среда, 18 января 2017 г., 19:44:03 UTC+3 пользователь Asterysk написал: > On Wednesday, 18 January 2017 18:12:31 UTC+4, [email protected] wrote: > > среда, 18 января 2017 г., 14:34:29 UTC+3 пользователь Asterysk написал: > > > >First of all we need to make sure that you are prepared for flashing. > > > >coreboot image cannot be >flashed internally on Lenovo G505S through a > > > >purely software way (I tried with >internal:laptop=force_I_want_a_brick > > > >flashrom option, it always fails, cant do that!) . > > > > > > >To install a coreboot, you will have to: > > > >1) get some hardware tools like screwdrivers, CH341A USB flasher and > > > >SOIC-8 test clip > > > >2) tear down your laptop to access the motherboard > > > >3) take SOIC-8 test clip and attach its wires to USB flasher that is > > > >supported by flashrom (such as CH341A), then attach SOIC-8 test clip to > > > >BIOS chip with 8 legs, then plug USB flasher device to another computer > > > >with Linux (while it is still connected to G505S motherboard through > > > >wires and SOIC-8 test clip) > > > >4) using flashrom, make a dump of your existing BIOS just in case, then > > > >flash a new coreboot image with verification 5) assemble your laptop in > > > >reverse order . That is exactly how computer repair shops are repairing > > > >laptops with failed BIOS updates, and are earning pretty good money on > > > >it > > > > > > >Here is a hardware flashing manual - > > > >http://dangerousprototypes.com/docs/Flashing_a_BIOS_chip_with_Bus_Pirate > > > >. > > > > > > Everything is described in a great detail here: complete list of tools > > > and where you could buy them (need to spend from $0 to $30, depends on > > > what tools you already have), how to connect these tools properly, a lot > > > of helpful photos - for example, photo of G505S motherboard, so you could > > > easily see where is that BIOS chip with 8 legs is located, dont need to > > > spend time reading the motherboard chip labels. While this instruction > > > mentions Bus Pirate USB flasher, the instructions for CH341A USB flasher > > > are exactly the same - only a flashrom command is different (could see > > > this command at the end of page) > > > > > > My current coreboot build is from December 2016 - it is not the latest, > > > but still pretty recent, so I am not going to rebuild it from scratch > > > yet. Still, there is one component inside BIOS image that could be easily > > > updated: KolibriOS, tiny wonderful open source operating system that fits > > > on a floppy. It could be launched from SeaBIOS Boot Menu, and works as a > > > RamDisk (no changes to your computer saved). After you tell that you are > > > prepared for hardware BIOS flashing, I will take KolibriOS latest daily > > > build, add it to ROM and send a complete coreboot BIOS ROM to you > > > > > > Please reply if you have any questions > > > > > > Best regards, > > > qmastery > > > ----------------------------------------------- > > > > > > Is it possible to also reflash the USB firmware at the same time in case > > > it has been tampered by Bad USB ? > > > > Asterysk, what do you mean by "reflash the USB firmware" ? USB firmware of > > G505S laptop? on Lenovo G505S platform, USB ports seem to be directly > > connected to Bolton-M3 Fusion Controller Hub FCH ("southbridge"), according > > to LA-A091P datasheet - > > https://justnote.by/assets/files/sch/Compal%20LA-A091P%20r1.0.pdf . There > > is a Bolton-M3 AMD datasheet for BIOS developers - > > http://support.amd.com/TechDocs/51205_Bolton_FCH_BIOS_Dev_Guide.pdf , but I > > cant understand if Bolton-M3 has any personal built-in memory which is > > possible to rewrite (and infect!), or it only maps the attached stuff to > > its memory map like LPC and PCI roms... Please help me to clarify! > > > > If we talk about the RAM of Bolton-M3 : computer's BIOS, while booting, > > could install XHCI blob to this RAM to enable USB 3.0. I hate closed source > > blobs with a passion, so - while building a coreboot - I chose not to > > include USB 3.0 XHCI blob ; so it is most likely that my laptop's "USB 3.0" > > blue ports are working only on USB 2.0 speed. That USB speed downgrade is > > the only downside of my open source build vs the official BIOS > > > > If we will look from a side of BadUSB flash drive, behind Bolton-M3 there > > are some USB devices like Card Reader and Web Camera. They have their > > personal USB controllers. So, even if Bolton-M3 does not have a personal > > possible-to-write memory, maybe a BadUSB device with super sophisticated > > firmware targeting this FCH could somehow hack Bolton-M3 FCH and force it > > to send the commands to reprogram the USB controllers of connected internal > > USB devices. To successfully perform this attack the attacker