xehqter

Version Bump

Nope, doesn't help. we need the uncompressed CRC32 for OEMBIOS.CA_ run "expand oembios.ca_ oembios.cat" from the command prompt and post the hash for OEMBIOS.CAT

After two weeks of work I wrote an app to decrypt OEMBIOS.DAT files, here are the differences between A04597C6 and C86378C7. For the most part they both search the exact same ranges. A04597C6 Checks F000:32F0 – F000:3310 (32bytes) for Gateway Checks F000:3110 – F000:F130 (32bytes) for Gateway C86378C7 Checks F000:3200 - F000:3220 (32bytes) for Gateway Checks F000:0000 - F000:FFFF (32bytes) for EMACHINES @Siginet You're correct you need an SLP key not an OEM Key

@FreeStyler :: This falls under my “is it necessary category”. Confusing to whom? The .CAT isn’t protected by WFP so it shouldn’t be in dllcache to begin with. If you feel it’s a major issue delete the file with a script. Other then making things “look nice” is there any value to this? UPDATE: Its not worth the effort in arguing it will delete the file in the next release. @Siginet OEMScan doesn’t work via DetachedProgram?

@FreeStyler: The dllcache directory doesn’t store .CAT files. After running sfc /scannow it only copies the BIN/DAT/SIG files. Weird, I checked it on multiple new installs and never saw an OEMBIOS.CAT file in that directory @vpn-user: The original OEMBIOS.CAT file is backed up to SystemDrive when it validates the OEMBIOS files being copied over. If validation fails it restores the original .CAT file. The file should be deleted if validation passes. Something to fix in the next release.

Ahh, okay.. ... Censured myself never know how that data could be used.

@Bezalel even better didn't think of that.

@Bezalel Guess I’ll dig deeper into MGADiag’s code because the results you’re describing are different then mine. Sounds like you’ve been down this road before, any hint’s you’d like to throw?

Sounds nice, right now I’m busy disassembling Microsoft’s Genuine Advantage code to better understand how OEMBIOS files work, I don’t have much time to add it. If you want a quick hacked solution. [AMI] CMD=".\PromptForChange.exe" [AWARD] CMD=".\PromptForChange.exe" [PHOENIX] CMD=".\PromptForChange.exe" put at the end of the oemscan.ini file will have the same effect as ELSE

The SLP Strings for Gateway CRC set A04597C6 are ‘Gateway’ and ‘Gateway, Inc’ I think multiple SLP entries refer to the number of different locations the string could be located. Here’s a partial list for gateway (CSI is on), I tested a few of them and they worked. Ohh and the region scanned is E000:0000 - F000:FFFF not F000:0000 - F000:FFFF These are the 32Bit addresses. 000fe840 = F000:E840 (16bit address) ... Censured myself never know how that data could be used.

@severach :: I was planning to implement it with WMI in C++ (same method as SP1 VBS script). I’ve used jellybean numerous times in OEM <-> OEM, OEM->ROYALTY, ROYALTY<-OEM situations. It would be somewhat redundant to use my application on a VLK CD. I'm not going to worry about MCE at the moment.

ToDo list: 1. Suggest using A16F9D62 instead of E4143622 in oemscan.ini - DONE 2. Variable to pass Bios Match Workaround: run a different copy of a script for each OEM instance via CMD in oembios.ini) - DONE 3. Change CDKey Workaround: run a script to change the CD Key via OEMSCAN.INI 4. Dry-Run (doesn't copy files) command line argument Scan a Specific Range 5. Add option to specify exact range to scan - DONE 6. Fix Bug: Original OEMBIOS.CAT backup file isn't deleted from %Systemdrive% - DONE 7. Delete dllcache\OEMBIOS.CAT - DONE 8. Fix Validation Bug - DONE 1, 2, and 4 should be easy.. I’ll definitely include them in next weeks release.

Kool, i knew setup would'nt complain, but a future WGA update might. Example: Future WGA update expects slp oem files, slp key, specific bios string/s, motherboard type, etc to match or throw a non geniune report. I thought svcpack was executed at the T13 stage.True, anything’s possible. just to clarify, when I said CMD I meant in the oemscan.ini file [Compaq] PATH=".\Compaq\" CMD="%SystemRoot%\notepad.exe" <--- insert VBS script here.. or create a batch file with the VBS script and put it here.

