On Wednesday, 18 January 2017 18:12:31 UTC+4, [email protected] wrote: > среда, 18 января 2017 г., 14:34:29 UTC+3 пользователь Asterysk написал: > > >First of all we need to make sure that you are prepared for flashing. > > >coreboot image cannot be >flashed internally on Lenovo G505S through a > > >purely software way (I tried with >internal:laptop=force_I_want_a_brick > > >flashrom option, it always fails, cant do that!) . > > > > >To install a coreboot, you will have to: > > >1) get some hardware tools like screwdrivers, CH341A USB flasher and > > >SOIC-8 test clip > > >2) tear down your laptop to access the motherboard > > >3) take SOIC-8 test clip and attach its wires to USB flasher that is > > >supported by flashrom (such as CH341A), then attach SOIC-8 test clip to > > >BIOS chip with 8 legs, then plug USB flasher device to another computer > > >with Linux (while it is still connected to G505S motherboard through wires > > >and SOIC-8 test clip) > > >4) using flashrom, make a dump of your existing BIOS just in case, then > > >flash a new coreboot image with verification 5) assemble your laptop in > > >reverse order . That is exactly how computer repair shops are repairing > > >laptops with failed BIOS updates, and are earning pretty good money on it > > > > >Here is a hardware flashing manual - > > >http://dangerousprototypes.com/docs/Flashing_a_BIOS_chip_with_Bus_Pirate . > > > > Everything is described in a great detail here: complete list of tools and > > where you could buy them (need to spend from $0 to $30, depends on what > > tools you already have), how to connect these tools properly, a lot of > > helpful photos - for example, photo of G505S motherboard, so you could > > easily see where is that BIOS chip with 8 legs is located, dont need to > > spend time reading the motherboard chip labels. While this instruction > > mentions Bus Pirate USB flasher, the instructions for CH341A USB flasher > > are exactly the same - only a flashrom command is different (could see this > > command at the end of page) > > > > My current coreboot build is from December 2016 - it is not the latest, but > > still pretty recent, so I am not going to rebuild it from scratch yet. > > Still, there is one component inside BIOS image that could be easily > > updated: KolibriOS, tiny wonderful open source operating system that fits > > on a floppy. It could be launched from SeaBIOS Boot Menu, and works as a > > RamDisk (no changes to your computer saved). After you tell that you are > > prepared for hardware BIOS flashing, I will take KolibriOS latest daily > > build, add it to ROM and send a complete coreboot BIOS ROM to you > > > > Please reply if you have any questions > > > > Best regards, > > qmastery > > ----------------------------------------------- > > > > Is it possible to also reflash the USB firmware at the same time in case it > > has been tampered by Bad USB ? > > Asterysk, what do you mean by "reflash the USB firmware" ? USB firmware of > G505S laptop? on Lenovo G505S platform, USB ports seem to be directly > connected to Bolton-M3 Fusion Controller Hub FCH ("southbridge"), according > to LA-A091P datasheet - > https://justnote.by/assets/files/sch/Compal%20LA-A091P%20r1.0.pdf . There is > a Bolton-M3 AMD datasheet for BIOS developers - > http://support.amd.com/TechDocs/51205_Bolton_FCH_BIOS_Dev_Guide.pdf , but I > cant understand if Bolton-M3 has any personal built-in memory which is > possible to rewrite (and infect!), or it only maps the attached stuff to its > memory map like LPC and PCI roms... Please help me to clarify! > > If we talk about the RAM of Bolton-M3 : computer's BIOS, while booting, could > install XHCI blob to this RAM to enable USB 3.0. I hate closed source blobs > with a passion, so - while building a coreboot - I chose not to include USB > 3.0 XHCI blob ; so it is most likely that my laptop's "USB 3.0" blue ports > are working only on USB 2.0 speed. That USB speed downgrade is the only > downside of my open source build vs the official BIOS > > If we will look from a side of BadUSB flash drive, behind Bolton-M3 there are > some USB devices like Card Reader and Web Camera. They have their personal > USB controllers. So, even if Bolton-M3 does not have a personal > possible-to-write memory, maybe a BadUSB device with super sophisticated > firmware targeting this FCH could somehow hack Bolton-M3 FCH and force it to > send the commands to reprogram the USB controllers of connected internal USB > devices. To successfully perform this attack the attacker will need to learn > a lot of HUGE datasheets! For example, here are two datasheets about > Bolton-M3 registers - > http://support.amd.com/TechDocs/51191_Bolton_FCH_RPR.pdf , > http://support.amd.com/TechDocs/51192_Bolton_FCH_RRG.pdf , 750 pages in > total! And that is not talking about other Bolton-M3 datasheets, the > datasheets of USB controllers which need to be hacked, and lots of other > stuff too... Perhaps only N$A can do that - if they care enough, they are > welcome to waste a few million $$$ to develop this hack XD That is, if they > can't find a more simple to exploit vulnerability like a vulnerability of > your software (such as web browser) or a network controller to infect its' > ROM directly > > At the moment, I know about and could read/write two firmwares on this laptop: > 1) BIOS firmware of 4MB size - > http://dangerousprototypes.com/docs/Flashing_a_BIOS_chip_with_Bus_Pirate > closed source BIOS could be replaced by (almost) open source coreboot > ("almost" - because e.g. there is a vga blob of 61952 bytes size with closed > source code, but coreboot's YABEL feature blocks this blob from a possible > undocumented access to other PCI devices, making it harmless) > 2) EC firmware of 128KB size - > http://dangerousprototypes.com/docs/Flashing_KB9012_with_Bus_Pirate - sadly > this closed source firmware doesn't have an open source alternative for > replacement, but at least you could read/write it, which is useful! For > example: there are a lot of free space at KB9012 128KB memory and, by > default, KB9012 stores various personal identifying information like serial > numbers near the end of unoccupied memory ; so, I extracted a clean KB9012 > firmware from Lenovo's BIOS update and flashed it to my KB9012, so now its > completely clean... By the way, there is a project to create open source > replacement firmware for KB9012 , called Origami EC ( > http://git.code.paulk.fr/gitweb/?p=origami-ec.git;a=summary ) already some > small demonstrating code is there, but it seems there are not enough common > interest in this project... > > Please write if you have more questions to discuss With regard to the Bolton-M3 Fusion Controller Hub FCH ("southbridge"), I think the attack would be to the SPI ROM. There is also the SMM and of course SSD/HDD firmware plus Webcam plus Audio Controller (reprogramming to make output an input and turn speaker into microphone).
I'm not sure if Coreboot over writes the UEFI as well as legacy BIOS. I've only recently started researching this so a long way to go -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/e4b57478-d99e-47e2-83c5-5b7cf9c273f1%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
