BiosTool — Complete Feature Guide

Everything you can do with BiosTool, explained tab by tab. This guide is for electronics technicians and BIOS repair professionals who want to know exactly what they're getting before their first purchase.

🔍

Analysis All plans

Upload any BIOS dump file and get a complete technical breakdown in seconds. Supports .bin, .rom, .cap, .exe, .fd, and .img formats up to 64MB. This is the starting point for every repair workflow.

🏭 Vendor Detection

Automatically identifies AMI Aptio, Insyde H2O, Phoenix, and Award. Detects version and build date from firmware headers.

📐 Intel Flash Descriptor

Reads IFD and maps all regions — FD, ME, GbE, BIOS — with exact byte offsets and sizes. Critical for knowing what to flash and what to leave alone.

⚙️ Intel ME

Reports ME version, CSME generation (Gen6–Gen17), Boot Guard status, and compatibility notes. Never touch ME blindly again.

📋 DMI / SMBIOS

Extracts Types 0–3: BIOS vendor, version, release date, System product name, board model, chassis type. The data that ties a BIOS to a specific machine.

📦 UEFI Firmware Volumes

Lists all Firmware Volumes (FV) with offsets, sizes, attributes, and FFS file count. Depth-2 traversal for nested volumes.

💊 Capsule Detection

Detects update capsule wrappers: ASUS APTX/APCB, AMI $CAPSULE$, Dell HDR, HP HPBIOSUPDREC, generic EFI GUID capsules.

✓ File: BIOS_Lenovo_ThinkPad_X1.bin (12.00 MB)
✓ Vendor: AMI Aptio 5.0 | Build: N2VET35W (1.20)
✓ SHA256: a3f2b1c9d4e7f8a1b2c3d4e5...

── Intel Flash Descriptor ──
FD region: 0x000000 – 0x000FFF (4 KB)
ME region: 0x001000 – 0x4FFFFF (5 MB)
BIOS region: 0x500000 – 0xBFFFFF (7 MB)

── Intel ME ──
Version: 14.1.55.1608 (CSME Gen14)
Boot Guard: Verified Boot + Measured Boot
💡 Tip: Always run Analysis first, even if you think you know the chip. The IFD region map tells you exactly which byte range to flash — writing to the wrong region is the #1 cause of bricks.
✂️

Extraction All plans

Split a full flash dump into its individual regions, strip vendor headers, and pad to a target size. All output files go to data/_bios_work/extract_{timestamp}/ for organized storage.

  • Auto-detect vendor and strip proprietary headers before extraction
  • Extract individual regions: FD, ME, GbE, BIOS as separate .bin files
  • Pad to target size: 4 / 8 / 16 / 32 MB — matches physical chip size
  • Extract DMI/SMBIOS block as separate file for editing
  • Generate checksums (MD5, SHA256) for every output file
  • Automatic backup of original before any processing
  • Full report: original size, final size, backup path, warnings
🔧

DMI Repair (Transplant) All plans

The most common BIOS repair: take the serial number, UUID, product name and board info from an original board and inject it into a new or replacement BIOS image. What used to take 30-45 minutes of hex editing now takes under 2 minutes.

🎯 Donor / Recipient

Donor = original BIOS with correct serial, UUID, board info.
Recipient = new or blank BIOS to be flashed.

🔐 Vendor Check

Automatically verifies both files use the same vendor (AMI/Insyde/Phoenix) before transplant. Mixing vendors = brik risk.

🛡️ ME Preservation

Intel ME region is preserved from the recipient by default. Never accidentally overwrite ME data during a DMI repair.

🔢 Checksum Fix

Auto-recalculates and patches all checksums after transplant. Eliminates "bad checksum" POST errors after flashing.

⚠️ Important: Donor and recipient MUST be the same BIOS vendor. AMI → AMI, Insyde → Insyde, Phoenix → Phoenix. Transplanting across vendors will produce an unbootable image.
🔌

Programmer All plans

A guided workflow for reading and writing SPI flash chips using physical programmers. Auto-detects connected hardware, runs pre-flight checks, and walks you through every step with real-time progress.

