[Need Help] Have I Found the Clevo Boot Guard Signing Keys?

BIOS/UEFI Modding BIOS Modding Guides and Problems
1

Discovery of Clevo Boot Guard Signing Keys

I may have uncovered the Clevo Boot Guard signing keys, which might have been staring us in the face all along. I need help from those more experienced in this field to develop a method for disabling BootGuard using a modified, SIGNED OEM BIOS. This could enable flashing mods or Coreboot distros onto Clevo laptops. I know only enough to be dangerous!

I also know this is a potential (ok, well it just is) a very large security vulnerability. Don't download random bioses unless it's from Clevo or self modified! I'm not responsible for bricking your machine if we get that far, and you should have a dump of your running bios and a ch341a programmer anyway! I could have probably profited off this as a bug bounty issue or something, but instead am being altruistic as I want more coreboot in the world!

Also note that aside from bootguard, the other applications in this package appear to be the full shebang necessary to produce flashable, OEM firmware update files. Be careful!

Now before you go posting this on reddit or whatever, let's make sure it is what I think it is so we don't get pie on our face...

Background

  • Context: Since the 10th or 11th generation of Core CPUs, Clevo has been using BootGuard, making BIOS modding and using System76 and Dasharo ports difficult or really, impossible.
  • Motivation: After my System76 machine failed, I chose a more affordable Clevo laptop since I like the hardware and the potential firmware hackability, but didn't really want to pay the premium and be locked into limited hardware choices, when their (and Dasharo's) firmware would work with other Clevo machines with slight modification. I want to mod the BIOS and/or install a coreboot distro and open source EC firmware on this new machine - ideally Dasharo, or the System76 firmware, if not vanilla coreboot.

Resources

  1. BIOS Repositories:
  2. Example BIOS Image + Tools:
    • P_Series/PDxx_Series/PDxxSxx/PDxxSNED/B10717.zip

Please note that there are various readmes, pdf/doc guides, and a text file with some instructions in the above zip. That last one needs translated from Chinese to English to read in my case (thanks Google), but there are further clues inside of these documents, as well.

Current Process

The BIOS rebuild batch files are messy, so youā€™ll need to work from within the BpmGen2 directory and copy the relevant files there to ensure everything functions correctly. Hereā€™s the process:

  1. Extract Keys:

    Use BootGuardKey.exe to extract 4 PEM key files (public and private). These keys are embedded in plaintext within the executable, indicating they are used across various BootGuard-enabled Clevo machines. Security by obscurity! Make sure to copy the pem files to the BpmGen2 directory - running it a second time deletes the keys, running it a 3rd extracts them again... "Secure." The extracted keys are essential for generating the key manifest and signing the BIOS images.

  2. Copy Files:

    Locate from the tree the below two files, and relocate and rename them inside the BpmGen2 directory accordingly: 

    @copy /b PD5xSNC.BIN Tool\RaptorLakeS_FIT.fd                                           
@copy /b RaptorLakeS.fdm Tool\RaptorLakeS.fdm
  3. Patch Hash: 
    @PatchFdmHash.exe RaptorLakeS_FIT.fd RaptorLakeS.fdm
  4. Generate Key Manifest: 
    @BpmGen2.exe KMGEN -KEY pubkey.pem BPM -SIGNKEY keyprivkey.pem -SIGNPUBKEY keypubkey.pem -SIGHASHALG SHA384 -SCHEME RSAPSS -KMKHASH SHA384 -KMID 0x01 -SVN 1 -KM Manifest.bin -d:2 >bpmgen2_km.txt
  5. Generate Signed Boot Guard: 
    @BpmGen2\BpmGen2.exe GEN RaptorLakeS_FIT.fd bpmgen2.params -BPM Manifest.bin -U RaptorLakeS.fd -KM KeyManifest.bin -d:2 >bpmgen2_bpm.txt
  6. Verify Signatures:

    Use BpmGen2.exe INFO to verify the signatures of the specific pieces processed by the BpmGen2 tool. This ensures that the key manifest and BIOS image segments match the official release.

