0

I am playing with a dump I made from a serial flash containing the BIOS of a ultra portable whose BIOS is protected by a password. I am trying to find the password or patch the routine which check the password.

Using binwalk I got the following result. I have search for strings containing 'password' but found nothing... So I think code is inside the mcrypt portion ...

Do you have idea what I can eventually do now to continue my journey??

enter image description here

2
  • Did any of the files that binwalk extracted yield anything? Dec 3, 2020 at 0:24
  • Just strings from the one wich is not crypted... I think that some UEFI PI firmware decrypt the ones wich are crypted ... So it would be possible to get the key for decrypting by disassembling the good UEFI PI... But it is hard for me...
    – rdpdo
    Dec 3, 2020 at 7:04

1 Answer 1

0

You should use UEFITool to analyze the dump. The modules themselves are not encrypted and can be extracted and disassembled using any standard tool supporting PE binaries.

The BIOS password implementation differs from platform to platform. In the easy case it would be somewhere in the NVRAM area on the same SPI flash, possibly obfuscated.

In the difficult case it could be stored in or checked by a separate chip such as the EC (embedded controller) and you would have to dump and RE it too.

There was a good talk on cracking the password for Toshiba laptops which was using the latter approach:

https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Hacking-Toshiba-Laptops.pdf

1
  • Thanks you I finally get into disassembly and found the strings "Invalid Password"... Now I am trying to get the reference call to this strings but found nothing... I will try to emulate the bios with some tools. I found unicorn or qemu... Will try it and look your url about toshiba. I will perhaps try to patch the check for the password and reflash the chip.
    – rdpdo
    Dec 4, 2020 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.