VOGONS


Reply 22 of 46, by Predator99

User metadata
Rank l33t
Rank
l33t
kylix wrote on 2021-05-15, 14:24:
At the moment I am using this: https://www.elhvb.com/mobokive/Archive/PcChip … 9961230_AMI.zip But as I said, the behavior is th […]
Show full quote

At the moment I am using this:
https://www.elhvb.com/mobokive/Archive/PcChip … 9961230_AMI.zip
But as I said, the behavior is the same with any other working BIOS.
So the password seems not to be stored in the Flash/ROM?

And sadly my POST card is broken, so I can't tell you any number. How would the number help regarding the password?

I see your BIOS seems to compressed in some way which makes it difficult to patch this password request out. The only string I see inside is "ALI8789 ROM".

Otherwise my idea would have been to take a look at the BIOS source with a debugger and patch out the password request. This is very easy if you have the correponding POST-code at hand. Otherwise it takes some time to find the correct location in the code.

But with a compressed ROM I dont know how to compress it back after modification.

I will try to get this ROM running in PCem and take a look at it...later 😉

Reply 23 of 46, by BitWrangler

User metadata
Rank l33t++
Rank
l33t++

I've come across boards where password was enabled with a jumper or rigged to the keylock functionality. Also I've not seen mentioned the default password AMIAMIAMI which is all I've ever needed on Ami BIOS motherboards. However, on a non standard board, foxxcon made for an OEM I never IDed, when it's PW_EN jumper was set and the CMOS was cleared, it was only a blank string then, so just pressing return at the password prompt worked.

Unicorn herding operations are proceeding, but all the totes of hens teeth and barrels of rocking horse poop give them plenty of hiding spots.

Reply 24 of 46, by kylix

User metadata
Rank Newbie
Rank
Newbie
Predator99 wrote on 2021-05-15, 15:18:
I see your BIOS seems to compressed in some way which makes it difficult to patch this password request out. The only string I s […]
Show full quote
kylix wrote on 2021-05-15, 14:24:
At the moment I am using this: https://www.elhvb.com/mobokive/Archive/PcChip … 9961230_AMI.zip But as I said, the behavior is th […]
Show full quote

At the moment I am using this:
https://www.elhvb.com/mobokive/Archive/PcChip … 9961230_AMI.zip
But as I said, the behavior is the same with any other working BIOS.
So the password seems not to be stored in the Flash/ROM?

And sadly my POST card is broken, so I can't tell you any number. How would the number help regarding the password?

I see your BIOS seems to compressed in some way which makes it difficult to patch this password request out. The only string I see inside is "ALI8789 ROM".

Otherwise my idea would have been to take a look at the BIOS source with a debugger and patch out the password request. This is very easy if you have the correponding POST-code at hand. Otherwise it takes some time to find the correct location in the code.

But with a compressed ROM I dont know how to compress it back after modification.

I will try to get this ROM running in PCem and take a look at it...later 😉

Ah, thank you very much, I would appreciate that!

I think right now, that perhaps the capacitors on the board somehow deliver the power for the RAM, that keeps the password? But why does the Reset-jumper not work at all?

Reply 25 of 46, by kylix

User metadata
Rank Newbie
Rank
Newbie
BitWrangler wrote on 2021-05-15, 15:19:

I've come across boards where password was enabled with a jumper or rigged to the keylock functionality. Also I've not seen mentioned the default password AMIAMIAMI which is all I've ever needed on Ami BIOS motherboards. However, on a non standard board, foxxcon made for an OEM I never IDed, when it's PW_EN jumper was set and the CMOS was cleared, it was only a blank string then, so just pressing return at the password prompt worked.

Thanks.
I tried an empty string and AMIAMIAMI.
Doesn't work.

Keylock works, but has no impact on the password.

Reply 26 of 46, by BitWrangler

User metadata
Rank l33t++
Rank
l33t++
Predator99 wrote on 2021-05-15, 15:18:

But with a compressed ROM I dont know how to compress it back after modification.

I got a feeling that one of the older skool bios mod tools did that, AmiBCP or something... pre 2005ish.. dos mode tool.

