Ok, the repo should now contain most interesting findings on A300, knoll and some pictures
But also BIOS images. Missing are "tools"
3.60R and 1.46 side-by-side
Drivers in the UEFI-Image
Probably CPU-microcode and more system-based-hw-images
e.g. "OemActivation" has OA3 -- which should be the OEM-Windows-Key-entry
--
https://docs.microsoft.com/en-us/troubleshoot/windows-client/deployment/validate-oem-activation-key
There is also the bugged S3-driver, driver for the power- and sleep-buttons, driver to wake up from sleep, all low-level stuff the OS does not care about. It has to use those functions written. (more drivers: RealtekUefiDriver (NIC), even Fonts are there, "Defaults" -- which is probably "Load Defaults", setupdata, etc) I just don't know where to look for knoll.
There are even links to .ca files (certificate- and cert-requests which are looking for "
http://crl.microsoft.com/pki/crl/products/MicCorThiParMarRoo_2010-10-05.cr")
There are even embedded images
Oh dear, this is has a big scope, if we gonna really gonna try to reverse and adopt it.
Some of the GUID's are generic and known by UEFI-specs, those have names on the UEFItool. Unknown enteties are shown by GUID. Probably Knoll/Chipset-releated is one of those unknown entities.
Me trying simultaniously to update the git-repo, so all who wants to get a hold of, can go-as-the-analysis-goes.
Reading Knoll-Activator Dan's Logic Analyzed Data
But I think here is also a problem. How can we do following:
1.
- set valid address to be 0x50
- write data to this address: "0x5E"
2.
- set valid address to read from: 0x50
- data read: 0x80 -- but than the orange data byte 5E: 80? Should it not be 0x5E as it was written?
Ah, I get it: It sets the address to read from, consists of 2 bytes:
- write to controller to read from 0x50 0x5E
- word from 0x505E = 0x80
Gonna look up I2C protocol to understand the happening...
So, somewhere in the UEFI BIOS should be 0x80 (and more), etc to "authorize" or "authenticate" the system-features?
Diggin further in the Trace:
It has sequence of reading 2 Bytes from an adjascent address, like:
Read: [Address | Value]
#1.
0x00 |
0x23 (may be the init), then
#2.
0xFE | 0x45
0xFF | 0xAD
#3. --> Could be first Config Block, then
0x7E | 0xCD
0x7F | 0x34
#4. --> second value of ??config block??
0x5E | 0x80
0x5F | 0xCE
#5. -->
0x40 | 0x04
0x41 | 0xCD
-->
(now again the ?separator?)
#6.
0x00 |
0x23 (same as first read, init)
#7. = #2.
0xFE | 0x45
0xFF | 0xAD
#8. = #3.
0x7E | 0xCD
0x7F | 0x34
#9. = #4.
#10. = #5.
It maybe a sync, init, so Clocks and Data passes and is not corrupted. (I2C-sync)
Now they can speak... lets see. Btw. The file I'm analyzing: "ActivatorChipTrimmed.sr", using PulseView stable (free)
the things I wrote are for the A-mark in the screenshot, very probably a sync-phase
Now lets look inside the main block, thicker, middle-part
Starts with
#1
write, addr=0x00, 1Byte, value=0x00
#2 then it reads (first block could be a value)
0x80 | 0x0C
0x81 | 0x4A
0x82 | 0x05
0x83 | 0x20
(here I dont know)
0x89 | 0x94
0x84 | 0x00
0x8C | 0x05
0x91 | 0x5A
(here could be the config-part, since it "just reads" straight on)
0x92
0x93
0x94
0x95
0x96
0x97
0x98
0x99
0x9A
0x9B
...
0xAF
(same as 3-lines of first block in beginning of #2)
0x80 | 0x0C
0x81 | 0x4A
0x82 | 0x05
(repeating again)
0x80 | 0x0C
0x81 | 0x4A
0x82 | 0x05
(then it repeats again the read from 0x92..0xAF)
(then again read from 0x80..0x82)
then it tries to read something, but there is no answer from the flash -- "data read-operation" returning no value
after it goes back reading from -- following addresses are new in the whole sequence:
0x02 | 0x0C
0x0C | 0x01
alternating
then it's done.
so there are not many bytes to understand.
It would make very much sence to grab the i2C trace from X300 and compare. Maybe by rewriting the Flash is it possible to "become the X300". Dunno untill now... However, this is all the data read from the Knoll:
FF 23 45 AD CD 34 80 CE 04 CD 23 45 AD CD 34 80
CE 04 CD 0C 4A 05 20 94 00 05 5A 5A 5A 10 D7 31
F0 0A 20 08 00 05 00 C0 14 27 E6 00 00 00 00 00
00 0C 4A 05 0C 4A 05 20 94 00 05 5A 5A 5A 10 D7
31 F0 0A 20 08 00 05 00 C0 14 27 E6 00 00 00 00
00 00 0C 4A 05 FF FF 0C 01 0C 01 FF FF 04 23 55
55 7C A4 DF F5 5D 2C 1F 4B 7A EB B5 66 27 6A 33
CB 2D FB A8 4B 0D 52 CC D1 88 4D 33 A1 55 55 4C
B4 07 01 23 63 5D FF 35 FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF 07 B5 11 01 00 9A 43 FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF 23 C1 4E BF E3 EE 7F 11 BB
E1 0E 15 2E C4 50 45 5A 94 0F C9 1B 0E 35 D8 A7
D3 A7 E7 46 F0 FD D6 D7 3E 0C
last thing:
X300-1.46 Frontend Options: OC Tweaker
A300-3.60R Frontend Options: OC Tweaker