Skip to content

ByteRipperWeb 0.9.1-1 — AMD and BIOS Guard read, a searchable tree, and panels that move

Choose a tag to compare

View all tags
@maxshevelev maxshevelev released this 08 Oct 08:38
· 205 commits to main since this release
v0.9.1-1
99b3bc5

This release reads the rest of the bench's dumps: AMD's PSP map and EC firmware, AMI BIOS Guard update files you can compare with a dump's BIOS region, ASUS's GPNV store, HP's signature blocks and Apple's device overrides. The UEFI tree can be searched, a row's details open large on Space, and the panels move — a panel grows out of its pill and folds back into it, and is pulled down by its header.

AMD dumps

  • The AMD PSP's map is read: the EFS, every PSP and BIOS directory and the firmware they list, as rows, with each directory's Fletcher-32 checked and fixed. The PSP's compressed BIOS image opens to what it inflates to.
  • AMD's Zlib sections open, and their stated length is written back when they are rebuilt.
  • AMD microcode found in padding and in Insyde map regions is shown by CPUID and revision.
  • The EC firmware is found on AMD dumps: an ITE image is cut out of the padding it sits in, and an Insyde map is placed by its own entry — also on a dump with bytes appended.

AMI BIOS Guard

  • A BIOS Guard (PFAT) update file opens as a tree in the UEFI panel: its table, its entries and the BIOS region they assemble.
  • Compare it with a dump's BIOS region: the dialog says which parts match and which differ, and Write puts the update's BIOS region into the dump as one undo step.

More of the image read

  • ASUS's GPNV store, where the machine's serial numbers, model and Windows key are kept, is read with a row per record.
  • HP's signature blocks are read out of padding, and the digest whose span is known is checked.
  • Apple's device overrides are read as a table of rules, the ROM information and the BIOS ID as tables, and a bzip2-compressed variable can be opened decompressed.
  • A VSS or NVAR variable's value is shown after its name, read as its type, and the VSS header is taken apart in the details.
  • The descriptor's PCH straps are read as words, with the ME-disable bit, GPR0 and the eSPI clock.
  • A WAV found among the data plays in a player under its details; a GIF's frames are counted.
  • Empty padding, free space and erased pad files are drawn grey in the tree.

Finding your way

  • Search the UEFI tree by name, GUID, type and subtype, from match to match; the tree opens the way to each match and shuts it again on the next.
  • Show in Tree: the dump's context menu takes you to the node under the clicked byte, and the reveal button explains what it does in the help.
  • A row's details open large over the window on Space; the arrow keys keep moving through the table behind them.
  • The empty screen lists the recent files, and prints what's new in the latest release under the version.
  • A help page has an address: in the browser, a link copied from the help opens the app on that page.

Panels

  • A panel grows out of its pill in the dock and folds back into it; closing one folds it into its pill too, and a new panel waits for the one it replaces.
  • Pull a panel down by its header — a part's, a tool's or the help's — to fold it away.
  • Update in Parent is offered in a modified part's header.
  • The minimap names what the pointer is over: a segment, a zone or a bookmark.

Smaller things

  • Operations that block the window show an indeterminate bar, and a Cancel already pressed says Cancelling….
  • A microcode change shows its progress and result in a dialog of its own.
  • A tool opened on a file whose image is already parsed shows its tree at once, without reading the image again.
  • The selected row of a tool's table is drawn in the saturated blue the Mac's tables use.

Fixes

  • Append File… and Insert File at Start… work in the page opened from disk. They failed with "certain files are unsafe for access within a Web application".
  • The bookmark popover is shown deep in a large file. In Chrome and in the Windows build it came up as a lone frame around the name field.
  • Copy Link and the other plain copies work when the app is opened over plain HTTP on a bench's network.
  • The minimap button is greyed out with no file open, as the menu item already was.
  • A panel opening out of its pill grows the same way it folds, instead of from the middle.
  • A fractional page zoom no longer draws a scroll bar under the dump.

The page (ByteRipperWeb-0.9.1-1.html) is the whole app in one file:
open it in Chrome or Edge from disk, no installation and no server. Files
never leave the machine. Opened from disk, a page has no private storage, so
File ▸ Duplicate needs the hosted page or the Windows build.

Windows (ByteRipper-0.9.1-1-setup.exe installs it for the current user
and starts fastest; -portable.exe and the .zip need no installation): the
same app in a window of its own, x64. Help ▸ Check for Update… installs the
next release from the setup. Not code-signed, so SmartScreen warns on the
first launch: choose More info ▸ Run anyway.

In the browser, the same release: https://maxshevelev.github.io/ByteRipperWeb/ —
and on a Mac, the native app: https://github.com/maxshevelev/ByteRipper/releases/latest

Assets 8
Loading