pk.fail

thayer , 12 hours ago (edited 12 hours ago) to linux in How to extract firmware of my Lenovo T480?

I can’t say for certain, but I think you just have to grab the last firmware binary released for your T480 from the Lenovo website and run it through the online validator: pk.fail

umami_wasbi OP , 12 hours ago

Tried. They only release it for Windows, or a bootable ISO, which I can’t see what files are in there. I also tried getting the firmware from LVFS but I’m not sure if I done it right as non of them start with "EFI " header (which I assume that’s the file I should be looking at).

thayer , 11 hours ago (edited 11 hours ago)

An ISO is just another archive format, similar to zip, tarballs, and rar files. Most modern archive tools can open and/or extract its contents like any other archive.

Edit:

It looks like Lenovo releases their ISOs formatted as a CD image. See: workaround.org/…/updating-the-bios-on-lenovo-lapt…

umami_wasbi OP , 11 hours ago (edited 10 hours ago)

Except the directory structure is totally gone. At least I can’t see it with either by mounting or with archive software.

thayer , 11 hours ago (edited 11 hours ago)

I was able to extract the img from the ISO using geteltorito as described in section 5 of this ArchWiki article. Once you mount the resulting img file, you’ll end up with the same file contents achieved by running their Windows BIOS Utility through wine.

The relevant binaries appear to be under the folders, N24ET76P and N24ET76W. Both scan clean for me, for whatever that’s worth:

<span style="color:#323232;">curl -X POST -F'file=@N24ET76P/$0AN2400.FL1' https://pk.fail
</span><span style="color:#323232;">{"details":{"analysis-time":"1.395106993s","hashes":{"md5":"ba73792a5fc831ca84b4cd3a21c03247","sha1":"24a5bb42d670c7705aed06588f0092ec11a32564","sha256":"b9510c73657460ae24c550b71d217a543b0fc3c30a3e081eff31d9d8f1a2bdda","sha512":"8ef6f0dcffbca05b79710b8599b1b1c926ee59185a675bc7eeede6da040c751097303ada523611271de6aaf190a597cdd6e9d5cf564d06987abcf712f61227c6"}},"status":"not-vulnerable"}
</span><span style="color:#323232;">
</span><span style="color:#323232;">curl -X POST -F'file=@N24ET76W/$0AN2400.FL1' https://pk.fail
</span><span style="color:#323232;">{"details":{"analysis-time":"1.438471526s","hashes":{"md5":"de1551b0bcc73e19375f7111def72278","sha1":"cd41f36d018f940c308a7be25a20e81bdb7e4cf2","sha256":"b3f646095e47bb94f04390c756cb4133201b1231a8b224174f10bb06bd3835f2","sha512":"55143f4903f92d88057bc9d4232b0d328e9ace36330f35fafdf0485d8bebb3f79b9fedc88ab1dec7fc04a8a3e0890887c1dd7632a2ffa397fb0917be90e3f93f"}},"status":"not-vulnerable"}
</span><span style="color:#323232;">
</span>

The linux command mentioned in the Ars Technica article elsewhere here is efi-readvar -v PK. For Fedora and Arch users, efi-readvar is available in the efitools package.

Edit: Clarity

CameronDev , 11 hours ago to linux in How to extract firmware of my Lenovo T480?

arstechnica.com/…/secure-boot-is-completely-compr…

Bottom of that article, there are commands to run from windows and Linux to detect it. Probably easier than messing with the firmware.

umami_wasbi OP , 7 hours ago

Thanks for the hint. I followed and checked: safe

<span style="color:#323232;">$ efi-readvar -v PK
</span><span style="color:#323232;">Variable PK, length 983
</span><span style="color:#323232;">PK: List 0, type X509
</span><span style="color:#323232;">    Signature 0, size 955, owner 3cc24e96-22c7-41d8-8863-8e39dcxxxxxx
</span><span style="color:#323232;">        Subject:
</span><span style="color:#323232;">            C=JP, ST=Kanagawa, L=Yokohama, O=Lenovo Ltd., CN=Lenovo Ltd. PK CA 2012
</span><span style="color:#323232;">        Issuer:
</span><span style="color:#323232;">            C=JP, ST=Kanagawa, L=Yokohama, O=Lenovo Ltd., CN=Lenovo Ltd. PK CA 2012
</span>

dingdongitsabear , 11 hours ago to linux in How to extract firmware of my Lenovo T480?

I don’t think any Thinkpads have AMI firmware, which is the source of this fuckup.