wifi card with a new one the BIOS will write this: 104-Unsupported wireless network device detected. System Halted. Remove device and restart. If you contact the Hewlett-Packard customer support they will probably try to satisfy you with advices such as update bios or update driver (as it would be possible to get in any operating system :)

So it is an useless effort. You have to help yourself. The whole change took 8 hours including the search. I have googled a lot, read things and finally decided to take the risk.

What shall we need. Laptop HP. My model is HP Pavillion dv2385ea. At each model we edit a different file. The one we are going to work with has for BIOS defined Intel and Broadcom wireless card. The original card is Intel PRO Wireless ipw 3945ABG. It was change with the card Atheros AR5BXB63 (AR5006x) MiniPCI-E.

Used application for hack: Phoenix Bios Editor Pro, EditPad Pro, SWinFlash. The whole pack can be downloaded here (password for archive is: hpwithlove). Original BIOS is in ROM F.39 (file sp36869.exe)

First of all we have to find out the data from the original card. Note. Just illustrative picture, there is no WiFi on the pc where I have written it ;)

Detekce vendoru

PCI\VEN_14E4&DEV_1677&SUBSYS_3006103C

I suggest to use the data as a quidance for searching in BIOS files (explanation below). If you change the data of the original card then it won´t work again so it is better to change a different card. There is about 5 cards from Intel and 5 from broadcom.

The best thing is to download the original WiFi drivers from the HP web (Intel or Broadcom Wireless LAN Driver) and look directly at bcmwl5.inf

%BCM430G_DeviceDesc% = BCM43XG11_NT60, PCI\VEN_14E4&DEV_4311&SUBSYS_1363103C
%BCM430G_DeviceDesc% = BCM43XG12_NT60, PCI\VEN_14E4&DEV_4311&SUBSYS_1364103C
%BCM430G_DeviceDesc% = BCM43XG13_NT60, PCI\VEN_14E4&DEV_4311&SUBSYS_1365103C
%BCM430M_DeviceDesc% = BCM43XM11_NT60, PCI\VEN_14E4&DEV_4312&SUBSYS_1360103C
%BCM430M_DeviceDesc% = BCM43XM12_NT60, PCI\VEN_14E4&DEV_4312&SUBSYS_1361103C
%BCM430M_DeviceDesc% = BCM43XM13_NT60, PCI\VEN_14E4&DEV_4312&SUBSYS_1362103C
%BCM430M_DeviceDesc% = BCM43XM14_NT60, PCI\VEN_14E4&DEV_4312&SUBSYS_135F103C

You will definetely find one there.

2. It is neccessary to find out these data PCI\VEN_XXXX&DEV_XXXX&SUBSYS_XXXXXXXX from the card that you plan to add and use. This might be little bit extreme but if we don´t have another notebook for the card testing this is the only possibility.

We start the PC without the card and right after the bios screene and before the windows starts to run press PAUSE on the keyboard and manualy insert the card into the laptop :) The two cables for antennas are not needed to be inserted. You just need to write down those numbers. When the win starts up it will catch it normaly or it might ask for drivers which you can handle out. (Comments from HP support about uncompatible device are “just bullshit!”) I read that it is possible even though linux but I not a linux expert.

3. Need to run filr sp36869.exe click everything but don´t do the flash. We need only the file 30B2F39.WPH that will be here C:\Program Files\SP36869\winphlash\

We open this file in program Phoenix Bios Editor. When opening it will announce few times an error, just ignore it and put YES to continue.

Phoenix BIOS Editor

4. Then go here C:\Program Files\Phoenix Technologies Ltd\BIOS Editor\TEMP\ and there you will find a file MOD_5100.ROM and open it in HexEdit Pro

Note. For other HP model the file is different so don´t think that it will be the same at each model. This works 100% for Pavillion dv2000 series. The other series as mentioned at http://www.richud.com/HP-Pavilion-104-Bios-Fix/ should be in these files BIOSCOD0.ROM – BIOSCOD6.ROM. At this we can use searching by hex numbers of our original card.

Also remamber when searchin that the numbers are coming from behind.

If the Broadcom from INF file is for example VEN_14E4&DEV_4311&SUBSYS_1363103C

Then in HexCode it will be

VEN&DEV E4 14 11 43
SUBSYS 3C 10 63 13

Opened and searched it will look like this: VEN&DEV E4 14 11 43

Edit-Pad-Pro

SUBSYS 3C 10 63 13

EditPad string

Both values VEN&DEV E4 14 11 43 and SUBSYS 3C 10 63 13 must be in accordance otherwise it won´t edit! I mention the brand Broadcom 14E4 on purpose although you will find Intel 8086 in other files and thanks the error the other part might change.

Next step when we have found the right VEN&DEV E4 14 11 43 and SUBSYS 3C 10 63 13 is to write in the line Replace the right Hex figure VEN&DEV from the card you wan to insert.
For example for Atheros VEN_168C&DEV_0013&SUBSYS_1025168C

It will look like this:

VEN&DEV
Orig: E4 14 11 43 -Broadcom
Mod: 8C 16 13 00 -Atheros

SUBSYS
Orig: 3C 10 63 13 – Broadcom
Mod: 8C 16 25 10 – Atheros

In the bottom chart we put hex which we want to change and under it into the replace the hex that we want to add and then we click on replace like this we do it on VEN&DEV and SUBSYS.

Phoenix BIOS editor string

Save and close.

5. In Phoenix Bios editor change the item with a double click from FE00 to FE01 and in consequence recreate the original value FE00.

This is good for the possibility save to be activated (Build bios ctrl + U).

If possible don´t change anything.

Because you don´t know which function will do what.

Finally you can display the log (optional), then comes the offer to save the new BIOS.

Confirm YES, the way where the file will be saved is optional.

winFlash dialogue

6. The last step is the flash of new BIOS by program SWinFlash (SWinFlash.exe). The link is at the beginning of the text.

Autor Killy. Translated by Mo.

Similar Posts: