me_cleaner and fwupd, or manipulating UEFI .cab files

Question

I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner. (The .cap file is a raw image compressed and wrapped with the flash tool as part of a capsule.) Then I suppose one has to reconstruct the capsule so it's valid, and it has a chance of passing signature check when updating firmware with fwupd.

My machine is a Thinkpad T460s, which is supported by fwupd/LVFS https://fwupd.org/lvfs/device/com.lenovo.ThinkPadN1CHT.firmware and the me_cleaner tool is described at https://github.com/corna/me_cleaner/wiki/Internal-flashing-with-OEM-firmware

In particular, I'd be happy with just me_cleaner.py -s <firmware image>, where -s is setting the HAP bit, and not modifying the actual image, so it may still pass signature check.

Any hint where to start?

Possibly related question: Reverse engineering UEFI CAP files

Answer 1

It's not exactly an RE question but I'll try to answer.

First of all, since the capsule is signed, it's very likely that any modification will invalidate the signature and the update process will refuse it.

In general, extracting a raw image from the capsule may range from trivial (e.g. for ASUS capsules it's usually enough to just cut off the header) to pretty hard (e.g. Intel capsules have multiply nested compressed firmware volumes for each part of the flash chip that can be updated independently, and it's quite difficult to reconstruct the full image from them), and making again a valid capsule is even harder without the vendor-specific tools (and signing keys, obviously).

While the general process of capsule update is described in the UEFI specification, the exact format and details are left to the vendor to implement. In general, there is usually a firmware module which is responsible for parsing & verifying the capsule and passing the data for flashing to the flashing component (usually an SMM module). You could try to find the code responsible for it and figure out how the capsule is laid out and try to restore the image but be prepared for a long road ahead.

I would suggest going with the external flashing workflow, it's more reliable and easier to recover from.