diff options
Diffstat (limited to 'docs/hcl/gm45_remove_me.md')
| -rw-r--r-- | docs/hcl/gm45_remove_me.md | 28 |
1 files changed, 0 insertions, 28 deletions
diff --git a/docs/hcl/gm45_remove_me.md b/docs/hcl/gm45_remove_me.md index 5b705e44..1552c40b 100644 --- a/docs/hcl/gm45_remove_me.md +++ b/docs/hcl/gm45_remove_me.md @@ -26,8 +26,6 @@ Another project recently found: <http://io.smashthestack.org/me/> [Back to previous index](./). - - ICH9 gen utility {#ich9gen} ================ @@ -145,8 +143,6 @@ brick your laptop. For external flashing guides, refer to [../install/](../install/). - - ICH9 deblob utility {#ich9deblob} =================== @@ -223,8 +219,6 @@ descriptor and 8K gbe regions, which will then be safe to flash. Refer back to [../install/\#flashrom](../install/#flashrom) for how to flash it. - - demefactory utility {#demefactory} =================== @@ -267,14 +261,11 @@ disassemble and re-flash externally unless you brick the device. demefactory is part of the ich9deblob src, found at *resources/utilities/ich9deblob/* - - The sections below are adapted from (mostly) IRC logs related to early development getting the ME removed on GM45. They are useful for background information. This could not have been done without sgsit's help. - Early notes {#early_notes} ----------- @@ -297,10 +288,6 @@ Early notes {#early_notes} what the X201 uses: <http://www.intel.co.uk/content/dam/www/public/us/en/documents/datasheets/6-chipset-c200-chipset-datasheet.pdf> - - - - Flash chips {#flashchips} ----------- @@ -325,13 +312,9 @@ Flash chips {#flashchips} - Schematics for X200s laptop: <http://pdf.datasheetarchive.com/indexerfiles/Datasheets-USER/DSAUPLD00006104.pdf>. - - - Early development notes {#early_development_notes} ----------------------- - Start (hex) End (hex) Length (hex) Area Name ----------- --------- ------------ --------- 00000000 003FFFFF 00400000 Flash Image @@ -399,8 +382,6 @@ X200. End justified means, and the utility is no longer needed since the ich9deblob utility (documented on this page) can now be used to create deblobbed descriptors. - - GBE (gigabit ethernet) region in SPI flash {#gbe_region} ------------------------------------------ @@ -410,7 +391,6 @@ documented in this public datasheet: The only actual content found was: - 00 1F 1F 1F 1F 1F 00 08 FF FF 83 10 FF FF FF FF 08 10 FF FF C3 10 EE 20 AA 17 F5 10 86 80 00 00 01 0D 00 00 00 00 05 06 20 30 00 0A 00 00 8B 8D @@ -433,7 +413,6 @@ is set to put gbe directly after the initial 4K flash descriptor. So the first 4K of the ROM is the descriptor, and then the next 8K is the gbe region. - ### GBE region: change MAC address {#gbe_region_changemacaddress} According to the datasheet, it's supposed to add up to 0xBABA but can @@ -463,9 +442,6 @@ Look at resources/utilities/ich9deblob/ich9deblob.c. to 0xBABA. In other words, the checksum is 0xBABA minus the total of the first 0x3E 16bit numbers (unsigned), ignoring any overflow. - - - Flash descriptor region {#flash_descriptor_region} ----------------------- @@ -529,8 +505,6 @@ So, *x << 12 = address* If it's in descriptor mode, then the first 4 bytes will be 5A A5 F0 0F. - - platform data partition in boot flash (factory.rom / lenovo bios) {#platform_data_region} ----------------------------------------------------------------- @@ -542,8 +516,6 @@ This is a 32K region from the factory image. It could be data It has only a 448 byte fragment different from 0x00 or 0xFF. - - Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\ Permission is granted to copy, distribute and/or modify this document under the terms of the Creative Commons Attribution-ShareAlike 4.0 |