Undocumented structures
Structures found in the dumps of the data corpus which no public source describes, and whose meaning could not be established from the data. They are left undecoded, and what is known of them is gathered here, so that the dumps which will tell more can be recognized.
1. Structures of several vendors
1.1. Type 128: sample structure of the firmware kit
Found on Insyde firmware: Lenovo IdeaPad and ThinkBook, Toshiba Satellite, HP 250 notebooks, Framework laptops, Gigabyte G5 and Neousys Nuvo.
The formatted area holds the bytes 55 AA 55 AA, and the structure carries
the strings Oem Test 1 and Oem Test 2, or Oem Type 128 Test 1 and
Oem Type 128 Test 2, which no field refers to. The structure is a sample
of the firmware kit which the vendors of the systems leave in place.
Other firmware carries structures of type 128 of its own. Microsoft Surface
Laptop 3 carries one referring to a single string, SHA followed by 40
hexadecimal digits, as many as the ones of a SHA-1 hash. Fujitsu ESPRIMO Q958
carries the structures of Fujitsu described with type 143.
1.2. Type 129
The Intel ASF information is decoded, see the chapter of the Intel reference
code structures. Other firmware gives type 129 to structures of its own:
Lenovo IdeaPad Z565 and Toshiba Satellite C655D carry one of 5 bytes, whose
strings are the ones of a type 128 sample, cut short, Gigabyte carries
structures of 38 bytes on a server board, beginning with zeroes and holding
0xFF from 0x0C on, and Precision M3800 one of 9 bytes of zeroes.
1.3. Type 133
Lenovo firmware of all the known models, from ThinkPad T61p to ThinkPad T14
Gen 3, carries a structure of 5 bytes, which refers to its only string at 0x04: KHOIHGIUCCHHII, the same
in all known data. Xiaomi TM1701, of Insyde firmware, carries a structure of
the same form, whose string TIMIPCR001V001 is of the same length.
AMI firmware of Intel platforms of the 12th generation and later (ASUS Prime
H610M-R and ROG STRIX Z690-A, Gigabyte B760M DS3H and H610M H V2, Beelink
SEi) carries a structure of 44 bytes, identical on all of them, which begins
with the GUID 7895B4F9-924D-410A-9639-123862B28A63 and holds the PCI vendor
ID of Intel, 0x8086, twice. ThinkPad T14 Gen 3 carries one of the same GUID
with other bytes and strings.
AMI firmware of servers (ASUS RS520-E9, iXsystems TrueNAS H30 and M50)
carries a structure of 12 bytes holding two DWORD values, e.g. 0x67B6D000
and 0x4000, which look like the address of a region of memory aligned to
4 KiB below 4 GiB, and its size.
1.4. Type 136
Found on the firmware of every vendor, mostly on Intel platforms. The
formatted area holds a single WORD, whose value depends on the code base of
the firmware rather than on the system: 0x0000 on AMI firmware, 0xFFFF on
Insyde firmware, and 0x5A5A on the firmware of Phoenix code base, e.g.
ThinkPad, Dell Precision 490 and HP Z600. Newer AMI tables carry a second
structure of type 136, of a DWORD of zero, which is the only one of Dell G15
5510.
1.5. Type 143
Fujitsu LifeBook S 4546 carries two structures, the first of which holds the
signature FJ_OEM at 0x05. Fujitsu ESPRIMO Q958 carries the same two
structures as type 128, followed by structures of the same type beginning with
03, a byte of 9, 0x0B or 0x0D, and 01 01, some of which refer to strings
such as [U:SCB1 and [V:CSM1.
MSI boards carry one referring to eleven strings, which name the firmware
components and their versions, e.g. GOP1-[N/A], RAID-1…16, PXEU1-v.2,
AMI-AptioV and MsiFlash-17 on PRO B650-S WIFI, and MEFW-9.0.20.1447,
VBIOS-2179 and PXEL1-2.53 on MS-7816. The strings of the components the
board lacks are N/A.
1.6. Type 148
Intel S2600WTT server board carries a structure of 48 bytes whose bytes from
0x05 on are the numbers of its strings, which give the versions of the
firmware components of the board: the BIOS ID, the BMC firmware, the
Management Engine, the SDR package, the FRU and the SDR file, the microcode
patches and more. The structure of 26 bytes of the Intel Bay Trail reference
code, e.g. of Lenovo IdeaPad 100S, is decoded as the Intel platform
information.
1.7. Type 248
Acer Aspire A515 and Nitro AN515 carry 00 02 6C 00 00 00 00, and Predator
G9-592 carries 00 02 6C 00 followed by the string BDF, which no field
refers to. Dell Inspiron 5370, Latitude 7390 and 7490 and XPS 13 9300 carry
00 00 00 00 followed by the number of their only string, BDF_DE_P87G,
BDF_DE_1901 or 12345678901.
Lenovo IdeaPad, Legion, Yoga, ThinkBook and V130 carry 14 bytes beginning with
AC AC AA 17, followed by the WORD values 0 or 0xFFFF at 0x08 and 0,
8 or 0x0B at 0x0A, and zeros.
2. Acer
2.1. Type 172
Acer Aspire A515, Nitro AN515 and Predator G9-592 carry 02 and a byte
which differs from one model to another, from 0x26 to 0x44, followed by
3-byte records of an ID, from 1 to 7, and a WORD value: 0x00FF, 1,
0x00FF, 1, 0x000F, 0x00FF and 0x00FF, the same on all of them.
