Fix for the "ERROR: MXM Structure not found or invalid" POST message

Discussion in 'Hardware Components and Aftermarket Upgrades' started by thx1137, Jan 7, 2010.

Thread Status:
Not open for further replies.
  1. thx1137

    thx1137 Newbie

    Reputations:
    25
    Messages:
    2
    Likes Received:
    1
    Trophy Points:
    5
    Hello everyone.

    I have a partial solution for you who want to upgrade an MXM graphics and you suffer from the infamous "ERROR: MXM Structure not found or invalid.
    Reflash MXM ROM or add MXM Structure and associated callbacks to SBIOS!
    POST will be halted for 30 seconds and performance will be limited to
    balanced performance mode until this is resolved..."

    The most annoying thing is the periodical pc-speaker beeping. You can live with the 30 second timeout, the increased performance is worth it. Beeping can be removed quite easily.

    Here is my thought process how I managed to remove it:

    After revealing the fact that the "MXM Structure..." string is stored in the video bios, it was clear that the code causing this must be stored in vbios too.

    So I started to search how the pc-speaker beeps are created. After reading an article concerning this topic on GameDev.net, it was clear, that pc speaker can be controlled only by writing to a hardware port 0x61.

    I fired up Visual Studio to find out what is the opcode for the
    Code:
    out 0x61, al;
    instruction. I wrote a short test program

    Code:
    int main(int argc, char *argv[])
    {
    	__asm
    	{
    		mov al, 0;
    		out 0x61, al;
    		mov al, 0;
    	};
        return 0;
    }
    After stepping through the program and enabling the display of opcodes, I have seen that the opcode I am looking for is E6 61.

    I have searched the vbios for this sequnece. I have found only two occurences close together. Just like in the GameDev article. This started to look promising.

    Then I disassembled the vbios in IDA (metapc, 16-bit code). I looked at position where I found these two instructions. (That is a BINGO! How do you say this? Ah, just bingo.) The code was very similar to that in GameDev article, pushes and pops were consistent. I was sure now that this wasnt just some random sequnece of bytes.

    So I replaced the 0xE6 0x61 bytes (in both locations) with 0x90 0x90 (do this in your favorite hex editor). This is a friend of every hacker - the NOP (no operation) instruction. x86 architecture uses instructions of variable length - 0x90 0x90 are two nop instructions (to keep the vbios file length the same). You have to make sure that you have ONLY changed the instructions marked in red rectangle in the IDA disassembly screenshot below (and ONLY in this screenshot, the other screenshots are refering to other topics), because i can not guarantee that there are no other 0xE6 0x61 sequences in other nvidia bioses (for example somewhere in data segments)
    [​IMG]
    Then I resaved the vbios in Nibitor to fix the checksum, flashed the vbios with nvflash and viola!


    As we speak, I am writing this from an Amilo Xi 1546 with an NV 9600M GT 1024MB DDR2, Hynix memory chips, green PCB.
    I have also modified the performance tables as it is described in the NightWalker guide, to make the card as powerful as it should be.

    I am quite confident that this fix should work for all combinations of NVIDIA cards and notebook models, which suffer from this problem.

    I think I do not have to remind you that you have to be careful and know what you are doing while performing this hack, otherwise you can brick your graphics card.

    The next challenge is to remove the 30 sec waiting time completely. I will look into it, if I am bored. Or you - dear readers, can (now that you know the general idea) fix it and share the solution with the world, to demonstrate that we will not just shell out another $1000 just to get better graphics in our notebooks.

    Update on the complete nag screen removal:
    It seems a bit more difficult than I first thought. Lots of references to the data segment are not resolved by IDA, and to this date I was not able to find the loop which gets repeated 30 times and calls the PC speaker code.

    As a nice side effect though, I found a place in the vbios code which tells what is the MXM revision of the card. Switch to IDA disassembly view and search for immediate value 0x5F80. Search will yield few int 0x15 calls which are used to query some MXM capabilities. One should look like this
    [​IMG]
    Click on the Jump to xref icon in this window. In the xrefs, find a location which looks like this
    [​IMG]
    The immediate value in the cl register tells you the revision. 10h = 1.0, 20h = 2.0, 21h = 2.1, etc.
     
    reylby likes this.
  2. Apsik

    Apsik Newbie

    Reputations:
    0
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    5
  3. mdwfeuer

    mdwfeuer Newbie

    Reputations:
    0
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    5
    hello i am german :))

    can you give me and put the vbios to my email address, please for the 9600 GS Nvidia card
     
  4. niffcreature

    niffcreature ex computer dyke

    Reputations:
    1,748
    Messages:
    4,094
    Likes Received:
    28
    Trophy Points:
    116
    what the heck you guys? is this how you to respond to something you dont understand? did you even read it??? :mad:
     
  5. Egypt

    Egypt Newbie

    Reputations:
    0
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    5
    thanks a lot but the problem is not with the Bios change, your VGA Card and it's gonna work perfect .. .... regards
     
Loading...
Thread Status:
Not open for further replies.

Share This Page