4 ms·
The BIOS way to do this is with an Option ROM. During boot, the BIOS scans for a special signature, and jumps to a fixed offset in that block. The OPROM init
by kijiki 10y ago
The BIOS way to do this is with an Option ROM. During boot, the BIOS scans for a special signature, and jumps to a fixed offset in that block. The OPROM init routine then hooks the various software interrupts that the BIOS, boot-loader and other OPROMs use to read from disk.
You can inject a custom one into your BIOS image, but if you have PCI/PCIe available, you can get cards that have an OPROM onboard. The easiest/hacky way is an old NIC that someone has reverse engineered enough to flash its OPROM; you're just using it for the OPROM, the NIC functionality is unused.
- drvdevd 10y agoVery interesting thank you. You may already be aware, but when I first saw the replies here mentioning Option ROMs I immediately thought of the thunderstrike EFI vulnerabilities for Macbooks. I've yet to actually mess with them, but apparently that was how they worked at least in the first generation, I haven't followed the research much further yet [https://trmm.net/Thunderstrike https://trmm.net/Thunderstrike]. So since option ROMs, for obvious reasons, survived the "transition" to EFI, does this mean the same mechanism could be used in BIOS machines? At least this might also have implications for backporting peripheral drivers too (for whatever reason)...