Re-flashing a computer BIOS with the TL866CS universal programmer - Page 1
Forum section: electronics / beginners

author: fubar.gr
author_rank: Unknown
timestamp: December 19, 2013, 02:53:04 pm
content: I have three computers that were struck by line overvoltage after a thunderstorm.All three exhibited the same symptoms. When powered up they would give the Bad BIOS checksum message and were basically frozen. I tried reseting the BIOS but after that they wouldn't even power up and the motherboard LED would flash continuously.One of the computers had an older dual bios motherboard that had a jumper for bios selection. I swapped the jumper and BINGO! The computer started again, good as new.I am quite sure that the other two have the same problem. But it is impossible to reflash the BIOS the usual way since they are completely unresponsive.Since I have the universal programmer that Dave reviewed some time ago, I decided to give it a try. I located the BIOS chips. One of them was a socketed DIP-8, the other one was a SOIC-8. I downloaded their respective BIOS roms and uploaded them onto the chips using the programmer.I put the chips back on the motherboards and.....nothing happened!Did I do something wrong? I did keep copies of the original contents, just in case, and they were almost the same size as the downloaded roms (around 500Kbytes).Is there some finer detail in BIOS flashing that I missed?

author: grumpydoc
author_rank: Super Contributor
timestamp: December 19, 2013, 04:04:31 pm
content: Yes, but it's a secret only initiates can knowSeriously - you might find that the ROM image has some header and checksum info so that the BIOS own flash code can use to verify the image - in which case you need to find that and strip it off manually.

author: amyk
author_rank: Super Contributor
timestamp: December 19, 2013, 09:52:23 pm
content: Quote from: grumpydoc on December 19, 2013, 04:04:31 pmIndeed, "almost the same size" is not enough - the image has to be exactly the size of the flash. "Around 500Kbytes" suggests a 4MBit flash, your image in that case must be 524,288 bytes. At 16 bytes from the end you should find an x86 far jump instruction (byte EA) asthat is the first instruction the CPU executes out of reset.

author: fubar.gr
author_rank: Unknown
timestamp: December 20, 2013, 11:14:31 am
content: Ok, I am not 100% sure that I pulled out the right chips. One board had a socketed DIP-8 chip. It was the only socketed chip so this has to be the bios, right? The hex dump from the chip was a few kbytes smaller than the BIOS I downloaded from the board manufacturer. This seemed weird, but I figured that the data could be messed up by the lightning.But there's another SO-8 flash chip near the back of the board. I am going to pull that out too.

author: amyk
author_rank: Super Contributor
timestamp: December 20, 2013, 12:25:46 pm
content: Quote from: fubar.gr on December 20, 2013, 11:14:31 amBecause the file likely has a header and/or trailer. The ROM image should be exactly a power of 2 in size. You can dump the BIOS from within a working computer and examine the end of it to see how big the header/trailer is.

author: fubar.gr
author_rank: Unknown
timestamp: December 20, 2013, 03:21:12 pm
content: I checked the other flash chip and it is a tiny 16 kilobyte one, so it can't be that one. So I picked the correct chip the first time. I am going to compare the dump to the downloaded BIOS file now.

author: TheBay
author_rank: Unknown
timestamp: December 21, 2013, 02:25:54 am
content: Did you take a dump of any of the original chips, if so I might be able to help.And BIOS updates can never be directly flashed with a programmer as your BIOS contains DMI/MAC/ME data etc which is unique to your system and not part of the update file, not to mention most update files are compressed or encrypted.

author: lapm
author_rank: Frequent Contributor
timestamp: December 21, 2013, 12:23:09 pm
content: I would say if those computers got hit by lightning over voltage, all bets are off... Even if bios re-flashing does the trick and they boot again, there can still be more damage waiting there to bit your backside at worst moment. Electronic systems are funny like that, they just don't like over voltages.I would not trust these computers be in working/safe conditions until properly checked.

author: amyk
author_rank: Super Contributor
timestamp: December 21, 2013, 12:28:56 pm
content: Quote from: TheBay on December 21, 2013, 02:25:54 amThat unique data is more likely stored on some other flash (the other 16KB one he discovered), and you can open a lot of updates in 7-zip and retrieve the ROM image itself.

author: fubar.gr
author_rank: Unknown
timestamp: December 21, 2013, 01:46:23 pm
content: I was mistaken apparently. Both files are identical in size. The footer is also identical while there are a few differences in the header.The motherboard is a P5L-MXHere's the dump and the latest BIOS downloaded from the Asus support websitehttps://www.dropbox.com/sh/g3jzes11x0grmnc/OBVbmDdHgjIs this where the various BIOS settings are saved?What exactly happens when the BIOS is reset? Is it re-written with data taken from somewhere else?

author: lapm
author_rank: Frequent Contributor
timestamp: December 21, 2013, 01:55:02 pm
content: What happens is bios chip gets programmed either random data or bulk erased. In later case it would read as big pile of 0's or 1's depending whats default none programmed state of memory cell is.

