Forum RSS Feed Follow @ Twitter Follow On Facebook

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Latest Threads
sgx enabling bios help
Last Post: wafa
Today 08:08 AM
» Replies: 0
» Views: 23
[REQUEST] Lenovo G510 (79CNxxWW) Whiteli...
Last Post: Sergio717
Today 05:17 AM
» Replies: 656
» Views: 167537
M2N32-SLI Deluxe AM3 Support Request
Last Post: Alxstroi
Yesterday 11:08 PM
» Replies: 105
» Views: 71446
[Request] HP Elitebook 6930P WLAN Whitel...
Last Post: Maxinator500
Yesterday 10:51 PM
» Replies: 17
» Views: 6609
[REQUEST] Lenovo G50-30 (A7CNxxWW) BIOS ...
Last Post: carmelletomato
Yesterday 07:29 PM
» Replies: 46
» Views: 22109
[REQUEST] Lenovo G50-70 (9ACNxxWW) BIOS ...
Last Post: colin89
Yesterday 06:04 PM
» Replies: 140
» Views: 41060
[REQUEST + BOUNTY] Lenovo Thinkpad P14s ...
Last Post: loadit
Yesterday 02:23 PM
» Replies: 3
» Views: 117
[REQUEST] Lenovo Yoga 2 Pro (76CNxxWW) W...
Last Post: Dudu2002
Yesterday 10:53 AM
» Replies: 845
» Views: 317377
[REQUEST] Lenovo Thinkpad E130 (H4ETxxWW...
Last Post: Dudu2002
Yesterday 10:51 AM
» Replies: 487
» Views: 101149
[REQUEST] Lenovo Yoga 11E (N15ETxxW) Whi...
Last Post: Dudu2002
Yesterday 08:15 AM
» Replies: 5
» Views: 2530
[REQUEST] CPU Support for Ryzen 5 3600 o...
Last Post: flexpavillion
Yesterday 04:32 AM
» Replies: 1
» Views: 353
Clevo P775TM1-G BIOS
Last Post: ActivatedNut
Yesterday 01:36 AM
» Replies: 145
» Views: 55371
ASUS P5G41T-M LX2/GB Unlocked Hidden Ove...
Last Post: GangsteR23
03-27-2024 04:58 PM
» Replies: 25
» Views: 64158
lenovo z570 Advanced Menu Unlocked
Last Post: Kaluva12345
03-27-2024 04:58 PM
» Replies: 7
» Views: 4110
L14 Gen 3 AMD , Need UEFI unlock advance...
Last Post: frankeinstein2532555
03-27-2024 04:08 AM
» Replies: 0
» Views: 109
[REQUEST] Lenovo Y400 & Y500 (6BCNxxWW) ...
Last Post: freedome
03-26-2024 11:00 PM
» Replies: 188
» Views: 52247
[Request] CPU support for Lenovo IQ57I
Last Post: DeathBringer
03-26-2024 10:02 AM
» Replies: 5
» Views: 251
unlocked Bios for Machenike s16
Last Post: Dudu2002
03-26-2024 09:06 AM
» Replies: 5
» Views: 340
[REQUEST] Bios Unlock Whitelist HP DV6-6...
Last Post: DimanTLT63
03-26-2024 03:03 AM
» Replies: 0
» Views: 158
[REQUEST] HP Pavilion G6-1252ss Whitelis...
Last Post: joseefitness
03-26-2024 01:40 AM
» Replies: 0
» Views: 142

Extracting boot logo & other stuff from a UEFI Tiano/Insyde .FD image
#1
Lightbulb 
There are essentially two ways to extract graphics from an .FD UEFI BIOS image:

(1) Look for capsules with specific GUIDs known to contain it, such as:

Code:
E5BBF7BE-2417-499B-97DB-39F4896391BC,SplashLogoPackage
1FFF93C2-8C76-49E4-8AB3-43D92F5445EF,LogoJpg
6F0CF054-AE6A-418C-A7CE-3C7A7CD74EC0,LogoPcx

(2) Search for magic strings associated with particular image formats, for example:
  • BMP: "BM" string
  • GIF: "GIF89a" string
  • JPEG: "JFIF" string
  • PCX: hexadecimal 0A 05 01 08
The .FD image can be decompressed with a number of tools, in particular: Phoenix Tool, UEFI Tool, or simply binwalk. The last two also include search capabilities. Otherwise, files can be searched with grepWin once decompressed.

I've succesfully extracted boot logos and other graphics from a number of Lenovo laptop BIOSes using the above methods, all of which yield the same results. Here's an example of what can be found once decompressed:

Code:
# <GUID>
[<LaptopModel>_<BiosVersion>] <File>

# 1FFF93C2-8C76-49E4-8AB3-43D92F5445EF,LogoJpg
[B460_1DCN26WW_4FCNAWW] 1024x768 JPEG: Boot logo (40,693 bytes; inside CRC32 GUID: FC1BCDB0-7D31-49AA-936A-A4600D9DD083)

# 6F0CF054-AE6A-418C-A7CE-3C7A7CD74EC0,LogoPcx
[Y700_CDCN53WW] 1024x768 PCX, 8-bit: All black (27,068 bytes)

# 771F77D1-13AF-48BF-2584-773D389E33CA
[Y700_CDCN53WW] 360x360 JPEG: "Invalid Public Key for Secure Flash" (17,656 bytes)

# 931F00D1-10FE-48BF-AB72-773D389E3FDA
[Y700_CDCN53WW] 208x157 BMP, 8-bit: Intel logo (33,236 bytes)

# 931F77D1-10FE-48BF-AB72-773D389E3FAA
[Y700_CDCN53WW] 300x300 BMP, 24-bit: Insyde logo (270,056 bytes)

# 156A8FFE-62DB-4FF3-82AD-2EBD8A3E3DF7
[Y520_4KCN24WW] [Y900_D0CN34WW] 768x432 GIF89a: Boot logo, animated (128,090 bytes)

# 1F56B2F9-6E6D-4014-BFD4-37C9E5D398F1
[Y520_4KCN24WW] 1536x864 GIF89a: Boot logo, animated (406,313 bytes)

# E5BBF7BE-2417-499B-97DB-39F4896391BC,SplashLogoPackage
[110_1QCN20WW] 548x308 JPEG: Boot logo (17,169 bytes; followed by a GIF w/icons)
[110_1QCN31WW] 548x308 JPEG: Boot logo (53,046 bytes; followed by a GIF w/icons)
[700_E5CN58WW] 548x308 JPEG: Boot logo (49,368 bytes; followed by several GIFs w/icons)

However, none of the above methods manage to locate the boot logo in Lenovo Y700 images such as CDCN37WW.fd and CDCN53WW.fd (attached), although it is clearly somewhere there. Can anyone tell me what I am missing?

Possibly the logo is in a format other than BMP/GIF/JPG/PCX. The BIOS images have a "TgaDecoderDxe" module inside. Could there be any TGA (Targa) images there? If so, how to find them? Or is it something else altogether? Like obfuscation with XOR or something more sophisticated? Suggestions appreciated.


Attached Files
.zip   CDCN53WW.fd.zip (Size: 4.02 MB / Downloads: 29)
find
quote


Forum Jump:


Users browsing this thread: 1 Guest(s)