[REQUEST] HP Folio 13-1000 Series Whitelist Removal

[fc7]

Did another test to try to understand what's going on:

1- Hashed the BIOS dump I took in my previous post (step 3).
2- Erased the BIOS.
3- Flashed the BIOS dump I took in my previous post (step 3).
4- Took another dump from the BIOS and save it to a different file.
5- Hashed the dump from step 4 and compared to the hash of step 1. They match so I know that the content of the BIOS is exactly the same.
6- Booted the laptop. Screen is on, but I only see a blinking cursor on the top left corner of the screen. Waited for a while but nothing happened seems stuck.
7- Powered off the laptop and took another dump of the BIOS and saved yet to a different file.
8- Hashed this new dump and compared it to the hashes from the dumps of step 1 and 5. To my surprise this new hash doesn't match with the other two.

Do you know why is it possible that on the first boot after flashing with the programmer the BIOS content change?
I didn't expect that to be honest.

[Maxinator500]

Do you know why is it possible that on the first boot after flashing with the programmer the BIOS content change?

This is a common thing that does not cause the cursor to appear in the corner of the screen. The content of the dump changes in variable areas and is subject to many factors, for example, after switching on, the timer starts counting. This is also saved in the dump, but the BIOS area remains unchanged.

[fc7]

Do you know why is it possible that on the first boot after flashing with the programmer the BIOS content change?

This is a common thing that does not cause the cursor to appear in the corner of the screen. The content of the dump changes in variable areas and is subject to many factors, for example, after switching on, the timer starts counting. This is also saved in the dump, but the BIOS area remains unchanged.

Thanks for the clarification.
Then I'm totally clueless on why taking a dump from a working stock BIOS, and flashing it again later on is not working and it's showing this behavior.
On the other hand flashing the BIOS update file always work.....

[fc7]

I just posted on another forum (https://www.win-raid.com/t8887f16-Can-t-...#msg144145) the problem I found when restoring a BIOS dump using the programmer (blinking cursor on the top left corner of the screen) and see if anyone can explain it.

On the other hand I wanted to ask you, which tool are you using to modify this BIOS, UEFITool, H2OEZE, Andy's Phoenix Tool something else?

In my case, for example when extracting module 91472655-50E0-4D81-9AF6-239E6F431B8C with UEFITool or H2OEZE I get a 1 byte difference in the extracted file, while I was expecting them to be exactly the same.

Sorry for asking too many questions I'm just trying to learn.

Thanks.

[Maxinator500]

On the other hand I wanted to ask you, which tool are you using to modify this BIOS, UEFITool, H2OEZE, Andy's Phoenix Tool something else?

To modify this bios, I used PhoenixTool because the replacement of modules can be done in bulk. UEFITool is also suitable, because you need the checksumm of each changed module to be recalculated and this tool does this automatically, but it does not know how to decrypt bios. H20EZE is not very convenient as it does not provide access to all modules.

[fc7]

Finally I found why the first backup (the one I took while flashing the first modded BIOS using InsydeFlash) wasn't working and after restoring it with the programmer all I got was a blinking cursor in the top left corner of the screen.

The problem was that the BIOS backup ME region was completely empty.
What I did to fix it was to use UEFITool 0.28 to extract the ME region from the BIOS file that was working (the one extracted from HP BIOS update package) and use it to replace the empty BIOS ME region in the backup.
Saved the new BIOS file and flashed it to the chip with the programmer and now everything seems to be back as it was before starting to play with it.

Maxinator500 thanks a lot for all your help and patience, I've learning a lot.

[Maxinator500]

The problem was that the BIOS backup ME region was completely empty.

Yes.

I can only confirm that creating a backup using InsydeFlash makes the ME region clean in the output file of the BIOS image.

But did you find the reason for what happening after you flashing backup made with the CH314A?

[fc7]

No, I didn't investigated that one but I checked and it has the ME information so no idea.
I'm also wondering if InsydeFlash is missing anything else from the backup besides the ME region, but so far it seems not.

Anyway, my next goal is to try to remove the whitelist without breaking USB boot (or anything else).

As an alternative I found a module that seems to contain the list of all allowed wifi cards: CD28DACA-BDBE-481A-90AC-625C79CF234C "H19BIOSLock"
So if I don't succeed removing the whitelist completely what I would try to do is to replace the IDs of a whitelisted card, with the IDs of my replacement card. In the end I didn't want to mess to much with the BIOS of this laptop, all I want is to be able to install the replacement wifi/bt card.

[fc7]

I finally solved it!

The reason why with the modded BIOS the laptop was not able to boot the OS if any USB drive was connected was this module: CD28DACA-BDBE-481A-90AC-625C79CF234C "H19BIOSLock"
It seems that this module was also patched and for some reason that patch was causing the problem. Moreover patching this module is not needed to bypass the whitelist.

Summary:

These are the only two modules that needs patching in order to bypass the whitelist and don't end up with a corrupted BIOS:

- 91472655-50E0-4D81-9AF6-239E6F431B8C "StartUpMenu": to bypass the whitelist
- 86D70125-BAA3-4296-A62F-602BEBBB9081: to be able to boot the modded BIOS

Also VERY IMPORTANT:
- To be able to flash the modded BIOS in my case at least, a programmer is needed.
- My advice is to dump the BIOS with the programmer first to have a backup and also to use that as a base image to patch the modules above and keep ME region + DMI data intact.

I hope this helps someone else in the future.
Thanks a lot Maxinator for all your help and patience!

EDIT: fixed typos