Re: [coreboot] lenovo x220, tool to extract binary blobs from BIOS update

[Peter Stuge]

Mat wrote:
> I was able to extract *.exe file with innoextract, but then running
> ifdtool to each file from extracted directory does not bring any
> success.

Can you show a directory listing which includes file sizes?

One idea is to try the bios_extract and/or uefi_extract utils.

//Peter

lenovo x220, tool to extract binary blobs from BIOS update

[diffusae]

Hi!

On 24.04.2018 16:50, Peter Stuge wrote:
> Can you show a directory listing which includes file sizes?
>
> One idea is to try the bios_extract and/or uefi_extract utils.

@x220:~/8DET74WW⟫ ll

total 25000
drwxrwxr-x 2     4096 Apr 24 18:33 ./
drwxrwxr-x 3     4096 Apr 24 18:23 ../
-rw-rw-r-- 1  8523776 Mär 13 15:30 $01CB000.FL1
-rw-rw-r-- 1  8523776 Jan 28  2013 $01CB000.FL2
-rw-rw-r-- 1  8523776 Jan 28  2013 $01CB100.FL2
-rw-rw-r-- 1      163 Mär  6 10:28 206a2.HSH
-rw-rw-r-- 1      163 Mär  6 10:28 206a3.HSH
-rw-rw-r-- 1      163 Mär  6 10:28 206a5.HSH
-rw-rw-r-- 1      163 Mär  6 10:28 206a6.HSH
-rw-rw-r-- 1      163 Mär  6 10:28 206a7.HSH

./ifdtool -x ~/8DET74WW/bios.bin
File /8DET74WW/bios.bin is 8523776 bytes
No Flash Descriptor found in this image

./bios_extract ~/8DET74WW/bios.bin
Using file "~/8DET74WW/bios.bin" (8324kB)
Error: Unable to detect BIOS Image type.

UEFITool can open the image, but I actually don't know which regions I
have to extract.

parseVolume: unknown file system FFF12B8D-7696-4C8B-A985-2747075B4F50
parseVolume: unknown file system 00504624-8A59-4EEB-BD0F-6B36E96128E0
parseVolume: unknown file system 16B45DA2-7D70-4AEA-A58D-760E9ECB841D
parseVolume: unknown file system E360BDBA-C3CE-46BE-8F37-B231E5CB9F35

Regards,
Reiner

lenovo x220, tool to extract binary blobs from BIOS update

[Nico Huber]

Hello Reiner,

On 24.04.2018 18:43, diffusae via coreboot wrote:
> ./ifdtool -x ~/8DET74WW/bios.bin
> File /8DET74WW/bios.bin is 8523776 bytes
> No Flash Descriptor found in this image

not sure what you are looking for, but I guess this is what you need,
because
> ./bios_extract ~/8DET74WW/bios.bin
> Using file "~/8DET74WW/bios.bin" (8324kB)
> Error: Unable to detect BIOS Image type.
>
> UEFITool can open the image, but I actually don't know which regions I
> have to extract.

there are no binaries that you need to extract that UEFITool generally
can extract (microcode updates are publicly available and gfx init is
open source).

Nico

lenovo x220, tool to extract binary blobs from BIOS update

[diffusae]

Hi Nico,

On 24.04.2018 19:38, Nico Huber wrote:
> not sure what you are looking for, but I guess this is what you need,
> because

I only was testing the image with the different extracting tools.
> > Error: Unable to detect BIOS Image type.

I guess, if you flash the vendor bios and then reread the content with a
spi flasher, the descriptor should be detected. But what for?
> there are no binaries that you need to extract that UEFITool generally
> can extract (microcode updates are publicly available and gfx init is
> open source).

Once I extracted vgabios.bin with that tool, but I never used it.

Do you think, that integrate the microcode updates into the coreboot
image should be enough? To be safe in case of CVE-2017-5715?

Regards,
Reiner

lenovo x220, tool to extract binary blobs from BIOS update

[Nico Huber]

On 26.04.2018 11:44, diffusae via coreboot wrote:
> Do you think, that integrate the microcode updates into the coreboot
> image should be enough? To be safe in case of CVE-2017-5715?

No, AFAIK, these updates do nothing on its own. They only add control
capabilities that your OS has to use (or be patched to use).

But if the question was, if there is nothing more to do in coreboot,
then yes.

AFAICS, microcode updates for the X220 (and more [1]) have been updated
in our blobs repo.

Nico

[1] https://review.coreboot.org/#/c/blobs/+/23315/