Jump to content
Rampage Dev

Patched Framebuffer Repository

18 posts in this topic

Recommended Posts

about:

This is a Repository for ATI and AMD patched Framebuffers. Here you will find a complete list of successfully patched framebuffers for ATI and AMD Graphics Cards. This is not a support page so do not post questions on this page. Start a new topic if you have questions. Thank you for your cooperation.

Framebuffer Editing Guides:

BCC9′s post that can be found here
Alexander Martinez’s post that can be found here
Mucha’s post that can be found here

Posting Guidelines:

The following are the posting guidelines for this page. Failure to follow set guidelines will mean that the patched framebuffer will not be posted on the first post. Thank you for your cooperation.

Graphics Card Model:

Graphics Card Manufacture Name:

Graphics Card Manufacture Part Number:

Fixed by:

Patched Framebuffer:

Share this post


Link to post
Share on other sites
Advertisement

Graphics Card Model: Colorfire HD7750 D5 1GP LP

Graphics Card Manufacture Name: Colorfire

Graphics Card Manufacture Part Number:N/A

Fixed by: Buri

Patched Framebuffer:

 

 

Personality: Buri

ConnectorInfo count in decimal: 4

Disk offset in decimal 662688

0000000    02  00  00  00  00  01  00  00  29  05  01  00  10  00  05  05

0000010    04  00  00  00  14  00  00  00  00  01  00  00  10  00  01  04

0000020    00  08  00  00  04  02  00  00  00  01  00  00  12  04  03  03

0000030    00  08  00  00  04  02  00  00  00  01  04  00  12  04  03  03

0000040

 

P.S. Before patching the FB, the video card can get full resolution with QE/CI, but after sleep, the screen will "frozen". Now it works well.

Share this post


Link to post
Share on other sites

After running more tests, below is the final edition; with the two ports working both individually and simultaneously.

Personality: Buri

ConnectorInfo count in decimal: 4

Disk offset in decimal 662688

0000000    02  00  00  00  00  01  00  00  29  05  01  00  10  00  05  05

0000010    04  00  00  00  14  00  00  00  00  01  00  00  10  00  01  04

0000020    00  04  00  00  04  03  00  00  00  09  03  00  21  03  02  02

0000030    00  08  00  00  04  02  00  00  00  01  04  00  12  04  03  03

0000040

==========================================================
Configuration of Clover's config.plist is Graphics--> InjectATI
                                                                              -->FBName=Buri
                                                                              -->VideoPorts=4
without CSmVideoDxe-64(Black screen, but will work normally after sleep--awake).
darkwake=0(or blackscreen after sleep--awake).

Share this post


Link to post
Share on other sites

                                                            post-11772-0-83937800-1395094176_thumb.png

 

 

Graphics Card Model: Asus/AMD HD 6570 GDDR3 1024MB(low power/low profile)

Graphics Card Manufacture Name: Asus

Graphics Card Manufacture Part Number:N/A

Fixed by: RobertX/Slice

Patched Framebuffer:

 

Personality: Ipomoea
ConnectorInfo count in decimal: 3
Disk offset in decimal 789568
0000000 00 04 00 00 04 03 00 00 00 01 00 00 12 04 01 05
              04 00 00 00 04 03 00 00 00 01 00 00 10 00 01 04
0000010 00 08 00 00 04 02 00 00 00 01 00 00 11 02 04 03
              00 08 00 00 04 02 00 00 00 01 00 00 12 04 04 03
0000020 10 00 00 00 10 00 00 00 00 01 00 00 00 00 00 02
              10 00 00 00 10 00 00 00 00 01 00 00 00 00 00 01
0000030

 

..marked in red are the modified values i used...  :smoke:

Share this post


Link to post
Share on other sites

Graphics Card Model: HD7870-DC2TG-2GD5-V2

 

Graphics Card Manufacture Name: ASUS

 

Graphics Card Manufacture Part Number: n/a

 

Fixed by: papadil2

 

Patched Framebuffer: OS X 10.8.5 - ATI7000Controller, OS X 10.9.2 - AMD7000Controller

Personality: Hamachi (Original - 10.8.5)
ConnectorInfo count in decimal: 4 - DP, DP, DVI-D, HDMI
Disk offset in decimal 609232
0000000    00  04  00  00  04  03  00  00  00  01  01  00  12  04  05  01
0000010    00  04  00  00  04  03  00  00  00  01  02  00  22  05  04  02
0000020    04  00  00  00  14  02  00  00  00  01  03  00  00  00  03  06
0000030    00  08  00  00  04  02  00  00  00  01  04  00  11  02  01  04
0000040

Personality: Hamachi (ASUS HD7870-DC2TG-2GD5-V2 - 10.8.5)
ConnectorInfo count in decimal: 4 - DVI-I, DVI-D, DP, HDMI
Disk offset in decimal 609232
0000000    00  02  00  00  04  02  00  00  00  01  01  00  10  00  01  06
0000010    04  00  00  00  14  02  00  00  00  01  02  00  11  02  02  05
0000020    00  04  00  00  04  03  00  00  00  01  03  00  12  04  03  01
0000030    00  08  00  00  04  02  00  00  00  01  04  00  22  05  04  02
0000040

 

