copy protection

Hi

I am developing a copy protection for my firmware, that runs on PC.
Till now, ISA cards with it’s own EEProm were used, and security was
based on serial number of cards in system, and storage of security
information into EEprom of those cards.

Now new PCI controller cards don’t have any serial# and no EEProm to
write to.

So I have 2 problems, how to uniquely identify HW that firmware is
running on (serial of HDD, CPU, MAC address ?) and how to store
security information (storage in filesystem won’t be protected agains
making image of disk and restoring it on expiration time)

Any tips, ideas, hints, code snippets would be appreciated

best regards

GASTAN

gastan <juraj@flexicam-dot-com.no-spam.invalid> wrote:

Hi

I am developing a copy protection for my firmware, that runs on PC.
Till now, ISA cards with it’s own EEProm were used, and security was
based on serial number of cards in system, and storage of security
information into EEprom of those cards.

Now new PCI controller cards don’t have any serial# and no EEProm to
write to.

So I have 2 problems, how to uniquely identify HW that firmware is
running on (serial of HDD, CPU, MAC address ?) and how to store
security information (storage in filesystem won’t be protected agains
making image of disk and restoring it on expiration time)

Any tips, ideas, hints, code snippets would be appreciated

AFAIK, there’s unused RAM space in the RTC chip that would be persistent
across reboots and not part of the filesystem…

Cheers,
-RK

Robert Krten wrote:

Any tips, ideas, hints, code snippets would be appreciated


AFAIK, there’s unused RAM space in the RTC chip that would be persistent
across reboots and not part of the filesystem…

The 8 byte HDD table is spare these days. You’re unlikely to get anywhere with the empty space further along as the BIOS will reset it each time you reboot.

Btw: If anyone finds a way to use the later empty parts of RTC RAM I’d love to know.

Evan

In article <d4jife$8u0$1@inn.qnx.com>, evanh@clear.net.nz says…

Btw: If anyone finds a way to use the later empty parts of RTC RAM I’d love to know.

Evan,
What exactly you’d love to know? :slight_smile: It doesn’t work on every chipset.
(as you know RTC went from independent chip into one of the bridges). My
PC has additional unused CMOS bank, I know it from the month I bought it
almost 3 years ago :slight_smile:

Gastan,
PCI board must have configuration space (header), also it may have
device dependent registers which you’re free to use as you want.

Although, any copy protection is vulnerable as long as your software is
worth to crack it :slight_smile: .ANY. Also the more publicly you discuss it, the
more vulnerable it becomes. From other hand, too aggressive protection
may hurt a legitimate user (for example, user just changed NIC because
old one burnt and your software stops working), so you have a risk to
lose customers.


Eduard.

In article <MPG.1cd7868814cb30a49896b8@inn.qnx.com>, ed1k@fake.address
says…

In article <d4jife$8u0$> 1@inn.qnx.com> >, > evanh@clear.net.nz > says…
Btw: If anyone finds a way to use the later empty parts of RTC RAM I’d love to know.

Evan,
What exactly you’d love to know? > :slight_smile: > It doesn’t work on every chipset.
(as you know RTC went from independent chip into one of the bridges). My
PC has additional unused CMOS bank, I know it from the month I bought it
almost 3 years ago > :slight_smile:

Oh, I forgot to mention, I know how to write data to that part of CMOS
and read them back. But I din’t find any use of it so far :slight_smile:

ed1k wrote:

PC has additional unused CMOS bank, I know it from the month I bought it
almost 3 years ago > :slight_smile:


Oh, I forgot to mention, I know how to write data to that part of CMOS
and read them back. But I din’t find any use of it so far > :slight_smile:

Yeah, reading and writing is no problem, the problem is BIOS will reset the contents on the next boot up.


Evan

ed1k wrote:

In article <d4jife$8u0$> 1@inn.qnx.com> >, > evanh@clear.net.nz > says…

Although, any copy protection is vulnerable as long as your software is
worth to crack it > :slight_smile: > .ANY.

…not if you use quantum encryption…!! :slight_smile:

Regards…

Miguel.

Eduard.

gastan wrote:

Hi

I am developing a copy protection for my firmware, that runs on PC.

Here’s a competitive open-source CNC router control product
that runs on Linux.

http://www.yty.net/cnc/

Can you afford to put your customers through the hassles
of copy protection? Or will they move to a better alternative?

John Nagle

In article <d4l2vf$bqd$1@inn.qnx.com>, evanh@clear.net.nz says…

ed1k wrote:
PC has additional unused CMOS bank, I know it from the month I bought it
almost 3 years ago > :slight_smile:


Oh, I forgot to mention, I know how to write data to that part of CMOS
and read them back. But I din’t find any use of it so far > :slight_smile:


Yeah, reading and writing is no problem, the problem is BIOS will reset the contents on the next boot up.

Nope. If you use CMOS bank which is in use by BIOS there is always a
danger to overwrite something important :slight_smile: Of course, if you confident
that some bytes are not used by BIOS, you can use them, but you have to
recalculate CRC and write new CRC as well.

What I was talking about is external CMOS bank provided by some
chipsets, and sometimes it’s completely unused by BIOS. My IBM 300GL
uses both primary and external CMOS banks, but some Award modular BIOS v
4.51PC on my dual Pentium II SMP box doesn’t use it, for example. So, I
wrote a hex signature to external CMOS bank and it is still there for
years. If someone still my computer I’ll have a tip for the police :slight_smile:

I didn’t find any use of it because it’s deeply hardware dependent. You
have to have RTC chip with extended capacity and BIOS that doesn’t use
it. Every chipset has a different rules to configuring access to it -
there is no single interface and seems nobody meant CMOS for application
layer. Nonetheless it would be a great asset especially for diskless
system, for example.

If you have some hardware around built on 430VX or 440 chipset you can
try small utility I attached. Just today I added support for 845GE
chipset (I hope I didn’t break anything)

First, you need a PC with 82371AB PIIX4 chip (VID=0x8086 DID=0x7110) or
with 82801DB ICH4 chip (VID=0x8086 DID=0x24C0). ‘pci -vv’ is your
friend.

Second, you need a BIOS on this PC that does not
use extended CMOS bank. Run
…/lscmos
and see if there are all 0xFFs in extended CMOS bank.

If you find a PC that meet two conditions above, run
…/lscmos -s
and again
…/lscmos
to confirm that signature is written to the first four bytes of the
extended CMOS bank.

Reboot you system. If BIOS didn’t complain about wrong
CMOS CRC, run ‘lscmos’ again to check the signature is
still there.

No easy way to remove the signature, except probably using
jumpers on motherboard :slight_smile: If something went wrong and
your computer does not work anymore, it’s solely your
fault.

Cheers,
Eduard.

Attachment: lscmos 6309 bytes


begin 600 lscmos
M?T5,1@$!0````````````(``P!*(4$"#0D#P#0`(``& M`"@`%@`3``8````T````-(`$"#2`!`C`````P`````4````$`````P```/0` M``#T@`0(](`$"!0````4````!`````$````!``````````"`!`@`@`0(K@T` M`*X-```%`````!````$```"P#0``L)T$"+"=!`C<````0`$```8`````$``` M`@````0.```$G@0(!)X$"(@```"(````!@````0````$````"`$```B!!`@( M@00(```````````$`````0```"]U<W(O;&EB+VQD<6YX+G-O+C(`$0```!8` M```5````#P```!$````0````!@```````````````@````$`````````%``` M``H````)````$P````L````.```````````````````````````````````` M``````,```````````````````````````````0`````````#0````<````` M``````````@````2````#`````4`````````````````````````"P```'"$ M!`BP````$@```!\```"`A`0(K0```!(````T````!)X$"``````1`/'_/0`` M`)">!`A0````$0`2`$4```#@G@0(!````!$`$@##````:(L$"``````1`/'_ MO````""%!`@`````$0`*`$L```"0A`0(20```!(```!6````H(0$"/P````2 M````T0```(R>!`@`````$0#Q_V$```"PA`0(L`(``!(```!H````-(8$"-8$ M```2``H`;0```,"$!`A%````$@```'0```#0A`0(/0```!(```#*````C)X$ M"``````1`/'_?@```."$!`B!````$@```(T```#,G00(`````!$`\?_=```` M\)X$"``````1`/'_HP```/"$!`@E````$@```*@`````A00(2@```!(```"S M````$(4$"&$````2`````&QI8F,N<V\N,@!P8VE?<F5A9%]C;VYF:6=?8G5S M`'!C:5]W<FET95]C;VYF:6=?8G5S`%]$64Y!34E#`%]3=&1O=70`97)R;F\` M<&-I7V%T=&%C:`!?:6YI=%]L:6)C`&=E=&]P=`!M86EN`&%T97AI=`!4:')E M861#=&P`<&-I7V9I;F1?8VQA<W,`7T=,3T)!3%]/1D93151?5$%"3$5?`&5X M:70`<&-I7V1E=&%C:`!V9G!R:6YT9@!?8G1E>'0`7V5T97AT`%]E9&%T80!? M7V)S<U]S=&%R=`!?96YD````D)X$"`4$``#@G@0(!04``-B=!`@'`0``W)T$ M"`<"``#@G00(!P@``.2=!`@'"0``Z)T$"`<+``#LG00(!PT``/"=!`@'#@`` M])T$"`<0``#XG00(!Q,``/R=!`@'%````)X$"`<5``#HKP8``,(``/\UT)T$ M"/\EU)T$"`````#_)=B=!`AH`````.G@_____R7<G00(:`@```#IT/____\E MX)T$"&@0````Z<#_____)>2=!`AH&````.FP_____R7HG00(:"````#IH/__ M__\E[)T$"&@H````Z9#_____)?"=!`AH,````.F`_____R7TG00(:#@```#I M</____\E^)T$"&A`````Z6#_____)?R=!`AH2````.E0_____R4`G@0(:%`` M``#I0/___TY)04TTA@0(B=.+="0`C4PD!(T$L8UX!(U0"(-X!`!T#(UV`(L" M@\($A<!U]U-25U%6Z$G___]H:(L$".A?____@\0$Z._^___'!>">!`@````` MZ+P```!0Z'+____,D%6)Y8/L%%/H`````%N!PT`8``#K%HUV`(N#Y/___XU0 M!(F3Y/___XL`_]"+@^3___^#.`!UXEO)PXUV`%6)Y8/L%%/H`````%N!PP08 M``!;R<.0D%6)Y8/L"(/$]/\U[)X$".@8____R<.)]E6)Y8/L"*'HG@0(BU4, M.44(?Q*#Q/R-11!04FB0G@0(Z/_^___)PY!5B>6#[`B#Q/C_=0AJ`.C%____ M@\3T:@'HO_[__XUV`%6)Y8/L7%=64X/$^,=%M`````!J`&H!Z(#^__^#Q!"# M^/]U$(/$]&B@BP0(Z*____^#Q!"-1;R)1:R-?;B-=<#K+HGV@_MS=`^#^W9U M$O\%Z)X$".L:B?;_!>2>!`CK$(/$]&C@BP0(Z'/___^#Q!"#Q/QHSHL$"(M% M#%"+10A0Z/?]__^)PX/$$(/[_W6U@\3X:$",!`AJ`N@:____@\3T:@#HM/W_ M_Z/LG@0(@\0@@_C_=1&#Q/3_-;2=!`CH'?___X/$$(/$^&B`C`0(:@+HX_[_ M_X/$]&C4A00(Z*K]__^#Q""+1:Q05VH`:``!!@#HMOW__X/$$(7`=!&#Q/3_ M-;2=!`CHU?[__X/$$(/$^&C`C`0(:@+HF_[__X/$^%9J`6I`:@#_=;S_=;CH M"OW__X/$,(7`=!&#Q/3_-;2=!`CHF?[__X/$$#';]L,/=1.#Q/Q3:.N,!`AJ M!.A7_O__@\00@\3\#[8$,U!H\HP$"&H$Z$#^__^#Q!!#@_L_?LN`?<"&=3F` M?<&`=3.*1<(\$'44@'W#<74.QT6T`0```,=%L,L````\P'44@'W#)'4.QT6T M`0```,=%L-@```"#Q/A6:@%J0&I`_W6\_W6XZ&?\__^#Q""%P'01@\3T_S6T MG00(Z/;]__^#Q!`QVY#VPP]U%H/$_(U#0%!HZXP$"&H$Z+#]__^#Q!"#Q/P/ MM@0S4&CRC`0(:@3HF?W__X/$$$.#^S]^R(/$^%9J`6I`:(````#_=;S_=;CH M_/O__X/$((7`=!&#Q/3_-;2=!`CHB_W__X/$$#';B?;VPP]U&8/$_(V#@``` M`%!HZXP$"&H$Z$']__^#Q!"#Q/P/M@0S4&CRC`0(:@3H*OW__X/$$$.#^S]^ MQ8/$^%9J`6I`:,````#_=;S_=;CHC?O__X/$((7`=!&#Q/3_-;2=!`CH'/W_ M_X/$$#';C78`]L,/=1F#Q/R-@\````!0:.N,!`AJ!.C1_/__@\00@\3\#[8$ M,U!H\HP$"&H$Z+K\__^#Q!!#@_L_?L6#Q/AH^(P$"&H"Z*+\__^#Q!"#?;0` M#X2Q````@\3X:`"-!`AJ`NB&_/__BUVP@<-`____B@0S@\00J`1T$X/$^&@A MC00(:@+H9/S__^M[B?8,!(@$,XM%L(/$^(V\,$#___]7:@%J`5#_=;S_=;CH MT?K__X/$((7`=!&#Q/3_-;2=!`CH4/S__X/$$(/$^%=J`6H!BT6P4/]UO/]U MN.B2^O__@\0@]@0S!'01@\3X:#"-!`AJ`NCV^___ZPV#Q/1H.HT$".@/_/__ M@\00@\3X:$^-!`AJ`.C5^___,=N#Q!"(V.9P]L,/=1.#Q/Q3:.N,!`AJ`.BW M^___@\00@\3\Y'$E_P```%!H\HP$"&H`Z)W[__^#Q!!#@_M_?L2#?;0`=%*# MQ/AH8HT$"&H`Z'_[__\QVX/$$(GVB-CF<O;##W43@\3\4VCKC`0(:@#H7_O_ M_X/$$(/$_.1S)?\```!0:/*,!`AJ`.A%^___@\000X/[?W[$@\3X:/B,!`AJ M`.@M^___@\00@SWDG@0(`'0U@WVT`'0O@\3X:("-!`AJ`N@,^___L`#F<K#> MYG.P`>9RL*WF<[`"YG*PON9SL`/F<K#OYG.-99A;7E\QP,G#D)!5B>6#[!13 MZ`````!;@<.T$@``BX/L____@SC_="&)]HN#[/___XL`_]"+@^S___^-4/R) MD^S___^#>/S_=>%;R<.)]E6)Y8/L%%/H`````%N!PW`2``!;R<.0D.@3^O__ MP@```````````````````````$9A:6QE9"X*```````````````````````` M````````4')O8V5S<R!D;V5S;B=T(&AA=F4@<W5P97)U<V5R(&-A<&%B:6QI M=&EE<RX*`'-V`````````````````````&QS8VUO<R`M(&1I<W!L87D@0TU/ M4R!C;VYT96YT+@HH8RD@,C`P-2P@161U87)D($MR;VUS:V]Y(#QE9#%K0'%N M>"UN:6=H="YC;VT^"@````````````````````````I#;VYN96-T:6YG('1O M('1H92!00TD@<V5R=F5R+BXN(``````````````````````````````````` M``````!/2RX*3&]O:VEN9R!F;W(@4$-)+TE302!B<FED9V4N+BX@```````` M````````````````````````````````1F]U;F0N"E)E861I;F<@8V]N9FEG M=7)A=&EO;B!R96=I<W1E<G,N+BX@``HE,#1X.@`@)3`R>``*`````````%5N M;&]C:VEN9R!E>'1E;F1E9"!#34]3(&)A;FLN+BX@`&%L<F5A9'D@;W!E;BX* M`%-U8V-E<W,N"@!2969U<V5D(&)Y(&-H:7!S970N"@!0<FEM87)Y($--3U,@ M8F%N:SH`"D5X=&5N9&5D($--3U,@8F%N:SH`````````````5W)I=&EN9R!S M:6=N871U<F4@=&\@=&AE(&5X=&5N9&5D($--3U,@8F%N:RX*````R)T$"("+ M!`B\G00(_____P````#_____``````2>!`@``````````':$!`B&A`0(EH0$ M"*:$!`BVA`0(QH0$"-:$!`CFA`0(]H0$"`:%!`@6A00(`0````$````,```` M6(0$"`T```!HBP0(!`````B!!`@%````#(,$"`8```"L@00("@```.(````+ M````$````!4``````````P```,R=!`@"````6````!0````1````%P````"$ M!`@1````\(,$"!(````0````$P````@````````````````N<WEM=&%B`"YS M=')T86(`+G-H<W1R=&%B`"YI;G1E<G``+FYO=&4P`"YH87-H`"YD>6YS>6T` M+F1Y;G-T<@`N<F5L+F)S<P`N<F5L+G!L=``N:6YI=``N<&QT`"YT97AT`"YF M:6YI`"YR;V1A=&$`+F1A=&$`+F-T;W)S`"YD=&]R<P`N9V]T`"YD>6YA;6EC M`"YB<W,````````````````````````````````````````````````````` M`!L````!`````@```/2`!`CT````%````````````````0`````````C```` M!P````(````(@00("`$```````````````````$`````````*@````4````" M````"($$"`@!``"D````!``````````$````!````#`````+`````@```*R! M!`BL`0``8`$```4````!````!````!`````X`````P````(````,@P0(#`,` M`.(```````````````$`````````0`````D````"````\(,$"/`#```0```` M!````!(````$````"````$D````)`````@````"$!`@`!```6`````0````) M````!`````@```!2`````0````8```!8A`0(6`0```@```````````````$` M````````6`````$````&````8(0$"&`$``#````````````````$````!``` M`%T````!````!@```""%!`@@!0``2`8`````````````!`````````!C```` M`0````8```!HBP0(:`L```@```````````````$`````````:0````$````" M````@(L$"(`+```N`@`````````````@`````````'$````!`````P```+"= M!`BP#0``#```````````````!`````````!W`````0````,```"\G00(O`T` M``@```````````````0`````````?@````$````#````Q)T$",0-```(```` M```````````$`````````(4````!`````P```,R=!`C,#0``.``````````` M````!`````0```"*````!@````,````$G@0(!`X``(@````%``````````0` M```(````DP````@````#````C)X$"(P.``!D```````````````(```````` M`!$````#``````````````",#@``F````````````````0`````````!```` M`@``````````````E!(``%`$```5````)@````0````0````"0````,````` M`````````.06``#!`0`````````````!```````````````````````````` M```!`````0```````````/'_"0```("%!`@````````*`!@```"PG00(```` M``$`#0`<````Q)T$"``````!``\`*@```("%!`@``````@`*`$````"\A00( M``````(`"@!+````M)T$"``````!``T`60```+R=!`@``````0`.``$````! M````````````\?\!`````0```````````/'_`0````$```````````#Q_PD` M```,BP0(````````"@`8````N)T$"``````!``T`9P```,"=!`@``````0`. M`'0````,BP0(``````(`"@"*````4(L$"``````"``H`2P```+R=!`@````` M`0`-`)4```#(G00(``````$`#P`)````U(4$"`````````H``````/2`!`@` M`````P`!(@00(,``@"($$"#``,R!
M!@``````P$,@P0(``````,`!0``````\(,$"``````#``8````` M``"$!`@``````P`'``````!8A`0(``````,`"8(0$"#``D` M`````""%!`@P*``````!HBP0(``````,"P@(L$"#
MP``````+"=!`@``````P`-``````"\G00(``````,`#@``````Q)T$"``` M```#`,R=!`@``````P`0```````$G@0(``````,`$0``````C)X$ M"``````#`!(`H@```.2>!`@$````$0`2`*<```!PA`0(L````!(```"[```` M@(0$"*T````2````T2>!@`````$0#Q_]D```"0G@0(4````!$$@#A
MX)X$"`01!(YP&B+!`@`````$0#Q_^X````4A@0('0!( M"@#R````Z)X$"01`!(`_+2=!@$````$0-,!#LG@0(! M`!$`$@`.`0``6(0$"``````2``@`%`$``"B%!`A7````$@`*`!L!@A00(
M!$`"@`B`0``D(0$"$D````2````+0$``*"$!`C\````$@```#@!``", MG@0(!$\?]$0L(0$"+`"```2````2P$#2&!C6!```$@
%!
M#4A00(%@```!(`"@!8`0:(L$“2``L`7@$``,"$!`A%````$@`` M`&4!``#0A`0(/0```!(```!O`0``C)X$"1/'_=@$``."$!B! M$@```(4!``#LA00()P```!(`"@"-`0``S)T$"``````1`/'_HP$``/">!`@` M$0#Q_Z@!#PA`0()0```!(```"M`0```(4$"$H````2````N`$!”%
M!AA````$@````!?7U!)0U]?&=C8S)?8V]M<&EL960N'N,P!?7T143U)?
M3$E35%]?%]?9&]?9VQO8F%L7V1T;W)S7V%U>!F:6YI7V1U;6UY&9O<F-E M7W1O7V1A=&$7U]#5$]27TQ)4U1?7P!?7T-43U)?14Y$7U`7U]D;U]G;&]B
M86Q?8W1O<G-?875X&EN:71?9'5M;7D7U]$5$]27T5.1%]?'-I9VX<&-I
M7W)E861?8V]N9FEG7V)U<P!P8VE?=W)I=&5?8V]N9FEG7V)U<P!?1%E.04U)
M0P!?4W1D;W5T&5R<FYO%]E=&5X=!S860=F5R8F]S:71Y&5R<FUS9P!P M8VE?:&%N9&QE%]I;FET%]S=&%R=!?8G1E>‘0<&-I7V%T=&%C:!?:6YI
M=%]L:6)C%]?8G-S7W-T87)T&=E=&]P=!M86EN&-L96%N=7``7V9I;FD M871E>&ET%1H<F5A9$-T;!?961A=&$<&-I7V9I;F1?8VQA<W,:W!R:6YT M9@!?1TQ/0D%,7T]&1E-%5%]404),15\7V5N9!E>&ET’!C:5]D971A8V@ )=F9P<FEN=&8
`
end

ed1k wrote:

In article <d4l2vf$bqd$> 1@inn.qnx.com> >, > evanh@clear.net.nz > says…
Yeah, reading and writing is no problem, the problem is BIOS will reset the contents on the next boot up.


that some bytes are not used by BIOS, you can use them, but you have to
recalculate CRC and write new CRC as well.

So, there is further CRCs in each bank? Got any docs?

I didn’t find any use of it because it’s deeply hardware dependent. You
have to have RTC chip with extended capacity and BIOS that doesn’t use
it. Every chipset has a different rules to configuring access to it -
there is no single interface and seems nobody meant CMOS for application

The one I worked on didn’t need any special coding, since the pages are only 64 bytes long the next three pages can just continue the 8 bit addressing.


Evan

In article <d4otet$8ft$1@inn.qnx.com>, evanh@clear.net.nz says…

ed1k wrote:
In article <d4l2vf$bqd$> 1@inn.qnx.com> >, > evanh@clear.net.nz > says…
Yeah, reading and writing is no problem, the problem is BIOS will reset the contents on the next boot up.


that some bytes are not used by BIOS, you can use them, but you have to
recalculate CRC and write new CRC as well.


So, there is further CRCs in each bank? Got any docs?

Well, I never tried to store anything in a CMOS bank that’s used by
BIOS. Although I think we have different meaning of word “bank” (see
below). My speculation is (since I never read any docs from BIOS
providers regarding CMOS layout - I doubt someone ever have it publicly
available), BIOS keeps CRC for every used bank at 0x38-0x3F. New
chipsets provide mechanism of locking those CMOS registers, so you will
read undefined garbage and write will not take effect. Once locked that
memory can’t be unlocked. I bet if you enter BIOS Setup, they are still
unlocked after reset, as soon as you exit BIOS Setup (or during normal
boot without setup changes) they are locked. Some RTC doesn’t seem to
have this protection what is pity because if you overwrite something
important and place correct CRC, BIOS will be fooled and something
really bad could happen. The bottom line is BIOS developers are free to
organize CMOS as they want and put CRC where they think it should be.

I didn’t find any use of it because it’s deeply hardware dependent. You
have to have RTC chip with extended capacity and BIOS that doesn’t use
it. Every chipset has a different rules to configuring access to it -
there is no single interface and seems nobody meant CMOS for application


The one I worked on didn’t need any special coding, since the pages are only 64 bytes long the next three pages can just continue the 8 bit addressing.

For more than decade CMOS memory bank in a PC is 128 bytes long. It is
called standard (or primary) memory bank. Yes, you don’t need any
special programming to access higher 64 bytes, because address is still
7 bits wide. Higher 8th bit of RTC CMOS address register happens to be
related to NMI, that’s why memory bank is limited to 128 bytes (don’t
try to access address higher 0x7F).

Nowadays, RTC usually provides 256 bytes of CMOS memory. First 128 byte
block is mapped to the standard location for sake of compatibility,
second 128 byte block is “extended bank”. Access to extended CMOS bank
is usually disabled under reset condition (at least all Intel chipsets
have it disabled). And problem is to unlock this extended bank. Intel
has three different ways to deal with it dependent on chipset, although
this is many years long evalution, not sporadic movements :slight_smile: I heard
some cheap chipsets have extended bank unlocked and probably there is no
mechanism to lock it - but I sell this info for what I bought, be warned
:slight_smile:

Access to extended CMOS memory is similar, but address register and data
register have different I/O location.

All this information is available in numerous datasheets at
http://developer.intel.com

If you know similar place where I could read datasheets for VIA chipsets
or SiS, I would be thankful.

Eduard.