An Option ROM is firmware called by the BIOS, for example the Video BIOS or a SCSI controller card. The BIOS Boot Specification requires that option ROMs are aligned to 2K boundaries and must begin with bytes 0x55 0xaa. After Power On Self Test (POST) the BIOS scans for option ROMs and if it finds a correct header executes the initialisation code at byte offset 0x3.
The Option ROM header is as follows:
Byte 0: 0x55
Byte 1: 0xaa
Byte 2: size of ROM in 512 byte pages
Byte 3: Option ROM entry point
To dump out the option ROMs, use the ree utility:
sudo apt-get install ree
..and run as follows:
sudo ree
..this will dump out all the option ROMs in the form: hexaddress.rom where hexaddress is the memory segment where the ROM is located. e.g. for my Video BIOS ROM, I get the file c0000.rom.
To disassemble this use ndisasm:
sudo apt-get install nasm
ndisasm -k 0,3 c0000.rom | less
..or just use strings on the ROM image to get an idea what the Option ROM is, e.g.
strings c0000.rom
000000000000
00IBM VGA Compatible BIOS.
PCIR
(00`
*@0p
H?@0b
..
..in this case it is a VGA BIOS, and this makes sense as VGA BIOS ROMs normally start from segment c0000. On my Lenovo laptop I observe that the ROM contains the string "DECOMPILATION OR DISASSEMBLY PROHIBITED" which spoils our fun in finding out what the ROM is doing...
Anyhow, ree + ndisasm are useful tools for poking around your PCs option ROMs on Linux.
The VGA BIOS of my Dell laptop (Intel Cantiga) says
ReplyDelete“For Evaluation Use Only.”.
There is also “DECOMPILATION OR DISASSEMBLY PROHIBITED”, which might come from the Intel sources.
Check out the romheaders utility which is part of fcode-devel from openbios.org. It's a tool to decode option rom headers and PCI headers.
ReplyDelete