Hewlett-Packard Bios Protection in newer laptops

Discussion in 'BIOS Mods' started by zuvieltext, Aug 10, 2011.

  1. zuvieltext

    zuvieltext MDL Junior Member

    Jun 11, 2011
    62
    24
    0
    #1 zuvieltext, Aug 10, 2011
    Last edited: Aug 17, 2011
    For the good or worse. I've just "finished" my BIOS-MOD project on my DV6-6003eg :D.
    I went trough several BIOS revision and finally settled with SP54024[F1-A] and found
    the countless emergency situations [aka bricked] quite frustrating and annoying.

    So, in order to safe others from going through the same bad experience. I'll post some notes to why
    it's so difficult to tackle the problem.

    First of all, HP had the great idea to protect every bit of the BIOS PEI and DXE images. Unfortunately
    for us, they went for a strong crypto and selected 2048-Bit RSA-SHA1 check embedded in the
    write-protected bootblock. There's no "software" way to patch the checks out of the image, since
    only the bios and HP's blasted EFI BIOS Update tool are capable of updating the bootblock and of
    course they check each new bootblock if it is signed properly.

    So, without the right private key or a hardware flasher, it's a hopeless task. They've locked us out. :censored:
    [Note: It's possible to modify the IDs of most WLAN card to match one in the whitelist.
    For Atheros cards, there's a utility called: atheros eeprom tool which can be found here:
    [aet] hxxp:tinyurl.com/43kx28o ]
     
  2. alxlbf2

    alxlbf2 MDL Junior Member

    Jun 18, 2011
    50
    7
    0
    Did you try to make a BIOS dump? It would be very surprising that they use such a strong protection. Also performance wise the BIOS must be very slow if it would be even flashed stay coded:mad:...
     
  3. zuvieltext

    zuvieltext MDL Junior Member

    Jun 11, 2011
    62
    24
    0
    No, it's not slow. The bootcode just calculates the sha1 sum [just a few kb, so this takes probably just a few usecs]
    and deciphers 256 byte signature. If both match, the new bootblock will be flashed. But if they don't, the procedure is aborted and you'll get a error message in red letters. [Of course, the verification does not take place when the boot block
    is already on the flash. Also the main bios DxE is only verified once a while [e.g. when the internal embedded controller
    was resetted or when it lost power for a minute]
     
  4. zuvieltext

    zuvieltext MDL Junior Member

    Jun 11, 2011
    62
    24
    0
    In fact, here's a little demonstration vvv.youtube.com/watch?v=9J-xu4-2lCA [replace vvv with www] :ninja_hide:.
     
  5. mbeifuss

    mbeifuss MDL Novice

    Dec 14, 2011
    2
    0
    0
    DV7 SP55068 modded BIOS whitelist removed


    Where can we get this modded BIOS? And does it require doing anything special to flash or use it?
     
  6. Camiloml

    Camiloml MDL Novice

    Oct 30, 2010
    4
    0
    0
    h t t p ://j.mp/yzVnTW

    You can try this one, seems to be working ;)