January 9, 2003

Modifying your BIOS for fun and profit

I have just done something very perverse, and quite inexplicably it seems to be working.

I have an Amptron Eureka SD-4925A. More accurately, work has one. I’m charged with getting it to boot Linux from the network and run an RDP client (probably rdesktop). I’m told the machine has network booting capabilities. OK, no problem. I take it home and look at it.

It will boot off the network. Unfortunately its boot protocol is something called “Novell RPL.” This is different from “IBM RPL,” especially because IBM RPL is supported in Linux but Novell’s is not. (I think I read something to the effect of “Novell won’t release specs for RPL.”) This does not make me a happy dictator. So now my boss thinks I should give up and boot from floppy or CD-ROM. Floppy is unreliable, though, and I can’t update CD-ROM without physically replacing it.

Somehow I start reading about Etherboot which provides a sort of “boot ROM” for your computer. You can load it off a floppy disk, or… some people seem to be putting it to EEPROM. What’s this? Some people are putting it in Award BIOSes? Hm. Unfortunately I have an AMI BIOS (though the most recent revision for my board at Amptron’s site mysteriously seems to be an Award BIOS). Not many instructions on this.

Now I find an IRC log from #ltsp (LTSP being the Linux Terminal Server Project I believe) mentioning the fact that a person named Dave Anders has some utilities you can use to modify an AMI BIOS. I got on #ltsp and talked to him. He was the one that got me started on the correct path of evil that lead to using a modified BIOS.

WARNING: If you were to follow the instructions I’m spewing forth here, you may render your computer unusable, damaged, or even turn it in to an evil sentient being bent on the domination of the entire human race — starting with you. I am not responsible for broken equipment, damage, loss of data, hair, or erectile dysfunction. The instructions henceforth are what I did. I do not guarantee this will work for you. I’m still fucking shocked it worked for me. I make a lot of assumptions here based on what my system is like. For example, I have a PCI NIC (on-board).

You’ll need a plain DOS boot disk, and probably a second blank floppy to load two utilities and a BIOS image on to. Boot off the floppy and use B: when you’ve booted up. Then when it asks you to insert the floppy for B: (unless you’ve got two floppy drives) insert the disk with the utilities and BIOS image on it.

First, back up your BIOS. I had to use the AMINF332.EXE utility from Amptron’s BIOS page. The newest AMI flash utility wouldn’t work; something about “Chipset/part not available” when I ran it, IIRC. You probably need to do this from a plain DOS boot disk. The command line is something like: AMINF332.EXE /SBACKUP.ROM. This should save your current BIOS to BACKUP.ROM. When I did it the size of my BIOS images were always 262,144 bytes.

At this point, make a copy of BACKUP.ROM to another disk. Make several copies. If you fuck up, you’ll thank yourself.

You’ll need an Etherboot image for your card. The nice people at Etherboot (I think they’re responsible) created http://www.rom-o-matic.net/ to help you create a boot ROM. You want to make a binary image; it’ll have an extension of .lzrom. If you don’t know what kind of Ethernet card you have, like I didn’t, I recommend the following: boot in to Linux. I used a Linuxcare Bootable Business CD-ROM I had lying about, but anything that you can run lspci on should do. Find the device and vendor IDs for your Ethernet card. In my case, for example, lspci showed me an Ethernet controller on 00:12.0 or something like that. Then you can do an lspci -n and find the numbers after “Class XXXX” (where XXXX is four hexadecimal digits). These will be in the format (at least on my machine) of “VVVV:DDDD” where VVVV is the vendor ID and DDDD is the device ID. You can check someplace like the Etherboot list of supported hardware, or a similar source from the latest version available on http://www.rom-o-matic.net/. I find “0×1106,0×3065″, look up in the list, and spot “family via-rhine”. That’s the “NIC/ROM type” I need to use on http://www.rom-o-matic.net/. Save the resulting ROM to your floppy disk.

Now you’ll need to put the utility AMIBCP.EXE on a floppy. Next run AMIBCP.EXE BACKUP.ROM. (You’d better have a copy of BACKUP.ROM elsewhere!) You’ll get a nice menu-driven interface, DOS-style. Select “Edit BIOS Modules”.

