Hamish Coleman
http://linux.conf.au/schedule/present...
In this talk, I will take you through the tools and techniques
I used to reverse engineer the keyboard controller in my Thinkpad
laptop and re-flash it with custom firmware. This will cover how the
Thinkpad range of laptops have tried to secure their firmware from
unauthorised changes. Finally, I will present my ongoing work to
reverse engineer the protocol used between the BIOS and the vendor's
flash update tool (which included writing a custom virtual machine
to emulate a minimal laptop).
I was driven to start this project when I realised that the laptops
currently on sale just did not meet my requirements. Even the durable
Thinkpad laptops I have preferred in the past are being dumbed down.
Eventually, I will need a new laptop - and with the current offerings,
I just do not want anything I can purchase off the shelf. I knew
I was not going to be able to build my own laptop from scratch
(and having discounted all the current free/open laptop offerings)
so I started looking at what I could hack together.
To keep the project achievable, I reduced my laptop gripes as far
as I could and focused on just the keyboard - asking the question:
"Can I shoehorn an older keyboard in a modern laptop?" Eventually
answering it with "yes, sometimes."
It turned out to be easily possible to physically replace the
keyboard on any of the Thinkpads in the xx30 series with one from the
xx20 series. I was stalled with a half-working keyboard until early
2016 when Zmatt published how he unlocked his laptop. The firmware
changes needed were bundled up into a complete build system which
others have used to replicate the keyboard replacement. However,
with both these laptop series' being several years old now, I am
still looking at forward porting this to a newer laptop - which has
led me to research the hardware and firmware design there.
I will also take the audience through my current knowledge of how
the vendor's protocol to tell the BIOS to write a new image to
flash works. Now that it is possible to write new code for the
embedded controller and to install it and run it - I wanted to
know how secure this was (or wasn't) separate to simply "fixing"
the keyboard. I have written a custom virtualisation tool to host
the vendors "dosflash" program and capture the protocol it uses to
request that the BIOS write a new image to flash.
It is my hope that others will be inspired to look closer at their
hardware and to give them both some tools and the confidence that
it is possible to "fix" the way that consumer hardware works.
