Improved Way to Add SLIC (SLP 2.0) Table into BIOS ACPI to Activate Windows Vista OEM

Microsoft is using SLP 2.0 (System Locked Preinstallation) technology for activation process of OEM (Original Equipment Manufacturer) edition of Windows Vista on branded PC. One of the requirement to activate Windows Vista with OEM product key is the existance of SLP public key and SLP marker which stored in SLIC table in ACPI. If you have older motherboard with no updated BIOS with SLIC table, the BIOS has to be patched or hacked to add in SLIC table plus OEMID and OEMTableID. The original instruction to add in SLIC information involves method to replace an existing ACPI description table, which may affect some functionalities of computer. Now there is improved way to actually add in SLIC table into BIOS ACPI module, without replacing any existing tables.

The new improved procedure may also works on older motherboards with BIOS that previously thought to be unable to edit or alter, or those BIOS that has to replace the APIC table which may force user to reinstall Windows operating system as existing OS fails (see step 8 of original article). As with the original guide, the following tutorial is based on Award BIOS on DFI CA64-TC motherboard. As usual the tools or utilities that needed include:

1. CBROM 2.15 or CBROM 2.19 – A tool to add, edit or exchange the components of an Award Modular BIOS. The tool is needed to edit and exchange ACPI digital byte-code table.
2. MODBIN6 2.01.01 – Used to modify the Award Modular BIOS strings or options. The tool is needed to modify Award core BIOS module, as CBROM is unable to edit the BIOS module.
3. WinHEX – A popular HEX editor used to modify content in the ACPI table.
4. HWDirect – An advanced low-level hardware register access software tool for Windows, used to dump the memory contents.

New: Virtual BIOS simulator for Windows Vista OEM activation without actually modify BIOS.

If you need help in modifying BIOS for activating Vista, check out this thread.

Part 1 – Modify BIOS to Add in SLIC Table

1. Create a temporary folder (Vista or BIOS is you like) at root directory (C:\)
2. Download CBROM 2.19, MODBIN6 2.01.01 and WinHEX with download links above, and place them in the temporary folder.

   

3. Extract your motherboard BIOS image with name in the format of XXXXXXXX.bin (if the BIOS image name is not with .bin extension, rename it) to the temporary folder by using tool like WinFlash. The easy way is to download the corresponding BIOS file which intended for flash BIOS upgrade from motherboard manufacturers’ websites.
4. Run modbin6.exe by double clicking on it.
5. Select the BIOS image file at the MODBIN6 menu.

   

6. Do not close the window of MODBIN6. Now go to the File Explorer for the temporary folder, you will notice that some more files have been created. Among them, ORIGINAL.BIN is the one that needs to be modify.

   

7. Launch WinHEX and open ORIGINAL.BIN.
8. Search for the string of “RSDT” (without quotation marks). If you only find RSDTFACPDSDTFACS string, there is no ACPI tables that you can changed, so the only way is to add in SLIC instead of replacing. Anyway, note down and remember the reference address to the starting location of ACPI descriptor tables string (example in this case is D0E0). In this case, there are 2 options:

   

   1. There is 4 or more blank (00 HEX value) in front of RSDT. In this case, move the whole string of RSDTFACPDSDT forward 4 position (left FACS intact unmoved). After moving, add in SLIC at the blank space leftover by moved string (should be right after moved string). Note down and remember the starting position of ACPI index string in HEX, i.e. D0DC in this case.

      
      Example of moving the ACPI string, by typing again the exact string that needs to be moved starting from earlier position.

   2. If there is not enough free blank space in front of RSDT, the whole ACPI tables index string can be moved to the blank unused space after that particular block of code. Search and locate a blank or free block in BIOS looks something like this, (example below show the free block starting from address of 0000E1E0), which has a block of empty unused value that can be written:

      

      Then, copy and paste and whole ACPI index string with SLIC (RSTDFACPDSDTSLIC with HEX value of 525344544641435044534454534C4943 to the free blank region in the BIOS found above. Note that you have to “paste”, which mean overwrite the existing “FF” code instead of add or insert, as no new digits or characters should be added. You can leave the existing ACPI string (RSTD…….) at original location intact or replaced with “00” or “FF” (both ignored bits is same to fill blank unused space), as the string at original location will no longer be used. Note down and remember the starting location of ACPI index string in HEX, i.e. E1E0 in this case.

      
      ACPI tables index string in new BIOS location (for example)

9. As the starting reference address or namespace location for ACPI tables index has been changed, so the reference pointer to the ACPI location has to be changed too. Go back to the original position of ACPI string (in this example is at D0E0). From there, search for HEX string of E0D0 (note the reserved position for D0E0 when called in pointer).

   

10. Edit and change the E0D0 to DCD0 or D0E1 (depending on which scenerio you used above) or any other starting location you choose (always reverse the location address you found at the offset).
11. A little bit in front or above the line, there should be the HEX bits of B903 which indicates to system ACPI tables or segments the string contained and should be read to memory space. If your system has more ACPI tables, this value will be different (B903 for 4 tables, B904 for 5 tables and so on). Change it to B904 or your value added by 1.

    
    Modified BIOS after adding in SLIC table into ACPI and correcting the reference pointer to ACPI location.

12. Save the modified BIOS with WinHEX.
13. Switch to MODBIN6 window, press F2 to save or click on File, then select Save.

    

Note that FACS has a fixed location that cannot be modifiable.

