edit toshiba bios image to accept any response code

[kiknusko]

Hello i am trying to edit toshiba bios image to accept any response code

[KvnTM]

Re: edit toshiba bios image to accept any response code

Hello i am trying to edit toshiba bios image to accept any response code

What's the point of this?

[RethoricalCheese]

Re: edit toshiba bios image to accept any response code

What's the point of this?

If you have response code generator to share then there is no point. If not, it was to remove bios password on toshibas. Sadly it is signed code so not possible to modify like this.

[imranromi]

Re: edit toshiba bios image to accept any response code

If you have response code generator to share then there is no point. If not, it was to remove bios password on toshibas. Sadly it is signed code so not possible to modify like this.

Yes correct bios cannot modified if modified laptop no give display.

[KvnTM]

Re: edit toshiba bios image to accept any response code

Thats why I asked. There is no point editing bios files like this. Never had luck modifying bios rom's with a hex editor or disassembler. I believe every bios has at least a checksum check.
I'd rather flash a clean bios with code signing intact. I don't think that it is locked to a cpu serial number or something else. Correct me if I'm wrong though.

It would be interesting to know which device checks the signing. If it is a routine in the bios file itself you could easily manipulate it. if the EC or PCH has a check for it then there is no way around it.

[RethoricalCheese]

Re: edit toshiba bios image to accept any response code

Password stored in ec/kbc so flashing clean bios has no point.

I modify bios files all the time to remove passwords. Even made a modifying tool for HP which only has positive feedback thus far

[KvnTM]

Re: edit toshiba bios image to accept any response code

Password stored in ec/kbc so flashing clean bios has no point.

I modify bios files all the time to remove passwords. Even made a modifying tool for HP which only has positive feedback thus far

Is this also true for EC's which are non programmable and the firmware is shared with the bios on a single flash chip? Or do they have an EEPROM or something else in it to store the password? Never looked into EC's that far.

[RethoricalCheese]

Re: edit toshiba bios image to accept any response code

Not sure if I understand your question.

EC/KBC can be programmable and not programmable. When it is not programmable, it might have an eeprom next to it. When it is programmable, it has internal eeprom.

When password is stored in EC/KBC (doesnt matter what kind), it is not possible to clear it by flashing a clean bios on main eeprom. Yes, it is possible to clear password from EC/KBC by flashing that with a clean file but this is often difficult because it might not be a soic8 eeprom.

[drgn997]

Re: edit toshiba bios image to accept any response code

@kiknusko
Start with something easy by modifying strings, but as RethoricalCheese or imranromi mentioned, it won't work as it seems that upon powering up, bios checks for firmware integrity.
I tried with a Tecra A9 with legacy bios, after modification it didn't give display output. With UEFI bioses seems easier to modify modules, but I haven't tried.

[said7002]

Re: edit toshiba bios image to accept any response code

Password check: BIOS
out_buf = call_EC(
func=0x24,
in_buf=MD5(input)[:8] + pwd_type
)
out_buf[0] == 0 ⇒ success

[przemek_79]

Re: edit toshiba bios image to accept any response code

Password check: BIOS
out_buf = call_EC(
func=0x24,
in_buf=MD5(input)[:8] + pwd_type
)
out_buf[0] == 0 ⇒ success

according to the author, just rewrite this code to python and you can generate the code yourself

https://cdn.badcaps-static.com/pdfs/...b4ab0f2e13.pdf

Challenge: BIOSout_buf =call_EC(func=0x1A, in_buf=rdtsc()+MD5(pc_serial)[:8])challenge = bytes_to_string(out_buf)


Response: BIOSout_buf =call_EC(func=0x1B, in_buf=string_to_bytes(user_input))out_buf[0]⇒ success/fail

[biospwd]

Re: edit toshiba bios image to accept any response code

according to the author, just rewrite this code to python and you can generate the code yourself

https://cdn.badcaps-static.com/pdfs/...b4ab0f2e13.pdf

Challenge: BIOSout_buf =call_EC(func=0x1A, in_buf=rdtsc()+MD5(pc_serial)[:8])challenge = bytes_to_string(out_buf)


Response: BIOSout_buf =call_EC(func=0x1B, in_buf=string_to_bytes(user_input))out_buf[0]⇒ success/fail

I tried but It does not work for me.

[jafasbay@gmail.com]

Re: edit toshiba bios image to accept any response code

i need the toshiba response code generator but i don know how to use phyton

[keczuk]

Re: edit toshiba bios image to accept any response code

Someone have free solution for toshiba laptop ?

[CraterM]

Re: edit toshiba bios image to accept any response code

Someone have free solution for toshiba laptop ?

Nop

[vinsun0399]

Re: edit toshiba bios image to accept any response code

Is this also true for EC's which are non programmable and the firmware is shared with the bios on a single flash chip? Or do they have an EEPROM or something else in it to store the password? Never looked into EC's that far.

YOU tell right , i think will have one method to unlock via patch bios file

[imranromi]

Re: edit toshiba bios image to accept any response code

YOU tell right , i think will have one method to unlock via patch bios file

No work patch bios.The main reason toshiba bios cannot modified in protection if you modified laptop not give display.Or challange code is random.

[shh-phd]

Re: edit toshiba bios image to accept any response code

the program written in which Program language???

[RethoricalCheese]

Re: edit toshiba bios image to accept any response code

the program written in which Program language???

There is no program

[tuanbacky]

Re: edit toshiba bios image to accept any response code

Hello i am trying to edit toshiba bios image to accept any response code

everybody can help response code ?