WYSE thin client Reverse Engineering

 Here is a list with all discovered NVRAM Tokens found in the BIOS. Some of them are documented in here .      All of this tokens are used for getting or setting a variable value when BIOS needs to set something up like the Audio IRQ for example.      This values are stored in the virtual CMOS of the system that is 512 bytes long. For saving more than 512 variable values, a masking technique was used to store more than 1 token value per byte. One byte from the CMOS will keep 3 or 4 NVRAM tokens values. Every NVRAM token has a mask that is applied to a CMOS byte to get the desired variable value.      So a NVRAM Token will define the CMOS offset for a specific byte and the mask to extract only the needed bites from that byte. ********************************************     For example to get the Audio IRQ from the NVRAM Token "AI" next computations are made: 3E4F                  mov...

Now I will present the BIOS chip memory map. The hex values represent the offset address in the chip. All ROM images are compressed with "CALG1 Compression Library" and all have a header of 32 bytes where is described the location where every ROM needs to be extracted, the size of the ROM before was compressed, the size after compression + some checksum that is not used. The data in this table is for the original BIOS. Patched ones are different. Header + Padding - all zeroes 0 ROM header 9CC0 Compressed VSA Init ROM 9CE0 ROM header 1:D170 Compressed JVGA BIOS 1:D190 ROM header 2:1110 Compressed PXE ROM 2:1130 ROM header 2:6F50 Compressed UHCI ROM 2:6F70 ROM header 2:70D0 Compressed GUI ROM 2:70F0 ROM header 2...

  The ROMs:      VSA Init ROM:  (Virtual Systems Architecture)  is a piece of software that is hiding the real hardware from the OS and is emulating standard hardware like keyboard controller, IDE controller, CMOS and other legacy hardware.       The Geode, rather than carrying lots of legacy hardware interfaces that are presumed to exist on x86 systems that might be painful to implement on a highly integrated, low power processor, the Geode often emulates such interfaces by use of software that is invoked by special traps that take place when the processor accesses these devices.     This emulation is made at the hardware level by setting some Model Specific Registers (MSRs) that control the GeodeLink Interface Units (GLIUs). This GLIUs can trap CPU access to some defined memory regions and run some ISRs from VSA software instead, or route the access to some other devices. VSA system is a TSR software(Terminate and Stay Reside...