PPC Wiki

asus predator helios 300 boot hang debugging

5 min read

the situation

laptop not able to boot windows (stuck in the spinner). any linux boot-stick also just stuck with no output. bios/boot menu fully working. grub (and other bootloaders) also completely work.

  • when booting a linux kernel with the linux efi stub two log lines are visible TODO recreate those two log lines and screenshot

    • quick digging in the linux source by melektron revealed that those lines are printed using efi_printk() instead of the usual printk()
    • this lead to the theory, that smth about the “exiting efi and fully taking over the hardware” (aka ExitBootServices()) is hanging.

  • bios updating would be a good idea, but the bios download page gives you a windows exe… which would flash the new bios. kinda a problem, when windows does not boot. lol

  • as far as i remember: once while playing a game using Vanguard (anti-cheat) the whole PC crashed. and after that was this broken state.

the debugging setup

log

  • plan: put efi_print()s all over the efi_stub_entry.

  • Pasted image 20260712115413.png … high res screen, small font, cheap camera… nothing readable

    • counting through though it is indeed exit_boot()… as suspected earlier
    • BUT… efi_err() obviosly does no longer work after efi_boot_exit()… so the hang might happen far after that actually.

  • WHYYYY does one fn want a pointer and the other a val. and WHY does the compiler not tell me about that when i do it wrong. … Pasted image 20260712182416.png

  • ok, file logging works nice

getting the firmware

  • it’s distributed as a stupid exe file

I feel stupid for not thinking of this, but google ai pointed out that obviosly the exe extracts the firmware first from itself and then flashes it.

however the exe crashes the whole user session in my windows VM…

dumping the firmware

Pasted image 20260926181149.png

  • later i used some custom hold down contraption to apply down preassure evenly over time: Pasted image 20260926181208.png

    • then i was reading the same all the time. (see reads five, six, seven on image)

  • the bin from the exe file is completely different. I found that in the “BIOS region” of the dump has the same Firmware Volume (uefi) entries with the same sizes as the extracted bin in it’s root “UEFI image”.

  • with dd if=cpu-firmware-original.bin skip=18394734 count=200 bs=1 | xxd i verified that i could extract the firmware volume. at offset 0x28 there is the _FVH magic value.

  • Pasted image 20260926184927.png … top bin file extracted from exe. bottom dump from flash of laptop

    • if you need the firmware files. contact me.

so id did:

#3F
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=18394734 \
count=266240 \
seek=16785406 

#FvGuid
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=18857584 \
count=696320 \
seek=17248256 

#DE
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=19824240 \
count=1572864 \
seek=18214912 

#CA
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=21397104 \
count=458752 \
seek=19787776 

#6F
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=21855856 \
count=9048064 \
seek=20246528 

#2C
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=30969456 \
count=524288 \
seek=29360128 

#System2Guid
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=31493744 \
count=524288 \
seek=29884416 

#099
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=32018032 \
count=249856 \
seek=30408704 

#B95
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=32267888 \
count=548864 \
seek=30658560 

#FvGuid
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=32816752 \
count=454656 \
seek=31207424 

#D0
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=33533552 \
count=720896 \
seek=31924224 

#9D
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=34909808 \
count=65536 \
seek=33300480 

#B5
dd if=cpu-firmware-original.bin bs=1 of=out.bin conv=notrunc \
skip=34979440 \
count=184320 \
seek=33370112
  • sudo ./result/bin/flashrom --programmer ch341a_spi -w out.bin -c W25Q256JV_Q

Graph View

Backlinks