Part 2 – Modify BIOS ACPI Table

1. Open command prompt by type Cmd in Run. Change directory or folder to the temporary folder if need to.
2. Type “cbrom219 XXXXXXXX.bin /acpitbl extract” (without quotes, with XXXXXXXX.bin the filename you choose, normally acpitbl.bin) and press Enter. You can also use awdbedit.
3. Press Enter again when prompted for an extract file name to use the default name of acpitbl.bin.
4. Use WinHEX to open acpitbl.bin (or whatever file name that you choose).
5. Search for “RSDT” string (without quotes).
6. At the end of RSDT table byte code block, just before the string of FACPt (or FXCPt for certain Gigabytes mobo), insert or add 4 bytes (00 00 00 00) to represent SLIC table. You can press Ctrl-0 keyboard shortcut for insert dialog box. Code after it will be pushed backward. Remember this location of SLIC.
7. The byte right after RSDT represent the length of the RSDT table. It needs to be added by 4 in hexadecimal mode. For example, if existing byte is 28, after plus 4 it will be 2C.

   

8. The OEMID and OEMTableID is the identifier string for SLP 2.0 that has to match with the product key, and thus has to edit to match according to the OEM product key and certificate that you have. OEMID has 6 characters, and OEMTableID has 8 characters. Each hardware manufacturer will have their own identifier here. So if you value your desktop or laptop computer brand, you need to figure out the correct value for it. However, if you’re using generic mobo, you can locate the string of “RSDT,…..XXXXXXXXXXXXXXX.0BAWRD” (without quotes, your BIOS string may be different), with RSDT,….._ASUS_Notebook1.0BAWRD. Here, the OEMID is _ASUS_ and OEMTableID is Notebook. Any empty character should be filled with blank (0×20). This will make your motherboard and BIOS to be recognized by Vista as ASUS mobo.

   

9. Save the file.
10. Download Asus OEM acpislic.bin.
11. Go back to the command prompt, type the following commandcopy acpitbl.bin /b + acpislic.bin /b acpitbl.bin /bPress Enter when done to add the SLIC table contents to end of ACPI module. acpislic.bin is digital certificate for SLIC which contains SLP certificate public key and SLP marker/logo. Press Enter to confirm if prompted warning of file overwrite.
12. Update the modified ACPI digital module into the BIOS by entering following command in the Command Prompt, and then press Enter:cbrom219 *.BIN /acpitbl acpitbl.bin
13. Flash and update your BIOS with the SLIC-included modified version. Check your motherboard guide for how to do it.a
14. BIOS update is completed. If you’re using Everest to check the tables of ACPI, you will notice that SLIC is not included yet. This is due to the corresponding memory address space or namespace is not added. Memory address space for SLIC has to be manually added. For this, we need to download and install HWDirect.
15. Launch Everest, expand the Motherboard section, then select ACPI. On the right pane, select RSDT, the determine the value of Memory Address. In this example, it will be 1FFF3000h.
16. Launch HWDirect.
17. Key in the memory address found from Everest in the first Physical Address (Hex) field. Size (bytes in Hex) set to the size of acpitbl.bin (2800 or above). And then click on Dump button to dump the memory to a file.
18. In the memory dump pane, search and locate SLIC or SLICv string. Note down and remember the physical memory address or offset of SLIC or SLICv (locate in front of the memory dump result). In this example, the memory address for SLIC is 1FFF5500.

    

19. If you haven’t close the WinHEX window, switch back to it. Else run WinHEX again and open acpitbl.bin.
20. Go back to the location (4 bytes of 00) we added in step 6 (figure in step 7). The ACPI table needs to be modified to set the memory address of SLIC.
21. Input the memory address space of SLIC into the previously added space and replace the existing value of 00 00 00 00. The memory address space value has to be entered in reverse order with 2 unit as a group. For example, for 1FFF5500, enter as 00 55 FF 1F.
22. Save the modified acpitbl.bin.
23. Update the modified ACPI tables into the BIOS again with the following command:cbrom219 *.BIN /acpitbl acpitbl.bin
24. Flash the modified BIOS to the system ROM.
25. Check if SLIC table is listed in Everest’s ACPI module, together with correct OEM ID (_ASUS_) and OEM Table ID (Notebook). Verify also they’re the same with the values in RSDT table.

Part 3 – Install Windows Vista and Signed OEM Certificate

1. Install Windows Vista with the following ASUS computer OEM product key:

   Home Basic: 2WP98-XXXXX-XXXXX-XXXXX-XXXXX
   Home Basic: 762HW-XXXXX-XXXXX-XXXXX-XXXXX
   Home Premium: BH626-XXXXX-XXXXX-XXXXX-XXXXX
   Home Premium: 8XPM9-XXXXX-XXXXX-XXXXX-XXXXX
   Business: 72PFD-XXXXX-XXXXX-XXXXX-XXXXX
   Ultimate: 6F2D7-XXXXX-XXXXX-XXXXX-XXXXX

   You can also change your existing Windows Vista product key by using the following command in command prompt with administrator privileges:

   slmgr.vbs -ipk <new product key>

2. Download oemcert.xrm-ms, the Microsoft signed OEM certification for ASUS computer which has the identifier that needs to match the BIOS SLIC identifier, preferably to C:\ root.
3. Open a command prompt and type the following command, then press Enter:

   slmgr.vbs -ilc C:\oemcert.xrm-ms

   This will install the digital certificate for OEM activation.

4. Check your system properties, Windows Vista should be activated.

Further refined way to modify BIOS to emulate as OEM BIOS with dynamic memory address allocation for SLIC table.

You can also find list of already modified BIOS that supports SLIC here.

Warning: Alteration to BIOS may invalidate warranty, cause computer to unable to boot up or other irrecoverable effect. Do it at your own risk.

Disclaimer: This article is for information and educational purpose only.