Jump to content

[UEFIPatch] UEFI patching utility

CodeRush

By CodeRush,
in UEFI

 Share
1,981 posts in this topic

Recommended Posts

StoneTemplePilots
StoneTemplePilots
Posted
Posted

Sorry, I missed that post. Here is a link to the original bios download: ZOTAC H87ITX-A-E BIOS and update utility

Many thanks for your help. That link obviously is for the bios before doing the PMpatch, and if it worked right for me the file "newbios" in my zip was simply the one patched by Coderush's utility under windows.

Flashing my newbios file to the board failed (under DOS using the various tools) as it gave me a response along the lines that a secure session could not be performed.

Try this one, it's flashlock removed + pmpatched + FFS checksums corrected.

Should be possible to start a secure flash session now. If it works you can use even fpt or flashrom.

When it's done and you had no probs to flash it I'll explain in detail how to do it yourself next time ; )

pa287.zip

Link to comment
Share on other sites
CodeRush
CodeRush
Posted
  • Author
Posted

BonBon6, security verification has nothing to do with FFS checksums (which must be corrected for any sectioned file), so it can't be bypassed so easily. 

AMI Aptio BIOSes have extended capsule header, where RSA2048 signature and SHA1 checksum of whole BIOS are located. Checksum can be corrected, but signature is a problem. Phoenix and InsydeH2O BIOSes have normal capsule header but extended volume headers with the same signature. If you don't have an AMI or Phoenix private key stolen - you can't sign your modified BIOS, I think. I wish I'm wrong, BTW. :)

  • Like 2
Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

BonBon6, security verification has nothing to do with FFS checksums (which must be corrected for any sectioned file), so it can't be bypassed so easily. 

AMI Aptio BIOSes have extended capsule header, where RSA2048 signature and SHA1 checksum of whole BIOS are located. Checksum can be corrected, but signature is a problem. Phoenix and InsydeH2O BIOSes have normal capsule header but extended volume headers with the same signature. If you don't have an AMI or Phoenix private key stolen - you can't sign your modified BIOS, I think. I wish I'm wrong, BTW. :)

 

Thanks CodeRush,

 

I read at MDL the ROMs can be flashed again when using OA30.txt key with new module option - but looks like that's possible only on Asus boards ;)

Link to comment
Share on other sites
styrian
styrian
Posted
Posted

@ CodeRush

 

I have tried the PMPatch WinVers. 0.5.13 on the 7720A15.exe of the Dell bios for Inspiron 17R SE 7720 (i7 3630qm) without success. On the with Universal Bios Backup Toolkit 2.0 backuped DellInc.-A15.rom done PMPatch I have  got this output:

 

PMPatch 0.5.13
PowerManagement modules not found.
PowerMgmtDxe/PowerManagement2.efi modules not found.
AMI nest modules not found.
Trying to apply patch #1
Nested PowerMgmtDxe/powerManagement2.efi module at 003429A8 patched.
Phoenix nest module at 00280048 patched.
CpuPei modules not found.
Output file generated.

 

Is it save to flash this patched rom?  I have read about some bricked SE 7720 with i7 3630 after flashing a moded unlocked bios. Which tool should I use for flashing the patched rom?

 

Thanks.

  • Like 1
Link to comment
Share on other sites
TimeWalker75a
TimeWalker75a
Posted
Posted

it's not safe in the first place because Universal Bios Backup tool clearly states it cannot guarantee it's making a complete copy of your BIOS chip.

Unpack the OEM .exe with either 7zip or start the updater and got to %TEMP% (Win+R > %TEMP%) and copy the flasher folder that contains the bios capsule. Then patch the capsule with PMPatch, reflash using original WinFlash flasher utility.

  • Like 4
Link to comment
Share on other sites
styrian
styrian
Posted
Posted

it's not safe in the first place because Universal Bios Backup tool clearly states it cannot guarantee it's making a complete copy of your BIOS chip.

Unpack the OEM .exe with either 7zip or start the updater and got to %TEMP% (Win+R > %TEMP%) and copy the flasher folder that contains the bios capsule. Then patch the capsule with PMPatch, reflash using original WinFlash flasher utility.

Thanks, flash went fine.

Link to comment
Share on other sites
stinga11
stinga11
Posted
Posted

We have found that AICPM.kext from 10.9 DP1 can be patched to enable SB-E processors but power management will not work.

