Badcaps Forums - View Single Post - BIOS guides, methods, resources and tools

**piernov** · 02-06-2022, 09:21 AM

1. How to dump and flash
1.1. BIOS
BIOS can be updated from software using the manufacturer's tool. It can also often be dumped from software (although not really reliable).
However, if you need to re-flash the BIOS because the computer does not boot and BIOS recovery procedure does not work, you need an external programmer.
Likewise, if you want to modify the BIOS to remove a password, it must be done with an external programmer.

When flashing a BIOS always make a backup first. Take 2 or 3 different dumps and make sure they are identical.
On Windows, you can use the command "fc /b" to check if two dumps are identical.
Make sure that the dumps looks good, i.e. not filled with 0x00 or 0xFF. After compression, if the file has a size of only a few kilobytes, the EEPROM was most likely not read properly.

Additionally, please read the FAQ at: https://www.badcaps.net/forum/showthread.php?t=98665

1.1.1. Programmers
TL866II is arguably the most reliable and easy to use programmer while still being relatively cheap.
If you also need eMMC support, consider T56 or RT809H
If you need LCD monitor In-System Programming through VGA port, consider RT809F or RT809H.

1.1.1.1. TL866II
Supports I2C, SPI, LPC, FWH, parallel.
Support list: http://www.autoelectric.cn/MiniPro/TL866II_List.txt

1.1.1.2. T56
Supports I2C, SPI, LPC, FWH, parallel, eMMC.
Support list: http://www.xgecu.com/MiniPro/T56_List.txt

1.1.1.3. RT809F
Supports I2C, SPI, LPC, FWH, VGA ISP.
Parallel interfaces support requires PEB-1 extension board and can be troublesome.
Support list: https://www.hklrf.com/Download__1.html
Software: http://doc.ifix.net.cn/@rt809/ENGLISH.html

1.1.1.4. RT809H
Supports I2C, SPI, LPC, FWH, parallel, eMMC, VGA ISP.
Support list: https://www.hklrf.com/Download__1.html
Software: http://doc.ifix.net.cn/@rt809/ENGLISH.html

1.1.1.5. EZP2019
Supports I2C (24-series), SPI (25-series), 93-series.
Support list: https://www.hklrf.com/24download/img/EZP2019-List.txt

Note: Auto-detection may not work properly for 8Mb and larger ROMs, it is recommended to select the part number manually. In addition, if there are errors when reading and writing, try to lower the speed.

1.1.1.6. CH341A
Supports I2C (24-series), SPI (25-series).

This programmer is not recommended but it is the cheapest programmer available.
It has several shortcomings:

Limited interfaces support, only SPI and I2C
Several different software with varying level of reliability and ROM IC support (especially troublesome with 128Mb and larger ICs)
Several different hardware design, some of them having design defects
No proper detection of communication issue with the ROM IC

Available software include: NeoProgrammer, Colibri, AsProgrammer, Flashrom…
Read the guide there: https://winraid.level1techs.com/t/gu...rammer/32948/3

If you have a black PCB, it is very likely that it needs to be modified for 3V operation instead of 5V. Failing to do so could damage the ROM IC.
Watch the instructions there:
https://www.youtube.com/watch?v=-ln3VIZKKaE
https://www.youtube.com/watch?v=HwnzzF645hA

1.1.2. Adapters

It is possible to use clips on SOIC-8 ICs to avoid desoldering, however it is *very unreliable* and will often lead to an empty or corrupt dump. Avoid whenever possible.
If you insist on using a clip, then make sure the programmer uses an additional buffer and line driver for SPI. For the TL866II this is available as an additional adapter, the T56 has it built-in.
It is recommended to desolder the chip and use an adapter board or socket. They exist for all sorts of packages: SOIC-8 200mil, SOIC-8 150mil, SOIC-16, WSON-8 8x6mm, WSON-8 6x5mm, USON-8 4x3mm, PLCC-32, TSSOP-48…

Most common packages for the BIOS SPI ROM on modern boards are SOIC-8 200mil and WSON-8 8x6mm.
Desktop boards sometimes use DIP-8 which can be inserted directly into the programmer.
Desktop boards before around 2005 used PLCC-32 (which can use a LPC, FWH or parallel bus), even older boards (in the 90s or older) used DIP-32.