Personality: Hamachi (Original - 10.9.2)
ConnectorInfo count in decimal: 4 - DP, DP, DVI-D, HDMI
Disk offset in decimal 811344
0000000    00  04  00  00  04  03  00  00  00  01  01  01  12  04  05  01
0000010    00  04  00  00  04  03  00  00  00  01  02  01  22  05  04  02
0000020    04  00  00  00  14  02  00  00  00  01  03  00  00  00  03  06
0000030    00  08  00  00  04  02  00  00  00  01  04  00  11  02  01  04
0000040

Personality: Hamachi (ASUS HD7870-DC2TG-2GD5-V2 - 10.9.2)
ConnectorInfo count in decimal: 4 - DVI-I, DVI-D, DP, HDMI
Disk offset in decimal 811344
0000000    00  02  00  00  04  02  00  00  00  01  01  00  10  00  01  06
0000010    04  00  00  00  14  02  00  00  00  01  02  00  11  02  02  05
0000020    00  04  00  00  04  03  00  00  00  01  03  01  12  04  03  01
0000030    00  08  00  00  04  02  00  00  00  01  04  01  22  05  04  02
0000040

 

DVI-D: OK

DVI-I: OK after sleep - partially OK

DVI-D + DVI-I: OK

DP + HDMI and combinations: not tested

Share this post


Link to post
Share on other sites

Graphics Card Model: mobility HD4330
Graphics Card Manufacture Name: acer (aspire timeline 4810TG)
Fixed by: whaka

Patched Framebuffer:

Personality: Shrike
ConnectorInfo count in decimal: 3
Disk offset in decimal 501464
0000000    02  00  00  00  40  00  00  00  09  01  00  00  12  01  00  07
0000010    10  00  00  00  10  00  00  00  00  01  00  00  00  10  01  01
0000020    00  08  00  00  00  02  00  00  00  01  00  00  10  00  02  02

Share this post


Link to post
Share on other sites

Graphics Card Model: Sapphire Vapor-X R9 290X 8Gb TRI-X

Graphics Card Manufacture Name: Sapphire

Graphics Card Manufacture Part Number: 11226-11

Fixed by: Baladi

Patched Framebuffer: 

00080000040200000001000022050103
00040000040300000001000712040201
00040000040300000001000021030302
04000000140200000001000011020404
00040000040300000001000010000505
00020000140200000001000010000606

Share this post


Link to post
Share on other sites

Graphics Card Model: XFX HD7770 CORE EDITION (With Power Color UEFI Bios

Graphics Card Manufacture Name: XFX

Graphics Card Manufacture Part Number: fx-777a-znf4

Fixed by: Buri

Patched Framebuffer: 

00040000040300000001030012040102
00080000040200000001010011020201
04000000140200000001020010000304
00020000040200000001040000100404

PS: Original XFX Core bios will never work, since they use a method that share one DAC for two DVI-I ports. So, if you want to have your XFX Core working, you'll need flash a bios with only one DVI port. I'm using here a Power Color one (that supports UEFI). So, you'll loose one DVI.

Share this post


Link to post
Share on other sites

Graphics Card Model: Sapphire R7 260X 2G D5

Graphics Card Manufacture Name: Sapphire

Graphics Card Manufacture Part Number: 11222-06

 

Ports: 4 (but has just the following HW-Connectors: 1xDP, 1xHDMI and 1x DVI)

Fixed by: EXMOOR

original EXMOOR:

02000000000100000001010322050204
02000000000100000001020312040103
00040000040300000001030711020301
00040000000100000001040321030505
00040000040300000001050710000402
00040000000100000001060320010505

Patched Framebuffer: 
00080000040200000001000022050103
00040000040300000001000712040201
00040000040300000001000021030302
04000000140200000001000011020404
00040000040300000001000010000505
00020000140200000001000010000606

Working Monitors: 1xDP plus 1xHDMI plus 1xDVI simultaneously.

 

Used the following Settings within CLOVER config:

 

FakeID: 0x66401002

    <key>Graphics</key>
    <dict>
        <key>DualLink</key>
        <integer>1</integer>
        <key>FBName</key>
        <string>Exmoor</string>
        <key>Inject</key>
        <dict>
            <key>ATI</key>
            <true/>
            <key>Intel</key>
            <false/>
            <key>NVidia</key>
            <false/>
        </dict>
        <key>InjectEDID</key>
        <true/>
        <key>NvidiaSingle</key>
        <false/>
        <key>PatchVBios</key>
        <true/>
        <key>VRAM</key>
        <integer>2048</integer>
        <key>VideoPorts</key>
        <integer>4</integer>
    </dict>
    <key>KernelAndKextPatches</key>
    <dict>
        <key>ATIConnectorsController</key>
        <string>8000</string>
        <key>ATIConnectorsData</key>
        <string>020000000001000000010103220502040200000000010000000102031204010300040000040300000001030711020301000400000001000000010403210305050004000004030000000105071000040200040000000100000001060320010505</string>
        <key>ATIConnectorsPatch</key>
        <string>000800000402000000010000220501030004000004030000000100071204020100040000040300000001000021030302040000001402000000010000110204040004000004030000000100001000050500020000140200000001000010000606</string>

latest BIOS of the card: Legacy/UEFI direct from SAPPHIRE

Share this post


Link to post
Share on other sites

Graphics Card Model:Mobility Radeon HD 5870

Graphics Card Manufacture Name:ASUS

Graphics Card Manufacture Part Number:N/A

Fixed by:Maromi

Patched Framebuffer:Nomascus(For VGA connector patching)

