DMI/SMBIOS editing

[lucash4x0r]

Would it be possible to edit the DMI information that resides in the ROM ( 0x000F0000-0x000FFFFF ) ? I've tried editing the SMBIOS that resides in the Phys address and it works on some chipsets, but on some it doesnt, any workaround ?

By the way, DMI != SMBIOS.

I'd like to keep using the wrappers included in the project, pretty neat project

[HoShiMin]

@lucash4x0r, what exactly happens on 'bad' chipsets?

[lucash4x0r]

It is not that they are bad, changes are simply not made, because you cant write to this part of the memory ? I suppose its because inside of the ROM ?

Can we edit from kernel this memory range 0x000F0000-0x000FFFFF ?

[HoShiMin]

@lucash4x0r, yes, you can, but how do you change this?

[lucash4x0r]

How can we edit it? Ive tried everything cr0 16bit flip, mdl and values dont change

[HoShiMin]

@lucash4x0r, oh, wait, 0xF0000..0xFFFFF - it's a physical range, not virtual. You should map it to virtual address space using MmMapIoSpaceEx. You will get a kernel virtual address and ability to edit this region.

And how it works? Somethig like?

mov rax, VA
mov [rax], val
mov rax, [rax] ; Here rax != val?

[lucash4x0r]

Could you explain a little bit that asm that you wrote there , what is it for essentially ? I am currently using RtlCopyMemory after i've done MmMapIoSpaceEx , I can read and edit the values just fine on my LAPTOP, but it wont work on my desktop, I can read values on desktop but values will not change. Further giving me more reasons to believe the ROM in some chipsets cannot be edited.

[lucash4x0r]

PSMBIOS_EPS FindSMBIOS(UCHAR* buff, ULONG size) // DMI is not equal to SMBIOS
{
	UCHAR* p = buff;

	for (ULONG i = 0; i < size; i += 16)
	{
		if (0 == memcmp(p, "_SM_", 4))
		{
			PSMBIOS_EPS psm = (PSMBIOS_EPS)p;

			if (0 == memcmp(psm->DMISignature, "_DMI_", 5))
			{
				UCHAR chk = 0;

				// verify checksum
				for (ULONG i = 0; i < psm->Length; i++)
				{
					chk += *(p + i);
				}

				if (0 == chk)
				{
					return psm;
				}
			}
		}
		p += 16;
	}
	return nullptr;
}

void clear_smbios()
{
	const ULONG MEMRANGE = 64 * 1024; // 0xF0000 ~ 0xFFFFF, 64K
	const ULONG MEMSTART = 0xF0000;

	PHYSICAL_ADDRESS addr;
	addr.QuadPart = MEMSTART;
	if (auto p = MmMapIoSpaceEx(addr, MEMRANGE, PAGE_READWRITE | PAGE_NOCACHE)) { 
		Log::Print("Mapped phys mem");

		if (auto pSMBIOS = FindSMBIOS((UCHAR*)p, MEM_RANGE - 0xF)) { // I try to find DMI
			Log::Print("SMBIOS at %p\r\n", 0xF0000 + ((UCHAR*)pSMBIOS->StructAddress - (UCHAR*)p)); // I find it just fine
			
			memset(pSMBIOS, 0, sizeof(PHYSICAL_ADDRESS)); // This wont work
		}

		MmUnmapIoSpace(p, MEM_RANGE);
	}
	else
		Log::Print("Failed mapping");
}

I am trying this for now with no luck

[HoShiMin]

@lucash4x0r, check whether HVCI/DeviceGuard are disabled on your desktop. And check what happens with something like http://rweverything.com/

[lucash4x0r]

@HoShiMin HVCI disabled on both computers

[lucash4x0r]

Laptop smbios no DMI type in sight

In desktop it seems smbios is located in dmi, and laptop is directly in physical memory idk if i explained myself good here, but there are definitely differences

[HoShiMin]

@lucash4x0r, try to edit this memory using RWEverything. Does it work?

[lucash4x0r]

Trying to edit the first letter of Megatrend, doesnt change, this is on desktop by the way

[HoShiMin]

@lucash4x0r, I don't know exactly, but it seems that your chipset rejects all writes to this memory

[lucash4x0r]

DMI Editor works on my desktop tho, i wonder how they do it

[HoShiMin]

@lucash4x0r, could you give me a link?