Binarly PKfail detector
pk.fail
Binarly PKfail detector

I want to check if my Lenovo T480 is afftected by the recent PKFail, but have no idea how to extract the bios firmware for validation. Can someone detail the steps? Thanks.

    • umami_wasabiOP
      8·
      4 months ago

      Thanks for the hint. I followed and checked: safe

      $ efi-readvar -v PK
Variable PK, length 983
PK: List 0, type X509
    Signature 0, size 955, owner 3cc24e96-22c7-41d8-8863-8e39dcxxxxxx
        Subject:
            C=JP, ST=Kanagawa, L=Yokohama, O=Lenovo Ltd., CN=Lenovo Ltd. PK CA 2012
        Issuer:
            C=JP, ST=Kanagawa, L=Yokohama, O=Lenovo Ltd., CN=Lenovo Ltd. PK CA 2012
  • dingdongitsabear
    8·
    4 months ago

    I don’t think any Thinkpads have AMI firmware, which is the source of this fuckup.

  • thayer@lemmy.caEnglish
    2·
    4 months ago

    I can’t say for certain, but I think you just have to grab the last firmware binary released for your T480 from the Lenovo website and run it through the online validator: https://pk.fail/

    • umami_wasabiOP
      2·
      4 months ago

      Tried. They only release it for Windows, or a bootable ISO, which I can’t see what files are in there. I also tried getting the firmware from LVFS but I’m not sure if I done it right as non of them start with "EFI " header (which I assume that’s the file I should be looking at).

        • umami_wasabiOP
          1·
          4 months ago

          Except the directory structure is totally gone. At least I can’t see it with either by mounting or with archive software.

          • thayer@lemmy.caEnglish
            2·
            4 months ago

            I was able to extract the img from the ISO using geteltorito as described in section 5 of this ArchWiki article. Once you mount the resulting img file, you’ll end up with the same file contents achieved by running their Windows BIOS Utility through wine.

            The relevant binaries appear to be under the folders, N24ET76P and N24ET76W. Both scan clean for me, for whatever that’s worth:

            curl -X POST -F'file=@N24ET76P/$0AN2400.FL1' https://pk.fail
{"details":{"analysis-time":"1.395106993s","hashes":{"md5":"ba73792a5fc831ca84b4cd3a21c03247","sha1":"24a5bb42d670c7705aed06588f0092ec11a32564","sha256":"b9510c73657460ae24c550b71d217a543b0fc3c30a3e081eff31d9d8f1a2bdda","sha512":"8ef6f0dcffbca05b79710b8599b1b1c926ee59185a675bc7eeede6da040c751097303ada523611271de6aaf190a597cdd6e9d5cf564d06987abcf712f61227c6"}},"status":"not-vulnerable"}

curl -X POST -F'file=@N24ET76W/$0AN2400.FL1' https://pk.fail
{"details":{"analysis-time":"1.438471526s","hashes":{"md5":"de1551b0bcc73e19375f7111def72278","sha1":"cd41f36d018f940c308a7be25a20e81bdb7e4cf2","sha256":"b3f646095e47bb94f04390c756cb4133201b1231a8b224174f10bb06bd3835f2","sha512":"55143f4903f92d88057bc9d4232b0d328e9ace36330f35fafdf0485d8bebb3f79b9fedc88ab1dec7fc04a8a3e0890887c1dd7632a2ffa397fb0917be90e3f93f"}},"status":"not-vulnerable"}

            The linux command mentioned in the Ars Technica article elsewhere here is efi-readvar -v PK. For Fedora and Arch users, efi-readvar is available in the efitools package.

            Edit: Clarity