Hardware & Devices

Hello friends,

First, thanks for the posts. I'm feeling at obligation to inform you some progress I did today.

I discovered some part of mistery. After many tries to save/restore passwords in CMOS, maybe some tool I had used for tests, did make a mess into CMOS as I posted before.

This is showed in dump where there are many bytes zeroed. I did make a hard reset on CMOS's battery and the program sent by motherboard maker, finally started to work correctly. Now I can do a copy of a configured CMOS and duplicate it on another PC or for himself, successfully. The motherboard we have, are OEM Gygabyte with security chip that encrypts the CMOS, if this feature was enabled on BIOS (default). I would also say that the manufacturer's program worked even on my home computer with a Gigabyte P35 Board with success, then I assume that it works for almost all Gigabyte boards.

A new correct dump of CMOS banks now seems like this:

SYSTEM: 'password'
USER  : 'password'

CMOS Bank 0:
    00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    -----------------------------------------------
 0: 21 20 26 00 11 bd 07 06 05 13 26 02 50 80 00 00
 1: 40 8b f0 00 03 80 02 c0 ff 2f 2f 40 00 00 00 00
 2: 00 00 00 00 00 00 ff ff 10 00 00 fe ff ff 09 a7
 3: c0 ff 20 00 bc db 8e 5c c1 0e b8 0f cb d1 da cf
 4: 0f 53 00 95 00 00 00 02 10 01 21 00 01 00 00 00
 5: 00 00 00 0d 0a 00 00 00 00 00 c8 24 00 00 00 00
 6: 00 00 00 03 00 20 13 2f 00 00 00 00 00 ff ff 00
 7: 2f 00 00 00 00 00 00 00 00 fc 00 00 cc 05 92 0f

CMOS Bank 1:
    00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    -----------------------------------------------
 0: ff df ff df c0 ff ff ff ff ff ff 8f 00 c0 09 09
 1: 70 b0 dc 6e 77 7b c9 c8 70 b0 dc 6e 77 7b c9 c8
 2: 00 00 00 00 00 00 00 00 7a c0 ca de b2 e6 c8 01
 3: 10 86 80 05 00 24 00 00 00 00 00 d0 ff 13 10 0d
 4: 85 4a 32 a5 39 33 02 01 02 33 33 55 56 00 00 00
 5: 00 10 00 cf 8f 9f 8f 8f 4f 5e 43 9f ce c7 43 cb
 6: 4f 17 f0 f4 db 8d c5 8f cc cf df 4b cd d1 cb f7
 7: cf cb ef c7 c8 cf 5d 43 0a d4 8f 8f df ce cf dd

The offset for passwords (on this PC) is located at bank 1,
offset 0x10 up to 0x1f:

70 b0 dc 6e 77 7b c9 c8  70 b0 dc 6e 77 7b c9 c8
 p  a  s  s  w  o  r  d   p  a  s  s  w  o  r  d


The letter ' a ' inside the CMOS is encrypted as 0xB0, but on another occasion, for example, if we change the password for ' senha ' (password in Portuguese Brazil), the letter ' a ' may vary for other value, as I realized today.

I know that the first 16 bytes are for the RTC and the program should not duplicate them. So, there are only 112 bytes to find out if all of these are written sequentially by the program, or at worst, the program computes and writes a CRC before rewrite the CMOS.

This will be the next challenge and the last will be how to do this within Windows and not through the DOS.

Well, the people say that when we got 50, we turn children again. In my case, specifically, this is not true: I just went back to brush the bits !!

But it is the best thing to keep the mind always "insane", don't you think?

edinando wrote:

This will be the next challenge and the last will be how to do this within Windows and not through the DOS.