Some time ago I bought an Alienware M14xR2 as my last laptop broke down. Lately, Alienware published an update for my BIOS that I can't burn in my computer because I only use Archlinux. By googling a bit I quickly found a tool for burning the BIOS in a DOS command line but I would need to have a look to the update package.
Just by executing the update file in a virtual machine in windows I soon figured out it was a self extracting package. I just searched %TEMP% files for the extracted version.
Ding.wav is just audio. I suppose it is played when flash is finished.Just by reading the header of the ini files we can guess they are configuration files for the flasher utility. The format is self explained in comments. In line 61 I found that the file I wanted for flashing was isflashWin.bin but after a fast attempt with FreeDOS and the tool I mentioned before I realised that the format was not FD as it should so I googled a bit more. As it turns out, Insyde has released a new update file format and as it seems it isn't documented.
Added BIOS Downloads with Large HDD Support (64GB/128GB) for older motherboards. Download ASUS Live Update tools. Download Phoenix Flasher tools. Where can I buy an EPROM programmer and BIOS Flash chips? Added Medion BIOS Updates. Added Added awdflash and Award Winflash BIOS Utilities. Added How to buy a Flash BIOS upgrade online? This package updates the UEFI BIOS (including system program and Embedded Controller program) stored in the ThinkPad computer to fix problems, add new. Insydeflash- windows-bios-flash-utility-28.pdf.
Inside the file I found a section that is exactly the same as the configuration file and it is preceded by a string quite suspicious.
I think these headers separate sections of the file as they are all 16 characters long. By having a look inside Hexedit I found that there is a padding of 8 bytes between the last character and some famous file magic numbers. I've done a simple python script (filesplitter) for splitting this kind of files and continue the analysis.
Insyde Bios Flash Utility Download Windows
Part number four is clearly the configuration file. If you are trying to tweak parameters in platform.ini note that it wont work, but if you modify this part of the binary file it will. It seems that Insyde is now using the platform.ini only to point to the update file (isflashWin.bin) and then the utility just parses the configuration from there.I had no success in running one and two. I've tried FreeDOS and Windows 98 in DOS mode which should have support for MZ executables but in the best case I got no output and in the worse some memory address exceptions.I found that number three is related to a utility called Flashrom but I don't have much time to investigate. Maybe some readers can point me in the right direction.After having a look to five in Hexedit I think it can be a BIOS image although I don't really know about this topic.
Although I could not flash my BIOS I could find some little information about this new format and I also found that MZ executable signatures weren't in the binary analysis tool I use (binwalk). The latest version of binwalk now looks for MZ executables.