среда, 18 января 2017 г., 14:34:29 UTC+3 пользователь Asterysk написал:
> >First of all we need to make sure that you are prepared for flashing.
> >coreboot image cannot be >flashed internally on Lenovo G505S through a
> >purely software way (I tried with >internal:laptop=force_I_want_a_brick
> >flashrom option, it always fails, cant do that!) .
>
> >To install a coreboot, you will have to:
> >1) get some hardware tools like screwdrivers, CH341A USB flasher and SOIC-8
> >test clip
> >2) tear down your laptop to access the motherboard
> >3) take SOIC-8 test clip and attach its wires to USB flasher that is
> >supported by flashrom (such as CH341A), then attach SOIC-8 test clip to BIOS
> >chip with 8 legs, then plug USB flasher device to another computer with
> >Linux (while it is still connected to G505S motherboard through wires and
> >SOIC-8 test clip)
> >4) using flashrom, make a dump of your existing BIOS just in case, then
> >flash a new coreboot image with verification 5) assemble your laptop in
> >reverse order . That is exactly how computer repair shops are repairing
> >laptops with failed BIOS updates, and are earning pretty good money on it
>
> >Here is a hardware flashing manual -
> >http://dangerousprototypes.com/docs/Flashing_a_BIOS_chip_with_Bus_Pirate .
>
> Everything is described in a great detail here: complete list of tools and
> where you could buy them (need to spend from $0 to $30, depends on what tools
> you already have), how to connect these tools properly, a lot of helpful
> photos - for example, photo of G505S motherboard, so you could easily see
> where is that BIOS chip with 8 legs is located, dont need to spend time
> reading the motherboard chip labels. While this instruction mentions Bus
> Pirate USB flasher, the instructions for CH341A USB flasher are exactly the
> same - only a flashrom command is different (could see this command at the
> end of page)
>
> My current coreboot build is from December 2016 - it is not the latest, but
> still pretty recent, so I am not going to rebuild it from scratch yet. Still,
> there is one component inside BIOS image that could be easily updated:
> KolibriOS, tiny wonderful open source operating system that fits on a floppy.
> It could be launched from SeaBIOS Boot Menu, and works as a RamDisk (no
> changes to your computer saved). After you tell that you are prepared for
> hardware BIOS flashing, I will take KolibriOS latest daily build, add it to
> ROM and send a complete coreboot BIOS ROM to you
>
> Please reply if you have any questions
>
> Best regards,
> qmastery
> -----------------------------------------------
>
> Is it possible to also reflash the USB firmware at the same time in case it
> has been tampered by Bad USB ?
Asterysk, what do you mean by "reflash the USB firmware" ? USB firmware of
G505S laptop? on Lenovo G505S platform, USB ports seem to be directly connected
to Bolton-M3 Fusion Controller Hub FCH ("southbridge"), according to LA-A091P
datasheet - https://justnote.by/assets/files/sch/Compal%20LA-A091P%20r1.0.pdf .
There is a Bolton-M3 AMD datasheet for BIOS developers -
http://support.amd.com/TechDocs/51205_Bolton_FCH_BIOS_Dev_Guide.pdf , but I
cant understand if Bolton-M3 has any personal built-in memory which is possible
to rewrite (and infect!), or it only maps the attached stuff to its memory map
like LPC and PCI roms... Please help me to clarify!
If we talk about the RAM of Bolton-M3 : computer's BIOS, while booting, could
install XHCI blob to this RAM to enable USB 3.0. I hate closed source blobs
with a passion, so - while building a coreboot - I chose not to include USB 3.0
XHCI blob ; so it is most likely that my laptop's "USB 3.0" blue ports are
working only on USB 2.0 speed. That USB speed downgrade is the only downside of
my open source build vs the official BIOS
If we will look from a side of BadUSB flash drive, behind Bolton-M3 there are
some USB devices like Card Reader and Web Camera. They have their personal USB
controllers. So, even if Bolton-M3 does not have a personal possible-to-write
memory, maybe a BadUSB device with super sophisticated firmware targeting this
FCH could somehow hack Bolton-M3 FCH and force it to send the commands to
reprogram the USB controllers of connected internal USB devices. To
successfully perform this attack the attacker will need to learn a lot of HUGE
datasheets! For example, here are two datasheets about Bolton-M3 registers -
http://support.amd.com/TechDocs/51191_Bolton_FCH_RPR.pdf ,
http://support.amd.com/TechDocs/51192_Bolton_FCH_RRG.pdf , 750 pages in total!
And that is not talking about other Bolton-M3 datasheets, the datasheets of USB
controllers which need to be hacked, and lots of other stuff too... Perhaps
only N$A can do that - if they care enough, they are welcome to waste a few
million $$$ to develop this hack XD That is, if they can't find a more simple
to exploit vulnerability like a vulnerability of your software (such as web
browser) or a network controller to infect its' ROM directly
At the moment, I know about and could read/write two firmwares on this laptop:
1) BIOS firmware of 4MB size -
http://dangerousprototypes.com/docs/Flashing_a_BIOS_chip_with_Bus_Pirate
closed source BIOS could be replaced by (almost) open source coreboot ("almost"
- because e.g. there is a vga blob of 61952 bytes size with closed source code,
but coreboot's YABEL feature blocks this blob from a possible undocumented
access to other PCI devices, making it harmless)
2) EC firmware of 128KB size -
http://dangerousprototypes.com/docs/Flashing_KB9012_with_Bus_Pirate - sadly
this closed source firmware doesn't have an open source alternative for
replacement, but at least you could read/write it, which is useful! For
example: there are a lot of free space at KB9012 128KB memory and, by default,
KB9012 stores various personal identifying information like serial numbers near
the end of unoccupied memory ; so, I extracted a clean KB9012 firmware from
Lenovo's BIOS update and flashed it to my KB9012, so now its completely
clean... By the way, there is a project to create open source replacement
firmware for KB9012 , called Origami EC (
http://git.code.paulk.fr/gitweb/?p=origami-ec.git;a=summary ) already some
small demonstrating code is there, but it seems there are not enough common
interest in this project...
Please write if you have more questions to discuss
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/43f1f643-607b-4c47-92c6-65702b814790%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