Thanks to SunKi for this 2 patches:

 

Quote

1. sudo perl -pi -e 's|\x74\x2f\x48\x89|\x90\x90\x48\x89|' /System/Library/Extensions/AppleIntelCPUPowerManagement.kext/Contents/MacOS/AppleIntelCPUPowerManagement

2. sudo perl -pi -e 's|\x74\xe7\x48\xc7|\x90\x90\x48\xc7|' /System/Library/Extensions/AppleIntelCPUPowerManagement.kext/Contents/MacOS/AppleIntelCPUPowerManagement

 

Hey man would be possible you update this patch for use in 10.8.5 since this doesn't work. Thanks in advance

Link to comment
Share on other sites
cope98
cope98
Posted
Posted

I get an error when I tried to patched my rom. I get the following error :

PMPatch 0.5.11
PowerManagement modules not found.
AMI nest modules not found.
Phoenix nest modules not found.
CpuPei module at 0066FE40 not patched: Patch pattern not found.
CpuPei module at 0076FE40 not patched: Patch pattern not found.

I was wondering if someone could help me or patch it for me.

My motherboard is an ASUS B85M-G.

 

Thank you,

 

Cope98

Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

I get an error when I tried to patched my rom. I get the following error :

...

I was wondering if someone could help me or patch it for me.

My motherboard is an ASUS B85M-G.

 

Thank you,

 

Cope98

 

Hey Cope98,

 

you could have helped yourself using PMpatch 0.5.13:

PMPatch 0.5.13
PowerManagement modules not found.
PowerMgmtDxe/PowerManagement2.efi module at 002B0748 patched.
AMI nest modules not found.
Phoenix nest modules not found.
CpuPei module at 0066FE40 not patched: Patch pattern not found.
CpuPei module at 0076FE40 not patched: Patch pattern not found.
Output file generated.

patched ROM uploaded

 

regardz

  • Like 1
Link to comment
Share on other sites
shiecldk
shiecldk
Posted
Posted

Hi CodeRush,

I'm going to help my friend patch his ASUS X202E. I got these logs in terminal:

XXX-macpro:~ XXX$ /Users/XXX/Downloads/PMPatch /Users/XXX/Downloads/X202EAS.210.CAP /Users/XXX/Desktop/X202EAS.210.CAP 
PMPatch 0.5.13
PowerManagement module at 00191108 patched.
PowerMgmtDxe/PowerManagement2.efi modules not found.
AMI nest modules not found.
Phoenix nest modules not found.
CpuPei module at 005A0F60 not patched: Patch pattern not found.
Output file generated.

Is this UEFI generated from PMPatch fine to flash?

 

Original UEFI is right here. "BIOS 210 (X202E)"

Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

Hi CodeRush,

I'm going to help my friend patch his ASUS X202E. I got these logs in terminal:

XXX-macpro:~ XXX$ /Users/XXX/Downloads/PMPatch /Users/XXX/Downloads/X202EAS.210.CAP /Users/XXX/Desktop/X202EAS.210.CAP 
PMPatch 0.5.13
PowerManagement module at 00191108 patched.
PowerMgmtDxe/PowerManagement2.efi modules not found.
AMI nest modules not found.
Phoenix nest modules not found.
CpuPei module at 005A0F60 not patched: Patch pattern not found.
Output file generated.

Is this UEFI generated from PMPatch fine to flash?

 

Original UEFI is right here. "BIOS 210 (X202E)"

patch from windows:

$>pmpatch X202EVAS.200.CAP X202EVAS.200-pmpatch.CAP
PMPatch 0.5.13
PowerManagement module at 00190838 patched.
PowerMgmtDxe/PowerManagement2.efi modules not found.
AMI nest modules not found.
Phoenix nest modules not found.
CpuPei module at 005A1720 not patched: Patch pattern not found.
Output file generated.

PowerManagement module at                  00190838 patched

Same on for your log but different offset: 00191108 patched

 

Fine to flash. If biosregion isn't flashlocked. :ninja:

  • Like 1
Link to comment
Share on other sites
shiecldk
shiecldk
Posted
Posted

patch from windows:

$>pmpatch X202EVAS.200.CAP X202EVAS.200-pmpatch.CAP
PMPatch 0.5.13
PowerManagement module at 00190838 patched.
PowerMgmtDxe/PowerManagement2.efi modules not found.
AMI nest modules not found.
Phoenix nest modules not found.
CpuPei module at 005A1720 not patched: Patch pattern not found.
Output file generated.

PowerManagement module at                  00190838 patched

Same on for your log but different offset: 00191108 patched

 

Fine to flash. If biosregion isn't flashlocked. :ninja:

Thanks!  :D

So I patch it again in Parallels. I found out the MD5 are the same although the offset is reported different.

Link to comment
Share on other sites
wiz329
wiz329
Posted
Posted

Nothing to do here with software methods now, if your ASUS x8x board doesn't support USB BIOS Flashback.

There is no way to flash modified BIOS on such boards, except external SPI programmer.

I heard some rumors about AMI Flash Utility able to flash BIOS on this platform, but I have no chance to test, that is why I don't recommend to try, unless you have SPI programmer to correct possible failure. But if you ask me about that, it appears that you don't have one.

 

I am having this same problem. I was told that this board (H87i-plus) most likely had the MSR unlocked. Is this true?

If not, am I able to flash the board using FTK?

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...