    <key>Graphics</key>
    <dict>
        <key>FBName</key>
        <string>Nomascus</string>
        <key>VideoPorts</key>
        <string>3</string>
        <key>Inject</key>
        <dict>
            <key>ATI</key>
            <true/>
        </dict>
    </dict>
    <key>KernelAndKextPatches</key>
    <dict>
        <key>ATIConnectorsController</key>
        <string>5000</string>
        <key>ATIConnectorsData</key>
        <string>02000000400000000901000000000005020000000001000009030000120403030004000004060000007300001102010100040000040700000073000021030202</string>
        <key>ATIConnectorsPatch</key>
        <string>02000000400000000901000010000005000800000402000000000000210301021000000010000000000100001000020800040000040700000073000021030303</string>
    </dict>

Share this post


Link to post
Share on other sites

Graphics Card Model: Radeon R9 290X

Graphics Card Manufactor: Sapphire

 

Patched Framebuffer: Exmoor

 

00 04 00 00  04 03 00 00  00 01  04 00  12  04  02  01 DP

00 08 00 00  00 02 00 00  00 01  03 07  22  05  03  03 HDMI
00 04 00 00  04 03 00 00  00 01  02 07  11  02  01  04 DVI-D (upper)
00 04 00 00  04 03 00 00  00 01  01 07  10  00  06  06 DVI-D (lower)
 
only patch which works with 2 (DVI) screens but system not stable: a lot of "surface testing not allowed" messages in system.log

Share this post


Link to post
Share on other sites

Here are FB patches that I was using for construction of AMD Radeon GPU Injector tool:

FB patch based on Sapphire HD6450 1GB / 100322L (device id - 0x6779)

Personality: Ipomoea

000400000403000000010000120401050008000004020000000100001102040310000000100000000001000000000002

patch:

040000001402000000010000100002040008000004020000000100002103010210000000100000000001000000100301
FB patch based on MSI HD6790 1GB / R6790-2PM2D1GD5 (device id - 0x673E)

Device id changes: 0x67381002 >>> 0x673E1002

Personality: Bulrushes

000400000403000000010000110201010004000004030000000100002103020200040000040300000001000012040303000400000403000000010000220504040004000004030000000100001000050500040000040300000001000020010606

patch:

000400000403000000010000120401010004000004030000000100002205020200080000040200000001000011020304040000001402000000010000110204060002000004020000000100001000050500020000040200000001000000100605
FB patch based on Asus Radeon EAH6850 1GB / DC/2DIS/1GD5/V2 (device id - 0x6739)

Personality: Duckweed

00040000040300000001000012040401000400000403000000010000220505020008000004020000000100001102030400020000140200000001000000000605

patch:

00040000040300000001000012040401000800000002000000010000220506040002000004000000000100001102010604000000140200000001000010000305
FB patch based on Asus Radeon EAH6870 1GB / DC/2DI2S/1GD5 (device id - 0x6738)

Personality: Gibba

0004000004030000000100001204050100040000040300000001000022050402000800000402000000010000110206040002000014020000000100000000030504000000040200000001000011020103

patch:

0004000004030000000100001204040100040000040300000001000022050502000800000402000000010000110206040002000014020000000100000000030504000000040200000001000011020106
FB patch based on MSI HD7730 1GB / R7730-1GD5V1 (device id - 0x6837)

Device id changes: 0x68391002 >>> 0x68371002

Personality: Dashimaki

00040000040300000001010112040401000400000403000000010201220505020400000014020000000103000000060600080000040200000001040011020103

patch

00020000040200000001000010000304000200000402000000010000001004040008000000020000000100002205020500040000040300000001000012040102
FB patch based on Asus HD7870 2GB / HD7870-DC2-2GD5-V2 (device id - 0x6818)

Personality: Futomaki

00040000040300000001010112040401000400000403000000010201220505020400000014020000000103000000060600080000040200000001040011020103

patch

00040000040300000001030012040101000400000403000000010400220502020400000014020000000101001000040600080000000200000001020011020303
FB patch based on PowerColor PCS+ R9 270X 2GB / AXR9 270X 2GBD5-PPDHE (device id - 0x6810)

Personality: Futomaki

00040000040300000001010112040401000400000403000000010201220505020400000014020000000103000000060600080000040200000001040011020103

patch

00020000040200000001000010000306040000001402000000010000110205050008000000020000000100002205020300040000040300000001000012040101
FB patch based on Gigabyte R9 280X 3GB / GV-R928XOC-3GD/F60 (device id - 0x6798)

Personality: Futomaki

00040000040300000001010112040401000400000403000000010201220505020400000014020000000103000000060600080000040200000001040011020103

patch

00020000040200000001000010000406000800000002000000010000110203040004000004030000000100001204010100040000040300000001000022050202
FB patch based on Sapphire Vapor R9 290X 8GB / 100361-8GVXSR (device id - 0x67B0)

Personality: Baladi

000400000403000000010300120403030004000004030000000101001102010100040000040300000001020021030202000400000403000000010400220504040004000004030000000105001000050500040000040300000001060020010606

patch

000800000402000000010200220502030004000004030000000101011204010100040000040300000001020021030202040000001402000000010300110203040004000004030000000105001000050500020000040200000001040110000406

Share this post


Link to post
Share on other sites

Sapphire R9 390 Nitro 8GB Backplate recognized as an R9 290 8GB

 

I did patch the gpu bios enabling driver independent temperature controlled fans.

