3 ms·
Other manufacturers do worse and prevent boot if your PCI ids aren't on a positive list. This is for example present on thinkpads, and while you could patch th
by csdvrx 3y ago
Other manufacturers do worse and prevent boot if your PCI ids aren't on a positive list.
This is for example present on thinkpads, and while you could patch the bios before, Intel bootguard now prevents you do that "for your own protection" :)
I hope the MSI leak contains actual bootguard keys for intel 11th gen+, and can be used to allow "unauthorized" PCI modules on modern thinkpads!
- Avery3R 3y agobootguard keys are oem specific
- csdvrx 3y agoThe MSI leak comments like https://sizeof.cat/post/leak-intel-private-keys-msi-firmware/ https://sizeof.cat/post/leak-intel-private-keys-msi-firmware... mentioned the bootguard keys maybe have been common to other manufacturers: "It is assumed that the keys for downloading the guard are not limited to compromising MSI products and can also be used to attack equipment from other manufacturers using Intel’s 11th, 12th and 13th generation processors (for example, Intel, Lenovo and Supermicro boards are mentioned)"
- wokkel 3y agoWhat worked for some older think machines (haven't tried it on my thinkpad though) is to update the bios (can be to the same version) and change the serial nr.to all zeroes (the update script asks if you want that). That got rid of the wifi whitelist i encountered.
- csdvrx 3y agoVery interesting! Could you please explain which serial? Can you do dmidecode and tell me which Handle/ UUID is all zeroes? Even if it may not directly apply to current thinkpads, it implies the UEFI module might have other conditionals before going on checking the positive list - something that should be easy to check by reversing the LenovoWmaPolicyDxe.sct PE32.
- ornornor 3y agoIf you’re interested, I have a dump of my TP bios flash unmodified and then the same version I paid some Russian guy to modify so the whitelist is removed and an extra menu unlocked. I basically sent them the dump, and after a “donation” I got the patches dump back. Would love to learn how to figure out what the changes are because with my limited knowledge I didn’t figure anything out.
- csdvrx 3y agoWhich thinkpad model? If you want to learn, https://erfur.github.io/2019/03/28/down_the_rabbit_hole_pt3.html https://erfur.github.io/2019/03/28/down_the_rabbit_hole_pt3.... is a good guide!
- ornornor 3y agoThanks, I am so going down this rabbit hole. It's for an X230, I wanted 802.11ac wifi in it.
- csdvrx 3y agoIf you are interested in doing other modifications yourself, also read about UEFI variables, how they control menu options and can be tweaked with just grub
- bubblethink 3y agox230 is easy, just install coreboot instead of messing with bios patches.
- undersuit 3y agoI'd love to buy a AMD Ryzen 3 Pro 5350g, but I don't want to deal with the stupid locked CPUs floating around from Lenovo pulls.