From 969ac353569c8f9f29a7a97e4d24203b04d7d8c2 Mon Sep 17 00:00:00 2001 From: Francis Rowe Date: Thu, 07 May 2015 12:13:44 -0400 Subject: docs/hcl/gm45_remove_me.html: notes about the demefactory util --- (limited to 'docs/hcl') diff --git a/docs/hcl/gm45_remove_me.html b/docs/hcl/gm45_remove_me.html index 8f7d56f..0e86166 100644 --- a/docs/hcl/gm45_remove_me.html +++ b/docs/hcl/gm45_remove_me.html @@ -228,6 +228,61 @@

+ +
+ +

demefactory utility

+ +

+ This takes a factory.rom dump and disables the ME/TPM, but leaves the region intact. + It also sets all regions read-write. +

+ +

+ The ME interferes with flash read/write in flashrom, and the default descriptor + locks some regions. The idea is that doing this will remove all of those restrictions. +

+ +

+ Simply run (with factory.rom in the same directory):
+ $ ./demefactory +

+ +

+ It will generate a 4KiB descriptor file (only the descriptor, no GbE). Insert that into + a factory.rom image (NOTE: do this on a copy of it. Keep the original factory.rom stored + safely somewhere):
+ $ dd if=demefactory_4kdescriptor.bin of=factory_nome.rom bs=1 count=4k conv=notrunc +

+ +

+ TODO: test this.
+ TODO: lenovobios (GM45 thinkpads) still write-protects parts of the flash. Modify the assembly code + inside. + Note: the factory.rom (BIOS region) from lenovobios is in a compressed format, which you have to extract. + bios_extract upstream won't work, but the following was said in #coreboot on freenode IRC: +

+
+<roxfan> fchmmr: try bios_extract with ffv patch http://patchwork.coreboot.org/patch/3444/
+<roxfan> or https://github.com/coreboot/bios_extract/blob/master/phoenix_extract.py
+<roxfan> what are you looking for specifically, btw?
+
+0x74: 0x9fff03e0 PR0: Warning: 0x003e0000-0x01ffffff is read-only.
+0x84: 0x81ff81f8 PR4: Warning: 0x001f8000-0x001fffff is locked.
+
+ +

+ Use-case: a factory.rom image modified in this way would theoretically have no + flash protections whatsoever, making it easy to quickly switch between factory/libreboot + in software, without ever having to disassemble and re-flash externally unless you brick + the device. +

+ +

+ demefactory is part of the ich9deblob src, found at resources/utilities/ich9deblob/ +

+ +
-- cgit v0.9.1