 

Original Baladi:

00040000 04030000 00010300 12040303
00040000 04030000 00010100 11020101
00040000 04030000 00010200 21030202
00040000 04030000 00010400 22050404
00040000 04030000 00010500 10000505
00040000 04030000 00010600 20010606

00040000 04030000 00010300 12040303 00040000 04030000 00010100 11020101 00040000 04030000 00010200 21030202 00040000 04030000 00010400 22050404 00040000 04030000 00010500 10000505 00040000 04030000 00010600 20010606

Ordered Original Baladi - wanted to see if the order matters:

00040000 04030000 00010100 11020101 
00040000 04030000 00010200 21030202 
00040000 04030000 00010300 12040303 
00040000 04030000 00010400 22050404 
00040000 04030000 00010500 10000505 
00040000 04030000 00010600 20010606

00040000 04030000 00010100 11020101 00040000 04030000 00010200 21030202 00040000 04030000 00010300 12040303 00040000 04030000 00010400 22050404 00040000 04030000 00010500 10000505 00040000 04030000 00010600 20010606

Patched Ordered Working but loosing screen aka going and staying dark after some time:

00080000 04020000 00010100 22050403
00040000 04030000 00010200 12040101 
00040000 04030000 00010300 10000205 
00040000 04030000 00010400 20010306 
04000000 14020000 00010500 11020504 
00040000 04030000 00010600 20010606

Patched Ordered Working w/o going dark:

NOTICE THIS LITTEL GUY	 |
			 v
00080000 04020000 00010101 22050403	changing from 00010100 to  00010101 here
00040000 04030000 00010200 12040101 
00040000 04030000 00010300 10000205 
00040000 04030000 00010400 20010306 
04000000 14020000 00010500 11020504 
00040000 04030000 00010600 20010606


00080000 04020000 00010101 22050403 00040000 04030000 00010200 12040101 00040000 04030000 00010300 10000205 00040000 04030000 00010400 20010306 04000000 14020000 00010500 11020504 00040000 04030000 00010600 20010606

Share this post


Link to post
Share on other sites

Graphics Card Model: Radeon R9 390 G1

Graphics Card Manufactor: Gigabyte

 

Patched Framebuffer: Baladi

 

00040000 04030000 00010000 12040101

00040000 04030000 00010000 10000205

00040000 04030000 00010000 20010306

00080000 00020000 00010001 22050403

04000000 14020000 00010000 11020504

 

000400000403000000010000120401010004000004030000000100001000020500040000040300000001000020010306000800000002000000010001220504030400000014020000000100001102050400040000040300000001020021030202

Share this post


Link to post
Share on other sites

Hope this helps someone.

 

Graphics Card Model: Radeon HD 6970M 2GB

Graphics Card Manufacturer: Dell

 

Patched Framebuffer: Cattail

 

02  00  00  00  40  00  00  00  29  05  00  00  10  00  00  05 - LVDS (Patched)

00  04  00  00  04  03  00  00  00  01  00  00  11  02  01  01 - DP

00  04  00  00  00  01  00  00  00  09  10  00  21  03  02  02 - DP

00  08  00  00  04  02  00  00  00  01  04  00  12  04  03  03 - HDMI (Patched)

 

Most frequent use of this would be in a Dell Precision M6600 (also used for an AMD FirePro M8900).

Share this post


Link to post
Share on other sites

ATI Mobility Radeon HD 3650 on Toshiba Satellite A300 Laptop on El Capitan

 

The framebuffer working was:

 

VGA (successfully detected and enabled - no QE/CI)

10000000100000000001000000100101

 

LVDS (successfully detected and enabled - DIFFERENT VALUES FROM SCRIPTS IN BOLD - no QE/CI)

02000000140200000901000010010211

 

HDMI (successfully detected but showed nothing in monitor - no QE/CI)

00080000000200000001000010000302

 

S-Video - not tested

 

Load VBIOS, Inject EDID and Rename from OVGA to IGPU in DSDT were essential for the monitors to work.

Share this post


Link to post
Share on other sites
On 13/04/2016 at 12:33 PM, Vlada. said:

Here are FB patches that I was using for construction of AMD Radeon GPU Injector tool:


FB patch based on Sapphire HD6450 1GB / 100322L (device id - 0x6779)

Personality: Ipomoea

000400000403000000010000120401050008000004020000000100001102040310000000100000000001000000000002

patch:

040000001402000000010000100002040008000004020000000100002103010210000000100000000001000000100301

Hello, This FB works in Gigabyte AMD Readeon HD R5 230 - 6450 ? In high sierra ...

