Another talk about CMOS password

For CMOS, I believe we are no longer unfamiliar. But in terms of CMOS passwords, I don't think I really know much about them, so we did some experiments and studied them. A lot of people have talked about it before, but I think there is a need to talk about it, so let's take out the right part for you.

Before talking about the password, or first say what is CMOS (this article said CMOS are for award). The CMOS actually holds some information about the computer's system clock and hardware configuration, which is read by the system at boot time, while initializing the state of each part of the computer, a total of 128 bytes, stored in the RAM chip.

OK, let's take a look at an example to illustrate some of the CMOS structure, the following 128 bytes is my CMOS content:

00000000H FF (FF) 00 01 00 18 00

SEC Alarm minute alarm small time alarm Sunday

00000010H 11 00 98 00 26 00 02 00 70 00 80 00 00 00 00-00

Monthly Register a Register B register C register D to diagnose the power

00000020H 7E F0 0F 00 80 00 02 00 00 00

Floppy drive password domain hard drive unknown device basic memory expansion

00000030H 7C 2E 7F 00 15 00 86 00 00 00 00 00

Memory hard drive type unknown password data bit unknown

of the 00 22 00 (E2) in the 00000040H

Unknown

00000050H FF E1 3F 00 08 00 59 00

Unknown

00000060H (FF) FF 00 FF (7C)

Unknown century value Unknown

00000070H 7D Bay A/00 19 00 E8 9B

Unknown

The above reference to other information, so not necessarily completely correct, but 38h-3ah password data can be sure, so the next cut to the point, talk about the CMOS password, because I can find all award bios, so the following conclusions are for award CMOS, and verify through on the following motherboard and corresponding BIOS. (The value of this article is 16 binary)

Motherboard name and model BIOS version BIOS date

Aopen (Jian ji) AP58 r1.50c 1998-07-13

Aopen (Jian ji) ax5t R1.80 1998-07-30

Epox (Pan-English) mvp3e unknown 1998-08-03

Epox (Pan-English) p2-112a unknown 1998-09-16

FIC (Volkswagen) PA-2007 v1.0a 1997-06-25

In the four bytes of 38H-3BH, because the 39H and 3BH two bytes have been 00H, so skip, then the key to the CMOS password is focused on the 38H and 3AH two bytes. Introduce a bit of award password rules, Award allows one to eight-bit password, each character range by 20h-7fh, that is, from the space to the ASCII code 127th. Presumably everyone has found that eight characters to be put into two bytes, as if not compression is not a good way. Yes, award is compressing it, but it's not a normal compression method, and I think Award has the idea of encrypting it, because there are so many vacancies in the CMOS, it seems to be no problem to put eight bytes, but so the bare password is more useless. The usual compression methods are lossless compression, such as ZIP,ARJ, or lossy compression, such as Mpeg,jpeg. But for such a few bytes, these methods do not have any useful, and the compressed things, should be able to restore, otherwise pressure to pressure to have no meaning. However, the award method is different, he not only carried out a super lossy compression, and this compression is not reversible, the following gives his encryption compression method (the following values, operations are based on 16):

If there is a password, eight bits, recorded as: ABCDEFGH (each bit of the range of 20h-7fh), it is the following formula operation: H+4*g+10*f+40*e+100*d+400*c+1000*b+4000*a, the result is saved from low to High: H1,H2, H3, Byte, and then save H2 to address: 3AH, H1 and H3 and save to 38H. If the password is less than eight digits, and so on. Here's an example:

My password is: R*vte,ascii code: 72H, 2AH, 76H, 74H, 65H, according to the formula: 72*100+2a*40+76*10+74*4+65=8615, so h1=00h,h2=86h,h3=15h, So the value of 3AH for 86h,38h is 15H.

It seems that the password is so simple, each time you enter the password, the BIOS will be counted, and then compared with the value of the CMOS, if the same release, otherwise not talk. This is the process, however, there are some problems to explain, first calculate, two bytes can express the number of passwords can be expressed: 164=65536 species, and eight-bit password, each has 96 options, the password can be expressed: 968≈7.2x1015 species, so theoretically, each password, You can find about 1011 of these passwords that have the same effect. But in fact not everyone is a eight-digit password, perhaps not so big and scary, but also quite a lot, as I that password, light and his same function of the five-digit password has more than 250,000, and six, seven, eight bit more, the number is not known, because he has never been counted, the time is too long, can not afford. So I casually put our research with the small program attached, you can search award CMOS password, we can calculate.

CMOS password talk about the same, it is time to stop the pen. But in order to reduce the doubt, let's talk a little more. Now the BIOS is more advanced, in the CMOS settings, most of the user and Supervisor password settings, I discussed here address for the user, as for supervisor, respective son research, because the password this thing, said too clearly, we are not interesting, right. Okay, here we are.