Making a Bios Cracker
See also: Detailed overview of Bios password algoritms

INDEX TABLE
1.  Introduction
2.  Memory area 000F000-000FFFFF
2.1 Flash-RAM upgrades
3.  Analyzing CMOS dumps
3.1 Dumping CMOS
3.2 Comparing the CMOS dumps
4.  At the end...

1. Introduction

The different BIOSes available to PCs are pretty much based on the same idea: allow the user to make a few settings, and store them into a special memory. The "problem" is that they allow people to set password. For various reasons we might want to know that password.

That memory is referred to as CMOS, though the name might not be a very good one. Anyway most PCs offer 128 bytes CMOS memory that can be easily read by any application. Luckily, most PCs saves the password encrypted into the CMOS memory, accessable by everyone. So what we must do is to locate the encrypted password, and decrypt it. Another good thing is that most BIOSes use very lame encyption - several just save the password in "scancodes", and others use simple algorithms based on e.g ROR, XOR, ADD and alike.

2. Memory area 000F000-000FFFFF

One way to attempt to gain information about a BIOS is to analyze the memory area reserved for BIOS ROM. This is usually only a part of the BIOS, but it may contain the entire encryption algorithm. Once you have dumped the BIOS ROM to disk, disassemble it and look trough the disassembly. Here's sample of a algorithm extracted from BIOS ROM. Now, this can be a very boring task, with little promis of effect. Therefore, analyzing the CMOS is often better.

2.1 Flash-RAM upgrades

A little variation of the ROM-dump trick is to download Flash-RAM upgrades if you want to crack a BIOS with Flash-RAM upgrade-option. However that might be even more painfull to analyze since some Flash-RAMs are bigger than 200kb - takes a lot of time to analyze. A very bad idea usually, but keep in mind that it is possible.

3. Analyzing CMOS dumps

What you should do is to dump the CMOS and then compare dumps with different password. What you need then is to think and have luck, and you might just find out the algorithm. I usually use password dumps of passwords a, aa, aaa, b, bb.

3.1 Dumping CMOS

Dumping CMOS is pretty simple, all you got to read a byte from CMOS is to set port[$70] to what byte you want to read (range 0 to 127) and then read it from port[$71]. So you pretty much just make yourself a FOR statement to get all 128 bytes and then save them into a file.

3.2 Comparing the CMOS dumps

There is no reason to attempt to keep everything in your head. Trying to compare CMOSes by look at one, and then the other is a very painful task. Instead write a program designed to compare CMOS dumps. Feel free to use CmosCmp.Pas, released as freeware by us. Pascal source only.

4. At the end...

Well now, what do you do when you know how the BIOS stores the password? If it is encrypted you just reverse the encryption algorithm. No need to explain that, if you know how it is encrypted you should easily be able to write the reverse algorithm. But if it is hashed, i.e only a checksum is stored like Award do you probably must bruteforce. However, if you are inventive you make something faster, like PWDigit for Award (written by Jan Stohner, not a member of the Eleventh Alliance)