OSDev.org

greenboard wrote:Is it possible for an operating system to access / modify BIOS settings?

greenboard wrote:Is the BIOS settings menu run just like an operating system, or does it have extra privileges and access that an operating system does not?

greenboard wrote:If so where are these settings stored, and what mechanism is used to protect access to them?

greenboard wrote:Would it be possible to create an OS that replicated the functionality of a BIOS settings screen?

greenboard wrote:This is purely a theoretical question

Is it possible for an operating system to access / modify BIOS settings?

greenboard wrote:Is the BIOS settings menu run just like an operating system, or does it have extra privileges and access that an operating system does not?

greenboard wrote:If so where are these settings stored, and what mechanism is used to protect access to them?

Octocontrabass wrote:n less-old PCs, the settings are stored in the firmware ROM, which is actually a type of EEPROM.

greenboard wrote:I know they will be stored in an extremely non-standarised manner and it would be stupid to try and read or modify them, but I am just asking out of curiosity, to try and better understand the boot process. Would it be possible to create an OS that replicated the functionality of a BIOS settings screen?

Korona wrote:"The BIOS uses the same instructions as the OS" is not the full story though. Lots of hardware has lock bits that can only be cleared by asserting the reset vector.

Ethin wrote:I must clear up a misconception you seem to have here, bzt. Your misconception is that if a kernel hunts down the appropriate bit or byte, they can do anything with UEFI. This is not so.

Ethin wrote:Additionally, you make the false assumption that every UEFI implementation is EDK2.

Ethin wrote:the probability that manufacturers of computers just threw EDK2 on them is highly unlikely.

Ethin wrote:Also, secure boot is most likely going to prevent you as well, as is the UEFI runtime services.

bzt wrote:

Ethin wrote:I must clear up a misconception you seem to have here, bzt. Your misconception is that if a kernel hunts down the appropriate bit or byte, they can do anything with UEFI. This is not so.

The TianoCore source says otherwise. It is not a "misconception", rather the result of the analysis of the TianoCore source code. You've been warned not to fall for the propaganda and marketing bs, I wrote: "Obviously Intel and M$ do not want you to know this, but in reality it is that simple."

bzt wrote:

Ethin wrote:Additionally, you make the false assumption that every UEFI implementation is EDK2.

Nope, I've never said that. Read my post carefully, I've specifically talked about TianoCore UEFI only.

bzt wrote:

Ethin wrote:the probability that manufacturers of computers just threw EDK2 on them is highly unlikely.

Quite the contrary, it is extremely very likely. Manufacturers are only interested in profit, not in a properly written firmware, which means they just add the minimum necessary drivers to TianoCore for their boards and get on with it. No manufacturers will spend money on implementing and testing a completely new firmware from ground up unless they really really have to.

bzt wrote:

Ethin wrote:Also, secure boot is most likely going to prevent you as well, as is the UEFI runtime services.

That's not so, empirically proven by many UEFI rootkits. Secure boot can't stop you from modifying the run-time services (either data or code), and I've already shown two ways how to circumvent the run-time service checks, so that is doable as well. (And here's a third one: with a UEFI driver, hijack ExitBootServices to patch SetVariable not to check AtRunTime or use a different variable). I'd advice you to study sources of rootkits (many are available on github and in MSF) and CVE tickets to learn about the many many ways how you can circumvent run-time checks.

If you expect security from UEFI, then you're the one who is mistaken. Not only it was written by non-security experts, never actually verified to be correct, but even the U.S. government forces it to be unsecure and law mandates backdoors to be placed in it. Which is conceptually wrong, because anybody can use those backdoors, not just the CIA.

Cheers,
bzt

Ethin wrote:

bzt wrote:The TianoCore source says otherwise. It is not a "misconception", rather the result of the analysis of the TianoCore source code. You've been warned not to fall for the propaganda and marketing bs, I wrote: "Obviously Intel and M$ do not want you to know this, but in reality it is that simple."

Sighs* Here we go again, more of your conspiracy theories that you can't prove.

/**
  Return TRUE if ExitBootServices () has been called.
  @retval TRUE If ExitBootServices () has been called.
**/
BOOLEAN
AtRuntime (
  VOID
  )
{
  return false;
}

bzt wrote:

Ethin wrote:

bzt wrote:The TianoCore source says otherwise. It is not a "misconception", rather the result of the analysis of the TianoCore source code. You've been warned not to fall for the propaganda and marketing bs, I wrote: "Obviously Intel and M$ do not want you to know this, but in reality it is that simple."

Sighs* Here we go again, more of your conspiracy theories that you can't prove.

Here we go again, yet another sad little attack attempt against me without thinking first. Personal insult instead of reasoning, is that really the best you can come up with? ROTFL! What were you thinking? That this will make me upset or something? It just make me feel sorry for you.

For your information, I've linked the source. I obviously know the answer, but just for the fun of it, I ask you, because I'm interested in *your* response, what do you think what will happen if you replace that AtRuntime() function with the following?

Code: Select all

/**
  Return TRUE if ExitBootServices () has been called.
  @retval TRUE If ExitBootServices () has been called.
**/
BOOLEAN
AtRuntime (
  VOID
  )
{
  return false;
}

If you think that this is a "conspiracy theory" as you say, then I kindly suggest you to see a theraphist for your own good.

And if you think governments aren't trying to force backdoors into software, then you've probably lived under a rock in the last decade (either that, or the New York Times as well as the The Guardian, Wired and Forbes must be all conspiracy theorists too because they all keep talking about backdoors and agencies...)

Have a nice day,
bzt

Ethin wrote:First, I have made absolutely no personal attacks towards you in this thread.

Ethin wrote:A personal attack is an abusive remark on or relating to somebody's person instead of providing evidence

Ethin wrote:Third, this reply of yours that I quoted in this post doesn't actually prove anything you said.

thepowersgang wrote:Please don't attack other forum members (even if it seems like they attacked you first), instead post clarifications and counter-arguments in a civil manner.

bzt wrote:

Ethin wrote:First, I have made absolutely no personal attacks towards you in this thread.

Yes, you did, called me a conspiracy theorists, several times.

Ethin wrote:A personal attack is an abusive remark on or relating to somebody's person instead of providing evidence

Which is exactly what you did. No matter how you put it, calling someone a conspiracy theorists is an abusive remark. It is hard not to notice that you haven't answered my question at all, instead you have repeated your insults.

Ethin wrote:Third, this reply of yours that I quoted in this post doesn't actually prove anything you said.

bzt wrote:

thepowersgang wrote:Please don't attack other forum members (even if it seems like they attacked you first), instead post clarifications and counter-arguments in a civil manner.

Thank you very much for the reminder. I'll keep that in mind. I'd also kindly ask you to take a look at this topic too, where some members are clearly trying to provoke fights. Thank you.

Cheers,
bzt