  • Auto-detect: CH341A (VID:1a86 PID:5512), FT2232H, DediProg SF100/SF600, Bus Pirate via USB VID/PID
  • Read workflow: 3 reads with SHA256 comparison — confirm stable read before trusting the dump
  • Write workflow: 5 steps — backup existing → verify backup → write → verify write → layout fallback if needed
  • Intel ME verification: version, platform (Consumer/Corporate), FITC version, compatibility range
  • Voltage warning: CH341A is 3.3V — automatically flags 1.8V chips that require a voltage adapter
  • Supported programmer selection: CH341A, FT2232, Bus Pirate, Serprog, DediProg
⚠️ CH341A voltage: The standard CH341A runs at 3.3V. Many ultrabooks and thin laptops use 1.8V BIOS chips (WSON-8 package). Connecting 3.3V to a 1.8V chip can permanently damage it. BiosTool will warn you — always check the chip datasheet or the Chip Database before connecting.
🔒

SR / WP Decode All plans

Decode Status Register 1 and SR2 values for any SPI flash chip. Enter the values (hex or decimal) and get a full bit breakdown plus ready-to-run flashrom commands for unlock, QE enable, and verification.

Input: SR1 = 0x9C SR2 = 0x02

── SR1 decoded (10011100) ──
BP0=0 BP1=1 BP2=1 BP3=1
SEC=0 TB=0 SRP0=1

⚠ WRITE PROTECTED — block protect bits set (BP1-BP3)
⚠ SRP0=1 — hardware WP pin is controlling write protect

── Unlock command ──
flashrom -p ch341a_spi --write-status-register 0x00
  • Decodes all SR1 bits: BP0–BP3, SEC, TB, SRP0
  • Decodes all SR2 bits: SRP1, QE (Quad Enable), LB1–LB3, CMP, SUS
  • Instant write-protection status with plain-English explanation
  • Generated flashrom commands: unlock, QE enable, status read, verify
  • SRP warning: explains when WP pin must be pulled low for software unlock to work
  • Reference table for all SR1/SR2 bits with chip compatibility notes
  • Works for Winbond, GigaDevice, Macronix, ISSI, XMC, Spansion, Adesto
✅

Sanity Check All plans

8 automated pre-flash checks that run in seconds. Run this before every write operation — it catches the mistakes that brick boards.

1. flashrom installed

Verifies flashrom.exe is present and executable on your system.

2. USB programmer detected

Confirms your CH341A or other programmer is connected and recognized.

3. Chip responsive

Sends a test read to confirm the chip is wired correctly and responding.

4. Voltage compatible

Checks that your programmer voltage matches the chip's rated voltage (3.3V vs 1.8V).

5. JEDEC match

Compares JEDEC ID reported by chip against your selected chip in the database.

6. File size match

Verifies your .bin file size equals the physical chip capacity. Wrong size = partial flash = dead board.

7. Backup exists

Confirms there's a backup in the Backup tab before you write anything.

8. Connection stable

Reads the chip 3× and compares SHA256 — unstable SOIC clip = mismatched hashes = don't flash yet.

💾

Backup Management All plans

Organized storage for all your BIOS backups with SHA256 verification, timestamp, and operation type. Never lose a backup again.

  • All backups stored in data/_bios_backups/{vendor}_{size}/{date}/ — one folder per device
  • Operation types: manual, pre_flash, pre_repair, original
  • SHA256 hash for every backup — verify integrity at any time
  • Filter by vendor, sort by date — find the right backup in seconds
  • Cleanup tool: keep last N backups per type, auto-delete older ones
  • File status indicator: green if file still on disk, red if moved or deleted
✅ Golden rule: Never flash without a backup in this list. The Sanity Check will refuse to proceed if no backup exists. This one rule has saved hundreds of boards.
📄

Professional Reports All plans

Generate a complete repair report after any analysis. Export as HTML, CSV, or JSON. Add your workshop branding and hand it to the customer or keep it for your records.

📊 HTML Report

Dark theme, fully standalone (no external CSS). Print-ready. Sections: Firmware Info, ME status, DMI data, IFD regions, Warnings. Can include UEFI module list.

📋 CSV Export

Structured tabular data for import into Excel or your workshop management system. All sections as separate tables in one file.

🗂️ JSON Export

Complete machine-readable dump of all analysis data. Ideal for API integrations, custom dashboards, or archiving.

🎨 Custom Branding

Add your workshop logo, name, and footer text to all HTML reports. Available in Pro Annual plan.

