If you are unfortunate and BIOS locks SMRAM and there are no other flaw
to use then BIOS firmware can be modified such that it doesn't set D_LCK
any more. After re-flashing modified BIOS ROM binary back and booting the
system from this BIOS, SMRAM will not be locked and can be dumped from
the OS. This, surely, works only if BIOS firmware isn't digitally signed.
Oh, we forgot that almost no motherboards use digitally signed non-EFI
BIOS firmware.

Here's a hint how to find where BIOS firmware sets D_LCK bit. BIOS
firmware is most likely using legacy I/O access to PCI configuration
registers using 0xCF8/0xCFC ports. To access SMRAMC register BIOS
should first write value 0x8000009C to 0xCF8 address port and then a
needed value (typically, 0x1A to lock SMRAM) to 0xCFC data port.

2. There's another, probably simpler, way to disassemble SMI handlers, that
doesn't require access to SMRAM at run-time.

2.1. Dump BIOS firmware binary from BIOS ROM using Flash programmer or
simply download the latest BIOS binary from vendor's web site ;). For
ASUS P5Q motherboard download P5Q-ASUS-PRO-1613.ROM file.

2.2. Most of the BIOS firmware including Main BIOS module which
contains SMI handlers is compressed. Use tools provided by vendor to
extract/decompress the Main BIOS module. ASUS BIOS is based on AMI BIOS
so we used AMIBIOS BIOS Module Manipulation Utility, MMTool.exe, to
extract the Main BIOS module. Open downloaded .ROM file in MMTool,
choose to extract "Single Link Arch BIOS" module (ID=1Bh), check "In
uncompressed form" option and save it. This is uncompressed Main BIOS
module containing SMI handlers.

Check out a resource on modifying AMI BIOS on The Rebels Heaven forum
[ami_mod].

2.3. Once the Main BIOS module is extracted you can start disassembling
it to find SMI handlers (for example, using HIEW or IDA Pro). In this
paper we hope to provide a starting point for analyzing SMI handlers.
...