Bypass Dell Inspiron 1100 battery check during BIOS update #

Installing Ubuntu (or any Linux distro for that matter) on a Dell Inspiron 1100 requires updating the BIOS to version A32 for video to work properly (8.10 instructions).

Unfortunately, the BIOS flashing utility (I1100A32.exe) will halt if it does not detect a charged battery:

ERROR
Battery must be installed.

ROM update not performed.
Press any key to exit.

Perhaps there are some documented command line switches or arguments? Apparently not:

A:\>I1100A32 /h

 Flash BIOS Update Program - Version A32
 Copyright 1990-2003 Dell Computer Corporation.  All Rights Reserved.

usage: I1100A32

The scanty documentation was equally unhelpful, as were my attempts to reverse engineer the flasher with IDA Pro and OllyDbg. Running strings for a clue to some switch or other proved fruitless as well.


UPDATE 1: I finally found the hidden switches in I1100A32.exe with a standard hex editor - they were "encrypted" with a ROT-1 Caesar cipher!! The first group is from the DOS app, the second group from Windows (both versions are included in the EXE, which can be split using DualEXE Manipulator):

OPQBVTF GPSDFJU KBCJM EXJN OWSBN XJQFOWSBN WFSCPTF QSHCPPU CPPU SFBEH[GJMF SFBESPNGJMF XSJUFSPNGJMF XSJUFIESGJMF OPSFCPPU JOGP GBDUPSZ TFSPVU C:711 GPSDFUZQF NJOJWV
...
DMBTTJD SFQPSUTUBUVT OPSCVSFTVMUT SCVSFTVMUT XSJUFSPNGJMF XSJUFIFYGJMF XSJUFIESGJMF XJQFDMFBO XJQFBMM WFSCPTF QSHCPPU OPSFCPPU OPQBVTF JOGP GPSDFUZQF GPSDFJU GBDUPSZ FEWV CPPU

Let's rotate them: $ tr '\60-\72\101-\172' '\57-\71\100-\171'

NOPAUSE FORCEIT JABIL DWIM NVRAM WIPENVRAM VERBOSE PRGBOOT BOOT READGZFILE READROMFILE WRITEROMFILE WRITEHDRFILE NOREBOOT INFO FACTORY SEROUT B9600 FORCETYPE MINIVU
...
CLASSIC REPORTSTATUS NORBURESULTS RBURESULTS WRITEROMFILE WRITEHEXFILE WRITEHDRFILE WIPECLEAN WIPEALL VERBOSE PRGBOOT NOREBOOT NOPAUSE INFO FORCETYPE FORCEIT FACTORY EDVU BOOT

Additional information on these switches can be found here and here. Don't play with these unless you know exactly what you are doing and are willing to take responsibility for your actions.

UPDATE 2: Didier Stevens kindly updated his open source XORSearch app (which helps uncover obfuscated strings) to support ROT encoding. Usage example: C:\>XORSearch -f file.with.list.of.strings.to.find file.with.obfuscated.strings

Thankfully, Christopher Muto had posed the following question to alt.sys.pc-clone.dell back in 2004:

   does anyone know of a way to flash the bios on an
   inspiron 3800 that does not have a battery?

Even more fortuitously, Bill Joy had responded:

   I have heard of a /forceit option when executing
   the flash. Another option I have seen is /jabil
   when forcing it to flash when it thinks it has an
   incompatible BIOS update -- maybe try it if the other
   option does not work?

   Since these batteries are available on eBay for only
   $40-50, it is probably not worth the risk of damaging
   your system.

Throwing caution to the wind, I decided to give the /forceit option a try (readers: do so at your own risk and joy). Lo and behold, the evil battery check was miraculously bypassed! Hallelujah!

/misc | Mar 29, 2009


Subscribe or visit the archives.