Forum RSS Feed Follow @ Twitter Follow On Facebook

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Latest Threads
[REQUEST] aorus 15g xc bios unlock
Last Post: genius239
Today 09:24 AM
» Replies: 1
» Views: 64
[REQUEST] Hystou S200 BIOS unlock
Last Post: genius239
Today 05:46 AM
» Replies: 26
» Views: 8449
[Request] Unlocking Voltages of i7 12700...
Last Post: Jarit.lal
Today 03:59 AM
» Replies: 0
» Views: 51
[REQUEST] Lenovo Legion 5 (EUCNxxWW) BIO...
Last Post: silent_light
Today 03:42 AM
» Replies: 0
» Views: 57
[REQUEST] Lenovo B50-70 (9DCNxxWW) BIOS ...
Last Post: Urry
Today 12:27 AM
» Replies: 103
» Views: 26333
[Request] Lenovo P580 Whitelist Removal
Last Post: Dudu2002
Yesterday 01:35 PM
» Replies: 172
» Views: 38124
[REQUEST] Lenovo Y50-70 (9ECNxxWW) BIOS ...
Last Post: Dudu2002
Yesterday 11:35 AM
» Replies: 2336
» Views: 618335
[REQUEST] Lenovo G580 (5ECNxxWW) Whiteli...
Last Post: mma21
Yesterday 04:23 AM
» Replies: 2105
» Views: 505804
[Close] Inspiron 14R 5421 BIOS unlock
Last Post: Dudu2002
Yesterday 03:31 AM
» Replies: 1
» Views: 190
LENOVO THINKPAD L440
Last Post: Dudu2002
Yesterday 03:29 AM
» Replies: 1
» Views: 143
[REQUEST] GL504GS BIOS unlock
Last Post: varu
08-10-2022 11:11 PM
» Replies: 70
» Views: 19564
[REQUEST] Lenovo G580 (62CNxxWW) Whiteli...
Last Post: pangzibupang
08-10-2022 10:10 PM
» Replies: 832
» Views: 226371
[Done] GA-5AX patch injection for RAS Pr...
Last Post: lukas12p
08-10-2022 10:12 AM
» Replies: 9
» Views: 3146
[REQUEST] Acer Aspire V3-772G BIOS Unloc...
Last Post: Dudu2002
08-10-2022 09:34 AM
» Replies: 651
» Views: 147108
[REQUEST] Lenovo G400S (7BCNxxWW) Whitel...
Last Post: Dudu2002
08-10-2022 09:21 AM
» Replies: 220
» Views: 64088
voltage control for 1135g7
Last Post: Devryd
08-10-2022 09:18 AM
» Replies: 0
» Views: 76
[Request] ROG Strix G15 Advantage Editio...
Last Post: Sml6397
08-10-2022 02:45 AM
» Replies: 76
» Views: 20707
[Request] Zotac Magnus One AMI Bios unlo...
Last Post: ptap
08-10-2022 12:59 AM
» Replies: 63
» Views: 9206
[Request] Unlock IBM ThinkPad R50e
Last Post: ihazcat
08-09-2022 06:31 PM
» Replies: 0
» Views: 158
Lenovo V130-15IKB 81HN00NDGE BIOS Unlock
Last Post: Viktor_
08-09-2022 01:44 PM
» Replies: 0
» Views: 144

[Guide] How to extract binary BIOS flash chip content out of an Insyde .fd file and d
#1
Just recently, I were faced a bricked Laptop Toshiba Satellite C50-A-1M0, which did nothing more than lighting some LEDs and switching off after about a minute.

The Problem came due to a stuck BIOS upgrade from version 1.10 to 1.40. The BIOS of this model is from Insyde.
To be honest, this Laptop is pretty old, but I never had such a case on my desk and there was no risk to break it even more - it was broken already. The only thing that could happen was that I'd get this PC running again, so I decided to give it a try.

First, I tried to restart the Flashin process as indicated on diverse pages, as also here: extracting the .fd file from the BIOS update on a USB-Stick and pressing special keys (Win+B, Fn+B,....) during Power-on. It was visible on the Stick's LED that the PC somehow did something on it. But I could never get to the point that the PC would beep or do anything else than switching off after a minute. I also tried the same with a similar CD in the drive, as the drive sounded as if it would do something. I tried every possible combination of keys - nothing.
All this did not work, so I needed another solution.

I stumbled across this page: https://www.rototron.info/recover-bricke...pberry-pi/
This guy is explaining very clearly how I could reprogram the Flash chip using a Raspberry Pi.
I still had a Raspberry Pi 3 in the drawer, so why not give it a try?
In his example, he had the Macronix MX25L8005 Flash IC, where in contrast, my PC used a Winbond W25Q64F. But that should be handled by the flashrom tool used on the Raspberry Pi.

