chipsec VS UEFITool

Here is the thread about ARM https://github.com/chipsec/chipsec/issues/461

using Chipsec utility. It requires installing Python 3, runs on any OS. Commands must be executed in elevated terminal / command prompt (or with sudo if using on non-Windows).

[CHIPSEC GitHub] https://github.com/chipsec/chipsec

Paul Asadoorian https://twitter.com/securityweekly https://eclypsium.com/2022/07/26/firmware-security-realizations-part-1-secure-boot-and-dbx/ https://github.com/mjg59/mei-amt-check https://github.com/chipsec/chipsec.git https://github.com/intel/INTEL-SA-00075-Linux-Detection-And-Mitigation-Tools https://github.com/ptresearch/mmdetect https://github.com/corna/me_cleaner/

https://github.com/chipsec/chipsec

It's not out of band and therefore vulnerable to massively clever malware, but it's still useful.

As an aside, if you want to sorta see how vunlerable your UEFI is, you can run Chipsec to find out. It has a specific test for all the write-enable bits and stuff.

If you are like me and don't have the option, you need to modify the option through EFI shell. Download UEFI Tool, IFR extractor, RU.efi, and UEFI Shell, and your bios.bin/biosfd . On HP laptops, you can obtain it through the third option "Copy" . You can find the platform ID in the bios.

Open 1 E7250A24 -- 1 System BIOS with BIOS Guard vA.24.bin file with UEFITool

UEFIPatch from LongSoft's GitHub A UEFI patchtool built on the older UEFITool engine. UEFITool is not needed for this patch, only the UEFIPatch applcation.

Download UEFITool from https://github.com/LongSoft/UEFITool/releases for example UEFITool_NE_A66_win32.zip is hidden behind the show all assets button

There's a discussion here about this being done successfully on a ThinkPad T460 with a SPI programmer and UEFITool. The same method should apply to the T460p.

UEFITool: https://github.com/LongSoft/UEFITool/releases

If HPET is not an option in firmware, then it is disabled (0x00) and hidden from you. Which in practice is bad. The only option for users in this case is to download your firmware from the vendor, use this tool to locate the register and set the value with this tool to enabled (0x01).

UEFITool

How to view proprietary blobs on your system

I have been a long ThinkPad user and have bought an XPS 13 for the first time. I changed my boot logo on my machines before using this tool following this guide.