Here’s the tricky part. At the bottom right-ish corner it says “Available Memory” (well, actually, it says “Availabel Memory”, but you get the idea) and to the right of that in parenthesis is the number of bytes remaining. You’re going to need enough available memory to insert your Etherboot ROM. To find out how much space it’s going to need, first press the insert key and type in the name of your Etherboot image file. The next screen should be “Change Module Characteristics”. For “Module ID” it should say something like “20h PCI AddOn ROM”. Use the arrow keys to move down to “Compressed” and press the plus key (+) to change that to “yes”. Now look up a couple lines at the value in the parenthesis after “Module Size”. This is how much available memory you’re going to need. For example, in my case I was going to need 14,518 bytes. Press the escape key twice to get back to the “Edit BIOS Modules” screen. Now if you don’t have enough available memory you’ll need to delete some things.

I got lucky with deleting modules. I found another module which was a “PCI AddOn ROM” and had “3065:1106″ listed in the right-most column. I now presume this was the old Novell RPL boot code for the network card. I deleted this and had plenty of space. The only other things I’m somewhat certain can be deleted is something like “OEM Logo” or “EPA / OEM Logo”. I’m not even real sure about this, but Dave Anders was able to do this in his case. I also note that, back from the main menu, I could select “Configure BIOS Options”, then scroll down to the bottom of the list and disable “Display AMI Logo” and “Display OEM Logo”. If you have to delete the OEM logo from the BIOS, you may want to turn off both of these options. I’ll also note that I read somewhere that you should not delete the “Image Display Code” (or “Image Dsiplay Code” as it appears in my BIOS); I don’t know if this is still valid.

Once you have enough space, do what we did before to check the size of the Etherboot ROM: press insert, enter the file name of the Etherboot ROM, change “Compressed” to “yes”. Instead of pressing escape twice to get back to the “Edit BIOS Modules” screen, though, press F10 to save these changes. It may ask you to confirm, which I think requires to press enter to confirm. You should see your new “PCI AddOn ROM” at the bottom of the list. Now press escape to go to the main menu and select “Save BIOS To Disk File”. I just overwrote my BACKUP.ROM because there wasn’t enough disk space to write a new ROM AFAIK.

Once you’re done with that, exit the AMIBCP utility. Now it’s time to flash your ROM file back up to the motherboard. Type AMINF332 YOUR.ROM /A where YOUR.ROM is whatever you saved your ROM as in AMIBCP, above. For example, I saved my ROM back out to BACKUP.ROM, so I’d type AMINF332 BACKUP.ROM /A. This should flash your computer then immediately reboot. When you reboot, enter the CMOS settings; in my case it asked me to go in to setup anyway, because in the process of flashing I guess your settings are erase. I loaded optimal settings and then went in to select boot devices. On my BIOS, a selection called “via-rhine.lz” or some such showed up. I selected this as the third boot device, behind floppy disk and CD-ROM. Save and exit with your BIOS parameters. Let your computer get to the point of trying to boot off the network. You should see something about “Etherboot” come up. Voila!

Just that easy. I’m fucking stunned this worked. All props to Dave Anders, without whom I probably would have given up, and the Etherboot team for making something so bizarre and useful so easy.

More reports on if this really works once I get a bootable image up and such. I can see my DHCP server responding already, but it’s not sending any boot image information out so I don’t expect Etherboot cares about the replies.

DD soundtrack, octaves, P2P, hard disks

Too long between web log entries. All because darkbook was powered off and packed up. Bad darky.

Of course, the chief reason the laptop didn’t get unpacked is because I’ve been working on my Donnie Darko soundtrack some more. It’s coming along. I learned all about dynamic compression in audio. (Unfortunately I can’t find any of the sites I visited on this topic originally. Search using words and phrases like “mastering” and “dynamic compression” perhaps.) I’m trying to leave the audio alone as much as possible. I find myself bringing up the low and high ends of the tracks that I found on the Internet (all the music tracks that weren’t on the score) with a graphic EQ though. Compressing some of the sound clips from the movie helps the CD to sound more consistent WRT volume level I think.

