Jump to content

[UEFIPatch] UEFI patching utility

CodeRush

By CodeRush,
in UEFI

 Share
1,981 posts in this topic

Recommended Posts

tampit
tampit
Posted
Posted

I have an Asus N750JV i7 laptop and I'd like to use your patch.

 

Here's the output pmpatch gives me:

 

 

PMPatch 0.5.14

PowerManagement modules not found.
PowerMgmtDxe/PowerManagement2.efi modules not found.
Trying to apply patch #1
Nested PowerMgmtDxe/PowerManagement2.efi module at 001D7184 patched.
Gap module inserted after repacked module.
AMI nest module at 00080848 patched.
Phoenix nest modules not found.
CpuPei module at 0059C310 not patched: Patch pattern not found.
Output file generated.

 

Is it safe to flash it?

 

What tool should I use for flashing? I suppose EZ flashing inside UEFI won't work.

 

Asus has posted a modified winflash on their website which lacks the backup option. http://dlcdnet.asus.com/pub/ASUS/nb/Apps_for_Win8/Splendid/WinFlash_Win7_8_VER2420.zip. Shall I flash the patched bios with it or use Phoenix PFlash? Or your FTK (Flash ToolKit)?

Thank you.

Link to comment
Share on other sites
Gringo Vermelho
Gringo Vermelho
Posted
Posted

You shall try them all until you find one that works.

 

You shall read the first post in this topic to learn whether your BIOS was patched or not.

 

The question is not "is it safe to flash it". Either it will flash or it won't.

 

If the idea of flashing a patched BIOS makes you uncomfortable then use one of the other available means to circumvent the locked register, like a patched AppleIntelCPUPowerManagement.kext.

The end result is exactly the same - the only difference is that you have to patch it again whenever Apple updates it.

  • Like 2
Link to comment
Share on other sites
CodeRush
CodeRush
Posted
  • Author
Posted

I have found a solution of BIOS Lock problem for Phoenix and Insyde BIOSes, that have PchBiosWriteProtect.efi driver.

This driver can be patched to disable SMI Lock and BIOS Lock completely.

 

BIOS Lock is set here:

48 8B 0D 6D 08 00 00 mov         rcx,qword ptr [00000ED8h] ; LPC registers base is stored in memory
B2 FE                mov         dl,0FEh                   ; 0xFE is (NOT 0x01), 0x01 is BIOSWE, i.e. disable BIOS write
48 81 C1 DC 00 00 00 add         rcx,0DCh                  ; 0xDC is BIOS_CNTL register offset
E9 5F 01 00 00       jmp         00000000000007D8          ; Jump to write function

This code is a part of SMI handler, that sets BIOSWE bit to 0 right after flashrom tries to set it to 1. Changing 0xFE to 0xFF will disable it.

 

SMI Lock is set here:

48 8B 0D 42 08 00 00 mov         rcx,qword ptr [00000ED8h] ; LPC registers base is stored in memory 
48 83 64 24 48 00    and         qword ptr [rsp+48h],0     ; Some stack variable is now 0, not related
B2 20                mov         dl,20h                    ; 0x20 is SMI_BWP, i.e enable SMI generation after BIOSWE set to 1 
48 81 C1 DC 00 00 00 add         rcx,0DCh                  ; 0xDC is BIOS_CNTL register offset
E8 02 01 00 00       call        00000000000007AC          ; Call of write function

This code is part of procedure, that registers SMI handler above. Changing 0x20 to 0x00 will disable the registration and handler itself.

After both modifications BIOSWE=1 and SMM_BWP=0 in BIOS_CNTL register, that allows flashrom to work normally.

Descriptor locks can still prevent access to ME and Descriptor regions, but BIOS region will now be free from stupid useless protections.

 

I haven't tried it yet, but I'm pretty sure it will work as supposed. Feel free to try it and post the result. :)

  • Like 7
Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

I have found a solution of BIOS Lock problem for Phoenix and Insyde BIOSes, that have PchBiosWriteProtect.efi driver.

This driver can be patched to disable SMI Lock and BIOS Lock completely.

 

BIOS Lock is set here:

48 8B 0D 6D 08 00 00 mov         rcx,qword ptr [00000ED8h] ; LPC registers base is stored in memory
B2 FE                mov         dl,0FEh                   ; 0xFE is (NOT 0x01), 0x01 is BIOSWE, i.e. disable BIOS write
48 81 C1 DC 00 00 00 add         rcx,0DCh                  ; 0xDC is BIOS_CNTL register offset
E9 5F 01 00 00       jmp         00000000000007D8          ; Jump to write function

This code is a part of SMI handler, that sets BIOSWE bit to 0 right after flashrom tries to set it to 1. Changing 0xFE to 0xFF will disable it.