Share this post


Link to post
Share on other sites

Graphics Card Model: Sapphire Pulse Radeon RX 560 2G GDDR5

Graphics Card Manufacture Name: Sapphire

Graphics Card Manufacture Part Number: 11267-02-20G
Fixed by: J1mmyS

Patched Framebuffer: Acre

000400000403000000010100000000001102050100000000
000800000402000000010200000000002103030400000000
040000001402000000010300000000001000040500000000

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By karthiksh1989
      can somebody walkthrough with the mojave installation guide?
      i have a mac high sierra 13.6 version on my macbook pro and want to install mojave on my desktop
      Exact config is Gigabyte gaming wifi 7 motherboard amy ryzen 7 2nd gen 2700X processor Gigabyte G1 8GB grapgic card VEGA 64
      running 2 nvme Samsung 256gb cards and 1 intel 180gb ssd internal and 1tb WD HDD, with 64 GB 3200Mhz Ram
       
      https://wa.me/919611736534 (whatsapp)
    • By Fede1132
      Hi guys i have a problem install macOs Mojave on my PC, I have this configuration:

      CPU: Ryzen 7 2700X;
      GPU1: GTX 970 Strix(For game rendering and 144Hz Monitor);
      GPU2: GTX 750ti Strix(For 2nd monitor rendering to get 100% performances from 1st 144Hz Monitor);
      MotherBoard: MSI x470 GAMING PLUS
      Hard Disk 1 (Windows 10): Samsung EVO M.2;
      Hard Disk 2 (For Storage): RAID (1) between two hard disks;
      Hard Disk 3 (For Mojave): Kingston SSD 120GB;

      I have created my USB with this:
       
      Create Bootable USB Code: sudo /Applications/Install\ macOS\ Mojave.app/Contents/Resources/createinstallmedia --volume /Volumes/USB -- /Applications/Install\ macOS\ Mojave.app -- nointeract && say Done. Clover Settings: Boot: Verbose; dart=0; nv_disable=0; kext-dev-mode=1; GraphicsEnabler=No; XMPDetection = No. Cpu: C6. Devices: (Not Enabled = [ ] - Enabled = [-] - Full Enabled [✓]) Inject (Full Enabled); Add ClockID (Full Enabled); FixOwnership (Full Enabled); Gui: (Not Enabled = [ ] - Enabled = [-] - Full Enabled [✓]) Enabled (Full Enabled); Screen Resolution: 1920x1080; Kernel and Kext Patches: (Not Enabled = [ ] - Enabled = [-] - Full Enabled [✓]) Apple RTC (Full Enabled); KernelPm (Full Enabled); SMBIOS: iMac(18,3); System Parameters: Inject Kexts = Yes; Inject System ID; Used Kexts: FakeSMC FakePCIID NVIDIA WEB LILU BIOS: VT-d = Disabled; XHCI Hand-Off = Enabled; Legacy USB Support: Enabled; Hard Disk: AHCI Mode; Selection Mode: Legacy + EUFI; Clover Install Log:
      Full Error Log:
       
    • By grisno
      Hi people,
       
      Installer to activate the sound card REALTEK ALC282-v2 (10ec:0282) with LayoutID 1 or 3 in MacOS. This installer does not contain AppleHDA patched Kext. To work properly, it must be installed over vanilla AppleHDA.kext.
       
      I want to thank the whole community for their efforts and content provided, because without these it would not be possible to create this installer.
       
      I would appreciate comments and suggestions!!
       
      Status:
      Speakers : OK Headphones : OK HDMI Audio : OK (Intel HD4K Tested) LineIn : N/A (Model Without LineIn) MicInt : OK MicIntNoiseReduction : OK MicExt : N/A (Model Without MicExt) AutoDetectLineIn : N/A (Model Without LineIn) Sleep : OK WakeUp : OK AutoSleep : OK Hibernate : OK Siri : OK   Tested Laptops:
       
      - HP Pavillion 15-D002SS
       
      Coming Soon:
       
      - Unified installer for the different supported operating systems.
      - Support model with LineIn jack.
       
      Modified Verbs:
      01271C20 01271D00 01271EA0 01271F90 01471C10 01471D00 01471E17 01471F90 01871CF0 01871D00 01871E00 01871F40 01E71CF0 01E71D00 01E71E00 01E71F40 02171C30 02171D10 02171E21 02171F00 01470C02   DSDT:
       
      Patch to apply with MaciASL in your DSDT
      ######################################### HDEF v1.00######################################## into method label _DSM parent_label HDEF remove_entry;into device label HDEF insertbeginMethod (_DSM, 4, NotSerialized)\n{\n If (LEqual (Arg2, Zero)) { Return (Buffer() { 0x03 } ) }\n Return (Package()\n {\n "layout-id", Buffer() { 0x01, 0x00, 0x00, 0x00 },\n //"layout-id", Buffer() { 0x03, 0x00, 0x00, 0x00 },\n "hda-gfx", Buffer() { "onboard-1" },\n "PinConfigurations", Buffer() { },\n })\n}\nend;  
    • By ludufre
      [GUIA] Correção de assinatura BIOS Insyde H2O
       
      Recentemente comprei um notebook Lenovo L440 pra instalar o macOS Mojave e fui substituir a placa wireless pela DW1560 porque a atual não é compatível. Descobri que existia uma whitelist de placas permitidas que as fabricantes estão adotando recentemente (no meu caso utiliza uma bios Phoenix Insyde BIOS H2O).
       
      Procurei em fórums de BIOS MODDING e encontrei pessoas que fizeram o patch pra mim. Só que após substituir a BIOS notei que o computador ficava apitando 5 vezes todas vez que ligava e fui me aprofundar no caso. E foi aí que descobri como resolver isso e por isso criei esse guia baseado nas informações que achei em alguns fóruns russos.
       
