Forum RSS Feed Follow @ Twitter Follow On Facebook

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Latest Threads
[REQUEST] Dell Inspiron 5675 CPU Upgrade
Last Post: claymore
Today 04:59 PM
» Replies: 5
» Views: 4062
i7 2860QM how to raise power limit?
Last Post: mariukonie
Today 04:31 PM
» Replies: 13
» Views: 611
[REQUEST] Dell Wyse 3040: CSM enable for...
Last Post: mm400
Today 05:58 AM
» Replies: 1
» Views: 683
[REQUEST] GA-8I865GME-775-RH (rev. 3.9) ...
Last Post: DeathBringer
Today 04:04 AM
» Replies: 1
» Views: 176
[REQUEST] Acer TravelMate 5760(G,Z) BIOS...
Last Post: quibic
Yesterday 01:03 AM
» Replies: 49
» Views: 26591
Asus P8Z77-M RT-d Unlock
Last Post: cbaldwin1
07-11-2025 04:21 PM
» Replies: 0
» Views: 270
[REQUEST] Lenovo Yoga 530-14ARR (8MCNxxW...
Last Post: Dudu2002
07-11-2025 02:04 PM
» Replies: 4
» Views: 3179
[REQUEST] Gigabyte GA-X99P-SLI BIOS with...
Last Post: DKisCRUSHIN
07-11-2025 09:50 AM
» Replies: 0
» Views: 251
Acer Aspire 5920G - Requesting Modded BI...
Last Post: EbrahimSiami
07-10-2025 02:56 PM
» Replies: 1
» Views: 415
Acer A517-51G-58S5 - Complete BIOS image...
Last Post: Humboldt
07-10-2025 01:07 PM
» Replies: 2
» Views: 295
Lenovo Yoga Pro 7 14ASP9 Bios Unlock
Last Post: Dudu2002
07-10-2025 03:02 AM
» Replies: 3
» Views: 393
[RESOLVED] Help! BIOS for Asus GL503VS R...
Last Post: AmosNZ
07-10-2025 12:09 AM
» Replies: 5
» Views: 3018
[REQUEST] Acer Predator Helios 500 PH517...
Last Post: TeckToe
07-09-2025 11:29 PM
» Replies: 4
» Views: 1520
Gigabyte G6X 9MG insydeH2O IOS Unlock
Last Post: Zzhheennyyaa
07-09-2025 04:37 PM
» Replies: 2
» Views: 639
[SOLVED] Lenovo IdeaPad 510-15ISK - BIOS...
Last Post: outsydeh2o
07-09-2025 09:39 AM
» Replies: 1
» Views: 428
(new to forums) searching for aid/direct...
Last Post: adorable_yangire
07-09-2025 12:11 AM
» Replies: 0
» Views: 359
[SOLVED] Change Serial Number, UUID, Mac...
Last Post: dsdn1
07-08-2025 07:55 PM
» Replies: 10
» Views: 16949
[REQUEST] Lenovo G50-45 BIOS Unlock
Last Post: szakiz
07-08-2025 05:36 PM
» Replies: 49
» Views: 53801
[REQUEST] Lenovo Yoga 7 Pro 82Y7 unlock
Last Post: Dudu2002
07-08-2025 07:13 AM
» Replies: 1
» Views: 285
[REQUEST] Lenovo G710 BIOS Whitelist Rem...
Last Post: Dudu2002
07-08-2025 07:12 AM
» Replies: 491
» Views: 218217

Extracting boot logo & other stuff from a UEFI Tiano/Insyde .FD image
#1
Lightbulb 
There are essentially two ways to extract graphics from an .FD UEFI BIOS image:

(1) Look for capsules with specific GUIDs known to contain it, such as:

Code:
E5BBF7BE-2417-499B-97DB-39F4896391BC,SplashLogoPackage
1FFF93C2-8C76-49E4-8AB3-43D92F5445EF,LogoJpg
6F0CF054-AE6A-418C-A7CE-3C7A7CD74EC0,LogoPcx

(2) Search for magic strings associated with particular image formats, for example:
  • BMP: "BM" string
  • GIF: "GIF89a" string
  • JPEG: "JFIF" string
  • PCX: hexadecimal 0A 05 01 08
The .FD image can be decompressed with a number of tools, in particular: Phoenix Tool, UEFI Tool, or simply binwalk. The last two also include search capabilities. Otherwise, files can be searched with grepWin once decompressed.

I've succesfully extracted boot logos and other graphics from a number of Lenovo laptop BIOSes using the above methods, all of which yield the same results. Here's an example of what can be found once decompressed:

Code:
# <GUID>
[<LaptopModel>_<BiosVersion>] <File>

# 1FFF93C2-8C76-49E4-8AB3-43D92F5445EF,LogoJpg
[B460_1DCN26WW_4FCNAWW] 1024x768 JPEG: Boot logo (40,693 bytes; inside CRC32 GUID: FC1BCDB0-7D31-49AA-936A-A4600D9DD083)

# 6F0CF054-AE6A-418C-A7CE-3C7A7CD74EC0,LogoPcx
[Y700_CDCN53WW] 1024x768 PCX, 8-bit: All black (27,068 bytes)

# 771F77D1-13AF-48BF-2584-773D389E33CA
[Y700_CDCN53WW] 360x360 JPEG: "Invalid Public Key for Secure Flash" (17,656 bytes)

# 931F00D1-10FE-48BF-AB72-773D389E3FDA
[Y700_CDCN53WW] 208x157 BMP, 8-bit: Intel logo (33,236 bytes)

# 931F77D1-10FE-48BF-AB72-773D389E3FAA
[Y700_CDCN53WW] 300x300 BMP, 24-bit: Insyde logo (270,056 bytes)

# 156A8FFE-62DB-4FF3-82AD-2EBD8A3E3DF7
[Y520_4KCN24WW] [Y900_D0CN34WW] 768x432 GIF89a: Boot logo, animated (128,090 bytes)

# 1F56B2F9-6E6D-4014-BFD4-37C9E5D398F1
[Y520_4KCN24WW] 1536x864 GIF89a: Boot logo, animated (406,313 bytes)

# E5BBF7BE-2417-499B-97DB-39F4896391BC,SplashLogoPackage
[110_1QCN20WW] 548x308 JPEG: Boot logo (17,169 bytes; followed by a GIF w/icons)
[110_1QCN31WW] 548x308 JPEG: Boot logo (53,046 bytes; followed by a GIF w/icons)
[700_E5CN58WW] 548x308 JPEG: Boot logo (49,368 bytes; followed by several GIFs w/icons)

However, none of the above methods manage to locate the boot logo in Lenovo Y700 images such as CDCN37WW.fd and CDCN53WW.fd (attached), although it is clearly somewhere there. Can anyone tell me what I am missing?

Possibly the logo is in a format other than BMP/GIF/JPG/PCX. The BIOS images have a "TgaDecoderDxe" module inside. Could there be any TGA (Targa) images there? If so, how to find them? Or is it something else altogether? Like obfuscation with XOR or something more sophisticated? Suggestions appreciated.


Attached Files
.zip   CDCN53WW.fd.zip (Size: 4.02 MB / Downloads: 29)
find
quote


Forum Jump:


Users browsing this thread: 1 Guest(s)