how to reset the bios password lenovo thinkpad t61

In particular a call will be made to the function gEfiHiiDatabaseProtocolInterface->NewPackageList which allows to register the database strings with a handle. Once the header is found, it is possible to find the initialization of this database. The header follows the EFI_HII_STRING_PACKAGE_HDR structure which contains, in particular, the StringInfoOffset field indicating the start of the string. Before all those strings, a header is present. This value indicates that this element of the HII database is a string. The strings found in databases can be easily identified: they are UTF-16 strings preceded by one byte with the value 0x14. This basically means that it is not possible to directly use an xref on the string when reversing. In particular the EFI_HII_STRING_PROTOCOL allows to retrieve strings from a 'Database' using a StringId which is a simple number. In UEFI, interfacing with the user is made using the Human Interface Infrastructure (HII): a set of interfaces which allow to print and get value from the user. The one I started to look at was LenovoSetupSecurityDxe since this driver appears to concentrate most of the code which allows to set and remove passwords using the user interface. A few drivers in the firmware were containing reference to strings 'passwords'. Lenovo ThinkPad firmware proposes several kinds of passwords, initially the one I was interested in was the one protecting the BIOS settings interface.

No vulnerability has been identified (yet) in the management of those passwords, but without further ado let's get started.

We will start by looking at how the reverse was started and the different kinds of passwords in the firmware, before having a more in depth look at two of them: the Power-On Password and the Bios Passwords. In this blogpost the goal is to explain how I started looking at the Lenovo password. The handling of passwords is specific to each constructor, which means the code explained here is specific to Lenovo and more precisely to a few ThinkPad (this is mostly common to three different ThinkPad versions, so most of this will probably stay the same). A few publications exist 1 2 3, but I was interested to look at it from a software point of view and was not actually sure it was the same implementation (in practice it is the same). At that time I got curious about how the UEFI passwords, which in particular are used to protect the BIOS interface, are handled. In my last blogpost I spoke about a vulnerability in the System Management Mode (SMM) code of my Lenovo ThinkPad.

How to reset the bios password lenovo thinkpad t61