i found a way to write to VMware's BiOS memory area 0xF000 ~ 0xFFFF (0xF0000xFFFFF)
Posted: Mon Apr 07, 2025 6:40 am
use the following code to operate the Programmable Attribute Map (APM) register to unlock the memory in this area
Code: Select all
EB3CB:
mov ch,30h;或者11h或者10h
mov al,59h;这是pam号
call readpci
mov cl,30h;或者33h
not cl
and ah,cl
or ah,ch
call writepci
mov bx,0f000h
mov es,bx
mov es:[0],bx
jmp $
readpci:
mov edi, eax
movzx eax, al
bts eax, 1Fh
and al, 0FCh
mov dx, 0CF8h
out dx, eax ; PCI Configuration Space Address Register
; bits 7..0: configuration space offset
; bits 10..8: function number
; bits 15..11: device number
; bits 23..16: bus number
mov eax, edi
mov dl, al
or dl, 0FCh
xchg al, ah
in al, dx
xchg al, ah
ret
writepci:
mov edi, eax
movzx eax, al
bts eax, 1Fh
and al, 0FCh
mov dx, 0CF8h
out dx, eax ; PCI Configuration Space Address Register
; bits 7..0: configuration space offset
; bits 10..8: function number
; bits 15..11: device number
; bits 23..16: bus number
mov eax, edi
mov dl, al
or dl, 0FCh
xchg al, ah
out dx, al
xchg al, ah
ret