author: TheBay
author_rank: Unknown
timestamp: December 21, 2013, 02:47:43 pm
content: I highly doubt it's saved in another chip, it will be on the Flash chip.I do a lot of BIOS stuff, I did the BIOS for the HP Microserver and do a lot of revovery work.Quote from: amyk on December 21, 2013, 12:28:56 pm

author: fubar.gr
author_rank: Unknown
timestamp: December 21, 2013, 04:28:50 pm
content: After doing some more research I think the pieces are starting to fall together.First of all, the BIOS and the so called "CMOS" are two different chips.The BIOS is an EEPROM chip that holds basically the motherboard's firmware. Being an EEPROM means that you cannot simply do a random change here and there. In order to make a change it has to be erased and re written completely.So the BIOS settings, like boot device order, Real Time Clock, etc. are saved on the "CMOS" chip, which is RAM and must be constantly powered by the CR battery cell in order to retain the data. But where the heck is that chip?I took an old motherboard and started from the battery holder. The negative terminal, as expected, is connected to the ground plane. The positive terminal goes to what looks like a tiny SMD resistor and a tiny SMD voltage reg, and then goes to a pin of the so called Super I/O chip.In the P5L-MX motherboard it is a Winbond W83627EHG-A. After peeking at the datasheet I am quite positive that this is where the BIOS settings are stored. Also, the CLRTC jumper I believe shorts one pin of the Winbond chip to the ground (via a resistor) when put in the Clear CMOS position.One of the problems with this motherboard was that when started up it would display "Bad CMOS checksum, press F1 to continue.", but the keyboard (tried both USB and PS2) was unresponsive. Since the keyboard, among other things, is controlled by the Super I/O chip, my guess is that the problem all along was not with the BIOS but with that Winbond chip.

author: TheBay
author_rank: Unknown
timestamp: December 21, 2013, 04:46:54 pm
content: That flash chip has no RTC so there will be another IC close to the batter that does the RTC and CMOS settings (Highly doubt its a CMOS device, the name stuck) take photos around battery area and post.Quote from: fubar.gr on December 21, 2013, 04:28:50 pm

author: M0BSW
author_rank: Frequent Contributor
timestamp: December 21, 2013, 05:07:21 pm
content: Quote from: fubar.gr on December 19, 2013, 02:53:04 pmWhat you need is the child next door to sort it out , as they seem to be the only ones who really understand it, bios etc. completely foreign to me and most other adults. I even need my 12 Year old daughter show me how my cell phone works and she does a cracking job of recording TV programs etc.

author: fubar.gr
author_rank: Unknown
timestamp: December 21, 2013, 06:14:52 pm
content: Quote from: TheBay on December 21, 2013, 04:46:54 pmYou're right. The RTC crystal seems to be connected to the Southbridge. Also after a more careful examination, it is the Southbridge that is connected to the battery, not the Super I/O chip. (Those damn traces are tiny and jump several times through vias to the top and bottom and back to top layer of the board. Following these traces is a PITA.)

author: casinada
author_rank: Frequent Contributor
timestamp: December 22, 2013, 02:41:32 am
content: The Bios is probably in Flash Memory and not EEPROM. What is the Chip Model number? I was trying to repair a corrupted bios for an HP Envy 20 and so far I haven't been able to program those pesky 8 pin SOIC chips with the TL866A. I will have to email the manufacturer of the TL866 to see if they can add a few more 25064 types that seem to be used in modern motherboards

author: amyk
author_rank: Super Contributor
timestamp: December 22, 2013, 12:01:12 pm
content: Quote from: fubar.gr on December 21, 2013, 06:14:52 pmIt got named the "CMOS" early in PC history because it was the only CMOS device on the system board, a Motorola MC146818 that stored nonvolatile configuration and had the RTC. Now it's more common to see the term NVRAM and on most Intel chipsets it's been moved into the southbridge (datasheet page 146.)

author: lapm
author_rank: Frequent Contributor
timestamp: December 22, 2013, 05:21:28 pm
content: Quote from: fubar.gr on December 21, 2013, 04:28:50 pmYes that's how it supposed to work under normal conditions. No manufacturer considers overvoltage hitting a chip a normal operating condition. I think i did say all bets are off when lightning strikes.Also quite a few eeprom chips allows you to flip bit from unprogrammed state to programmed state. And all this without erasing entire chip. Try it yourself and you will be suprised how many chips allows this to be done. Heck even Microchip microcontrollers allowed this and it was even recommended trick in few codeing books in 2000 still. Place few nop commands in program (in as 1111111111111...) and program some other command over them later if you need little code tweaking later.I have personally used this trick in 32k eeprom chip. Burn in bootloader and programm in the application code later. Need to erase chip, unless bootloader or application changes. Yes, unprogrammed state of memory cell read back as "1".