Lenovo DMI Decryption Tool

Special Topics Other Tools (not BIOS modding related)
1

Some time ago (when I was new to BIOS modding) I wanted to change my Lenovo laptop’s serial number, UUID etc. but I wasn’t able to do that, even with UEFITool because Lenovo encrypts DMI. I wrote a little C++ opensource program to decrypt and encrypt the 2 LENV blocks so you can edit and encrypt the BIOS dump again: https://github.com/Shmurkio/LenovoDMIDecryptor. I recorded a video on how to use: https://www.youtube.com/watch?v=mUXLHaK0CU8

Update: I finally fixed some stuff regarding the encryption key retrieval and now it also fixes the checksum automatically, no data should be invalid anymore.

4 Likes
2

Thank you for sharing your contribution in the forum, all the best.
Can you detail what’s the output of the results…“Successful, hit enter to close”

3

Lenovo uses XOR to encrypt the 2 DMI Blocks. The program gets the key used for the encryption and decrypts both DMI blocks. After it decrypted both blocks it prints the “Success” message. You can find them in the dump after “LENV”. After you edited the dump just drag the decrypted file in the program again and it will be encrypted.

1 Like
4

Hello, this is brilliant. Any chance to get the compiled version please?

5

Thank you. Yes, the compiled version is in the releases tab
Capture

6

Thanks!

7

@lfb6 can you help me with the checksum generation for the DMI blocks? I know that it’s a CRC16 checksum but I don’t have a clue how it’s generated.

Capture
Capture1866×335 23.9 KB

In this picture I circled the byte that’s used to XOR the data with to decrypt/encrypt the DMI in red and the checksum in blue. Lenovo swaps the bytes for the checksum so the actual checksum for the data is 0x9D60. The data in this case are 4080 bytes of 2A bytes. I’m going to attach the DMI area of a BIOS dump with valid checksums. The second DMI block consist of 4080 bytes of 3B and the checksum is 0xAC50. Do you know how to manually generate that checksum?
DMI.zip (213 Bytes)