       
      Prefácio
       
      Quando a BIOS falha no teste te integridade, algumas funcionalidades Intel AMT param de funcionar e é emitido uma sequência de 5 apitos duas vezes no boot.
      Após modificar para remover whitelist (habilitar placas WI-FI não autorizadas), destravar MSR 0xe2 (hackintosh), habilitar menu avançado, etc. a BIOS não vai passar no teste de integridade causando esse problema.
      Essa verificação de integridade é feita através da assinatura RSA do bloco da BIOS chamado TCPABIOS (mais informações abaixo) com a chave pública no formato modulus 3 também armazenada na BIOS.
      Esse bloco TCPABIOS armazena os checksums de cada volume da BIOS.
       
      O que faremos é gerar novos checkums para esses volumes que foram modificados, gerar um para de chaves RSA (privada e pública), assinar esse bloco com a chave privada e substituir a chave pública.
       
       
      Ferramentas necessárias
       
      - EFITool NE alpha 54: https://github.com/LongSoft/UEFITool/releases
      - HxD 2.1.0: https://mh-nexus.de/en/hxd/
      - OpenSSL: http://gnuwin32.sourceforge.net/packages/openssl.htm (Download -> Binaries)
      - Microsoft File Checksum Integrity Verifier (FCIV.exe): https://www.microsoft.com/en-us/download/details.aspx?id=11533
       
      Passo a passo
       
      Vamos abrir a BIOS modificada, localizar o bloco TCPABIOS e entender sua anatomia.
       
      1. Abra a BIOS no HxD
       

      (Vamos utilizar nesse guia a BIOS modificada no fórum MyDigitalLife.com pelo usuário Serg008 para o notebook Lenovo B590)
       
      2. Busque a palavra TCPABIOS:
       


       
      3. O bloco começa com TCPABIOS e termina com antes de TCPACPUH
       

       
      4. Anatomia:
       
      54 43 50 41 42 49 4F 53 48 31 38 34 61 31 31 2F
      32 36 2F 31 33 49 42 4D 53 45 43 55 52 00 FD 27
      34 2A 35 AB 41 26 39 E3 32 E5 B6 8A D6 49 5B 0B
      77 F9 82 58 48 00 00 00 CE 18 1F 00 00 00 03 00
      00 00 00 00 00 00 27 00 00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00 00 00 00 FF FF 83 04 D4
      52 52 95 C5 D7 21 55 78 0E 5C AD 47 EE C4 3D 1D
      C1 EC 69 03 2B 51 A5 42 61 96 22 F9 7B 88 57 B7
      A8 9D D0 20 DB 5B 11 10 55 07 84 6C 62 DF FA 2F
      6A A8 43 0C 8A 40 AF 79 0D 31 DB 5A 5D C8 2F EB
      F8 7C 87 B0 A6 3D 2A 88 AE 91 9D 88 E3 AA 85 E3
      5A B3 91 7F 28 68 1F BA 92 C4 7E 10 F5 1A 7E 75
      A9 6F CE C0 4F BA FA 79 A5 98 2B 50 60 BA 09 73
      7B 03 D1 0C 3E A2 9C 44 DF E9 F2 92 34 7B
       
      Cinza: Nome e informações do bloco
      Vermelho: Informações dos volumes (Checksum e Cabeçalho)
      Azul: Separação da lista de volumes para a assinatura do bloco
      Verde: Assinatura do bloco TCPABIOS são os últimos 128 bytes
       
      Lista de Volumes:
       
      Cada volume tem o formato: 00 FD 27 34 2A 35 AB 41 26 39 E3 32 E5 B6 8A D6 49 5B 0B 77 F9 82 58 48 00 00 00 CE 18 1F 00 00 00 03 00 00 00 00 00
                                                      (prefixo 3 bytes + checksum 20 bytes + offset 4 bytes + tamanho do volume 6 bytes + separador do fim 6 bytes)
       
      Os volumes são enumerados e utilizam o primeiro byte no prefixo para isso (00 FD 27), começando do 0.
      A BIOS utilizada nesse exemplo possui somente um volume, mas no caso de mais de um volume, seria: 00 FD 27 .., 01 FD 27 ..., 02 FD 27 ...
      - Checksum é o cálculo SHA1 do volume.
      - Offset é a posição do volume dentro da BIOS. Os bytes ficam invertidos, nesse caso seria 00 00 00 48 ou seja: 48h
      - Tamanho do volume também está com os bytes invertidos, então: 1F18CEh
       
      Então é isso. Precisamos corrigir essas informações (checksum, offset e tamanho)
       
      5. Para extrair os volumes abra a BIOS com o UEFITool e veja como identificar os volumes (nosso exemplo há somente um volume, se houvessem outros estariam também dentro de EfiFirmwareFileSystemGuid):
       

       
      Na BIOS original, circulado em vermelho podemos ver o nosso volume.
      Observe que em azul temos Offset e verde o tamanho. Exatamente como verificamos acima no HxD. Já na BIOS modificada vemos que está diferente o tamanho:
      Oridinal: 1F18CEh
      Modificada: 1F12D5h (vamos precisar disso mais tarde)
       
      6. Vamos extrair esse volume escolhendo a opção “Extract as is...”
       
       
       
      7. Utilize esse comando para obter o checkum desse volume: fciv.exe -sha1 File_Volume_image_FvMainCompact.ffs
       

       
      Agora temos o checksum que é 396e0dc987219b4369b1b9e010166302ce635202
       
      8. Substitua as informações no bloco TCPABIOS:
       

       
      Observe que o tamanho do volume precisa ter os bytes invertidos, então se o total são 6 bytes e é 1F12D5h, fica D5 12 1F 00 00 00 no lugar de CE 18 1F 00 00 00.
      Se o offset for diferente, também realizar o mesmo procedimento invertendo os bytes.
      Checksum alterar de 34 2A 35 AB 41 26 39 E3 32 E5 B6 8A D6 49 5B 0B 77 F9 82 58 para 39 6E 0D C9 87 21 9B 43 69 B1 B9 E0 10 16 63 02 CE 63 52 02
       
      Faça esse procedimento para cada volume na BIOS.
       
