Jump to content

[UEFIPatch] UEFI patching utility

CodeRush

By CodeRush,
in UEFI

 Share
1,981 posts in this topic

Recommended Posts

Riley Freeman
Riley Freeman
Posted
Posted

Excited to try this out! I think there should be a DOS version as well. My X79 only has OS X installed so I can't use the windows one.

 

I found a copy of scedos but got a "Memory Allocation Error" when I tried to run it. Maybe it's not the Aptio version.

 

Will that SMI lock open up NVRAM writing for BIOS versions like mine where it's read-only?

Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

Excited to try this out! I think there should be a DOS version as well. My X79 only has OS X installed so I can't use the windows one.

 

I found a copy of scedos but got a "Memory Allocation Error" when I tried to run it. Maybe it's not the Aptio version.

 

Will that SMI lock open up NVRAM writing for BIOS versions like mine where it's read-only?

 

yes, there's a dos version too, but to edit the dump from dos is pain ;)

even I don't suggest to unlock SMM, as it's a security feature

Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

Yep. I can only write modified BIOS files via USB Flashback. FPT can't do anything.

 

The NVRAM lock is as big an issue as it prevents us from fully using the Ozmosis bootloader (can't set SMBIOS variables in NVRAM).

if you want you can upload your rom and I'll remove the lock manually

Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

The method worked on ASUS Z87 Plus.  :thumbsup_anim:

thanks for feedback, exactly what I thought :D never doubt your own comment!

 

@ Riley, this X79 looks very special, I can't find the required pattern in any of the modules nor a PchInit.Dxe for patching.

I'm sorry.

This needs reverse engineering due to totally different presuppositions compared to Intel Series 7 / Series 8, and I suggest

no one will do it, X79 is rarely sold.

  • Like 1
Link to comment
Share on other sites
CodeRush
CodeRush
Posted
  • Author
Posted

It's a bug in LZMA SDK compiled by clang, will be solved in next build. Try version for Windows.

You can't compress a file with UEFITool now, this feature will be added in a pair weeks.

  • Like 1
Link to comment
Share on other sites
yangshun1029
yangshun1029
Posted
Posted

MacPro:new SHUN$ ./PMPatch X79E4_3.40 X79E4_3.40-P

PMPatch 0.5.14

PowerManagement module at 00591B38 not patched: Patch pattern not found.

PowerMgmtDxe/PowerManagement2.efi modules not found.

AMI nest modules not found.

Phoenix nest modules not found.

CpuPei module at 0079CA10 not patched: Patch pattern not found.

 

I have uploaded my bios,plase help me!

X79E4_3.40.zip

Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

MacPro:new SHUN$ ./PMPatch X79E4_3.40 X79E4_3.40-P

PMPatch 0.5.14

PowerManagement module at 00591B38 not patched: Patch pattern not found.

PowerMgmtDxe/PowerManagement2.efi modules not found.

AMI nest modules not found.

Phoenix nest modules not found.

CpuPei module at 0079CA10 not patched: Patch pattern not found.

 

I have uploaded my bios,plase help me!

Yangshun,

simply no need for a patch?

You are able to boot os x as I see on your cmd ;) powermanagement isn't locked, test with msrdump.

As an alternative you can use AICPMPatch.

Link to comment
Share on other sites
Tebogo
Tebogo
Posted
Posted

FTK is not meant for notebooks. Are you sure that AFU /GAN method doesn't work for you?

 

Sorry, I didn't realize is was not meant for laptops. I'll try later this day the AFU /GAN method.

 

I found your article about that: http://www.win-raid.com/t286f16-Guide-Flashing-modified-AMI-Aptio-UEFI-using-AFU.html#msg3571

 

Or should I follow: http://www.insanelymac.com/forum/topic/285444-pmpatch-uefi-patching-utility/page-39?do=findComment&comment=1951029

 

Thank you!

Link to comment
Share on other sites
CodeRush
CodeRush
Posted
  • Author
Posted

Nope, it's a new variant of lock in PowerManagement module, here is the disassembly:

mov ecx, 0E2h                      ; 0xE2 MSR to ECX
mov [rsp+28h+arg_8], rax           ; Old register value stored in RAX to structure in memory
bts dword ptr [rsp+28h+arg_8], 0Fh ; Test and set bit 15 (LOCK)
mov rdx, [rsp+28h+arg_8]           ; Locked value to RDX
call sub_180004CCC                 ; WRMSR inside

It can't be patched with PMPatch right now, but will be patched by hand.

  • Like 2
Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

Nope, it's a new variant of lock in PowerManagement module, here is the disassembly:

mov ecx, 0E2h                      ; 0xE2 MSR to ECX
mov [rsp+28h+arg_8], rax           ; Old register value stored in RAX to structure in memory
bts dword ptr [rsp+28h+arg_8], 0Fh ; Test and set bit 15 (LOCK)
mov rdx, [rsp+28h+arg_8]           ; Locked value to EDX
call sub_180004CCC                 ; WRMSR inside

It can't be patched with PMPatch right now, but will be patched by hand. I will do the mod in 20 min. 

Where did you gather this awesome assembler knowledge? I'm stunning!

Link to comment
Share on other sites
yangshun1029
yangshun1029
Posted
Posted

Nope, it's a new variant of lock in PowerManagement module, here is the disassembly:

mov ecx, 0E2h                      ; 0xE2 MSR to ECX
mov [rsp+28h+arg_8], rax           ; Old register value stored in RAX to structure in memory
bts dword ptr [rsp+28h+arg_8], 0Fh ; Test and set bit 15 (LOCK)
mov rdx, [rsp+28h+arg_8]           ; Locked value to EDX
call sub_180004CCC                 ; WRMSR inside

It can't be patched with PMPatch right now, but will be patched by hand. I will do the mod in 20 min. 

thanks

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...