MacBook Pro 15"/17" boards before 2015, MacBook Pro 13" non-Retina and MacBook air before 2011 use SOIC-8 200mil
MacBook Air and MacBook Pro 13" Retina boards between 2011 and 2015 use WSON-8 8x6mm.
Apple boards from 2015 to 2017 use WSON-8 6x5mm.
Apple boards from 2018 onwards use USON-8 4x3mm for T2/M1 ROM.

1.2. EC

Dumping and flashing EC often requires a dedicated EC programmer. Some EC can be flashed with regular SPI ROM programmers.
List of EC that may require programming: https://www.badcaps.net/forum/showthread.php?t=66963

1.2.1. Programmers

1.2.1.1. SVOD3

Code:

ENE
ITE
Nuvoton
SMSC

SVOD3 debug ZIF programming PCB - https://www.badcaps.net/forum/showthread.php?t=108704

1.2.1.2. SVOD4

Code:

ENE
ITE
Nuvoton
SMSC

1.2.1.3. Vertyanov

Code:

ENE
ITE
Nuvoton
SMSC

1.2.1.4. RT809H
Support list: https://www.hklrf.com/Download__1.html

Code:

ENE
 KB9010
 KB9012
 KB9016
 KB9018
 KB9022
 KB9028
ITE
 IT8386E
 IT8580E
 IT8585E
 IT8586E
 IT8587E
 IT8595E
 IT8985E
 IT8987E
 IT8996E
Nuvoton
 NPCE288N
 NPCE388N
SMSC 
 MEC1653
 MEC1650
 MEC1633
 MEC1609
 MEC1619
 MEC1618
 MEC5035
 MEC5045
 MEC5055
 MEC5075
 MEC5085

1.2.1.5. RT809F
Not a dedicated EC programmer, standalone programmer supports EC SPI and JTAG interfaces only. PEB-1 extension board supports ITE interface.

Support list: https://www.hklrf.com/Download__1.html

Code:

ENE
 KB9010
 KB9012
 KB9016
 KB9018
 KB9022
 KB9028
ITE (requires PEB-1 extension board)
 IT8580
 IT8585
 IT8586
 IT8587
 IT8985
 IT8595
 IT8987
 IT8996E
SMSC
 MEC1653
 MEC1650
 MEC1633
 MEC1609
 MEC1619
 MEC1618
 MEC5035
 MEC5045
 MEC5055
 MEC5075
 MEC5085

1.2.1.6. T56
Not a dedicated EC programmer, supports EC SPI interface only.
Support list: http://www.xgecu.com/MiniPro/T56_List.txt

Code:

ENE
 KB9010
 KB9012
 KB9016
 KB9018
 KB9022

1.2.1.7. TL866II
Not a dedicated EC programmer, supports EC SPI interface only.

Support list: http://www.autoelectric.cn/MiniPro/TL866II_List.txt

Code:

ENE
 KB9010
 KB9012
 KB9016
 KB9018
 KB9022

1.2.2. Adapters
Adapter boards exist for some programmers, chip must be (partially) soldered on the adapter board, then the adapter board is connected to the programmer to be flashed.

In most cases, EC can also be programmed in-system through the keyboard connector. Adapter for the programmer to keyboard connector is required, as well as correct cable (keyboard connectors can have different number of pins and different pitch). Pinout of the keyboard connector matching the EC programming interface must be known and set up in the programmer software.

