On 23.03.2017 20:26, Michael Fuckner wrote:
Hi,
I got a file, 8MB in size and it contains data. md5sum is not identical to original file and binwalk looks different on the beginning.
Not sure, what an "original" file would be. The flash contains data that is specific to your device like serial numbers, the MAC address etc. Also, at least two of the firmwares in your flash are self-modifying (ME, UEFI).
The original file starts with 0x258988, so this is the area for ME and Ethernet Config?
What is 0x258988 supposed to mean? an offset? I doubt that binwalk can give any thorough report of the flash image though.
Let's have a look at your log:
=== Region Section === FLREG0 0x00000000 FLREG1 0x07ff0200 FLREG2 0x005a0000 FLREG3 0x5a000000 FLREG4 0x00000000
--- Details --- Region 0 (Descr.) 0x00000000 - 0x00000fff Region 1 (BIOS ) 0x00200000 - 0x007fffff Region 2 (ME ) 0x00000000 - 0x0005afff Region 3 (GbE ) 0x00000000 - 0x01a00fff Region 4 (Platf.) 0x00000000 - 0x00000fff
This is part of the Firmware Descriptor, the first part of any modern Intel flash image. Beside many other things it contains this partition table. It looks very odd, with overlapping regions. I haven't looked into changes in the descriptor for Skylake yet, maybe it's not decoded correctly.
However if you want to verify your image you can try to decode the read descriptor:
$ make -Cutil/ich_descriptors_tool/ $ util/ich_descriptors_tool/ich_descriptors_tool -f flash.bin
It should give you the same output that you can find in your log.
Thanks again for testing and your log, it's nice to see things working! ;)
Nico