1

I am trying to remove the white listing for wireless cards from my Thinkpad L540 running Debian Buster. I did the following steps:

  1. booted with kernel parameter iomem=relaxed
  2. used pawn to dump BIOS
  3. made multiple dumps and compared the md5sum to be sure I have a valid dump
  4. I opened the BIOS dump with UEFITool
  5. searched for the string "Unauthorized network card...."
  6. I found the PE32 image section and extracted the body. It is an efi file
  7. opened the file with IDA free and searched for the hex to find the function.

This is the produced file from IDA:

I don't know how to get the graph view. I am not sure what to change exactly. But I think this is the relevant part:

sub_6FC proc near

var_148= qword ptr -148h
var_140= qword ptr -140h
var_138= qword ptr -138h
var_130= qword ptr -130h
var_128= byte ptr -128h
var_F8= byte ptr -0F8h
arg_0= qword ptr  8
arg_8= qword ptr  10h

mov     rax, rsp
mov     [rax+8], rbx
push    rdi
sub     rsp, 160h
lea     r8, [rax+10h]
mov     rax, cs:qword_1040
mov     rbx, rcx
lea     rcx, qword_458+8
xor     edx, edx
call    qword ptr [rax+140h]
xor     edi, edi
cmp     rax, rdi
jl      loc_7FF
mov     edx, [rbx+4]
movzx   r9d, word ptr [rbx]
cmp     edx, 0FFFFFFFFh
jnz     short loc_75D
movzx   eax, word ptr [rbx+2]
lea     r8, a04x04x     ; "%04x/%04x"
lea     edx, [rdi+28h]
lea     rcx, [rsp+168h+var_128]
mov     dword ptr [rsp+168h+var_148], eax
call    sub_F9C
jmp     short loc_78E

loc_75D:
movzx   ecx, word ptr [rbx+2]
movzx   eax, word ptr [rbx+4]
shr     edx, 10h
mov     dword ptr [rsp+168h+var_138], edx
mov     dword ptr [rsp+168h+var_140], eax
mov     dword ptr [rsp+168h+var_148], ecx
lea     rcx, [rsp+168h+var_128]
lea     r8, a04x04x04x04x ; "%04x/%04x/%04x/%04x"
mov     edx, 28h ; '('
mov     di, 1
call    sub_F9C

loc_78E:
mov     r8, cs:off_298
lea     r9, [rsp+168h+var_128]
lea     rcx, [rsp+168h+var_F8]
mov     edx, 0F0h ; 'ð'
call    sub_F9C
mov     rax, cs:qword_2A0
mov     r9d, dword ptr cs:qword_280+0Ch
mov     r8d, dword ptr cs:qword_280+8
mov     ecx, dword ptr cs:qword_280
mov     [rsp+168h+var_130], rax
lea     rax, [rsp+168h+var_F8]
movzx   edx, di
add     edx, dword ptr cs:qword_280+4
mov     [rsp+168h+var_138], rax
mov     rax, cs:off_290
mov     [rsp+168h+var_140], rax
mov     rax, cs:qword_1028
mov     [rsp+168h+var_148], rax
mov     rax, [rsp+168h+arg_8]
call    qword ptr [rax+8]

loc_7FF:
mov     rbx, [rsp+168h+arg_0]
add     rsp, 160h
pop     rdi
retn
sub_6FC endp

And I thought of replacing the jl loc_7FF to jmp loc_7FF. But I am not sure if this is correct.

I don't know how to provide the graph view.

Thanks for the help

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.