Watchguard Firebox XTM 8 Series

stephenw10

Ok, wonder why it didn't work the first time? Hmm.
Never mind, now you can read out the bios file and open it with a bios editor to see if it holds any secrets. It probably won't to be honest. Only the X-Core box had the ability to set the arm/disarm led status from the bios. It will let you see how easy it would be to unlock the bios menus. On the XTM5 it was simply a matter of changing to default access level but it was high risk as you've probably read in the xtm5 thread.

Steve

Eams

Yeah.. I think I might have downloaded the 64bit package when I was in fact running the 32bit nanobsd build - having tried so many different builds :P

Ok I've got the BIOS saved to disk, what do I use to open it and have a look, modbin6 from the freedos image?

Eamon

stephenw10

No, modbin6 only works for Award bioses.
You have to use an AMI bios editor, there are several, none of them work very well! ::)
There is a patched version of AMIBCP that sort of works. MMTool can extract/replace bios modules.
None of them are too easy to get hold of I recal.

Steve

Eams

Ah ok, I found this… www dot bios-mods dot com/downloads/

Eamon

Edit: Hyperlink removed.

stephenw10

Yeah that looks good. 3.13 is the version I have.
Perhaps not a great plan to link there from the forum. Don't want to bring down any heat on the dev team. :)

Steve

stephenw10

I checked the XTM5 bios and it reports:

AMIBIOS 080015  02/03/10(C)2006

So that looks like it's bios core version 8.00.15 which is the same as yours (see your first screenshot). The only difference is that yours is twice the size.
I found a copy of amibcp 3.51, which is the most recent I could find, and it still couldn't open your rom file. All those amibcp programs are dated 2008 though so none are terribly new. There are v4 available but I'm lead to believe they are for much newer efi bioses.
Edit: Yep V4.53 can't open any files I have here.

Steve

Eams

I'm thinking the bios dump is somehow wrong.

Had a bit of a dig around the Watchguard support site and I found this on the XTM 8

Hardware Specifications
XTM 8 Series
Processor 2 .66 GHz Quad Core
Memory: Flash 1 GB
Memory: RAM 2 GB

Now that's either the BIOS flash memory or the compact flash card.

Eamon

stephenw10

It's the CF that's 1GB. A 1GB BIOS would be huge! ;)

I agree the most likely thing seems to be that the image is corrupt. That could have happened during extraction, a flashrom problem, or during transfer or something else.

Steve

Eams

Haha!! that's what I get for looking at the specs when I'm half awake!!

Ok so how do I get the BIOS saved properly? I did flashrom -r file.bin then I downloaded it via the pfSense webgui.

Is there a better way?

Eamon

stephenw10

Hmm. Ok. Sometimes your web browser can try to interpret files.
When extracting the bios from the XTM5 I used a filename that was filename.rom and I transfered it via SCP using WinSCP.

To check the file integrity you can generate an MD5 sum for it on the box and then on your windows machine or where ever you put it.

[2.1-BETA1][root@pfsense.localdomain]/tmp(3): flashrom -r backup.rom
flashrom v0.9.5.2-r1515 on FreeBSD 8.3-RELEASE-p8 (i386), built with libpci 3.1.9, GCC 4.2.1 20070719  [FreeBSD], little endian
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OK.
Found chipset "Intel ICH7/ICH7R". Enabling flash write... OK.
Found ST flash chip "M25P80" (1024 kB, SPI) at physical address 0xfff00000.
Reading flash... done.
[2.1-BETA1][root@pfsense.localdomain]/tmp(4): md5 backup.rom
MD5 (backup.rom) = fcefa2906d7c3179264a8528ba0a7cea

I use WinMD5 to check it after transfer.

Steve

Eams

Ok so as it stands my XTM 8 is locked in a never ending bios reboot due to a "CMOS Checksum Bad" error :(

How this happened is as follows:

I had flashed the Lanner FW-8750 firmware to the board - flashrom0.9.2 gave an error and to get on irc.

I spoke with idwer/stefan and a couple of other flashrom devs who were kind enough to compile the lastest flashrom (0.9.6.2 - I think) for pfsense 2.0.3 (many thanks guys).

However before that had come through, I flashed back the back up Bios - got the same error - rebooted and the XTM 8 was back to how it was from the factory ie bios locked but working.

I then followed the Lanner reps advice and used AFUDOS to flash the Lanner bios, which reported it had flashed successfully! and thats how I got to the never ending bios reboot :(

So at the moment I'm waiting on a SPI programming board to arrive from the US so I can flash the bios via the SPI header.

Eamon

IMG_20130524_192911.jpg_thumb

AMIBIOS-flashed.jpg_thumb

AMIBIOS-Error.jpg_thumb

stephenw10

Yikes, that's a message you never want to see. :o

Although the xtm8 is based on the 8750 is not an 8750, there are hardware differences that may mean the standard BIOS cannot work. Though I can't think what they might be.

Failed CMOS checksum is a fairly standard error after updating the BIOS. I take it you've tried clearing the cmos or trying to load the default values. I'm sure the flashrom guys will have discussed that.

You can always try the 4 resistors like I did. ;)

Steve

Eams

No it's not the message I wanted to see either!

The bios they sent was after I had supplied the serial number and board model/version so one would assume it would match!

Yeah I've cleared the cmos, it won't allow me to get into the bios which is the worst part :(

I'm avoiding the 4 resistors and going for a proper SPI programmer ;)

Eamon

stephenw10

More patient than me. :)

Eams

Not really, I just hate soldering ;)

Eams

Looks like I'll have to go the soldering route :(

I've tried the BlackCat SPI programmer but it just won't recognise the rom even though it supports it :(

Eamon

stephenw10

Is the ROM chip powered? How does it connect?

Eams

The rom chip is powered when the unit is in standby.

The SPI programmer connects directly to the SPI-ROM header on the motherboard. I've tried it every which way but no joy :(

Eamon

stephenw10

Well that's quite disappointing. A long wait for no result. :(
Good luck with the soldering. :)

Steve

angelkiller

My XTM 510 is flashed with unlocked BIOS, thanks @ stephenw10. It works like a charm with pfsense.
Now i have two XTM 810 and will try to run pfsense on them. I want to get into the BIOS without luck.
Can someone tell me the correct serial settings for that and has someone a unlocked BIOS running?

greetz from Germany

edit:
Get into Bios with keyboard connected to the XTM 810 and del key ok.
Now i try to make a cf with pfsense and run it and make a Bios backup file.