Forum RSS Feed Follow @ Twitter Follow On Facebook

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Latest Threads
[REQUEST] Lenovo Yoga 11E (N15ETxxW) Whi...
Last Post: Dudu2002
Today 08:15 AM
» Replies: 5
» Views: 2512
[REQUEST] Lenovo G50-70 (9ACNxxWW) BIOS ...
Last Post: Dudu2002
Today 07:23 AM
» Replies: 139
» Views: 40954
[REQUEST] CPU Support for Ryzen 5 3600 o...
Last Post: flexpavillion
Today 04:32 AM
» Replies: 1
» Views: 312
Clevo P775TM1-G BIOS
Last Post: ActivatedNut
Today 01:36 AM
» Replies: 145
» Views: 55299
ASUS P5G41T-M LX2/GB Unlocked Hidden Ove...
Last Post: GangsteR23
Yesterday 04:58 PM
» Replies: 25
» Views: 64125
lenovo z570 Advanced Menu Unlocked
Last Post: Kaluva12345
Yesterday 04:58 PM
» Replies: 7
» Views: 4095
[Request] HP Elitebook 6930P WLAN Whitel...
Last Post: Maxinator500
Yesterday 02:25 PM
» Replies: 15
» Views: 6564
Lenovo ThinkCentre M715q 2nd Gen & AMD R...
Last Post: RedfieldHUN1987
Yesterday 09:23 AM
» Replies: 2
» Views: 137
L14 Gen 3 AMD , Need UEFI unlock advance...
Last Post: frankeinstein2532555
Yesterday 04:08 AM
» Replies: 0
» Views: 86
[REQUEST] Lenovo Y400 & Y500 (6BCNxxWW) ...
Last Post: freedome
03-26-2024 11:00 PM
» Replies: 188
» Views: 52166
[REQUEST] Lenovo G510 (79CNxxWW) Whiteli...
Last Post: ghostinoss
03-26-2024 09:21 PM
» Replies: 655
» Views: 167094
[Request] CPU support for Lenovo IQ57I
Last Post: DeathBringer
03-26-2024 10:02 AM
» Replies: 5
» Views: 232
unlocked Bios for Machenike s16
Last Post: Dudu2002
03-26-2024 09:06 AM
» Replies: 5
» Views: 325
[REQUEST] Bios Unlock Whitelist HP DV6-6...
Last Post: DimanTLT63
03-26-2024 03:03 AM
» Replies: 0
» Views: 136
[REQUEST] HP Pavilion G6-1252ss Whitelis...
Last Post: joseefitness
03-26-2024 01:40 AM
» Replies: 0
» Views: 120
[REQUEST] Lenovo S310 & S410 (8BCNxxWW) ...
Last Post: morgley
03-25-2024 10:43 PM
» Replies: 14
» Views: 6330
Acer Nitro ANV15-51 Bios Bin File Reques...
Last Post: Papethzkie23
03-25-2024 06:04 PM
» Replies: 0
» Views: 136
[REQUEST] Lenovo G710 BIOS Whitelist Rem...
Last Post: si1975
03-25-2024 01:28 PM
» Replies: 468
» Views: 125403
[REQUEST] Lenovo Yoga 2 Pro (76CNxxWW) W...
Last Post: TalKaz
03-25-2024 11:10 AM
» Replies: 844
» Views: 317035
[REQUEST] Toshiba Satellite A300D PSAK0C...
Last Post: 1000palladium
03-25-2024 10:43 AM
» Replies: 4
» Views: 227

Unlocking BIOS on An Embeded Device
#1
Unlocking BIOS on An Embeded Device

# The device
Its BIOS reads:
- InsydeH20 Version: APL.1.0.15
- UEFI Version: 2.5

The BIOS has two main interfaces:
- `Front Page`
  The first interface after hitting `ESC` key repeatly right after pressed its power button.
  Please reference the attachment `The device - front page.png`
- `Setup Utility`
  Please refernce the attachment `The device - Setup Utility.png`

Main chips on its board:
- CPU: `Atom Processor E3930`
- BIOS Chip: `MXIC MX, 2SU6473F, M2I-10G, 8E544200, L18489S`
- TPM Chip: `Infineon, SLB 9670, VQ20 30, T6H1839`
- Network Chip: `Marvell, W8997-M1216`

# Whats wanted
There are two limitations on its bios:
  - The booting OS is EFI protected, i.e., only the customized Ubuntu 16.04 OS distributed by its manufactory can be booted.
    Trying to boot from a different OS installation (EFI, not legacy mode) USB stick will leads to `\EFI\BOOT\BOOTx64.EFI has been blocked by the current security policy.`

    So, to my understanding, one need to do sth. like `Clean TPM` to set the TPM status, or disable the protection, before install different OSs.
    However, There is no such option in its BIOS. It seems these options are hidden (ref `Whats tried`).

  - One of the USB 3.0 port is limited to be use as a network access point (like a router).
    Can't find related options in the BIOS neither.

So, wanted:
  - unlocking the options for TPM/Secure boot options
  - unlocking the options for USB Ports settings.

# Whats tried
## Extract the stock BIOS image
Extracted its original BIOS image from the MXIC chip using CH341A Programmer.
Please reference the attachment `Stock BIOS image.bin`.

## A small experiment
After some searching (I am new to BIOS modding), found a tool, `InsydeH2OEZE_x86_WIN_100.00.03.04`, can be used to read the image.
So I tried to make a small change of its `BIOS version` content from `APL.1.0.15` to `APL.1.0.15.toMod`.
Then reflashed the mod bios image back to the MXIC chip.
After that the device can boot to its BIOS and the `Version` reads `APL.1.0.15.toMod`.

## Lets GTD
So I tried to continue.

First, the export result from `H2OEZE`'s `Function`-`other`-`Setup menu`-`Export setup menu`,
  shows there are `TPM` related options exists. So they were just hidden somehow.
  (Please reference the attachment `Export setup menu.csv` for the result.)

Second, some online posts suggested the visibility of the options may controlled by `H2OFormBrowserDxe` module.
So, the module was exported via `H2OEZE`'s `Function`-`BIOS image`-`Components`-`Module`-`Export module`-`9E5DAEB4-.. (H2OFormBrowserDxe)`,
this result the attachment `9E5DAEB4-(H2OFormBrowserDxe).ffs`.
Then using `Universal IFR Extractor v0.5(2014 donovan6000)` to extract its info from it.
However, its extraction, `9E5DAEB4-(H2OFormBrowserDxe) IFR.txt`, provides no usable info -- its almost empty.

Third, as there is a `Setup Utility` interface, so the `SetupUtility` module was exported -`FE3542FE-C1D3.FV04.SetupUtility.ffs`.
Then using the `IFR extractor` to extract it, which results `FE3542FE-C1D3.FV04.SetupUtility IFR.txt`.
There are two things about it:
  - I failed to find 'TPM' or 'secure boot' related options in the result.
  - As an experiment, working on learning how to modify the `ffs` file with the help from the `IFR` txt to enable the options in the module, such as the `SystemConfig`.

Any advices?
Many thanks!


Attached Files
.zip   BIOS Chip-MX25U6435F.zip (Size: 5.28 MB / Downloads: 11)
find
quote


Forum Jump:


Users browsing this thread: 2 Guest(s)