I’ll take this time to mention a problem I had. I wanted to apply band dynamic compression to a track. In case I’m using the wrong terms, by “band dynamic compression” I mean compressing only a certain set of frequencies (or at least that’s how it looks to me). I knew human voice, at least for talking, ran between 300Hz to 3.3KHz from P.J. (I didn’t check this, so it might be wrong.) However, the band for the filter in Sound Forge 5 is selected with a center frequency and a band width measured in octaves. There are standard octaves, but that doesn’t really apply here. Also, the plug-in let you select a fractional octave. Note that the plug-in apparently does not let you select a band width higher than three octaves, though. So between scott and I we were able to come up with equations that (we think) solve the problem: turning a range of frequencies into a center frequency with a width in octaves. r = log2(u/l) where r is the range in octaves, u is the upper frequency of the range, l is the lower frequency of the range, and log2 is a base two logarithm. All frequencies are given in Hz. For example, for the frequency range of 300Hz to 3.3KHz, the result is a width of about 3.46 octaves. Since the plug-in was limited to three octaves, I graphed y = x * 2^3 which makes x the low end of the frequency range and y the high end of the frequency range. This way I could quickly move along the graph and find a new frequency range that was suitable. The center frequency of a frequency range that is to be used in a center/octave range can be determined with c = sqrt(u*l) where u and l are as above, c is the center frequency, and sqrt is a square root function. Again, all frequencies are in Hz. For example, for the end range I picked of 400Hz to 3.2KHz, the center frequency is about 1131Hz.

I’ll take a brief moment here to plug Emu48, an HP 48SX/GX emulator. Also on that page (http://www.hpcalc.org/) you can find HP 48SX/GX ROMs, and somewhere on the site is apparently the entire HP 48 GX user manual converted to PDF. I’ve been using this as my desktop calculator and I’m totally hooked. It’s certainly more powerful than my TI-85, and I would almost suppose that it’s more powerful than a TI-89. I’d probably say it’s easier to use than a TI-89, too, but I’m weird like that. Too bad these calculators – though I suspect they’re no longer made — are still so expensive. I at least wish I had a PDA that could an emulator for it, like a WinCE device (except… I’m not sure I’d run WinCE, even for that; I bet I could make it run in Linux on a PDA) or a Sony Clie, which can apparently run some version of an emulator so far.

Let me take a moment to plug Sonic Foundry‘s Noise Reduction DX 2.0 plug-in set. These things work great. Of something like 11 copies of Tears for Fears’ “Head Over Heels” I found on the Internet, I think every single one of them had a click at about 9s in to the song. I had almost given up hope when I rand it through the Click Removal plug-in. In about two minutes I had tweaked the params and removed the click completely to my satisfaction. I’ve also been using the noise reduction plug-in on some of the clips I took from the movie. At first I thought it was distorting the vocals, but after tinkering for 15m or so (hint: try mode 3) I was satisfied. I think the voices do sound a bit weird, especially in headphones, but I don’t think they necessarily sound any weirder than they already do on the CD. Plus (I believe) both plug-ins have the ability to let you hear what they’re discarding. Recommended.

CD Architect 5 continues to annoy me a bit. I was playing with Event FX to add EQ and/or compression to tracks. However, the normalization function of CD Architect doesn’t take the result of Event FX in to account when calculating the gain that needs to be applied to a track. At first I was just playing the song through, watching to see if the meters clipped and if so, by how much. Then I’d just adjust, for example, the EQ’s output gain down by whatever I needed to get -0.10dB. More recently, though, I’ve been taking advantage of CD Architect’s ability to make multiple takes of a track. You can right click a track and select “Open a copy in Sound Forge.” This will create a copy of the track with “Take N” (where N is a number >= 2) appended to the file name and open it in Sound Forge. Now you can apply the effects in Sound Forge, then just normalize it out yourself. If you decide you don’t like it, just close the file and copy over it from the original take. (Nitpick: when you open a copy of “Foo Take 5.wav” it makes “Foo Take 5 Take 2.wav”.) Not so bad. I’ve been getting along with it.

I’ve been getting some feedback on the soundtrack, and I appreciate it. I’m trying to respond to it wherever possible.