@FreeStyler I knew someone would ask that.. Give me a week, I’m working on a new project OEMBIOS project, if it doesn’t work out I’ll add a command line argument that will do a dry-run without copying the files.

@ Siginet Thanks for spotting the typo. I’ll add a scan range but I want to know more about OEMBios files before I do it. I don’t want to add a feature only to find out its being implemented incorrectly. @ Randy Rhoads I don’t see why you can’t run it anytime during the setup. Personally I’m running it via svcpack. I’ve been using the DELL Royalty OEM key and it hasn’t complained. If you think it might be an issue you should be able to run a vbscript via CMD and change the key for each OEM.

OEMScan v1.21 http://www.msfn.org/board/index.php?showtopic=82638 Validates the OEMBIOS.BIN/SIG/DAT files against the .CAT file before copying. If they're mismatched it won't copy them over. Copies OEMBIOS.BIN/DAT/SIG to DllCache Many thanks to severach for the help.

Version Bump... Or to wait 15 minutes on hold only to get disconnected.. arggg.. tip: use the number pad to enter your responses, do you want to activate XP, 1, are you in front of the computer, 1, enter product id, 12345…

twiddling the API WinTrust.DLL CryptCATAdminAcquireContext CryptCATAdminAddCatalog CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext Got it from disassembling / on demand debugging signtool.exe

@Siginet As best I can see OEM XP Tool saves an image of the BIOS (0xF0000-0xFFFFF), Display’s your XP CD KEY / Product ID, and gives you a list of known OEMBIOS Address lists. It doesn’t detect the address OEMBIOS uses. Then again I can’t read Chinese. I’ll PM you the list. Is AutoIT capable of making Win32 API Calls?

@Bezalel In my previous post I listed all the instances of "gateway" on a gateway system. I individually inserted gateway into all the addresses on a VirtualPC bios. Only F000:E840 activated. From there I started at E800 and worked my way up in 16byte increments and then @ F000:E83F.. nothing worked till I reached F000:E840.. then went from F000:E8F0 down. So allot of trail and error to get that range. @Siginet Sounds reasonable but until I start seeing users complaining about specific OEMBIOS files not activating & providing detailed info I’m not too worried. Using the Gateway, Emachine OEMBIOS is the most logical (that’s what I use @ work) I’ve seen older dells not activate, but I’d like to believe those dells didn’t have an SLP bios because it’s an older system. The main reason I created my program was for Compaq / HP systems, since I’ve seen Compaq Branded Laptops using “HP Pavilion” OEMBIOS files and visa versa. Maybe to rephrase, if it works 98% of the time I’m happy, and so far I haven’t encountered any problems with my utility @ work. I like your new app, would it be possible to also do a dump of the address range to possibly give a hint towards the area it’s located. Ie: bios header, DMI, etc. Maybe subtracting 20h from the address. IE: Gateway @ F000:E840 run 'D F000:E820' in debug. It’s not critical. @Everyone I’m curious what the project goals are now. They seemed to have strayed a bit. If it’s to have a system to make an automated multi manufacture CD I think we’ve succeeded. Are we now trying to figure out why Gateway (and maybe other) OEMBIOS files are picky about the address used? Is it necessary? How many users does it really effect? If that’s the case we should have a dedicated post we can refer to with the info like FreeStylers 202 post to list our conclusions? Is there another utility besides MGADiag that’s being used to figure out SLP Strings? How are you guys coming up with these longer then 4 id’s SLP’s? .

No, it means if your motherboard is from a Royalty OEM (Dell, Gateway, HP, IBM, etc) and you acquire the correct OEMBIOS files with a Royalty OEM CD Key (not the one on the side of your case) it will convert your OEM copy to a Royalty OEM copy bypassing the need for activation. As-If you had used the Royalty OEM’s recovery cd to install windows XP. The idea is IT guys & Repair Shops which handle multiple brands of computers don’t have to spend 6minutes on the phone to activate windows if they’re installing on a Royalty OEM’s system. Think of it as a System Restore CD for multiple brands of computers.