1.2.3. Automatic flashing

Some platforms can automatically flash a blank EC from the image stored in an external SPI ROM alongside the main BIOS when power is first applied. This assumes that there is no other issue on the board.
Platform with automatic flashing:

Most Asus laptops
Quanta Y11A
To be completed…

02-06-2022, 09:21 AM	#2
piernov Super Moderator Join Date: Jan 2016 City & State: Valbonne, 06 My Country: France I'm a: Knowledge Seeker Posts: 4,051	Re: BIOS guides, methods, resources and tools 1. How to dump and flash 1.1. BIOS BIOS can be updated from software using the manufacturer's tool. It can also often be dumped from software (although not really reliable). However, if you need to re-flash the BIOS because the computer does not boot and BIOS recovery procedure does not work, you need an external programmer. Likewise, if you want to modify the BIOS to remove a password, it must be done with an external programmer. When flashing a BIOS always make a backup first. Take 2 or 3 different dumps and make sure they are identical. On Windows, you can use the command "fc /b" to check if two dumps are identical. Make sure that the dumps looks good, i.e. not filled with 0x00 or 0xFF. After compression, if the file has a size of only a few kilobytes, the EEPROM was most likely not read properly. Additionally, please read the FAQ at: https://www.badcaps.net/forum/showthread.php?t=98665 1.1.1. Programmers TL866II is arguably the most reliable and easy to use programmer while still being relatively cheap. If you also need eMMC support, consider T56 or RT809H If you need LCD monitor In-System Programming through VGA port, consider RT809F or RT809H. 1.1.1.1. TL866II Supports I2C, SPI, LPC, FWH, parallel. Support list: http://www.autoelectric.cn/MiniPro/TL866II_List.txt 1.1.1.2. T56 Supports I2C, SPI, LPC, FWH, parallel, eMMC. Support list: http://www.xgecu.com/MiniPro/T56_List.txt 1.1.1.3. RT809F Supports I2C, SPI, LPC, FWH, VGA ISP. Parallel interfaces support requires PEB-1 extension board and can be troublesome. Support list: https://www.hklrf.com/Download__1.html Software: http://doc.ifix.net.cn/@rt809/ENGLISH.html 1.1.1.4. RT809H Supports I2C, SPI, LPC, FWH, parallel, eMMC, VGA ISP. Support list: https://www.hklrf.com/Download__1.html Software: http://doc.ifix.net.cn/@rt809/ENGLISH.html 1.1.1.5. EZP2019 Supports I2C (24-series), SPI (25-series), 93-series. Support list: https://www.hklrf.com/24download/img/EZP2019-List.txt Note: Auto-detection may not work properly for 8Mb and larger ROMs, it is recommended to select the part number manually. In addition, if there are errors when reading and writing, try to lower the speed. 1.1.1.6. CH341A Supports I2C (24-series), SPI (25-series). This programmer is not recommended but it is the cheapest programmer available. It has several shortcomings: Limited interfaces support, only SPI and I2C Several different software with varying level of reliability and ROM IC support (especially troublesome with 128Mb and larger ICs) Several different hardware design, some of them having design defects No proper detection of communication issue with the ROM IC Available software include: NeoProgrammer, Colibri, AsProgrammer, Flashrom… Read the guide there: https://winraid.level1techs.com/t/gu...rammer/32948/3 If you have a black PCB, it is very likely that it needs to be modified for 3V operation instead of 5V. Failing to do so could damage the ROM IC. Watch the instructions there: https://www.youtube.com/watch?v=-ln3VIZKKaE https://www.youtube.com/watch?v=HwnzzF645hA 1.1.2. Adapters It is possible to use clips on SOIC-8 ICs to avoid desoldering, however it is very unreliable and will often lead to an empty