[vbox-dev] VM Memory space: region in BIOS - patching/overridepossible?

Mark Cranness mark.cranness at gmail.com
Sat Jun 4 12:29:28 GMT 2011

Arioch wrote:
>       the program is copy-protected: is "attached" to last 16 bytes
> of BIOS, those F000:FFF0 to :FFFF
>       the rest of BIOS is not to be the key, but "BIOS creation date"
> definitely is.

You can create a custom BIOS file, and then patch the last few bytes, and attach the patched bios file to the VM.

1) Get to a command prompt in the VM, and run these commands in the VM to capture the VirtualBox BIOS:

r cs
r bx
n bios.bin

Here they are again with comments:
C:\>debug    [This runs debug.exe, a primitive MS supplied debugger.  It should be present on your Win98 system]
r cs    [This command says Let me set the CS register, debug.exe will display the current CS and then a ':' prompt]
eff0    [This sets the CS register to hex EFF0, which is hex 100 bytes before the BIOS at F000]
r bx    [This command says let me set the BX register, debug displayed the cirrent BX then a ':' prompt]
1        [This sets the BX register  to 1 (digit ONE)]
n bios.bin    [This says set the fileName to "bios.bin"]
w        [This writes BX:CX bytes (hex 10000 = dec 65536 bytes), starting at EFF0:100]
q        [Quit]

You should now have a file bios.bin, which is the VirtualBox bios, dumped.

2) Use whatever tool you feel comfortable with to patch the file.
Make sure it can edit binary files without mangling them.
Perhaps use DOS fc/b command to compare before and after editing.

These commands, if CAREFULLY entered, will enable you to edit the file.

C:\>copy bios.bin bios.bak
C:\>debug bios.bin
mov ax,cs
add ax,10
mov es,ax
[ENTER key, blank line]
g 100
d es:fff0
e es:fff0

Here they are again with comments.
C:\>copy bios.bin bios.bak    [Takes a backup]
C:\>debug bios.bin    [Starts debug.exe, opening file bios.bin as a starting point]
a 100       [Starts to assemble (write) a small assembler program]
mov ax,cs    [Program line 1: Move the CodeSegment register to AX]
add ax,10    [Program line 2: Add 10 (hex) to the AX register]
mov es,ax    [Program line 3: Move the AX register to the ExtraSegment register]
                [Enter key, blank line to exit "a" mode.]
g 100        [Start running the program at address 100]
t            [Run line 1]
t            [Run line 2]
t            [Run line 3, at this point, ES now contains CS+10, see note below]
L            [This re-Loads bios.bin, undoing the temp program above]
d es:fff0    [This dumps the last 16 bytes of the bios, you should be able to see the date.]
e es:fff0    [This allows editing of the last 16 bytes.  Use SPACE to move to the next byte, enter numbers to change a byte,
ENTER to exit.]
[Repeat the last two commands as needed to get the date as you need it. Values are HEX ASCII]
w        [Writes the edited bios.bin to disk]
q        [Quit]

Note: The program is simply to set the ES register to CS+10, to make it possible to access the last 100 hex bytes of bios.bin.
Although debug.exe can load and save files larger than FF00 bytes in length, manual hex arithmetic or munging the segment
registers is required to display or edit anything beyond byte FF00.  You can do the arithmetic yourself and leave out the steps
between and including "a 100" and the last "t", if you use "r" to display the CS register value, "r es" to set the ES register
value, and enter the manually computed value CS+10(hex).

C:\>fc/b bios.bin bios.bak
[FileCompare /Binary] should show ONLY the edits to the date.  If there are other differences, then something went wrong with
the editing, try again.

3) Copy the file out of the guest file system into the host's filesystem.

4) Set the VM to use the bios file.

VBoxManage setextradata "MyVM" "VBoxInternal/Devices/pcbios/0/Config/BiosRom" "c:\bios.bin"

(Substitute your VM name for MyVM, and you will have to specify the path to VBoxManage.exe, this might work:
    "%VBOX_INSTALL_PATH%VBoxManage.exe" setextradata ......)

Good luck!


More information about the vbox-dev mailing list