Unicorn herding operations are proceeding, but all the totes of hens teeth and barrels of rocking horse poop give them plenty of hiding spots.

Reply 27 of 46, by Doornkaat

User metadata
Rank l33t
Rank
l33t
kylix wrote on 2021-05-15, 14:53:

The board uses an ALI M5818 RTC chip.

Not too relevant to the thread, but I just looked this part up - are you sure your board is using it?
It would be a bit strange because there's an RTC built into the M1487. I also can't spot the M5818 on the board on pictures online and it's a pretty large chip.
Am I looking at the wrong board or revision?

Reply 28 of 46, by weedeewee

User metadata
Rank l33t
Rank
l33t
Doornkaat wrote on 2021-05-15, 16:29:
Not too relevant to the thread, but I just looked this part up - are you sure your board is using it? It would be a bit strange […]
Show full quote
kylix wrote on 2021-05-15, 14:53:

The board uses an ALI M5818 RTC chip.

Not too relevant to the thread, but I just looked this part up - are you sure your board is using it?
It would be a bit strange because there's an RTC built into the M1487. I also can't spot the M5818 on the board on pictures online and it's a pretty large chip.
Am I looking at the wrong board or revision?

Seems to be clearly visible between the isa slots. 😁

z0EZ6mT.jpg

Right to repair is fundamental. You own it, you're allowed to fix it.
How To Ask Questions The Smart Way
Do not ask Why !
https://www.vogonswiki.com/index.php/Serial_port

Reply 30 of 46, by Doornkaat

User metadata
Rank l33t
Rank
l33t
weedeewee wrote on 2021-05-15, 17:11:
Seems to be clearly visible between the isa slots. 😁 […]
Show full quote
Doornkaat wrote on 2021-05-15, 16:29:
Not too relevant to the thread, but I just looked this part up - are you sure your board is using it? It would be a bit strange […]
Show full quote
kylix wrote on 2021-05-15, 14:53:

The board uses an ALI M5818 RTC chip.

Not too relevant to the thread, but I just looked this part up - are you sure your board is using it?
It would be a bit strange because there's an RTC built into the M1487. I also can't spot the M5818 on the board on pictures online and it's a pretty large chip.
Am I looking at the wrong board or revision?

Seems to be clearly visible between the isa slots. 😁

z0EZ6mT.jpg

Hmm, there's a chip labelled M5818P. But it only has 20pins vs. 24pins on the M5818. Can't find a datasheet for it though.😕

Reply 31 of 46, by weedeewee

User metadata
Rank l33t
Rank
l33t
Doornkaat wrote on 2021-05-15, 17:48:

Hmm, there's a chip labelled M5818P. But it only has 20pins vs. 24pins on the M5818. Can't find a datasheet for it though.😕

Did you find a datasheet for the M5818 ? a quick google glance doesn't reveal any to me.

Right to repair is fundamental. You own it, you're allowed to fix it.
How To Ask Questions The Smart Way
Do not ask Why !
https://www.vogonswiki.com/index.php/Serial_port

Reply 32 of 46, by Predator99

User metadata
Rank l33t
Rank
l33t
BitWrangler wrote on 2021-05-15, 15:47:
Predator99 wrote on 2021-05-15, 15:18:

But with a compressed ROM I dont know how to compress it back after modification.

I got a feeling that one of the older skool bios mod tools did that, AmiBCP or something... pre 2005ish.. dos mode tool.

Can somebody try to extract the image with AmiBCP? I dont have a DOS machine around here at the moment...

Reply 33 of 46, by Horun

User metadata
Rank l33t++
Rank
l33t++

Try this: remove the PSU connectors including the CF card power and remove the battery from the board,
use a low ohm resistor (like 100 ohm) between the psu connector pins for +5v (red) and Ground (black) to ground out any voltage held by the onboard capacitors for about 10 minutes.
reconnect psu and boot w/o battery and see if it gives a "cmos error press F1 or delete" type message.

