--:----:--Keyboard shortcuts (?)Fullscreen (f)

Redirecting AMIBIOS8 (legacy) output to serial

by Theldus
GNU/Linux ◆ xterm ◆ bash 416 views

In this recording, I show an AMI BIOS (AMIBIOS8, legacy) from a PCWare IPM41-D3/Intel DG41WV that outputs everything to the serial port. This accomplishment was made possible by an extensive reverse engineering process within module 18 (DisplayManager), where I discovered numerous printing routines.

This BIOS is always in graphical mode (640x480x16 colors), drawing characters on the screen directly from the base address 0xA0000. However, with a little of creativity, I was able to hack one of these routines in order to obtain characters and their respective positions on screen. These characters were then processed in my routine before being sent to the screen.

Aside from the RE process itself, two other difficult aspects were involved:

  1. Codepage 437: The BIOS character set doesn’t match what the terminal typically expects (usually UTF-8). Consequently, I had to construct a lookup table for character conversion before sending them.

  2. Performance: I was able to successfully maintain the same positions for characters on the monitor by using ANSI Escape Sequences. However, this resulted in an 8-byte overhead for each character sent. To address this, my code also keeps track of the current position of the screen cursor (serial). If the desired character position is the same as the current position, no escape sequence is sent. In practice, this means that an escape sequence is generally sent only once for each new line, significantly reducing the amount of data transmitted over the cable.

Much of this reverse engineering work would not have been possible without my own debugger, BREAD, specifically designed for real-mode 16-bit code: https://github.com/Theldus/bread