Extracting blobs/ROM image from original Lenovo (Phoenix) FL2 files

[tlaurion]

@theopolis : As specified here, trying to do a PoC to be able to extract ME related regions from original Lenovo bios updates (hopefully 8MB rom image) from Lenovo FL2 file, and nothing extracted matches me_cleaner expected file format:

wget https://download.lenovo.com/pccbbs/mobiles/g2uj31us.exe && innoextract ~/g2uj31us.exe && echo -e "\n\n EXTRACTING FL1\n\n\n" && /usr/bin/python2.7 /usr/local/bin/uefi-firmware-parser ./app/G2ETB5WW/\$01D3000.FL1 -e && echo -e "\n\n\n EXTRACTING FL2 \n\n\n" && /usr/bin/python2.7 /usr/local/bin/uefi-firmware-parser ./app/G2ETB5WW/\$01D3000.FL2 -e --superbrute && echo -e "\n\n\n Testing me_cleaner against all extracted files.... output given only on successful files... \n\n\n" && find ./pfheader* ./capsule-Capsule/ ./volume-0/ -type f | while read filename; do python ~/me_cleaner/me_cleaner.py $filename &>/dev/null; if [ $? -eq 0 ]; then echo $filename; fi; done;

Output of code snippet: none.

Meaning: no file extracted from FL1 (expected) nor FL2 (not expected) matches extracted ME region, nor 8MB raw region. Also, note that FL2 regions needed to be extracted with --superbrute, a simple -e reporting unsupported format, same result with --brute.

Any advice?

[tlaurion]

I would have thought #53 permitted this.

chipsec doesn't produce me_cleaner regions either to be able to extract blobs directly from Heads CIs from original firmware images.

@theopolis @anatol @andreiw @thops @iROOT : How to accomplish this?

[theopolis]

It looks like you found a way forward in discussion on the heads project. I'm on leave right now but I can take a look at adding (or fixing) extraction within uefi-firmware-parser in a few months when I return. 😄

[tlaurion]

It looks like you found a way forward in discussion on the heads project. I'm on leave right now but I can take a look at adding (or fixing) extraction within uefi-firmware-parser in a few months when I return. smile

@theopolis: yeah, not perfect though. Would be better if it was possible to extract the ME ROM region correctly and apply me_cleaner directly on the full image. IFD descriptor still has to be extracted from an already flashed image.

[theopolis]

Ok, I'll read though all of the dev/debugging in the related issues and try to come up with the step-by-step for extracting and see if it can be done with this parser/extractor.

[tlaurion]

You can read chipsec/chipsec#870 (comment) and close this issue!