Hate posting a reply and then have to edit it because it made no sense 😁 First computer was an IBM 3270 workstation with CGA monitor. https://archive.org/details/@horun

Reply 34 of 46, by Doornkaat

User metadata
Rank l33t
Rank
l33t
weedeewee wrote on 2021-05-15, 18:32:
Doornkaat wrote on 2021-05-15, 17:48:

Hmm, there's a chip labelled M5818P. But it only has 20pins vs. 24pins on the M5818. Can't find a datasheet for it though.😕

Did you find a datasheet for the M5818 ? a quick google glance doesn't reveal any to me.

No but yes. 😅 According to Wikipedia it is a clone of the Motorola MC146818. Here's a datasheet for that:
https://datasheetspdf.com/pdf-file/518035/Mot … rola/MC146818/1
Upon looking up the chip I remembered I knew the M5818 from a GMB-386SAT that I once found in a scrap lot. All socketed chips were removed but still with the lot. That's why I was looking for a much larger chip.

Reply 35 of 46, by kylix

User metadata
Rank Newbie
Rank
Newbie
Horun wrote on 2021-05-15, 22:12:

Try this: remove the PSU connectors including the CF card power and remove the battery from the board,
use a low ohm resistor (like 100 ohm) between the psu connector pins for +5v (red) and Ground (black) to ground out any voltage held by the onboard capacitors for about 10 minutes.
reconnect psu and boot w/o battery and see if it gives a "cmos error press F1 or delete" type message.

Thanks, I tried this now, but without success. It still asks for the password.
Actually the "cmos error press F1 or delete" type message is also shown for half a second, and then the password screen shows up. Of course I also tried to press F1 and del etc. in this very moment, but it does not work.

Reply 36 of 46, by Horun

User metadata
Rank l33t++
Rank
l33t++

Hmm that is odd. If the battery fails and CMOS is lost how are you supposed to get into the BIOS...stupid BIOS 🤣

Hate posting a reply and then have to edit it because it made no sense 😁 First computer was an IBM 3270 workstation with CGA monitor. https://archive.org/details/@horun

Reply 37 of 46, by gmipf

User metadata
Rank Newbie
Rank
Newbie

With the message "cmos error press F1 or delete" the password should be deleted. Maybe the password is saved on some sort of nonvolatile SRAM, like on notebooks. You could also try to dump the bios using an EPROM programmer and check it with a hex editor.

Reply 38 of 46, by Horun

User metadata
Rank l33t++
Rank
l33t++
gmipf wrote on 2021-05-18, 01:14:

With the message "cmos error press F1 or delete" the password should be deleted. Maybe the password is saved on some sort of nonvolatile SRAM, like on notebooks. You could also try to dump the bios using an EPROM programmer and check it with a hex editor.

Agree ! The M918 was also sold by Amptron as the DX9300 and have most of the original docs for it and does not mention anything about password if cmos gets lost. That would be an important factor to include !
https://web.archive.org/web/19970327141851/ht … com/9300-1.html
https://web.archive.org/web/19970327140521/ht … om/manuals.html

Hate posting a reply and then have to edit it because it made no sense 😁 First computer was an IBM 3270 workstation with CGA monitor. https://archive.org/details/@horun

Reply 39 of 46, by darry

User metadata
Rank l33t++
Rank
l33t++
Horun wrote on 2021-05-18, 02:03:
Agree ! The M918 was also sold by Amptron as the DX9300 and have most of the original docs for it and does not mention anything […]
Show full quote
gmipf wrote on 2021-05-18, 01:14:

With the message "cmos error press F1 or delete" the password should be deleted. Maybe the password is saved on some sort of nonvolatile SRAM, like on notebooks. You could also try to dump the bios using an EPROM programmer and check it with a hex editor.

Agree ! The M918 was also sold by Amptron as the DX9300 and have most of the original docs for it and does not mention anything about password if cmos gets lost. That would be an important factor to include !
https://web.archive.org/web/19970327141851/ht … com/9300-1.html
https://web.archive.org/web/19970327140521/ht … om/manuals.html

Maybe the SRAM on the RTC chip has gone bad in such a way that the board thinks there is a password because of some stuck bits .