will need to > > learn a lot of HUGE datasheets! For example, here are two datasheets about > > Bolton-M3 registers - > > http://support.amd.com/TechDocs/51191_Bolton_FCH_RPR.pdf , > > http://support.amd.com/TechDocs/51192_Bolton_FCH_RRG.pdf , 750 pages in > > total! And that is not talking about other Bolton-M3 datasheets, the > > datasheets of USB controllers which need to be hacked, and lots of other > > stuff too... Perhaps only N$A can do that - if they care enough, they are > > welcome to waste a few million $$$ to develop this hack XD That is, if they > > can't find a more simple to exploit vulnerability like a vulnerability of > > your software (such as web browser) or a network controller to infect its' > > ROM directly > > > > At the moment, I know about and could read/write two firmwares on this > > laptop: > > 1) BIOS firmware of 4MB size - > > http://dangerousprototypes.com/docs/Flashing_a_BIOS_chip_with_Bus_Pirate > > closed source BIOS could be replaced by (almost) open source coreboot > > ("almost" - because e.g. there is a vga blob of 61952 bytes size with > > closed source code, but coreboot's YABEL feature blocks this blob from a > > possible undocumented access to other PCI devices, making it harmless) > > 2) EC firmware of 128KB size - > > http://dangerousprototypes.com/docs/Flashing_KB9012_with_Bus_Pirate - sadly > > this closed source firmware doesn't have an open source alternative for > > replacement, but at least you could read/write it, which is useful! For > > example: there are a lot of free space at KB9012 128KB memory and, by > > default, KB9012 stores various personal identifying information like serial > > numbers near the end of unoccupied memory ; so, I extracted a clean KB9012 > > firmware from Lenovo's BIOS update and flashed it to my KB9012, so now its > > completely clean... By the way, there is a project to create open source > > replacement firmware for KB9012 , called Origami EC ( > > http://git.code.paulk.fr/gitweb/?p=origami-ec.git;a=summary ) already some > > small demonstrating code is there, but it seems there are not enough common > > interest in this project... > > > > Please write if you have more questions to discuss > With regard to the Bolton-M3 Fusion Controller Hub FCH ("southbridge"), I > think the attack would be to the SPI ROM. > There is also the SMM and of course SSD/HDD firmware plus Webcam plus Audio > Controller (reprogramming to make output an input and turn speaker into > microphone). > > I'm not sure if Coreboot over writes the UEFI as well as legacy BIOS. > > I've only recently started researching this so a long way to go
SPI ROM - is it SPI flash chip of 4MB size which contains BIOS, or something else? What do you think? Interesting idea about turning speaker into microphone, did not know these devices have a similar structure... but from the online tutorials - looks like it requires a hardware modification. BTW on this laptop both microphone and speaker are controlled by the same Conexant chip (according to the datasheet), so there are no reasons to try using the (removable) speaker when you could use internal microphone (which is soldered to motherboard, but could be desoldered or damaged intentionally by you). Also this Conexant is attached through PCI, not through USB, if that matters I don't think that Evil Maid attacker will bother developing a custom BadUSB for this laptop, when he could just clone a coreboot project, add malware code to it, build a malicious BIOS image and flash it to your laptop when you aren't at home. It takes about 1 hour to tear down a laptop, attach a hardware flasher to its' BIOS chip, read a BIOS image, calculate its' checksum to make sure that it has not been altered by any malware since the last time of your flashing, and then assemble a laptop back in reverse order. Or maybe faster than 1 hour after you have done it many times. Some coreboot people remove a piece of plastic from laptop's bottom (either by drilling it, or using a gas lighter to heat a knife to slice through plastic) - to make it possible to access BIOS chip in a matter of seconds... but of course this increases "Evil Maid" security risk, would be much faster for attacker to quickly come, infect your BIOS and go away unnoticed coreboot is a complete replacement of original closed source InsydeH2O UEFI/BIOS. When I install coreboot using a hardware flasher, I erase the whole BIOS chip with 0xFFFFFFFF, then overwrite it completely with my own (almost) open source BIOS image - which contains coreboot, (small vga blob) and coreboot's payloads. No traces of original BIOS image, it is 100% replaced ;) -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/f1638031-879f-4670-8356-1efc603fe996%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
