25

I want to dump the BIOS data of my laptop to a file. The only solution I found is the following command:

dd if=/dev/mem bs=X skip=Y count=1

X and Y are different in suggested solutions by different people because there are different BIOS types.

Is there a way to find the exact address of BIOS data in /dev/mem? Can I use dmidecode to find the address range of BIOS in memory? And does Linux dump all BIOS data in RAM or just a special part of it?

If Linux can dump BIOS data to RAM, can the root user also access the BIOS directly?

  • i am not computer nor english language expert. the word "data" confuses me a little. what to you mean by "bios data"? do not you mean only "document" data like bios configuration? do you mean all data together with executable firmware? – qdinar Feb 14 at 11:07
20
+100

You can try using biosdecode.

It is a command line utility to parses the BIOS memory and prints information about all structures (or entry points) it knows of. It finds out information about hardware such as:

  • IPMI Device
  • Type of memory and speed
  • Chassis Information
  • Temperature Probe
  • Cooling Device
  • Electrical Current Probe
  • Processor and Memory Information
  • Serial numbers
  • BIOS version
  • PCI / PCIe Slots and Speed

etc.

Things to consider:

  • biosdecode parses the BIOS memory and prints the information about all structures.
  • Decoding BIOS data is the same as dumping a computer's DMI. The DMI table mainly describes what the system is currently made of.
  • Data provided by biosdecode is not in a human-readable format.

Viewing the contents on screen

You will need to use dmidecode command for dumping a computer’s DMI (SMBIOS) table contents on screen.

$ sudo dmidecode --type 0 

Search the man page for more information:

$ man dmidecode

Yes, the kernel keeps only the information it needs from the BIOS in the RAM. However you can make real-time BIOS calls from the root user using C applications that include embedded ASM (Assembly code), etc.

You can read more about the Linux kernel and a system's BIOS in this article from Linuxmagazine titled: Linux and the BIOS.

| improve this answer | |
12

I think what you're looking for is flashrom. Provided that your system is supported, you can read your BIOS content by issuing

# flashrom -r <outputfile>

If you only want to save the so called CMOS RAM (those extra-bytes you save configuration to, like alarm on RTC et al) the kernel's nvram driver and device might help you:

config NVRAM
     tristate "/dev/nvram support"
     depends on ATARI || X86 || (ARM && RTC_DRV_CMOS) || GENERIC_NVRAM
     ---help---
       If you say Y here and create a character special file /dev/nvram
       with major number 10 and minor number 144 using mknod ("man mknod"),
       you get read and write access to the extra bytes of non-volatile
       memory in the real time clock (RTC), which is contained in every PC
       and most Ataris.  The actual number of bytes varies, depending on the
       nvram in the system, but is usually 114 (128-14 for the RTC).

       This memory is conventionally called "CMOS RAM" on PCs and "NVRAM"
       on Ataris. /dev/nvram may be used to view settings there, or to
       change them (with some utility). It could also be used to frequently
       save a few bits of very important data that may not be lost over
       power-off and for which writing to disk is too insecure. Note
       however that most NVRAM space in a PC belongs to the BIOS and you
       should NEVER idly tamper with it. See Ralf Brown's interrupt list
       for a guide to the use of CMOS bytes by your BIOS.

       On Atari machines, /dev/nvram is always configured and does not need
       to be selected.

       To compile this driver as a module, choose M here: the
       module will be called nvram.
| improve this answer | |
  • This is a good suggestion but likely won't work on your laptop. The support of laptop BIOS' is lacking for this piece of software. For example it would not run on any Thinkpad laptops that I own (many different models). – slm May 3 '14 at 3:12
10

If other tools are not available or cannot be used, here is a way to make an educated guess as to what region of memory to dump.

For instance, from within a VirtualBox VM, I successfully dumped its BIOS by doing:

$ grep ROM /proc/iomem # https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-firmware-memmap
000c0000-000c7fff : Video ROM
000e2000-000e2fff : Adapter ROM
  000f0000-000fffff : System ROM
# dd if=/dev/mem of=pcbios.rom bs=64k skip=15 count=1 # 15*64k + 64k
| improve this answer | |
  • 2
    How do you know which sizes to use based on the memory addresses? – unseen_rider Feb 6 '17 at 11:18
7

Option bios in dmidecode

dmidecode -t bios

Read the memory from C:0000 to F:FFFF without the need for dmidecode

dd if=/dev/mem bs=1k skip=768  count=256 2>/dev/null | strings -n 8
| improve this answer | |
3

This worked for me in VirtualBox:

$ grep ROM /proc/iomem

which results in:
000c0000-000c7fff : Video ROM
000e2000-000e2fff : Adapter ROM
000f0000-000fffff : System ROM

System ROM starts at 000f0000, which is 0xF0000.

Open browser and go to http://www.hexadecimaldictionary.com/hexadecimal/0xF0000. This says the decimal value is 983040, which divided by 1024 to get kilobytes is 960 which is the starting point and the value for 'skip'.

The end number is 0xFFFFF which is 1048575 which is just shy of 1024. 1024 - 960 is 64, which is the value of 'count'.

The command to run to dump the bios is thus:

dd if=/dev/mem of=pcbios.bin bs=1k skip=960 count=64
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.