      9. Agora precisamos gerar o checksum de todo o bloco TCPABIOS mas sem considerar os últimos 131 bytes, ou seja desconsiderar de FF FF 83 + 80 bytes da assinatura anterior.
       
      Copie para um novo arquivo no HxD e salve como tcpabios
       

       
      Utilize o comando para gerar o checksum desse bloco: fciv.exe -sha1 tcpabios
       

       
      Checksum do bloco TCPABIOS: 0da6715509839a376b0a52e81fdf9683a8e70e52
       
      Crie um novo arquivo no HxD e adicione 108 bytes com 00 e cole o checksum no final e salve como tcpabios_sha, ficando assim:
       

       
      10. Agora vamos gerar a chave privada RSA com modulus 3: openssl genrsa -3 -out my_key.pem 1024
       

       
      Assinar o arquivo tcpabios_sha: openssl rsautl -inkey my_key.pem -sign -in tcpabios_hash -raw > tcpabios_sign
       

       
      Agora aproveite para gerar a chave publica: openssl rsa -in my_key.pem -outform der -pubout -out my_key_pub.der
       

       
      E gerar modulus 3 da chave pública: openssl rsa -pubin -inform der -in my_key_pub.der -text -noout
       

       
      Copie e cole a chave em um arquivo de texto para utilizar daqui a pouco. Remova todos os “:” e coloque tudo em uma única linha, ficando assim:
       

       
      11.   Abra o arquivo tcpabios_sign no HxD, copie o conteúdo e substitua a assinatura no final do bloco TCPABIOS:
       
       
       
      12. Agora vamos localizar na BIOS o local da chave pública e substituir. Essa chave começa com 12 04 e termina com 01 03 FF e fica após o bloco TCPABBLK.
       
      A chave fica assim: 12 04 + 81 bytes + 01 03 FF. Faça uma busca por 01 03 FF para localizar mais facilmente. Verifique se antes dos 81 bytes tem os bytes 12 04 para ter certeza que achou.
       

       

       
      Agora substitua pela chave pública que ficou anotado no arquivo de texto anteriormente, ficando assim:
       

       
       
      Salve e está pronto. Sua BIOS está assinada e pronta.
       
    • By ludufre
      [GUIDE] Fix Insyde H2O BIOS signature (5 beeps on Lenovo)
       
      I recently bought a Lenovo L440 laptop to install the Mojave macOS and I replaced the wireless card with the DW1560 because the current one is not compatible. I discovered that there was a whitelist of enabled cards that manufacturers are adopting recently (in my case it uses a Phoenix Insyde BIOS H2O).
       
      I searched the BIOS Modding forums and found people who did the patch for me. But after replacing the BIOS I noticed that the computer keep beeping 5 times every time I boot. So, I went deeper into this issue and that's when I figured out how to solve it. Then I created this guide based on the information I found in some Russian forums.
       
      Preface
       
      When the BIOS integrity test fails, some Intel AMT functionality stops working and a sequence of 5 whistles is issued twice at boot.
      After modifying to remove whitelist (enable unauthorized WI-FI cards), unlock MSR 0xe2 (hackintosh), enable advanced menu, etc. the BIOS will not pass the integrity test causing this problem.
      This integrity check is done through the RSA signature of the BIOS block called TCPABIOS (more information below) with the public key in modulus 3 format also stored in the BIOS.
      This TCPABIOS block stores the checksums of each BIOS volume.
       
      What we will do is generate new checksum for those volumes that have been modified, generate a RSA (private and public) key pair, sign that block with the private key, and replace the public key.
       
       
      Tools needed
       
      - EFITool NE alpha 54: https://github.com/LongSoft/UEFITool/releases
      - HxD 2.1.0: https://mh-nexus.de/en/hxd/
      - OpenSSL: http://gnuwin32.sourceforge.net/packages/openssl.htm (Download -> Binaries)
      - Microsoft File Checksum Integrity Verifier (FCIV.exe): https://www.microsoft.com/en-us/download/details.aspx?id=11533
       
      Step by step
       
      Let's open the modified BIOS, locate the TCPABIOS block and understand its anatomy.
       
