UNIVERSITY OF DAR ES SALAAM
IS 158
Computer BIOS/Firmware
Reprogramming
(Advanced Computer Maintenance)
Course Instructor: Dr. Diana Rwegasira
Assistant Instructor: Mr. Lucas E. Manyota
Introduction to Firmware
Firmware is low-level system software that starts the
computer before the operating system loads. Older
systems use Legacy BIOS (Basic Input/Output System),
while modern systems primarily use UEFI (Unified
Extensible Firmware Interface). UEFI is responsible for
initializing hardware and loading the operating system,
while also providing improved security, faster boot times,
and support for larger storage devices
Firmware performs hardware initialization and verifies
that core components are functioning correctly during
startup
CONT …
Typically, firmware is stored in SPI (Serial Peripheral Interface)
NOR flash memory chips mounted on the motherboard. SPI
flash provides fast communication between the firmware chip
and the motherboard chipset using a small number of pins.
Firmware chip sizes commonly range from 8 MB to 32 MB in
consumer systems, while enterprise and server platforms may
use larger capacities depending on firmware complexity and
recovery features.
It responsible for POST (Power-On Self-Test), boot device
selection, low-level hardware configuration, and passing control
to the operating system bootloader
SPI Flash Memory
Non-volatile memory chip used to store BIOS/UEFI firmware
on the motherboard, Common manufacturers include
Winbond, Macronix International (MXIC), and GigaDevice
Typically available in SOIC8/SOP8 surface-mount packages
with 8 pins. Requires proper voltage handling during reading
or flashing operations, commonly 1.8V or 3.3V, to avoid
damaging the chip or motherboard
CONT …
CONT …
Firmware Architecture
Keep in mind that actual firmware layouts vary by
motherboard vendor and platform, so these are some of
regions/components
➢
Boot Block Region
Contains minimal recovery code used to initialize the system
and restore firmware in case of corruption or failed updates.
➢
Main BIOS/UEFI Region
Stores the primary firmware code responsible for hardware
initialization, POST, boot management, and UEFI services.
CONT …
➢ NVRAM Variables
Non-Volatile RAM area used to store firmware settings
such as boot order, Secure Boot keys, hardware
configuration, and system preferences.
➢ Intel ME / AMD PSP Regions
Dedicated management engine firmware regions used
for low-level platform management, security functions,
remote administration, and trusted execution features.
CONT …
➢ Descriptor and Recovery Regions
Define memory layout, access permissions, and
protected firmware areas. Recovery regions support
firmware restoration and emergency boot operations.
➢ Embedded Controller (EC) Firmware
Firmware for the embedded controller chip responsible
for keyboard input, battery management, thermal
control, fan operation, and power management
functions.
Common Reprogramming Tools
CH341A SPI programmer, TL866II Plus, Bus Pirate,
Raspberry Pi SPI interface, SOIC8 clips and adapters,
RT809H / RT809F
CONT …
Embedded Controller Firmware (EC)
Embedded Controller (EC) is a separate microcontroller on
the motherboard that handles low-level hardware
management independently of the main CPU and
BIOS/UEFI. It is responsible for tasks such as keyboard input
processing, battery charging control, fan speed regulation,
and thermal monitoring. It continues operating even when the
system is in sleep or powered off states (as long as standby
power is present).
CONT …
EC firmware is tightly coordinated with the system BIOS/UEFI
firmware. In most platforms, both are developed and released
in matching versions because they share configuration data
and hardware initialization dependencies.
If the EC firmware and BIOS version are mismatched, the
system may behave abnormally. Common issues include
failure to power on, incorrect battery charging behavior,
unresponsive keyboard or touchpad, and abnormal fan
speeds or thermal control instability.
CONT …
In short, the EC operates as a dedicated hardware
management subsystem, and its firmware version
compatibility with BIOS is critical for stable system operation.
CONT …
Reverse Engineering Firmware
Firmware is first extracted from the SPI flash chip, then
analyzed as a binary image.
PE32 modules (UEFI executables) are disassembled to
understand firmware logic. Tools like Ghidra and IDA Pro
are used for static analysis
DXE drivers are studied to see how hardware is initialized
and controlled. NVRAM variables are checked to
understand stored system settings (boot order, security
keys, configuration)
Common Firmware Failure Scenarios
Interrupted BIOS update (power loss or forced shutdown)
Cause: User updates BIOS on low battery, unstable power,
or closes system mid-update.
Indicators: No boot (no POST), black screen, recovery mode
prompt, or repeated restart loop.
Wrong BIOS file selection
Cause: Downloading/flashing firmware for the wrong
laptop/motherboard model or revision.
Indicators: System powers on but no display, fans spin at full
speed, or complete boot failure.
CONT …
Forced shutdown during boot or update
Cause: Holding power button or removing battery during
startup/firmware update.
Indicators: Corrupted boot sequence, inability to enter BIOS,
or system stuck on logo.
Incorrect BIOS settings changes
Cause: Misconfiguration of boot mode (UEFI/Legacy),
Secure Boot, or SATA mode.
Indicators: OS not detected, boot device error, or system
fails to load operating system.
CONT …
BIOS downgrade to incompatible version
Cause: Installing older firmware that does not support current
hardware or microcode.
Indicators: System instability, missing hardware detection, or
failure to boot.
CMOS/NVRAM corruption from incorrect resets
Cause: Improper CMOS reset (jumper misuse or battery
removal during operation).
Indicators: BIOS settings reset repeatedly, incorrect
time/date, or unstable boot behavior.
CONT …
Faulty EC firmware
Cause: Corrupted embedded controller firmware.
Indicators: Keyboard not working, battery not charging, fan
running at maximum speed, or system not powering on
properly.
Hardware SPI flash degradation
Cause: Aging or defective flash memory chip.
Indicators: Random boot failures, inconsistent firmware
behavior, or inability to reliably read/write firmware.
CONT …
Power instability during normal use (leading to firmware
corruption indirectly)
Cause: Repeated sudden shutdowns or faulty power supply.
Indicators: Gradual boot issues, BIOS recovery triggers, or
corrupted settings over time.
ASK
LET’S PROCEED IN PRACTICAL WAYS