🗃️

Chip Database 2.0 All plans

88+ SPI flash chips with full specifications. Search by name, vendor, or JEDEC ID. Extend with your own chips using the plugin system — no waiting for updates.

  • 88+ chips from 19 vendors: Winbond, Macronix, GigaDevice, Micron, Spansion, ISSI, Adesto, XMC, Microchip, AMIC, FMSH, Puya, Boya, EON, Zbit, Dosilicon, Infineon
  • Full specs per chip: JEDEC ID, capacity (MB), voltage (3.3V/1.8V), package (SOIC-8/WSON-8/BGA), supported operations
  • JEDEC prefix guide: EF=Winbond, C2=Macronix, C8=GigaDevice, 20=Micron/XMC, 1F=Adesto
  • 1.8V chips flagged with voltage adapter warning
  • Plugin system: add chips via JSON or CSV bulk import
  • Plugin chips have priority over built-in database — your definitions always win
  • CSV template available for bulk import
🧩

UEFI Module Extraction All plans

Parse all Firmware Volumes and extract every UEFI module as an individual .efi or .te file. For advanced firmware analysis and modification.

  • Parses all FV sections and extracts FFS files (PE32 and TE modules)
  • Per-module info: GUID, type (DRIVER/APPLICATION/DXE_CORE/SMM_DRIVER/PEI_CORE), format, human-readable name from UI section, offset in file
  • Output: .efi/.te files in data/_bios_work/modules_{timestamp}/
  • Download all modules as ZIP in one click
  • Grouped by type with file count and total size per group
🔍

UEFI Variable Store All plans

Locate and parse UEFI variable stores (VSS and EVSA) inside a BIOS image. Extract SecureBoot keys, boot order, and platform setup variables.

  • Finds VSS (EFI_VARIABLE_STORE_GUID) and EVSA ($EVSA) stores automatically
  • Parses key variables: SecureBoot, SetupMode, PK, KEK, db, dbx, BootOrder, Boot####, Setup, CpuSetup, SaSetup
  • Decodes BootOrder: Boot0000→Boot0001→... with device names
  • Clear SecureBoot: provides PK variable offset for manual Setup Mode patch
  • Export notable variables as JSON file
  • Filter by name, "notable only" checkbox to reduce noise
☁️

Cloud Repair Engine Pro

Submit heavy repair jobs to our dedicated cloud server. Your workstation stays free while we process in the background. Download results when ready — up to 24 hours after completion.

  • Submit via web UI or REST API — full programmatic control
  • Max file size: 64MB — handles full platform flash images
  • Up to 5 concurrent jobs per account, 2 per API key
  • Jobs stored 24 hours — download at your convenience
  • Full job lifecycle API: submit, status, download, report, list, delete
  • Priority queue for Pro subscribers — your jobs run first
Submit a job:
POST /api/bios/v1/jobs/submit
Authorization: Bearer your_api_key

Check status:
GET /api/bios/v1/jobs/job_8f3a2c1d
→ { "status": "completed", "duration_sec": 76 }

Download result:
GET /api/bios/v1/jobs/job_8f3a2c1d/download
🔗

REST API All plans

Every feature in BiosTool is accessible via HTTP API. Build your own workshop dashboard, automate batch repairs, or integrate BIOS analysis into your existing software.

  • API key authentication — one key per account, regenerate at any time
  • POST /api/bios/analyze — full analysis, returns JSON with all fields
  • POST /api/bios/extract — region extraction with options
  • POST /api/bios/repair — DMI transplant with all options
  • POST /api/bios/sr_decode — SR1/SR2 decode with generated commands
  • GET /api/bios/plugins/all — chip database search
  • GET /api/bios/chip-db/version — database version check
  • Full Cloud Jobs API: submit, status, download, report, list, delete
  • JSON responses, standard HTTP status codes, no rate limit on Pro
🎨

Custom Branding Pro Annual

Make the reports look like they came from your workshop. Add your logo, workshop name, contact info, and custom footer text to all HTML reports you generate.

  • Upload your workshop logo (PNG/SVG)
  • Set workshop name, address, phone, email
  • Custom footer text on every report
  • Applied automatically to all HTML reports — no extra steps
  • Included in Pro Annual plan (€249/year)