Putting the word “Gateway” @ F000:E840 in my VirtualPC BIOS activates A04597C6 & C86378C7 OEMBIOS files. F000:E830 00 00 .. F000:E840 47 61 74 65 77 61 79 00-00 00 00 00 00 00 00 00 Gateway......... Update: With allot of trail and error I found that you can put the word 'Gateway' anywhere between F000:E840 and F000:E85F and it will activate with C86378C7 and A04597C6.

@xehqter What does this exactly mean? If you simply copy over the OEMBIOS files they will pass WGA Validation but fail WinTrust (ie: SFC /SCANNOW, KeyUpdateTool, etc) because the cat file needs to be imported into a special database. The new version imports the cat file.

Gateway 2000 using A04597C6 OEMBIOS files S F000:0000 FFFF "Gate" F000:4E54 F000:4E70 F000:4ED5 F000:4EF1 F000:4F45 F000:E840 F000:FFC0 DMI Information: F000:4E50 04 00 C3 19 47 61 74 65-77 61 79 20 00 FF FF FF ....Gateway .... F000:4E60 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF 00 19 ................ F000:4E70 47 61 74 65 77 61 79 20-32 30 30 61 72 63 20 00 Gateway 200arc . F000:4E80 FF FF FF FF FF FF FF FF-FF FF 00 19 52 65 76 69 ............Revi F000:4E90 73 69 6F 6E 20 30 31 00-FF FF FF FF FF FF FF FF sion 01......... F000:4EA0 FF FF FF FF FF FF 00 19-30 30 30 30 31 32 33 34 ........00001234 F000:4EB0 35 20 20 20 20 20 20 20-00 FF FF FF FF FF FF FF 5 ........ F000:4EC0 FF FF 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ F000:4ED0 00 00 00 00 19 47 61 74-65 77 61 79 20 00 FF FF .....Gateway ... F000:4EE0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF 00 ................ F000:4EF0 19 47 61 74 65 77 61 79-20 32 30 30 61 72 63 20 .Gateway 200arc F000:4F00 00 FF FF FF FF FF FF FF-FF FF FF 00 19 52 65 76 .............Rev F000:4F10 69 73 69 6F 6E 20 30 31-00 FF FF FF FF FF FF FF ision 01........ F000:4F20 FF FF FF FF FF FF FF 00-19 30 30 30 30 31 32 33 .........0000123 F000:4F30 34 35 20 20 20 20 20 20-20 00 FF FF FF FF FF FF 45 ....... F000:4F40 FF FF FF 00 19 47 61 74-65 77 61 79 20 00 FF FF .....Gateway ... F000:E830 B1 FA E8 14 66 81 4E 18-00 02 CB 00 00 00 00 00 ....f.N......... F000:E840 47 61 74 65 77 61 79 00-00 00 53 BB 08 00 E8 AB Gateway...S..... F000:E850 03 5B C3 56 26 80 3D 81-0F 94 C3 75 06 3C 02 75 .[.V&.=....u.<.u F000:FFA0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ F000:FFB0 FF E7 50 41 54 43 48 32-E8 B8 FE CB 00 00 00 00 ..PATCH2........ F000:FFC0 47 61 74 65 77 61 00 4B-34 32 2E 30 32 2E 30 34 Gatewa.K42.02.04 F000:FFD0 00 32 30 30 41 52 43 20-20 00 34 32 2E 30 32 2E .200ARC .42.02. F000:FFE0 30 34 00 00 E9 A8 B5 00-00 00 00 00 00 00 00 00 04.............. F000:FFF0 EA 5B E0 00 F0 30 33 2F-30 33 2F 30 34 00 FC FB .[...03/03/04... System Informantion (Mixed Display) < Type, Length, Handle = 1, 19h, 1h > Manufacturer : Gateway Product Name : Gateway 200arc Base Board Informantion (Mixed Display) < Type, Length, Handle = 2, 8h, 2h > Manufacturer : Gateway Product : Gateway 200arc System Enclosure or Chassis (Mixed Display) < Type, Length, Handle = 3, 11h, 3h > Manufacturer : Gateway

@Bezalel The previous character was CRLF so 0x0D, 0x0A, FSC SERVER, 0x20, 0x20, ....... 0x0D, 0x0A 0x20 being SPACE.. perhaps it was reading all the spaces after the string.. hmm..