ASUS M5A78L-M LX3 MC Update

[fre4kyc0de]

Hello all together,

I'd like to create an Microcode-updated BIOS for my ASUS M5A78L-M LX3 to get Spectre2-mitigations.
It's a non-UEFI BIOS.
The current processor is an AMD FX-6300, but may change in the next time to a different one.
Link to original BIOS: https://dlcdnets.asus.com/pub/ASUS/mb/SocketAM3+/M5A78L-M_LX3/M5A78L-M-LX3-ASUS-1401.zip


According to MC Extractor (1.30.0 r102) there are newer microcodes for the following CPUIDs available:
- 00100F41 (010000C6 -> 010000DB)
- 00100FA0 (010000BF -> 010000DC)
- 00600F12 (06000629 -> 0600063E)
- 00600F20 (0600081C -> 06000852)

Searching the internet I found different tutorials telling to hex-edit the new microcodes into the ROM-file and then rebuild one part of the rom using UEFITool. As far as I understand, this doesn't make sense as it's a non-UEFI rom.
I also tried to edit the image using MMTool 3.26, but it doesn't find a "CPU MicroCode Patch Module".

Could someone help me by telling me, how to update the microcode or posting a microcode-updated image.

Thanks in advance

[genius239]

Open bios file by mmtool and extract e2 module.
https://i.imgur.com/Oo1m2Hh.png

The e2 mudule contain microcode.
Here are microcode address on e2 module.

cpu00100F40
address : 368a8h - 36c67h

cpu00100F41
address : 360a8h - 36467h

cpu00100F43
address : 367a8h - 37467h

cpu00100F62
address : 35710h - 35acfh

cpu00100FA0
address : 34038h - 343f7h


cpu00600F12
address : 246d8h - 250f7h

cpu00600F20
address : 225a0h - 22fbfh

[fre4kyc0de]

Thanks for the fast reply.

So I need to do these three steps:
1) extract the E2 module using MMTool
2) hex-edit the new MC into the extracted E2 module
3) replace the original E2 module in the rom with the patched one using MMTool

Correct?

[genius239]

Thanks for the fast reply.

So I need to do these three steps:
1) extract the E2 module using MMTool
2) hex-edit the new MC into the extracted E2 module
3) replace the original E2 module in the rom with the patched one using MMTool

Correct?

Yes
Use the same size microcode to replace old one.

[fre4kyc0de]

Then I understood. Thanks again.

Just for verification:
SHA1(E2): 9FAAF377FF9659408F65C3831C0D84AE7698E3C4
SHA1(E2_patched): 356AD88FE45E8256298027233D31C53C67CED25D

[fre4kyc0de]

Update just failed, now recovering...

[edit]
MMTool created the ROM just fine, but after programming the BIOS put me into "ASUS CrashFree BIOS" requiring me to reflash using the Support-DVD.
[/edit]

[genius239]

Update just failed, now recovering...

[edit]
MMTool created the ROM just fine, but after programming the BIOS put me into "ASUS CrashFree BIOS" requiring me to reflash using the Support-DVD.
[/edit]

Why??
I think this modify method is right.
After rom saved, do you open it by amibcp and no any error??

Could you attach your mod file??

[fre4kyc0de]

AMIBCP 3.13 opens the file just fine.

File attached

[Lost_N_BIOS]

E2 module location moved to front of BIOS @ 1c and due to being there it's missing leading file size + header info before the module that's in original BIOS, plus probably broke some stuff that was originally at beginning of BIOS. You may need to hex edit (Copy mod E2) paste into stock BIOS at exact original location a0000. If that fails, hex edit microcodes in place on complete BIOS file one by one.

[fre4kyc0de]

This might explain, why it fails to boot.

But if I hex-edit the microcode into the original ROM both "ASUS EZ-Flash" and AFUDOS report the ROM as "damaged".
Is there anything MMTool changes when replacing the module (e.g. CRC32)? And if yes, is it stored before or after the module?

As MMTool shows two different sizes ("source size" and "size in rom" (== "source size" + 0x14)) I'll try to move the "new" E2-module + it's header/footer from the broken modded BIOS to 0xA0000 in a new copy and try that one.

[edit]
There is a kind of header in front of the inserted module:
original (0x9FFEC - 0x9FFFF): C0 A4 04 00 16 B4 8D AA F4 FF 04 00 FF FF E2 90 00 00 00 00
patched (0x8 - 0x1B):            C0 A4 04 00 51 CD 02 D3 14 B5 13 00 FF FF E2 80 00 00 00 00
The first 4 bytes represent the size of the module ("source size" = 0x4A4C0), but I don't know / can't guess the meaning of  the rest.
[/edit]

[edit2]
I copied around byte by byte and after adjusting all of the "header" bytes to match the ones from the broken MMTool-Mod the ROM flashed and booted fine.
According to "RW-Everything" the injected Microcode has been loaded and is working.
The ROM hasn't been fully tested, but is attached now.
[/edit2]