Overclock.net › Forums › Graphics Cards › AMD/ATI › Polaris Bios Editing ( RX5xx / RX4xx )
New Posts  All Forums:Forum Nav:

Polaris Bios Editing ( RX5xx / RX4xx ) - Page 16

post #151 of 3419
Quote:
Originally Posted by caa82437 View Post

You will also need to reboot with Driver Enforcement disabled after patching: http://www.howtogeek.com/167723/how-to-disable-driver-signature-verification-on-64-bit-windows-8.1-so-that-you-can-install-unsigned-drivers/

Is that required on every reboot?
post #152 of 3419
Quote:
Originally Posted by caa82437 View Post

Ok... So I have some experimental patches for the driver to bypass the SHA1 hash in the BIOS. You will need to run Windows with signature enforcement disabled.

BACKUP YOUR OLD DRIVER!

16.7.1 - C:\Windows\System32\atikmdag.sys
Code:
Signature: 74 21 3B C6 74 13 83 C0 FE 3B C6 77 16 48 8B

TEST1
Patch: 90 90 3B C6 EB 13 83 C0 FE 3B C6 77 16 48 8B

TEST2
Patch: 90 90 3B C6 90 90 83 C0 FE 3B C6 90 90 48 8B

TEST3
Patch: EB 21 3B C6 74 13 83 C0 FE 3B C6 77 16 48 8B

TEST4
Signature: 0F 85 BE 00 00 00 48 8B 07 48 8B
Patch: 90 90 90 90 90 90 48 8B 07 48 8B

Run each test separately, if TEST1 doesn't work try TEST2 etc...

I don't have a desktop computer atm, so I can't test this myself.

I got "CODE 31" in device manager for all 4.
post #153 of 3419
Quote:
Originally Posted by arkcom View Post

I got "CODE 31" in device manager for all 4.

And you were in Driver Enforcement Mode Disabled?
post #154 of 3419
Quote:
Originally Posted by caa82437 View Post

And you were in Driver Enforcement Mode Disabled?

Yes, test mode enabled on Windows 10.
post #155 of 3419
make sure that driver signing is also disabled its pretty tricky on win 10
FX
(7 items)
 
  
CPUMotherboardGraphicsRAM
FX-8320@4.4Ghz M5A99FX PRO R2.0 AMD Radeon R9 290X Patriot Memory  
Hard DriveCoolingMonitor
Samsung 840 Raijintek Ereboss iiyama X4071UHSU (4K) 
  hide details  
Reply
FX
(7 items)
 
  
CPUMotherboardGraphicsRAM
FX-8320@4.4Ghz M5A99FX PRO R2.0 AMD Radeon R9 290X Patriot Memory  
Hard DriveCoolingMonitor
Samsung 840 Raijintek Ereboss iiyama X4071UHSU (4K) 
  hide details  
Reply
post #156 of 3419
Has anyone with the 4gb PowerColor rx480 tried flashing the XFX OC bios?

Will it work? (or should i first try 8gb powercolor bios that can be found here: https://www.techpowerup.com/vgabios/184369/powercolor-rx480-8192-160603)

Before the flash i'll actually check the memory chips on my card smile.gif
Edited by weirdgod - 7/8/16 at 6:24am
post #157 of 3419
Quote:
Originally Posted by arkcom View Post

I got "CODE 31" in device manager for all 4.

Can confirm, it's always Code 31

Edit:
Modifying the .inf file (change version number) -> Working
Modifying the atikmdag.sys just one bit -> Code 31


Edited by PCIEgate - 7/8/16 at 7:42am
post #158 of 3419
post #159 of 3419

RESULTS:

0: Failed trying to unsign atikmdag.sys. File doesn't appear to be digitaly signed.

Edit:
unsigned catalog file with same result.
Edited by PCIEgate - 7/8/16 at 8:07am
post #160 of 3419
@caa82437

It has taken me a while to find ROM pack where nothing is changed within data/command tables. I lack the expertise to crack this so I present it hoping you or another may.

If you compare the tables list you will see ROMs are nearly identical except for fewer elements then any others I have.

Collated info on Signature (Click to show)
So we know from this info by The Stilt:-
Quote:
The signature is actually a hash of the hashes of the protected blocks.

Then in the PM I sent we have Lordkag info.
Quote:
It is most likely done on the Legacy ROM, the only thing left to determine is its boundaries and how it transforms from SHA-1 (160 bits) to Some_Hash (128 bits).

And this (+ note at end of post).
Quote:
If the 8-bit checksum and CRC can change without affecting the hash, it would imply that the hash must exclude them from calculation.

Next you can see some of my testing for boundaries in this post.
Quote:
113-C88100-107 date change post smile.gif .
113-C8800100-107 code revision change not post frown.gif .
113-C8800100-107 padding area between legacy & efi change post smile.gif .

Above tests are "pure UEFI" mode, any modified ROM regardless of mod, mobo will only post with CSM=ON, SB=OFF.

