An Option ROM is firmware called by the BIOS, for example the Video BIOS or a SCSI controller card. The BIOS Boot Specification requires that option ROMs are aligned to 2K boundaries and must begin with bytes 0x55 0xaa. After Power On Self Test (POST) the BIOS scans for option ROMs and if it finds a correct header executes the initialisation code at byte offset 0x3.
The Option ROM header is as follows:
Byte 0: 0x55
Byte 1: 0xaa
Byte 2: size of ROM in 512 byte pages
Byte 3: Option ROM entry point
To dump out the option ROMs, use the ree utility:
sudo apt-get install ree
..and run as follows:
..this will dump out all the option ROMs in the form: hexaddress.rom where hexaddress is the memory segment where the ROM is located. e.g. for my Video BIOS ROM, I get the file c0000.rom.
To disassemble this use ndisasm:
sudo apt-get install nasm
ndisasm -k 0,3 c0000.rom | less
..or just use strings on the ROM image to get an idea what the Option ROM is, e.g.
00IBM VGA Compatible BIOS.
..in this case it is a VGA BIOS, and this makes sense as VGA BIOS ROMs normally start from segment c0000. On my Lenovo laptop I observe that the ROM contains the string "DECOMPILATION OR DISASSEMBLY PROHIBITED" which spoils our fun in finding out what the ROM is doing...
Anyhow, ree + ndisasm are useful tools for poking around your PCs option ROMs on Linux.