Predator G9-592 carries the records 1 to 6 only, and Aspire A515-52 and
A515-52G the records 8 to 11 too, of the values 0, 1, 2 and 1. The
IDs 1 to 7 are the kinds of the devices of the device list (type 171). The
second byte is not the length of that structure, although it is on Nitro
AN515-31.
3. Dell
3.1. Type 179
Dell G15 5510 carries a structure referring to a single string, 1[ followed
by 64 hexadecimal digits and ], in the key[value] form of the OEM strings
(type 11) of Dell. The digits are as many as the ones of a SHA-256 hash.
3.2. Type 217
Dell notebooks and workstations, from Latitude D500 to G15 5510 and XPS 13
9300, carry a structure referring to the strings US-101 and Proprietary
at 0x04 and 0x05, followed by 01 03, the same on all of them, which may
describe the keyboard. Precision M3800 carries one of blank strings, followed
by 00 00, and G15 5515 one referring to Keyboard twice, followed by
02 02.
3.3. Type 222
Found on Dell firmware of every kind of system, from OptiPlex GX110 and PowerEdge 1300 to PowerEdge R740xd and XPS 13 9300, of 13 bytes, or of 15 or 16 bytes on newer systems.
| Offset | Length | Value |
|---|---|---|
|
|
|
|
|
A single bit set: |
|
|
|
|
5 |
Date and time in BCD: year of two digits, month, day, hour and minute, e.g.
|
|
2 or 3 |
Only in structures of 15 or 16 bytes, e.g. |
The date is set on most notebooks and desktops, and on a few servers. It is mostly weeks or months later than the release date of the firmware, but it is earlier on PowerEdge 4400 and R740xd, so it is not the date the firmware was updated.
4. HP
4.1. ProLiant servers
The ProLiant G1 to G6 servers carry structures of types 196, 198, 205, 210,
213, 214, 215, 217, 218, 220, 222, 223, 227 and 228, which neither dmidecode
nor the drivers of HP describe. Type 196 holds a single byte of zero, type
198 e.g. 17 00 00 01 3C 00 01, and type 205 the ASCII text FATx at 0x06.
4.2. HP Z600
The workstation carries structures of types 153, 197 and 207, of which type 197 is not the processor information of the ProLiant servers.
5. Lenovo
5.1. Type 131: CMOS layout
ThinkPads of Phoenix firmware, T61p, T410, W510 and X201, carry a structure of
type 131 of 17 bytes referring to the strings BOOTINF 20h, BOOTDEV 21h
and KEYPTRS 23h, which name registers of the CMOS memory, along with the
Intel vPro information and the ThinkVantage Technologies enablement of the
same type. The numbers of the strings are followed by FF FF 1F 00 00 00 00
00, a byte of 2 on T61p and 3 on the others, and a byte of zero.
5.2. Type 132
ThinkPads and Lenovo B590 carry three bytes, sometimes followed by a byte of
zero: 1 or 2, a byte from 0xC0 to 0xDB, e.g. 0xD8 on most of them,
and 0x36, the same on all of them.
5.3. Types 137 to 139
ThinkPad T61p carries structures of types 137 to 139.
5.4. Type 141
ThinkPads of 2019 and later (T14 Gen 1 to Gen 3, T490, E14 Gen 5, L15 Gen 1)
carry several structures of 18 to 56 bytes, each of which begins with the
text THNK, followed by a WORD of zero and the kind of the structure,
a DWORD at 0x0A: 0, 0x10, 0x30, 0x40, 0x50 or 0x60. The data
of the structure begins at 0x0E.
The structures of the kinds 0 to 0x40 hold a DWORD value, e.g. a small
number, 0xFFFFFFFF, or the text LiP on T14 Gen 2a. The one of the kind
0x50 holds two QWORD values. The one of the kind 0x60 is a log of five
events: a WORD count of the events, e.g. 22, followed by 8-byte records
of the date and the time of the latest ones in BCD: year of four digits as a
WORD, month, day, hour, minute, second and a byte of zero, e.g.
24 20 05 26 18 08 39 00 for 2024-05-26 18:08:39, the latest first.
6. Phoenix and Award
Foxconn M61PMV and Packard Bell iMedia S3210, of Phoenix firmware, carry structures of types 188, 190, 192 and 194, and Gigabyte GA-MA74GMT-S2 and GA-MA78GM-S2H, of Award firmware, structures of types 188, 190, 192, 194 and, on GA-MA74GMT-S2, 196 and 198, of 212 to 244 bytes, which hold tables of small numbers. Award Software was acquired by Phoenix Technologies, and the structures are of the code base the firmware of both descends from.
All of these boards are AMD platforms of DDR2 memory, e.g. Phenom 9550 on
AMD 780G and Athlon II X2 215 on NVIDIA MCP78, and the structures share their
layout whatever the chipset is. They look like the state of the memory
controllers the reference code of AMD keeps as it trains the memory, the
MCTStatStruc and DCTStatStruc of the code coreboot carries: types 192 and
194 hold per-byte-lane delays, e.g. 0F 10 10 10 and 17 17 16 16, for the
two DRAM controllers. The fields of coreboot have changed over time, and do
not match the structures closely enough to decode them.
7. Cisco
7.1. Types 203 and 204
Cisco UCS C220 M5 carries a structure of type 203 of 36 bytes and one of type
204 of 28 bytes along with the decoded ones, both beginning with 03, as the
PCI adapter information does, and referring to no strings: 03 6A 0A 04 04
followed by small numbers, e.g. 3 at 0x0D and 0x11, and 03 00 01 02 00
00 08 followed by zeros.