Skip to content

Instantly share code, notes, and snippets.

@tostercx
Created September 26, 2024 13:01
Show Gist options
  • Save tostercx/f6fb1e486d8d89b021993e3bbba27282 to your computer and use it in GitHub Desktop.
Save tostercx/f6fb1e486d8d89b021993e3bbba27282 to your computer and use it in GitHub Desktop.
BEK-V429S modified bios RE

modified VER 2.01r

The call at 0x24FD is passed to a detour function that always returns 5. Not sure why the cache size is stored that way but the math works out. Before printing 0x10 << (5-1) is indeed 256K.

BIOS_F:24CD ; ---------------------------------------------------------------------------
BIOS_F:24CE aCacheMemory    db 'Cache Memory      : ',0
BIOS_F:24E3
BIOS_F:24E3 ; =============== S U B R O U T I N E =======================================
BIOS_F:24E3
BIOS_F:24E3 ; Attributes: info_from_lumina
BIOS_F:24E3
BIOS_F:24E3 print_cache_mem proc near
BIOS_F:24E3                 mov     al, cs:byte_FEB10
BIOS_F:24E7                 and     al, 0Ch
BIOS_F:24E9                 cmp     al, 8
BIOS_F:24EB                 jnz     short just_return
BIOS_F:24ED                 mov     si, 24CEh       ; "Cache Memory"
BIOS_F:24F0                 call    print_str
BIOS_F:24F3                 mov     si, 5A54h
BIOS_F:24F6                 call    sub_F1E10
BIOS_F:24F9                 or      al, al
BIOS_F:24FB                 jz      short print_space_none
BIOS_F:24FD                 call    get_cache_size_but_return_5   ; <------ this function is detoured
BIOS_F:2500                 or      al, al
BIOS_F:2502                 jnz     short print_K   ; if not 0, print K of mem
BIOS_F:2504
BIOS_F:2504 print_space_none:                       ; CODE XREF: print_cache_mem+18↑j
BIOS_F:2504                 mov     al, 20h ; ' '
BIOS_F:2506                 call    print_char
BIOS_F:2509                 mov     al, 20h ; ' '
BIOS_F:250B                 call    print_char
BIOS_F:250E                 jmp     short print_none ; None
BIOS_F:2510 ; ---------------------------------------------------------------------------
BIOS_F:2510
BIOS_F:2510 print_K:                                ; CODE XREF: print_cache_mem+1F↑j
BIOS_F:2510                 mov     cl, al
BIOS_F:2512                 dec     cl
BIOS_F:2514                 mov     ax, 10h
BIOS_F:2517                 shl     ax, cl          ; 0x10 << (5-1) = 256
BIOS_F:2519                 call    print_int
BIOS_F:251C                 mov     al, 4Bh ; 'K'
BIOS_F:251E                 call    print_char
BIOS_F:2521
BIOS_F:2521 just_return:                            ; CODE XREF: print_cache_mem+8↑j
BIOS_F:2521                 retn

...

BIOS_F:DF00 ; =============== S U B R O U T I N E =======================================
BIOS_F:DF00
BIOS_F:DF00
BIOS_F:DF00 get_cache_size_but_return_5 proc near   ; CODE XREF: print_cache_mem+1A↑p
BIOS_F:DF00                 call    get_cache_size       ; im not sure why they bother calling the original
BIOS_F:DF03                 cmp     al, 5
BIOS_F:DF05                 jz      short locret_FDF09   ; if al == 5 return
BIOS_F:DF07                 mov     al, 5                ; otherwise set al to 5, then return
BIOS_F:DF09
BIOS_F:DF09 locret_FDF09:                           ; CODE XREF: get_cache_size_but_return_5+5↑j
BIOS_F:DF09                 retn

Same function in VER 1.2

Here at 0x2420 it just goes to the actual function.

BIOS_F:23F0 ; ---------------------------------------------------------------------------
BIOS_F:23F1 aCacheMemory    db 'Cache Memory      : ',0
BIOS_F:2406
BIOS_F:2406 ; =============== S U B R O U T I N E =======================================
BIOS_F:2406
BIOS_F:2406
BIOS_F:2406 print_cache_mem proc near
BIOS_F:2406                 mov     al, cs:byte_FEB10
BIOS_F:240A                 and     al, 0Ch
BIOS_F:240C                 cmp     al, 8
BIOS_F:240E                 jnz     short just_return
BIOS_F:2410                 mov     si, 23F1h       ; "Cache Memory"
BIOS_F:2413                 call    print_str
BIOS_F:2416                 mov     si, 569Eh
BIOS_F:2419                 call    sub_F1D80
BIOS_F:241C                 or      al, al
BIOS_F:241E                 jz      short print_space_none
BIOS_F:2420                 call    get_cache_size  ; <------ not patched
BIOS_F:2423                 or      al, al
BIOS_F:2425                 jnz     short print_K   ; if not 0, print K of mem
BIOS_F:2427
BIOS_F:2427 print_space_none:                       ; CODE XREF: print_cache_mem+18↑j
BIOS_F:2427                 mov     al, 20h ; ' '
BIOS_F:2429                 call    print_char
BIOS_F:242C                 mov     al, 20h ; ' '
BIOS_F:242E                 call    print_char
BIOS_F:2431                 jmp     short print_none
BIOS_F:2433 ; ---------------------------------------------------------------------------
BIOS_F:2433
BIOS_F:2433 print_K:                                ; CODE XREF: print_cache_mem+1F↑j
BIOS_F:2433                 mov     cl, al
BIOS_F:2435                 dec     cl
BIOS_F:2437                 mov     ax, 10h
BIOS_F:243A                 shl     ax, cl
BIOS_F:243C                 call    print_int
BIOS_F:243F                 mov     al, 4Bh ; 'K'
BIOS_F:2441                 call    print_char
BIOS_F:2444
BIOS_F:2444 just_return:                            ; CODE XREF: print_cache_mem+8↑j
BIOS_F:2444                 retn
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment