How to build an NMI generator board?

NTDEV
1

I saw some instructions once on how to build
this hardware board when you need to break into
a locked system that does not have an NMI button.
Does anyone know where to find it?

I think I should watch the DVD of ‘Lost In Translation’.

=====================
Mark Roddy

> -----Original Message-----
> From: xxxxx@garlic.com [mailto:xxxxx@garlic.com]
> Sent: Monday, March 15, 2004 12:49 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] Re:using KeWaitForxxx properly with verifier
>
> So what ?. Make it free then I will use it :slight_smile: There is a joke
> - "In a little town, there was a new resurant, and the label
> was “GrandPa eats and GrandKid pays”. Two retired fellows,
> saw the label on their way to evening walk. Got very curious,
> and one of them stepped right in, and asked the Manager, is
> it really true what you said on that label. Manager said, we
> are serious about what we say. Yes of course it is true. They
> both went in eat a lot, and walking out of the resturant. The
> Manager cameby, handed out the bill. They said, right now you
> said that our grandpa would pay for this.
>
> Manager said, this is bill for what your Grandpa eat.
>
> -pro
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@stratus.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@attbi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

2

You can go to

http://www.microsoft.com/whdc/hwdev/platform/proc/dmpsw.mspx?pf=true#dmpsw1

there’s an easy to build NMI Switch PCI board in there. Note however that
there’s no documentation for the AMD 20R4 Pal program, although it should be
pretty easy to figure it out - the 20R4 and the 7406 are there just to make
sure that the PCI spec is obeyed (as far as the NMI signal goes), however,
it’s just as easy to remove those parts out, and you can do it with the
74HC14 alone. One of our QA guys tinkers with hardware, and he wired a few
of those for us. You can do the same on an ISA board, it’s probably almost
the same circuit.

Alberto.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@comcast.net
Sent: Monday, March 15, 2004 2:29 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] How to build an NMI generator board?

I saw some instructions once on how to build
this hardware board when you need to break into
a locked system that does not have an NMI button.
Does anyone know where to find it?

I think I should watch the DVD of ‘Lost In Translation’.

=====================
Mark Roddy

> -----Original Message-----
> From: xxxxx@garlic.com [mailto:xxxxx@garlic.com]
> Sent: Monday, March 15, 2004 12:49 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] Re:using KeWaitForxxx properly with verifier
>
> So what ?. Make it free then I will use it :slight_smile: There is a joke
> - "In a little town, there was a new resurant, and the label
> was “GrandPa eats and GrandKid pays”. Two retired fellows,
> saw the label on their way to evening walk. Got very curious,
> and one of them stepped right in, and asked the Manager, is
> it really true what you said on that label. Manager said, we
> are serious about what we say. Yes of course it is true. They
> both went in eat a lot, and walking out of the resturant. The
> Manager cameby, handed out the bill. They said, right now you
> said that our grandpa would pay for this.
>
> Manager said, this is bill for what your Grandpa eat.
>
> -pro
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@stratus.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@attbi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The contents of this e-mail are intended for the named addressee only. It
contains information that may be confidential. Unless you are the named
addressee or an authorized designee, you may not copy or use it, or disclose
it to anyone else. If you received it in error please notify us immediately
and then destroy it.

3

Thanks, I agree with your assumptions
Ed

You can go to

http://www.microsoft.com/whdc/hwdev/platform/proc/dmpsw.mspx?pf=true#dmpsw1

there’s an easy to build NMI Switch PCI board in there. Note however that
there’s no documentation for the AMD 20R4 Pal program, although it should be
pretty easy to figure it out - the 20R4 and the 7406 are there just to make
sure that the PCI spec is obeyed (as far as the NMI signal goes), however,
it’s just as easy to remove those parts out, and you can do it with the
74HC14 alone. One of our QA guys tinkers with hardware, and he wired a few
of those for us. You can do the same on an ISA board, it’s probably almost
the same circuit.

Alberto.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@comcast.net
Sent: Monday, March 15, 2004 2:29 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] How to build an NMI generator board?

I saw some instructions once on how to build
this hardware board when you need to break into
a locked system that does not have an NMI button.
Does anyone know where to find it?
> I think I should watch the DVD of ‘Lost In Translation’.
>
>
> =====================
> Mark Roddy
>
>
> > -----Original Message-----
> > From: xxxxx@garlic.com [mailto:xxxxx@garlic.com]
> > Sent: Monday, March 15, 2004 12:49 PM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] Re:using KeWaitForxxx properly with verifier
> >
> > So what ?. Make it free then I will use it :slight_smile: There is a joke
> > - "In a little town, there was a new resurant, and the label
> > was “GrandPa eats and GrandKid pays”. Two retired fellows,
> > saw the label on their way to evening walk. Got very curious,
> > and one of them stepped right in, and asked the Manager, is
> > it really true what you said on that label. Manager said, we
> > are serious about what we say. Yes of course it is true. They
> > both went in eat a lot, and walking out of the resturant. The
> > Manager cameby, handed out the bill. They said, right now you
> > said that our grandpa would pay for this.
> >
> > Manager said, this is bill for what your Grandpa eat.
> >
> > -pro
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@stratus.com To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@attbi.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The contents of this e-mail are intended for the named addressee only. It
contains information that may be confidential. Unless you are the named
addressee or an authorized designee, you may not copy or use it, or disclose
it to anyone else. If you received it in error please notify us immediately
and then destroy it.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@attbi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

I actually got the equations for the PAL by calling up Microsoft tech
support. However, I can’t find them now, even though it seems like
something that I would have saved. The only odd thing that I recall was
that the SERR# had to be active either exactly 1 clock or maybe more than
one clock.

We did something similar for ISA by using the IOCHCHK signal. We sometimes
even do that by hand by just taking a wire and manually shorting it to
ground. The timing isn’t that key on that signal.

5

http://www.microsoft.com/whdc/hwdev/platform/proc/dmpsw.mspx

-----Original Message-----
From: Taed Wynnell [mailto:xxxxx@vertical.com]
Sent: Monday, March 15, 2004 3:54 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] How to build an NMI generator board?

I actually got the equations for the PAL by calling up Microsoft tech
support. However, I can’t find them now, even though it seems like
something that I would have saved. The only odd thing that I recall was
that the SERR# had to be active either exactly 1 clock or maybe more than
one clock.

We did something similar for ISA by using the IOCHCHK signal. We sometimes
even do that by hand by just taking a wire and manually shorting it to
ground. The timing isn’t that key on that signal.

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@softek.fujitsu.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Thanks, I think our PCI guys can figure out what SERR needs to be.

Ed

http://www.microsoft.com/whdc/hwdev/platform/proc/dmpsw.mspx

-----Original Message-----
From: Taed Wynnell [mailto:xxxxx@vertical.com]
Sent: Monday, March 15, 2004 3:54 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] How to build an NMI generator board?

I actually got the equations for the PAL by calling up Microsoft tech
support. However, I can’t find them now, even though it seems like
something that I would have saved. The only odd thing that I recall was
that the SERR# had to be active either exactly 1 clock or maybe more than
one clock.

We did something similar for ISA by using the IOCHCHK signal. We sometimes
even do that by hand by just taking a wire and manually shorting it to
ground. The timing isn’t that key on that signal.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@softek.fujitsu.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@attbi.com
To unsubscribe send a blank email to xxxxx@lists.osr.com