Check BIOS ROM for changes/corruption

[derChronostat]

Hi,
i hope its ok to post a BIOS-related question. My PC works fine, but out of curiosity I wanted to check my BIOS for changes/corruption via checksum (SHA1).
I got the fresh and identical BIOS version from manufacturer website and checked the hash.
I went to BIOS and saved a backup and checked the hash. Result - hashes are not identical


I checked byte-size of both files - identical
I tried different things (save-changes or not, filenames, several backups within one session, etc) and boiled it down to the situation that apparently every distinct BIOS-session I start, is causing a change to the BIOS ROM. I started several sessions, saved a backup each session and checked the hash. Every single ROM is different, except when I did the backup twice within ONE session.

If every indivdual session yields a different BIOS ROM how can I track BIOS integrity/changes?


Any ideas?


Thanks, Chris

 

[iko22]

Hi derChronostat

I am not too sure that both files contain the same information.

The BIOS that you are able to download from the manufacturer's website is the complete Firmware of the motherboard.

However, the file that you are able to save from within BIOS, only contains the custom configuration settings of that BIOS. Therefore, this second file will be different to the first file, so I am not sure as how you got them to be the same size.

 

[Paul Black]

The BIOS that you are able to download from the manufacturer's website is the complete Firmware of the motherboard.

However, the file that you are able to save from within BIOS, only contains the custom configuration settings of that BIOS. Therefore, this second file will be different to the first file . . .

 

[derChronostat]

I just used the ASUS EZ Flash 2 Utility within the BIOS to do a backup. That yielded a file with the expected size, identical to the ROM downloadable from the manufacturer website. In the meantime I used UEFITool to compare the content of downloaded and backed up BIOS. The files show obvious differences in the Regions but the BIOS region of both files contain exactly the same Volumes and File-content. I extracted several Volumes and compared the checksums and found that some volumes are identical between the two ROMs and some volumes differ.


I could understand that the EZ Flash Utility is doing some proprietary stuff that results in a slightly different ROM-image than the original but what I do not understand is why it is changing from BIOS-session to BIOS-session.
From my understanding an image of a ROM-chip which is 'read only', hence no custom configuration should be in it.
If there is, I would expect that if I do not change custom config I should at least get identical backups and should be able to compare the backups with each other. Which is not the case



Ok, I was hoping that this would be a relatively straight forward thing but whatever ASUS is doing, it hinders tracking BIOS integrity.