Comments (24)
@lucash4x0r, what exactly happens on 'bad' chipsets?
from kernel-bridge.
It is not that they are bad, changes are simply not made, because you cant write to this part of the memory ? I suppose its because inside of the ROM ?
Can we edit from kernel this memory range 0x000F0000-0x000FFFFF ?
from kernel-bridge.
@lucash4x0r, yes, you can, but how do you change this?
from kernel-bridge.
How can we edit it? Ive tried everything cr0 16bit flip, mdl and values dont change
from kernel-bridge.
@lucash4x0r, oh, wait, 0xF0000..0xFFFFF - it's a physical range, not virtual. You should map it to virtual address space using MmMapIoSpaceEx. You will get a kernel virtual address and ability to edit this region.
And how it works? Somethig like?
mov rax, VA
mov [rax], val
mov rax, [rax] ; Here rax != val?
from kernel-bridge.
Could you explain a little bit that asm that you wrote there , what is it for essentially ? I am currently using RtlCopyMemory after i've done MmMapIoSpaceEx , I can read and edit the values just fine on my LAPTOP, but it wont work on my desktop, I can read values on desktop but values will not change. Further giving me more reasons to believe the ROM in some chipsets cannot be edited.
from kernel-bridge.
PSMBIOS_EPS FindSMBIOS(UCHAR* buff, ULONG size) // DMI is not equal to SMBIOS
{
UCHAR* p = buff;
for (ULONG i = 0; i < size; i += 16)
{
if (0 == memcmp(p, "_SM_", 4))
{
PSMBIOS_EPS psm = (PSMBIOS_EPS)p;
if (0 == memcmp(psm->DMISignature, "_DMI_", 5))
{
UCHAR chk = 0;
// verify checksum
for (ULONG i = 0; i < psm->Length; i++)
{
chk += *(p + i);
}
if (0 == chk)
{
return psm;
}
}
}
p += 16;
}
return nullptr;
}
void clear_smbios()
{
const ULONG MEMRANGE = 64 * 1024; // 0xF0000 ~ 0xFFFFF, 64K
const ULONG MEMSTART = 0xF0000;
PHYSICAL_ADDRESS addr;
addr.QuadPart = MEMSTART;
if (auto p = MmMapIoSpaceEx(addr, MEMRANGE, PAGE_READWRITE | PAGE_NOCACHE)) {
Log::Print("Mapped phys mem");
if (auto pSMBIOS = FindSMBIOS((UCHAR*)p, MEM_RANGE - 0xF)) { // I try to find DMI
Log::Print("SMBIOS at %p\r\n", 0xF0000 + ((UCHAR*)pSMBIOS->StructAddress - (UCHAR*)p)); // I find it just fine
memset(pSMBIOS, 0, sizeof(PHYSICAL_ADDRESS)); // This wont work
}
MmUnmapIoSpace(p, MEM_RANGE);
}
else
Log::Print("Failed mapping");
}
I am trying this for now with no luck
from kernel-bridge.
@lucash4x0r, check whether HVCI/DeviceGuard are disabled on your desktop. And check what happens with something like http://rweverything.com/
from kernel-bridge.
@HoShiMin HVCI disabled on both computers
from kernel-bridge.
Laptop smbios no DMI type in sight
In desktop it seems smbios is located in dmi, and laptop is directly in physical memory idk if i explained myself good here, but there are definitely differences
from kernel-bridge.
@lucash4x0r, try to edit this memory using RWEverything. Does it work?
from kernel-bridge.
Trying to edit the first letter of Megatrend, doesnt change, this is on desktop by the way
from kernel-bridge.
@lucash4x0r, I don't know exactly, but it seems that your chipset rejects all writes to this memory
from kernel-bridge.
DMI Editor works on my desktop tho, i wonder how they do it
from kernel-bridge.
@lucash4x0r, could you give me a link?
from kernel-bridge.
https://filebin.net/cxf8m9x4x354iszr/DMIEDIT_utility.rar?t=tn69zca7
I just uploaded it, UCOREW64.sys is the one that does the changes, this program for example doesnt work on my laptop, because is not supported, but it does on desktop, and can also change the values just fine
from kernel-bridge.
If i had better reversing skills I would reverse their driver to see what exactly they're doing, this is dbgview after editing a value of the smbios/dmi
from kernel-bridge.
@lucash4x0r, thanx a lot. Seems interesting, I'll check it and will add this to the Kernel-Bridge 2:
from kernel-bridge.
In the meantime, any tip on how i could translate this so i could use it? Cheers
from kernel-bridge.
PVOID BusToPhys(PHYSICAL_ADDRESS a1, SIZE_T a2)
{
PVOID result = nullptr;
PHYSICAL_ADDRESS BusAddress;
BusAddress.QuadPart = a1.QuadPart;
if (HalTranslateBusAddress(Isa, 0, a1, NULL, &BusAddress))
{
result = MmMapIoSpaceEx(BusAddress, a2, PAGE_READWRITE | PAGE_NOCACHE);
Log::Print("Result: %p", a4);
}
else
{
DbgPrint("HalTranslateBusAddress failed\n");
result = 0;
}
return result;
}
My ghetto attempt to make it work, works on laptop but not desktop.... lmao!
from kernel-bridge.
@lucash4x0r, try MmGetVirtualForPhysical or remove PAGE_NOCACHE from MmMapIoSpaceEx
from kernel-bridge.
I dont see how MmGetVirtualForPhysical could benefit me here, also removing PAGE_NOCACHE works on laptop but once again not in desktop, quite annoying this, been at this for a few days now and 0 success thus far.
Have you had the opportunity to look more into dmi editor driver ?
from kernel-bridge.
https://filebin.net/cxf8m9x4x354iszr/DMIEDIT_utility.rar?t=tn69zca7
I just uploaded it, UCOREW64.sys is the one that does the changes, this program for example doesnt work on my laptop, because is not supported, but it does on desktop, and can also change the values just fine
Sorry to necro the thread but can you please reupload the driver? I'd like to analyze it too.
Thank you.
from kernel-bridge.
I am interested in an editor for SMBIOS and DMI for a motherbaod based on Intel Atom 5, anyone of you guys has such program I could run from a command prompt, is there such a program?
from kernel-bridge.
Related Issues (20)
- How can i load unsigned driver with this signed driver ?
- Windows on ARM, Support? HOT 1
- C++ exception handling is not supported with /kernel HOT 4
- Fastest way to read process memory HOT 10
- N HOT 1
- CppSupport BSOD
- signed binaries can not be loaded HOT 8
- add APIs HOT 1
- Does KbCreateUserThread support windows7 HOT 2
- KbWriteProcessMemory HOT 5
- Compiler crash in 'VMX.h'
- How to use the hypervisor to change the CPUID values? HOT 2
- how to find the process name or id which causes the VM EXIT in hypervisor mode HOT 2
- how to intercept KUSER_SHARED_DATA using Hypervisor?
- Error install HOT 4
- Memory leak at StringAPI operator +
- What are SVM & MSR_VM_CR ? HOT 1
- vlang support
- invalid
- Try using the serialization library based on your CppSupport HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kernel-bridge.