 

SMI Lock is set here:

48 8B 0D 42 08 00 00 mov         rcx,qword ptr [00000ED8h] ; LPC registers base is stored in memory 
48 83 64 24 48 00    and         qword ptr [rsp+48h],0     ; Some stack variable is now 0, not related
B2 20                mov         dl,20h                    ; 0x20 is SMI_BWP, i.e enable SMI generation after BIOSWE set to 1 
48 81 C1 DC 00 00 00 add         rcx,0DCh                  ; 0xDC is BIOS_CNTL register offset
E8 02 01 00 00       call        00000000000007AC          ; Call of write function

This code is part of procedure, that registers SMI handler above. Changing 0x20 to 0x00 will disable the registration and handler itself.

After both modifications BIOSWE=1 and SMM_BWP=0 in BIOS_CNTL register, that allows flashrom to work normally.

Descriptor locks can still prevent access to ME and Descriptor regions, but BIOS region will now be free from stupid useless protections.

 

I haven't tried it yet, but I'm pretty sure it will work as supposed. Feel free to try it and post the result. :)

 

Is it a NVRAM variable which could be patched potentially from UEFI shell, is it accessible?

 

 

Memory Commands — EFI Shell. Commands for listing and managing memory, EFI variables, and NVRAM details.

default

Set the default NVRAM values.

dmem

Dump memory or memory mapped IO.

dmpstore

Display all EFI variables.

memmap

Display the memory map.

mm

Display/modify MEM/IO/PCI.

Link to comment
Share on other sites
StoneTemplePilots
StoneTemplePilots
Posted
Posted

Potentially - yes, but I don't know one. Needs further testing.

 

I dumped the whole store using dmpstore -all > outfile.txt

328KB, a lot of variables inside ;)

What I could do now: flash a locked bios, dump again and compare what's changed.

EZFlash keeps the NVRAM widespread intact.

nvstore.zip

Link to comment
Share on other sites
CodeRush
CodeRush
Posted
  • Author
Posted

NVRAM will not be changed after that modification, no need to do it. 

 

UPD: I didn't found any NVRAM-related code, and BIOS lock is set only in PBWP.efi.

"SMI Lock" from PchInitDxe.efi is in fact not related to BIOS lock in BIOS_CNTL register and must be left untoched.

Link to comment
Share on other sites
FelipeZé
FelipeZé
Posted
Posted

Does this looks oK? 

./PMPatch bios/isflash.bin bios/isflash_patched.bin
PMPatch 0.5.14
PowerManagement modules not found.
PowerMgmtDxe/PowerManagement2.efi module at 0075333E not patched: Unknown error.
AMI nest modules not found.
Trying to apply patch #1
Nested PowerMgmtDxe/PowerManagement2.efi module at 0001FFE2 not patched: Unknown module state.
Nested PowerMgmtDxe/PowerManagement2.efi module at 00254430 patched.
Nested SmmPlatform module at 0001FFBE not patched: Unknown module state.
Nested SmmPlatform module at 00263CB0 not patched: Patch pattern not found.
Phoenix nest module at 00312CC8 patched.
CpuPei modules not found.
Output file generated.

Do I need windows to flash it? 

Link to comment
Share on other sites
Gringo Vermelho
Gringo Vermelho
Posted
Posted

1. Please, you and everybody else, stop asking that question. Read the first post in this topic and then decide for yourself if it looks ok.

 

2. The answer to that is usually no. You need a way that allows you to flash a patched BIOS. To learn what your options are, read the BIOS section of your motherboard manual, go to the discussion forum of your motherboard on the manufacturer's website etc.

Link to comment
Share on other sites
Eruerable
Eruerable
Posted
Posted

I'm having a spot of bother and I was wondering if someone here might be able to shed some light. I am trying to update the BIOS on an ASUS Maximus Gene VI using a 16GB pen drive formatted to FAT32.

 

I can't get the BIOS Flashback to work, either with an unmodified or patched M6G.CAP file. I get approximately 20-30 seconds of activity from the USB drive and ROG button after holding it down, a video I watched took much longer than this so I'm guess it is aborting part way through.

 

I also tried a normal BIOS update using the unmodified BIOS in EZ Flash 2 Utility, it passes verification and says the system will reset, but on restart the BIOS is still the old one.

 

A couple of times that I tried it brought me back to a BIOS recovery screen that was displaying the updated BIOS version, but my only option is to initial BIOS setup which restores the old version.

 

Has anyone else encountered and overcome these problems? Are there any log files or something that I could access and post to assist diagnosing the problem?

 

Cheers!  :)

Link to comment
Share on other sites
Eruerable
Eruerable
Posted
Posted

Just had a go at the afudos /gan method and when running PMPatch on my bios backup it says to the effect of "not found" on every line. Does this suggest that one of my attempts at flashing the updated BIOS was successful?

 

I tried running PMPatch on a BIOS file I had previously patched and the output was identical.

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...