I decided to solder the chip out, as I currently don't own such a clamp for contacting the SOIC8 in-circuit. Plus, several guys out there reported that due to other circuits on the board, signal level and power supply might be insufficient, if just supplied by the Pi.

There are a lot of working descriptions on how to connect this Winbond Flash IC to the Raspberry Pi, but I found this one to be fine and it worked as well: https://github.com/nopnop2002/Raspberry-W25Q64
I am not aware of the software this guy has on the page. But I used his Fritzing wiring plan.

As I had the IC soldered-out and wired to the Raspberry Pi, I just followed the instructions from the rototron page above:
Code:
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2000 -V

And after some other beginner-faults, flashrom showed me the result I were looking for: 
Code:
Found Flash chip "W25Q64".
- Okay, let's go.

I took a dump of the bricked Flash using
Code:
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2000 -V -r bricked.bin
in order to be safe if anything would happen.

Then, I were ready to flash the new content. - But which one?

I read in several comments that the .fd file in the installer .exe is the BIOS content and that it can be used the same way as a .bin file is used. So, I extracted the .fd file from the 1.40 Update and tried to flash it to the device:
Code:
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2000 -V -w DM10S140.FD

Unfortunately, that failed!
And the error message was really confusing:   
Code:
Error: Image size (9056560 B) doesn't match the flash chip's size (8388608 B)!

Does that mean, I can't use this file? - It seems like!

But what would I use then?
An internet search did not reveal anything new about .fd and .bin files, so I had to find the solution by myself.

Assumption was that the right content must be contained in this file.

When I open this file in 7-Zip, it turns out that it has different sections. One of them ".text" - the by far largest one - is 9054304 Bytes long. Highly probable that this further contains the content I need, plus some overhead I don't need.

What could I do in order to find that out?

Well, just out of pure luck, I also had the brick.bin flash dump. So, maybe I could find some hints in that file?
So, I openend that file using HxD:

   

So, the brick.bin file starts with one line of 0xFFs and the second line starts with "5A A5 F0 0F".
The .text file beginning is completely different. So, let's see it we can find the upper sequence in the .text file...  Tada!

   
The beginning sequence of the brick.bin is stored at offset 0x0430! Seems to work. And in the line above, there is a text saying "IFLASH_BIOSIMG". So, it really looks like there is a section marked, which contains the flash binary I need.
I erased the part before offset 0x0430 and saved the file under a new name "DM10S140.BIN".

So, let's do the same with the end of my brick.bin:

   

Interestingly, the brick.bin file size is exactly 8388608 Bytes (= 0x800000 Bytes), just as the chip size.

The file concludes with a line "0F 09 E9 1B...". Let's seek that in the .text file...

And: BAM! - That's it!

   


So, the End of the brick.bin file, Offset 0x7FFFFF is stored in the now shortened .text file at Offset 0x7FFFFF!

It seems pretty clear that everything between is my flash content and below is some text overhead I can just cut off...

Did that, and saved the file. The new "DM10S140.BIN" file now had exactly the same size as the "brick.bin" file, which made perfect sense.

I prayed once that it would work and flashed it on the device:

Code:
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2000 -V -w DM10S140.BIN

After some time (and many pages of output due to the -V switch :-), flashrom concluded its process:

Code:
Erase/write done.
Verifying flash... VERIFIED

Seemed like the flash had worked. Now, there was no other way than the re-assembly of the Laptop in order to get the proof.

Unsoldered the chip from the wires, soldered it back to the mainboard and assembled the PC.
And...  It is fixed and running! --> SDG


Most of this surely is not new to the readers of this forum. But I have not found anything about how to extract the .bin file from the fd file.
Maybe, some other tools do this automatically. But flashrom - or at least the implementation I were using - was not able to do so.

I believe, I am not the only person ever facing this problem, so hopefully, this will help anyone else...


In order to help others not having the necessary files, I also attach the now running Insyde BIOS 1.40 .bin file for the Toshiba Satellite C50-A-1M0 ready for flashing.


Attached Files
.bin   DM10S140.BIN (Size: 8 MB / Downloads: 1)
find
quote
#2
Thank you for writing up this guide.
find
quote
#3
Thank you for a guide so well made that I unbricked my Acer SF314-51 with your method, worked like a charm! Many thanks from Canada! I used a CH341 programmer instead of a Raspberry and that part is just for reading or writing on the chip.
find
quote


Forum Jump:


Users browsing this thread: 1 Guest(s)