Hewlett-Packard Bios Protection in newer laptops

For the good or worse. I've just "finished" my BIOS-MOD project on my DV6-6003eg .
I went trough several BIOS revision and finally settled with SP54024[F1-A] and found
the countless emergency situations [aka bricked] quite frustrating and annoying.

So, in order to safe others from going through the same bad experience. I'll post some notes to why
it's so difficult to tackle the problem.

First of all, HP had the great idea to protect every bit of the BIOS PEI and DXE images. Unfortunately
for us, they went for a strong crypto and selected 2048-Bit RSA-SHA1 check embedded in the
write-protected bootblock. There's no "software" way to patch the checks out of the image, since
only the bios and HP's blasted EFI BIOS Update tool are capable of updating the bootblock and of
course they check each new bootblock if it is signed properly.

So, without the right private key or a hardware flasher, it's a hopeless task. They've locked us out.
[Note: It's possible to modify the IDs of most WLAN card to match one in the whitelist.
For Atheros cards, there's a utility called: atheros eeprom tool which can be found here:
[aet] hxxp:no_short_urls_allowed/43kx28o ]

 

No, it's not slow. The bootcode just calculates the sha1 sum [just a few kb, so this takes probably just a few usecs]
and deciphers 256 byte signature. If both match, the new bootblock will be flashed. But if they don't, the procedure is aborted and you'll get a error message in red letters. [Of course, the verification does not take place when the boot block
is already on the flash. Also the main bios DxE is only verified once a while [e.g. when the internal embedded controller
was resetted or when it lost power for a minute]

 

In fact, here's a little demonstration vvv.youtube.com/watch?v=9J-xu4-2lCA [replace vvv with www] .