Forum Login

flashrom -c switch command usage?

Rendering Error in layout Widget/Social: Call to a member function exists() on null. Please enable debug mode for more information.

Start
Prev
1
Next
End

cyber16
Topic Author
Offline
Haxor Guru

8 years 8 months ago - 8 years 8 months ago #1118 by cyber16

flashrom -c switch command usage? was created by cyber16

Well I have a couple salvaged water damaged mid 2012 air boards that are locked, they boot fine to the ? folder otherwise
Purchased the clip and figured may as well purchase a raspberry pi 2, installed raspbian
Followed the how to www.ghostlyhaks.com/blog/blog/hacking/18-apple-efi-bypass
I am not a normal linux user so I need so do some legwork as I go, but this command was unknown so I just skipped it.
Now we need to modify the blacklist by commenting out the SPI entry if it exists: Sudo nano /etc/modprobe.d/raspi-blacklist.conf
My MX chip was found with several other MX definitions and was told to use the -c with the model listed.
I have came up empty how to enter that -c switch in
Anyone want to help ?
Here is a line I used to get that response
flashrom –r /efi/read1.bin -V -p linux_spi:dev=/dev/spidev0.0

How & where would the -c MXmodenumber entered in?
The chip on this board is the MX25L6406E
That is listed in as "MX25L6406E/MX25L6408E"

Last edit: 8 years 8 months ago by cyber16.

Please Log in or Create an account to join the conversation.

token.paul
Offline
Haxor Elite

8 years 8 months ago #1122 by token.paul

Replied by token.paul on topic flashrom -c switch command usage?

Just use it as it written:
flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6406E/MX25L6408E" -r bla-bla-bla

The following user(s) said Thank You: cyber16

Please Log in or Create an account to join the conversation.

cyber16
Topic Author
Offline
Haxor Guru

8 years 8 months ago #1123 by cyber16

Replied by cyber16 on topic flashrom -c switch command usage?

The boards with the MX chips are now dumping.
The Micron chip boards dumped easy

Thank you now I will need to search them bins to locate the area to edit. I think I understand that part.
I did take three dumps of each and will compare them prior.

Please Log in or Create an account to join the conversation.

cyber16
Topic Author
Offline
Haxor Guru

8 years 8 months ago - 8 years 8 months ago #1124 by cyber16

Replied by cyber16 on topic flashrom -c switch command usage?

Edit:
I figured it out

Installed notpad++ and searched and found the $SVS
At some what of a loss on the edits,
Could I ask someone to tale a look at this dump and FEEL free to make the appropriate edit and repost it.
I will then compare to the original to give my self a better idea as to how to proceed with the others

I also installed HxD editor some months ago and here is a screen shot
Just unsure how or what to place into that area, just delete it Im sure will not work. The how to says fill with yyyy

THANK YOU

Last edit: 8 years 8 months ago by cyber16.

Please Log in or Create an account to join the conversation.

token.paul
Offline
Haxor Elite

8 years 8 months ago - 8 years 8 months ago #1134 by token.paul

Replied by token.paul on topic flashrom -c switch command usage?

Yes, you can't just delete it. Area with password like a partition on the disk and all customer data stored like files on the filesystem on that flash.
If you trying to edit firmware on Mac OS X or other unix system you can use my script for patching. Actually it is simple Perl-script which uses basic perl language directives may be it will run on Windows too... I don't test it.
Extract an archive and copy your firmware dump into some folder. In the terminal go to that folder. Make sure that script, firmware dump and files 'SVS_Type1.bin' an 'SVS_Type2.bin' located in one folder and run:

./rom_scan_patcher.pl <firmware_dump_filename>

If password will be found (or $SVS area will not be 'virgin', i.e. password was set) script will ask you for patching. Press 'Enter' to confirm or any other key followed by 'Enter' to cancel. Make sure that 'RFT' variable was determined in the scanning result. It may have value '1' or '2' in other case please report me.
In the result you'll get modified firmware with '.modified' suffix to the original firmware dump and 'flashrom.layout' file as well as command line arguments for 'flashrom'.
Copy modified firmware and 'flashrom.layout' file to RP and flash a chip with a generated arguments:

flashrom -p linux_spi:dev=/dev/spidev0.0 -c 'IF_IT_NECESSARY' <generated arguments>

This operation will flash password area only and will replace it by clean.