Past this point, I have not yet determined what else needs done because I was up way too late figuring this much out. I was hoping for some help and confirmation if possible on this discovery, but if nobody else pitches in, I'll eventually get to it but it may be a few weeks.

Next Steps

  • Disable BootGuard (mode 0) to allow for custom firmware or replacement with Coreboot. This will be with the CSME mfit tool?
  • Help Appreciated - Assistance with the final steps to disable BootGuard and complete the confirmation and modification process is much appreciated! I'll work on this when I can but I'm exhausted!

[color=blue][u]Edit by Fernando:[/u] Thread title shortened and specified[/color]
1 Like
2

guess it may help with running 13/14th on NH5xJxx

1 Like
3

Pretty much every Clevo that has bootguard I believe. Same certs I think, from a cursory look.

4

Hi, IĀ“ve unlocked my CLEVO NP50SND bios. 13700hx +rtx4060

After unlocking variables (UEFIToll , IFR , HxD ā€¦)from a dump bios or from a downloaded 32MB file you can make use of their oem driver that comes with the signing tool and all boot guard certificates HiDrive and resing the modded driver to flash it into your laptop. To do this you will a ā€œSecure Certificateā€ , find how to do it here (name it as ā€œSecure Certificateā€). Insyde H2O bios unlocking/flashing : Read all.

After all done you will end with a resigned isFlash.efi file and fhast it via ftp with a usb drive. You may have to remove one ram dim out and all the SSD drives to be able to do it.

1 Like
5

Hi there. It is really rare to see someone discussing about this specific bios.

Recently I think the links below are down:

  1. BIOS Repositories:

Any backup? Could you please upload * P_Series/PDxx_Series/PDxxSxx/PDxxSNED/B10717.zip again? I want to update my bios. Thank you so much!

6

The user repo still works for meā€¦the hidrive does seem to be down. I hope not forever!

User repo last updated in October 2024ā€¦

7

Yes the repo is still working, with unavailability of some latest patch. Unfortunately, I think the hidrive was expired permanently. As you can check : https://clevo-computer.com/en/support-drivers the official site was down and even the domain is ready to be sold. I found nowhere that clevo-computer will establish a new site and create a new link for downloading the resources.

å¾®äæ”ęˆŖ图_20241121135043
å¾®äæ”ęˆŖ图_202411211350431390Ɨ1188 203 KB

8

So I didnā€™t think I still had theseā€¦I did on my other machine though, from when I was tinkering and flashingā€¦

I emailed the ā€œfor saleā€ email to see if the individual selling that site could possibly reupload and share that stuff somewhere but Iā€™m not holding my breath.

mega.nz/folder/HRtnlSKI#mDHznumG3f1DZ_EeUQpIyw

1 Like
9

I saw all the drivers for this model have been updated on www.clevo.com.tw.
Unfortunately, the resources are unable to be downloaded and no bios or EC available.

Our model: PD5x7xSNx(-D)(-G)

10

Checked my NH55JNNQ machine with MEINFO from CSME TOOL v16.1, the FPF fused key hash is exactly same to this key (CreateDeleteBIOSKey.keypubkey.pem) and signature with the private key(CreateDeleteBIOSKey.keyprivkey.pem) can be verified by the aforementioned public key. As for disabling BootGuard, in my humble opinion, is not possible since OEM has fused this key hash to PCH and it will be verified by firmware/hardware from Intel. But since we have the KM key, we can just sign custom bios key manifest with this key. I was thought of enabling some feature (Intel TXT) for my machine with Intel MFIT but sadly I dare not to do so since Iā€™m lack of recovery method. The flash chip for storing BIOS is in a 256MB SMT package. I can not make reliable connection with it without desoldering it from motherboard.