BIOS HP Rompaq FreeDOS PXE USB Boot

From richud.com
Jump to navigation Jump to search


Extract the BIOS

Download the SPxxxxxx.EXE to a temp folder, then extract with 7zip. As with most HP software it is packed full of fluff too.

e.g. the HP 8740w bios

$ 7za x sp55500.exe 

7-Zip (A) [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_GB.UTF-8,Utf16=on,HugeFiles=on,4 CPUs)

Processing archive: sp55500.exe

Extracting  /CryptRSA.efi
Extracting  /CryptRSA32.efi
Extracting  /FirmwareUpdate.exe
Extracting  /FreeDOS/KERNEL.SYS
Extracting  /HpBiosUpdate.efi
Extracting  /HpBiosUpdate.s09
Extracting  /HpBiosUpdate.sig
Extracting  /HpBiosUpdate32.efi
Extracting  /HpBiosUpdate32.s09
Extracting  /HpBiosUpdate32.sig
Extracting  /hpqFlash.exe
Extracting  /HPUSBFW.exe
Extracting  /kernels.zip
Extracting  /ROM.CAB
Extracting  /Rompaq/68CAD.BIN
Extracting  /Rompaq/config.sys
Extracting  /Rompaq/eRompaq.exe
Extracting  /Rompaq/gpl2.txt
Extracting  /Rompaq/KERNEL.SYS
Extracting  /Setup.exe
Extracting  /WSSP55500.rtf

Everything is Ok

Files: 21
Size:       13918806
Compressed: 8455016

The Rompaq folder contains a (slightly) special FreeDOS kernel (basically its modified to boot eRompaq.exe instead of command.com) and the bios .bin file. The config.sys tells it the shell is erompaq.exe too.

The contents of this folder just needs to be copied to a bootable floppy image, with a FreeDOS kernel

Create the BIOS boot floppy

Full info about creating a Bootable floppy disk image, see here.

This is the terse verion.

#create 8.8Mb image
dd if=/dev/zero of=/tmp/test.ima bs=512 count=17280
#format image
mkfs.msdos -F 16 -n "richud.com" /tmp/test.ima
#Add a FreeDOS boot sector, (you will need to have downloaded and built ms-sys, as described in link
./ms-sys-2.2.1/bin/ms-sys -f -5 /tmp/test.ima
#fix boot sector hex as described in link. This bit shouldnt matter if PXE booting it via memdisk.
hexedit /tmp/test.ima
#mount the image on loop device and mount the filesystem
losetup /dev/loop0 /tmp/test.ima && sleep 1 && udisks --mount /dev/loop0
#copy Rompaq files to floppy image
cp Rompaq/* /media/richud.com/
#unmount filesystem and loop device
udisks --unmount /dev/loop0 && losetup -d /dev/loop0
#compress the image, should end up about 2Mb
gzip -c -9 /tmp/test.ima > /tmp/hp8740w.ima.gz

Syslinux entry to boot

Simply chain load via memdisk, could be PXE server or from USB etc.

Label HP 8740w F21
LINUX /pxe/memdisk
INITRD /bios/8740w.ima.gz

Double packing

The two BIOS's covering the below is double packed with even more fluff.

HP 6360t Mobile Thin Client

HP EliteBook 8460p Notebook PC

HP EliteBook 8460w Mobile Workstation

HP EliteBook 8560p Notebook PC

HP ProBook 6360b Notebook PC

HP ProBook 6460b Notebook PC

HP ProBook 6560b Notebook PC


$ 7za x sp55676.exe 

7-Zip (A) [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_GB.UTF-8,Utf16=on,HugeFiles=on,4 CPUs)

Processing archive: sp55676.exe

Extracting  /68SCE.CAB
Extracting  /68SCF.CAB
Extracting  /hpqflash/hpqRun.exe
Extracting  /hpqflash/map.ini
Extracting  /hpqflash/sp55676_E.exe
Extracting  /hpqflash/sp55676_F.exe
Extracting  /HPQFlash.exe
Extracting  /hpqRun.exe
Extracting  /map.ini
Extracting  /ROM.CAB
Extracting  /WSSP55676.rtf

Everything is Ok

Files: 11
Size:       23907817
Compressed: 21507080

Then you need to peel another layer of the onion back in /hpqflash/ to reveal the Rompaq folder

$ 7za x hpqflash/sp55676_E.exe -o/tmp/E/

7-Zip (A) [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_GB.UTF-8,Utf16=on,HugeFiles=on,4 CPUs)

Processing archive: hpqflash/sp55676_E.exe

Extracting  /FirmwareUpdate.exe
Extracting  /FreeDOS/KERNEL.SYS
Extracting  /HPQFlash.exe
Extracting  /HPUSBFW.exe
Extracting  /kernels.zip
Extracting  /ROM.CAB
Extracting  /Rompaq/68SCE.BIN
Extracting  /Rompaq/config.sys
Extracting  /Rompaq/eRompaq.exe
Extracting  /Rompaq/gpl2.txt
Extracting  /Rompaq/KERNEL.SYS

Everything is Ok

Files: 11
Size:       10172430
Compressed: 7054993

And same for 7za x hpqflash/sp55676_F.exe -o/tmp/F/

Then you are where you were in top example.