As on Hawaii/Fiji we have no issue with driver detecting signature incorrect for modified ROM my testing has been for UEFI purposes (ie "pure UEFI mode on mobo).
Quote:
Testing was done on all the same hardware/system only ROM on Fury X was being changed. The test was mobo must post with display output and UEFI usable whilst CSM=Off, SB=ON and FB=ON, SSD/HDD was disconnected for this testing.


Now the Sapphire Tri-X 290 OC ROM pack:-

i) legacy ROM checksum differs but is not part of signature make up from my Fiji testing, see note.
ii) date change I know is irrelevant in context of signature as tested this. Bios P/N and the 2 other text differences between ROMs I will check.
iii) as the hex value which enables UEFI in a ROM is after ROM code revision from my test info in spoiler I would deem editing there is protected by signature, but will test this.
iv) next BIOS_IDTF changes, see note further on.
v) then from 0x269 we have the bios signature change and the rest of the ROM hex for hex is identical until UEFI/GOP module. Which from Lordkag info and my testing of changing padding between legacy and uefi sections is outside of boundaries it covers.


Tri-X_290_OC_ROMs.zip 147k .zip file


Note:- BIOS_IDTF I have been noting on Fiji when I flash an updated stock ROM from Sapphire/AMD and compare dump it will change during flashing process and legacy checksum is also updated to reflect this change.

*** edit ***
point ii) above BIOS P/N I'm deeming is protected as changing that = no post.
Edited by gupsterg - 7/8/16 at 11:27am
XPS - R7 1700
(14 items)
 
XPS - i5 4690K
(12 items)
 
XPS - Q6600
(8 items)
 
CPUMotherboardGraphicsRAM
Ryzen 7 1700 Asus Crosshair VI Hero Sapphire Fury X@1145/545 G.Skill Trident Z 2x 8GB 3200MHz C14 
Hard DriveCoolingCoolingCooling
Samsung Evo 840 ThermalRight Archon IB-E X2 + 2x TY143 ThermalRight TY-143 2x front case intake Arctic Cooling F12 + 2x F9 as rear case exhaust 
OSMonitorKeyboardPower
Win 7 Pro x64 / Win 10 Pro x64 Asus MG279Q Cherry MX-Board 3.0 Cooler Master V850 
CaseMouse
SilverStone TJ06 Logitech G700S 
CPUMotherboardGraphicsRAM
i5 4690K@4.9GHz 1.255V Asus Maximus VII Ranger Sapphire Fury X@1145/545 HyperX Savage 2x8GB 2400MHz C11 
Hard DriveCoolingOSMonitor
Samsung Evo 840 TR Archon SB-E X2 Win 7 Pro x64 / Win 10 x64 Asus MG279Q 
KeyboardPowerCaseMouse
Cherry MX-Board 3.0 Cooler Master V850 SilverStone TJ06 Logitech G700S 
CPUMotherboardGraphicsRAM
Intel Q6600 G0 Asus P5K Premium Black Pearl Sapphire Toxic HD5850 Corsair Dominator 4GB 
Hard DriveCoolingOSPower
Crucial MX 100 256GB TR TRUE Rev.A Win 7 Pro x64 Cooler Master V650 
  hide details  
Reply
XPS - R7 1700
(14 items)
 
XPS - i5 4690K
(12 items)
 
XPS - Q6600
(8 items)
 
CPUMotherboardGraphicsRAM
Ryzen 7 1700 Asus Crosshair VI Hero Sapphire Fury X@1145/545 G.Skill Trident Z 2x 8GB 3200MHz C14 
Hard DriveCoolingCoolingCooling
Samsung Evo 840 ThermalRight Archon IB-E X2 + 2x TY143 ThermalRight TY-143 2x front case intake Arctic Cooling F12 + 2x F9 as rear case exhaust 
OSMonitorKeyboardPower
Win 7 Pro x64 / Win 10 Pro x64 Asus MG279Q Cherry MX-Board 3.0 Cooler Master V850 
CaseMouse
SilverStone TJ06 Logitech G700S 
CPUMotherboardGraphicsRAM
i5 4690K@4.9GHz 1.255V Asus Maximus VII Ranger Sapphire Fury X@1145/545 HyperX Savage 2x8GB 2400MHz C11 
Hard DriveCoolingOSMonitor
Samsung Evo 840 TR Archon SB-E X2 Win 7 Pro x64 / Win 10 x64 Asus MG279Q 
KeyboardPowerCaseMouse
Cherry MX-Board 3.0 Cooler Master V850 SilverStone TJ06 Logitech G700S 
CPUMotherboardGraphicsRAM
Intel Q6600 G0 Asus P5K Premium Black Pearl Sapphire Toxic HD5850 Corsair Dominator 4GB 
Hard DriveCoolingOSPower
Crucial MX 100 256GB TR TRUE Rev.A Win 7 Pro x64 Cooler Master V650 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: AMD/ATI
Overclock.net › Forums › Graphics Cards › AMD/ATI › Polaris Bios Editing ( RX5xx / RX4xx )