Example:

1. Scanning process

$ ./rom_scan_patcher.pl ./Example.bin
System byteorder: Little Endian
Mode: Only scanning = 0, Silent = 0
ROM: ./Example.bin
Intel BIOS signature found
Apple Specific Data block start found at: 0x00610000
Scanner should find first var within 2048 bytes of data...
'PchInit' usually... or 'Setup'
Variable at: 0x00610060 RFT: 2, Sizes (Key: 12 Value: 176)
GUID: abbafb4d9213de4fabb8c41cc5ad7d5d at: 0x00610070 (6357104)
Key: Setup Value: 0000000000000000010000000000010001000001000001010201010301010001020000000000000101010101010101010100000000000000000000000000000000010100000001010000000000000000000000000000000000000001010a01010100030000000000000101010101000000010101010100000000000000000000000101010101000000030303030303030301010101010101010000000000000000000000000000000000000000000000
====
File size: 0x007fffff (8388608) bytes. Record format type 2 detected
Image for 8 Mbytes flash chip

= Calculated SVS start offset: 0x00632050 (6496336)=
SVS: 24535653b01f00005afefe0100000000
== Match stamp type: 2
= Calculated SVS end offset: 0x00634050 (6504528)=
SVS: 24535653b01f00005afefe0100000000
== Match stamp type: 2
Password area looks fine... Password is set or was set.
Password record parsing...
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x00632070 (6496368)
State: 7f00, Key: 3E6D568B, Value Size: 4
Value: 02000500
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x006320aa (6496426)
State: 7c00, Key: , Value Size: 8
Value: 0000000000000000
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x006320e8 (6496488)
State: 7f00, Key: CBF2CC32, Value Size: 69
Value: ff23804e9aa7d147a3427524cfc96dc400bbaf9026106a5df38337d05c2cb94848721666440e723638a7cc5d5ca59a6a674fcd20e61b63da409ff200003ee5010001000000
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x00632163 (6496611)
State: 7f00, Key: BC9772C5, Value Size: 8
Value: deac04db76a2a8e2

==
RFT: 2, SVS offset: 0x00632050, password set 1 time(s) and ACTIVE
Ready for pathing... [confirm]

2. Patching (Enter pressed)

Ready for pathing... [confirm]
FireUp
Output to: ./Example.bin.modified
SVS area cleaner: SVS_Type2.bin at offset: 0x00632050
Layout file for 'flashrom':
00000000:0063204f UpperZone
00632050:0063404f SVS
00634050:007fffff LowerZone
UpperZone end at: 0x0063204f, 6496335 bytes
LowerZone end at: 0x007fffff, 1884080 bytes
Copy original file... done.
Setup pointer to: 0x00632050 returned: 0x00632050 patching... done.
Created files:
Modified ROM: ./Example.bin.modified
Flashrom Layout: ./flashrom.layout
===
Arguments for 'flashrom': --layout ./flashrom.layout --image SVS -w ./Example.bin.modified
===

Flashing (modified firmware and layout file on the RP in one folder and we will flash MX chip):

flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6406E/MX25L6408E" --layout ./flashrom.layout --image SVS -w ./Example.bin.modified

File Attachment:

File Name: scan-n-pat...beta.zip
File Size:5 KB

Last edit: 8 years 8 months ago by token.paul. Reason: Code tag added

Please Log in or Create an account to join the conversation.

thaGH05T
Offline
Admin
Happy Hunting....

8 years 8 months ago #1152 by thaGH05T

Replied by thaGH05T on topic flashrom -c switch command usage?

I am going to post a video of the usage of his script as soon as I find a bit more time. Sorry for being so absent guys.

If I helped you, buy me a beer!!! Happy Hunting...

Please Log in or Create an account to join the conversation.

Start
Prev
1
Next
End

Main Menu

N00BZ

ljamal
ljamal74
mikeg2atest
ducchinhbui
anjarezt

flashrom -c switch command usage?

Attachments:

File Attachment:

Attachments:

Main Menu

Trending

Who's Online

N00BZ

Cookies

EU e-Privacy Directive