目前惠普BIOS最烦人的特性之一是他们实现白名单。这些阻止你使用硬件,惠普不批准。这是通过检查在引导UUID的硬件问题。如果它不匹配任何可接受的BIOS查找表中列出,然后它将产生一个错误,拒绝启动。惠普目前使用白名单WIFI和WWAN卡片。这是一个常见的错误有一个未经授权的无线网卡安装:
Letsget started with the tutorial. If you'd like to follow along by using the sameBIOS that I am, then here's where you can download it. I'll assume that by nowyou've read a few of my other tutorials, so I don't have to go over some of thebasic things anymore. Just like in all the others, unpack your BIOS installerso that you have access to the BIOS rom. Open the rom in Andy's tool and pressthe Structure button. We want to locate the module that contain the"104-Unsupported" string, so lets extract the DXE Core module andopen it with a hex editor. You can get the same hex editor that I use, HxD,here. You can also get the latest version of Andy's tool here.
我不知道这在1月的时候寻找与内置的蓝牙无线网卡,与hackintosh和aircrack完全兼容。这些要求让我买一个创锐讯AR9285和AR3001 BT组合卡。所以当我安装它,我的笔记本电脑,惠普dv7t -4100,104 -不支持无线网络设备的错误。这个事件是导致我参与改装Insyde BIOS放在第一位。
正如我之前所说,这通常是不可能让这些教程和我想一样通用。很少有两个不同的BIOS实现这一限制以完全相同的方式,所以不要期望遵循本教程逐字将删除白名单在你特定的BIOS。
让我们开始本教程。如果你想跟着我通过使用相同的BIOS,然后在这里您可以下载它。我假设现在你读过我的一些其他的教程,所以我没有过去的一些基本的东西了。就像在所有的其他人,解压安装程序,你可以访问你的BIOS的BIOS罗罗在安迪的工具,按结构按钮。我们要定位模块包含“104 -不支持”的字符串,所以允许提取DXE核心模块和用十六进制编辑器中将其打开。你可以得到相同的十六进制编辑器,我使用,HxD,这里。你也可以获得最新版本的安迪的工具。
Remember, Insyde BIOS uses Unicode characters in its strings,which are 16 bits long. This extra byte is most often just an empty byte, soseparate all the character in the string your searching for by 00s. This makesmore sense if you look at what I'll be searching for. It found it at offset0x323C2E.
记住,Insyde BIOS使用Unicode字符的字符串,这是16位长。这种额外的字节通常只是一个空字节,所以单独的字符串中的所有字符你寻找到00年代。这更有意义,如果你看看我会寻找。它在抵消0 x323c2e发现它。
Now lets search for the byte sequence that marks thebeginning of a module, 4A 5D. That way we can see the name of the previousmodule, which is the one that contains the string we found.
现在让我们搜索字节序列,标志着一个模块的开始,4 5 d。这样我们可以看到前面的模块的名称,这是我们发现的一个包含字符串。
Now use IDA Pro to open that module's corresponding file inthe DUMP folder produced by Andy's tool. Remember to open the file with thelargest size. As you can see here, there are several E62F9F2F-4895-4AB5-8F1A-399D0D9C6B90file, but I'm only opening the 8 kB one.
现在使用IDA Pro转储文件夹中打开该模块的相应文件由安迪的工具。记得要打开文件的最大大小。正如您所看到的,这里有几个e62f9f2f - 4895 - 4 - ab5 - 8 f1a -399 d0d9c6b90文件,但我只打开8 kB。
Now lets use the default file format thatIDA Pro determine for us. Mine was Portable executable for AMD64.
现在让我们使用默认的文件格式,艾达为我们专业确定。我是AMD64便携式可执行。
This ended up being a real small module onmine. This leads me to assume that BiosLockPcie's only task is to enforce theBIOS WIFI whitelist. This check will most likely happen after the error'saddress is loaded into one of the CPU registers. Lets find that string in thedata section of this module and see where it is referenced from. I find thiseasier to do in IDA Pro's hex view. Mine was at offset 0x18000120E.
这个我最终成为一个真正的小模块。这让我认为BiosLockPcie唯一的任务是执行BIOS WIFI白名单。这张支票将最有可能发生错误的地址后加载到一个CPU寄存器。让发现字符串在该模块的数据部分,看看从哪里引用。我觉得这更容易在IDA Pro的十六进制的观点。我是在0 x18000120e抵消。
Now switch back to assembly view to seewhat references this offset. Hmmm.... that's weird, nothing references thisoffset.
现在切换回装配视图引用这些偏移量。嗯....真是奇怪,没有引用这个偏移量。
So Insyde BIOS have several different supported languages. Tooptimize this, the compiler they used bunched all the different languagestrings together. So now only the first part of this bunch is referenced by anycode, then a different variable determines where in this bunch to start displaying.So lets scroll up a bit until we see an address that is referenced. You'll knowwhen you find one because there'll be blue text to its right showing theoffsets of these calling function. After scrolling up about 50 - 100 bytes, Ifound it.
所以Insyde BIOS有几种不同的语言支持。为了优化这个问题,他们使用的编译器集中所有的不同的语言字符串。所以现在只有这个群的第一部分是引用的任何代码,然后不同的变量决定,在这群开始显示。所以让向上滚动,直到我们看到一个引用的地址。你就会知道当你发现因为会有蓝色文字的正确显示这些调用函数的偏移量。滚动约50 - 100字节后,我找到了。
HP BIOS白名单.zip(1.87 MB, 下载次数: 610)
附件有个文档,是word的,我压缩成zip了,大家可以下载,有图片。
就在上边,大家别忘记下载。
如果大家用下载工具下载,得到的附件可能是xxxx.php,把PHP改成ZIP,然后解压,就看到word文件了。docx格式的,用OFFICE 2007或者以上版本看,或者WPS也行。
有在研究HP白名单的朋友吗?