or corrupt dump. Avoid whenever possible. If you insist on using a clip, then make sure the programmer uses an additional buffer and line driver for SPI. For the TL866II this is available as an additional adapter, the T56 has it built-in. It is recommended to desolder the chip and use an adapter board or socket. They exist for all sorts of packages: SOIC-8 200mil, SOIC-8 150mil, SOIC-16, WSON-8 8x6mm, WSON-8 6x5mm, USON-8 4x3mm, PLCC-32, TSSOP-48… Most common packages for the BIOS SPI ROM on modern boards are SOIC-8 200mil and WSON-8 8x6mm. Desktop boards sometimes use DIP-8 which can be inserted directly into the programmer. Desktop boards before around 2005 used PLCC-32 (which can use a LPC, FWH or parallel bus), even older boards (in the 90s or older) used DIP-32. MacBook Pro 15"/17" boards before 2015, MacBook Pro 13" non-Retina and MacBook air before 2011 use SOIC-8 200mil MacBook Air and MacBook Pro 13" Retina boards between 2011 and 2015 use WSON-8 8x6mm. Apple boards from 2015 to 2017 use WSON-8 6x5mm. Apple boards from 2018 onwards use USON-8 4x3mm for T2/M1 ROM. 1.2. EC Dumping and flashing EC often requires a dedicated EC programmer. Some EC can be flashed with regular SPI ROM programmers. List of EC that may require programming: https://www.badcaps.net/forum/showthread.php?t=66963 1.2.1. Programmers 1.2.1.1. SVOD3 Code: ENE ITE Nuvoton SMSC SVOD3 debug ZIF programming PCB - https://www.badcaps.net/forum/showthread.php?t=108704 1.2.1.2. SVOD4 Code: ENE ITE Nuvoton SMSC 1.2.1.3. Vertyanov Code: ENE ITE Nuvoton SMSC 1.2.1.4. RT809H Support list: https://www.hklrf.com/Download__1.html Code: ENE KB9010 KB9012 KB9016 KB9018 KB9022 KB9028 ITE IT8386E IT8580E IT8585E IT8586E IT8587E IT8595E IT8985E IT8987E IT8996E Nuvoton NPCE288N NPCE388N SMSC MEC1653 MEC1650 MEC1633 MEC1609 MEC1619 MEC1618 MEC5035 MEC5045 MEC5055 MEC5075 MEC5085 1.2.1.5. RT809F Not a dedicated EC programmer, standalone programmer supports EC SPI and JTAG interfaces only. PEB-1 extension board supports ITE interface. Support list: https://www.hklrf.com/Download__1.html Code: ENE KB9010 KB9012 KB9016 KB9018 KB9022 KB9028 ITE (requires PEB-1 extension board) IT8580 IT8585 IT8586 IT8587 IT8985 IT8595 IT8987 IT8996E SMSC MEC1653 MEC1650 MEC1633 MEC1609 MEC1619 MEC1618 MEC5035 MEC5045 MEC5055 MEC5075 MEC5085 1.2.1.6. T56 Not a dedicated EC programmer, supports EC SPI interface only. Support list: http://www.xgecu.com/MiniPro/T56_List.txt Code: ENE KB9010 KB9012 KB9016 KB9018 KB9022 1.2.1.7. TL866II Not a dedicated EC programmer, supports EC SPI interface only. Support list: http://www.autoelectric.cn/MiniPro/TL866II_List.txt Code: ENE KB9010 KB9012 KB9016 KB9018 KB9022 1.2.2. Adapters Adapter boards exist for some programmers, chip must be (partially) soldered on the adapter board, then the adapter board is connected to the programmer to be flashed. In most cases, EC can also be programmed in-system through the keyboard connector. Adapter for the programmer to keyboard connector is required, as well as correct cable (keyboard connectors can have different number of pins and different pitch). Pinout of the keyboard connector matching the EC programming interface must be known and set up in the programmer software. 1.2.3. Automatic flashing Some platforms can automatically flash a blank EC from the image stored in an external SPI ROM alongside the main BIOS when power is first applied. This assumes that there is no other issue on the board. Platform with automatic flashing: Most Asus laptops Quanta Y11A To be completed… __________________ OpenBoardView — https://github.com/OpenBoardView/OpenBoardView Last edited by SMDFlea; 05-07-2023 at 05:31 AM.. Reason: edited winraid link