      1. Open the BIOS with HxD
       

      (We will use the modded BIOS in the MyDigitalLife.com forum by the Serg008 user for the Lenovo B590 laptop in this guide)
       
      2. Find the word TCPABIOS:
       


       
      3. The block starts with TCPABIOS and ends before TCPACPUH
       

       
      4. Anatomy:
       
      54 43 50 41 42 49 4F 53 48 31 38 34 61 31 31 2F
      32 36 2F 31 33 49 42 4D 53 45 43 55 52 00 FD 27
      34 2A 35 AB 41 26 39 E3 32 E5 B6 8A D6 49 5B 0B
      77 F9 82 58 48 00 00 00 CE 18 1F 00 00 00 03 00
      00 00 00 00 00 00 27 00 00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00 00 00 00 FF FF 83 04 D4
      52 52 95 C5 D7 21 55 78 0E 5C AD 47 EE C4 3D 1D
      C1 EC 69 03 2B 51 A5 42 61 96 22 F9 7B 88 57 B7
      A8 9D D0 20 DB 5B 11 10 55 07 84 6C 62 DF FA 2F
      6A A8 43 0C 8A 40 AF 79 0D 31 DB 5A 5D C8 2F EB
      F8 7C 87 B0 A6 3D 2A 88 AE 91 9D 88 E3 AA 85 E3
      5A B3 91 7F 28 68 1F BA 92 C4 7E 10 F5 1A 7E 75
      A9 6F CE C0 4F BA FA 79 A5 98 2B 50 60 BA 09 73
      7B 03 D1 0C 3E A2 9C 44 DF E9 F2 92 34 7B
       
      Gray: Name and Block Information
      Red: Volume Information (Checksum and Header)
      Blue: Separation of the list of volumes and the block signature
      Green: Signature of the TCPABIOS block are the last 128 bytes
       
      List of Volumes:
       
      Each volume has the format: 00 FD 27 34 2A 35 AB 41 26 39 E3 32 E5 B6 8A D6 49 5B 0B 77 F9 82 58 48 00 00 00 CE 18 1F 00 00 00 03 00 00 00 00 00
                                              (Prefix 3 bytes + checksum 20 bytes + offset 4 bytes + volume size 6 bytes + end delimiter 6 bytes)
       
      The volumes are enumerated and use the first byte in the prefix for this (00 FD 27), starting at 0.
      The BIOS used in this example has only one volume, but in the case of more than one volume, it would be: 00 FD 27 .., 01 FD 27 ..., 02 FD 27 ...
      - Checksum is SHA1 calculation of the volume.
      - Offset is the volume position within the BIOS. The bytes are inverted, in this case it would be 00 00 00 48, equals to 48h
      - Volume Size is also with the bytes inverted, then: 1F18CEh
       
      Then that's it. We need to correct this information (checksum, offset and size)
       
      5. To extract the volumes open the BIOS with the UEFITool and see how to identify the volumes (our example there is only one volume if there were others would also be inside EfiFirmwareFileSystemGuid):
       

       
      In the original BIOS, circled in red we can see our volume.
      Note that in blue we have offset and green the size. Exactly as we checked up on HxD. In the modified BIOS we see that the size is different:
      Original: 1F18CEh
      Modified: 1F12D5h (we'll need this later)
       
      6. Let's extract this volume to calculate the checksum by choosing the "Extract as is ..."
       
       
       
      7. Use this command to get the checksum of this volume: fciv.exe -sha1 File_Volume_image_FvMainCompact.ffs
       

       
      Now we have the checksum that is 396e0dc987219b4369b1b9e010166302ce635202
       
      8. Replace the information in the TCPABIOS block:
       

       
      Note that the volume size must have the bytes inverted, so if the total is 6 bytes and is 1F12D5h, becomes D5 12 1F 00 00 00 in place of CE 18 1F 00 00 00.
      If the offset is different, also perform the same process by inverting the bytes.
      Checksum change from 34 2A 35 AB 41 26 39 E3 32 E5 B6 8A D6 49 5B 0B 77 F9 82 58 to 39 6E 0D C9 87 21 9B 43 69 B1 B9 E0 10 16 63 02 CE 63 52 02
       
      Do this for each volume in the BIOS.
       
      9. Now we need to generate the checksum of the whole TCPABIOS block but without considering the last 131 bytes, that is to dismiss FF FF 83 + 80 bytes from the previous signature.
       
      Copy to a new file in HxD and save as tcpabios
       

       
      Use the command to generate the checksum of this block: fciv.exe -sha1 tcpabios
       

       
      Checksum of TCPABIOS block: 0da6715509839a376b0a52e81fdf9683a8e70e52
       
      Create a new file in HxD and add 108 bytes with 00 and paste the checksum at the end and save as tcpabios_hash, thus:
       

       
      10. Now let's generate the RSA private key with modulus 3: openssl genrsa -3 -out my_key.pem 1024
       

       
      Sign the file tcpabios_hash: openssl rsautl -inkey my_key.pem -sign -in tcpabios_hash -raw > tcpabios_sign
       

       
      Now enjoy to generate the public key: openssl rsa -in my_key.pem -outform der -pubout -out my_key_pub.der
       

       
      And generate public key modulus 3: openssl rsa -pubin -inform der -in my_key_pub.der -text -noout
       

       
      Copy and paste the key into a text file to use soon. Remove all ":" and put everything on a single line, thus:
       

       
      11.   Open the tcpabios_sign file in HxD, copy the contents and replace the signature at the end of the TCPABIOS block:
       
       
       
      12. Now let's locate the location of the public key in the BIOS and replace it. This key starts with 12 04 and ends with 01 03 FF and is after the TCPABBLK block.
       
      The key looks like this: 12 04 + 81 bytes + 01 03 FF. Search for 01 03 FF to locate more easily. Verify that before the 81 bytes have bytes 12 04 to make sure you found.
       

       

       
      Now substitute for the public key that was annotated in the text file previously, thus:
       

       
       
      Save and you're ready. Your BIOS is signed and ready.
×