1

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've

  • used flashrom and a soic8 clip to dump the bios to a bios.img file
  • made another dump and compared with diff bios.img bios2.img to verify the file
  • used the UEFITool to find and extract the relevant section containing the string "Unauthorized network card ..." as an .efi file
  • Analyzed that section using Ghidra
  • Found a function in Ghidra (FUN_00010ec4) that contains said string (DAT_000104d0), and an entry function that calls this function.

Below, I'll post the function containing the string first, and then the entry function. Also, I'll put a link there to the extracted body.

void FUN_00010ec4(undefined8 param_1,undefined *param_2,undefined8 param_3,undefined8 param_4)

{
   if (param_2 == (undefined *)0x0) {
     param_2 = &DAT_00010ec0;
  }
  (**(code **)(DAT_00011040 + 0x170))(0x200,param_1,param_2,param_3,&DAT_000104d0,param_4);
  return;
}

The above function gets called from here: 

longlong entry(undefined8 param_1,longlong param_2)

{
  longlong lVar1;
  undefined8 local_res18;
  undefined8 *local_res20;
  undefined local_18 [24];

  FUN_00010f08(param_1,param_2);
  lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010480,0,&DAT_00011058);
  if (-1 < lVar1) {
    lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010410,0,&DAT_00011070);
    if (-1 < lVar1) {
      lVar1 = (**(code **)(DAT_00011040 + 0x140))(&DAT_000103f0,0,&DAT_00011078);
      if (-1 < lVar1) {
        lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010460,0);
        if (-1 < lVar1) {
          DAT_00011060 = *local_res20;
          local_res18 = 0;
          _DAT_00011068 = &LAB_00010b54;
          (**(code **)(DAT_00011040 + 0x80))(&local_res18,&DAT_000103d0,0,&DAT_00011068);
          DAT_00011028 = local_res18;
          FUN_00010ec4(0x10,FUN_00010cf8,0,local_18);
          lVar1 = 0;
        }
      }
    }
  }
  return lVar1;
}

The body, as well as the dumped .img can be found here.

Now I don't know what to do with this. Could I just remove the line FUN_00010ec4(0x10,FUN_00010cf8,0,local_18); and the function would never get called, thus freeing me from the whitelist? What other possibilities do you see to get around it?

This is the first time I deal with BIOS-modding, and I really don't want to brick my laptop. Also I'm sorry, if I use the wrong tags. I'm open for suggestions for better fitting ones.

Improve this question
3
  • When modifying binaries usually you can't just "delete a line" because you are just looking at the decompiled code. Changing something in decompiled code does not change the binary. If you want to remove a certain function call you have to overwrite it in the binary with different commands that don't do anything like NOP or an add command on an unused register.
    – Robert
    May 29, 2020 at 21:26
  • I see. I've managed to find the hex code corresponding to the line in question, replaced that with FF FF FF FF FF, and fed it to Ghidra again. Now at that line it says /* WARNING: Bad instruction - Truncating control flow here */ instead. I imagine this is not the thing I want. Any idea what I could use that would not give me a warning?
    – BraveSentry
    May 29, 2020 at 23:07
  • You can't just put FF FF FF FF there, it has to be valid opcodes. 90 is the opcode for nop (no operation - does nothing) for example which is typically used to overwrite code to skip it. You're playing with fire though and don't seem to know what you are doing so be careful.
    – Johann Aydinbas
    May 30, 2020 at 3:29

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.