I was playing with KaZaA for the past 24h or so. Hint: KaZaA sucks for MP3s, rules for other things. Like, say, for example — just an example, of course — finding software. With this I also installed Kazoom which is a little program that basically combs over all your downloads at a configured interval and tells KaZaA to search for other people you can download from simultaneously. Warning: Kazoom includes ad-ware out the yin yang. I suggest four things after installation: (1) msconfig and remove all the stuff it wants to run at start up; (2) go to “Add/Remove Programs” and delete all the stuff that it put in there; (3) remove the stupid icons off your desktop (thankfully few of them); (4) download and run Ad-Aware.

I was a bit concerned at my low participation rating. Reading up on this in KaZaA documentation, apparently people with higher participation ratings get priority in downloads. I was originally only sharing something like 350 files including a bunch of MP3 files and some MP3 albums (high-quality releases). I was only at “Low (12)” or something. Apparently there are two ways to increase your rating according to the documentation: share more files, and giving files integrity ratings and proper metadata. I decided to give a go at sharing files first, so I decided to share my download directory. Wham, now I’m sharing 21,000 files or so, including a bunch of software, NES ROMs, etc. Still no increase. I go to try and rate some files and find the interface horribly, terribly, unusably slow. I rated about 20 files before I gave up; the process of doing those 20 files probably took me 10 minutes.

I am then told by Andy the Benevolent that there exist KaZaA hacks to raise your participation level. At this time I will make this plea to the reader: please share! I only ran such a hack after sharing pretty much everything I had that would have been of use on my hard disk. Don’t be a total leech, not when it’s so easy to share. (As I was writing this I realized I had closed KaZaA. I’ve since re-opened it, solely for people to download from me.) Kazaa Hack 2.0.2 apparently runs against KaZaA or KaZaA Lite. It takes a little while to show up in KaZaA, but if you click the skyrocket button, leave it running for a while (say 5-10m maybe), then click “Freeze” and close the hack, KaZaA will probably update your participation rating within 10m or so. At least, this is how I did it, and I’m now “Supreme Being (1000)”. Note that after increasing my user level, my downloads increased in speed by a factor of 15 or so.

Finally, I went out and blew $800 tonight on five Maxtor 120GB 2MB cache ATA/133 FDB drives and two controllers. BTW, FDB apparently stands for “fluid dynamic bearings,” which I think translates to “quiet drives.” I was considering the Western Digital 120GB 8MB cache ATA/100 drives, but they were slightly more expensive than the Maxtor drives, I’m told by a knowledgeable and trustworthy source that the Maxtor drives are good, and the performance should be near enough what I need it to be. It was difficult to decide between cache and speed. (Maxtor makes an ATA/133 drive that has 8MB cache, but it’s out of my price range. AFAIK, WD makes no ATA/100 drives.) Here’s a comparison of two WD 120GB drives, one with 2MB cache and one with 8MB cache. Here’s someone comparing ATA/100 drive(s) vs. ATA/133 drive(s), though this article has more of a focus on RAID. Then there’s a person that I don’t know making a specific comment about the trade-offs between speed and cache. In the end I just said “fuck it” and bought from Googlegear who had the best price. Incidentally, they also had the Highpoint Rocket133 two channel controllers I wanted. Even better, they’re going to ship it all two day for cheap, it seems; some sort of sale they’re having. If it’s all in stock and ships by Friday, I could have it by next Tuesday. Oh fuck. I just realized that I bet I’ll be hard pressed to find a motherboard with on-board ATA/133. I bet I need another Highpoint controller. I should have just gotten one to begin with. Then I’ll have to procure a faster processor (faster than the 500MHz I have lying about) and probably a motherboard to go with it, and maybe a case big enough to hold six drives and a CD-RW (the Cendyne, I think). One with enough power supply. Eek. This is getting more expensive as I talk about it. I’ll try and get Googlegear to modify the order I guess. Lets see how the customer service goes.

I’m going to try and contact them via e-mail then go to sleep. I would like to be in bed before sunrise tonight, I think. More tinkering with box that needs to boot Linux from the network tomorrow.