Record · corpus.blog/posts/01a08c64-aa06-7056-9bd4-42882b5fac6b

🤫 Unlocking secret ThinkPad functionality for emulating USB devices

xairy.io · published 22 February 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at xairy.io Wayback capture

3blogs citing

First cited: 1 Mar 2024
Most recent: 31 Aug 2024
Rank this month: not ranked
Links from this post: 124
Words captured: 27,827

Cited by

Blog

In the post

Date

reflexive.space

Enabling DCI.DbC on a Jasper Lake NUC Read at the source ↗

31 Aug 2024

davidjwalz.com

Dump of Interesting Links Read at the source ↗

8 Mar 2024

n0.lol

BGGP4: A 420 Byte Self-Replicating UEFI App For x64 Read at the source ↗

1 Mar 2024

Links from this post

Link

Host

https://edc.intel.com/content/www/us/en/design/ipla/software-development-platforms/client/platforms/alder-lake-desktop/12th-generation-intel-core-processors-datasheet-volume-1-of-2/010/extensible-device-controller-interface-xdci/

edc.intel.com

https://github.com/greatscottgadgets/Facedancer

github.com

http://www.hwtools.net/Adapter/EC3380-AB.html

hwtools.net

https://docs.broadcom.com/docs/12351862

docs.broadcom.com

https://www.sonnettech.com/product/echoexpresscard34thunderbolt.html

sonnettech.com

http://www.hwtools.net/adapter/usb3380evb.html

hwtools.net

http://www.bplus.com.tw/Adapter/PP3380-AB.html

bplus.com.tw

https://github.com/ufrisk/pcileech/blob/master/usb3380.md

github.com

https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-usb_role

kernel.org

https://elixir.bootlin.com/linux/v6.5/source/drivers/usb/roles/intel-xhci-usb-role-switch.c

elixir.bootlin.com

https://elixir.bootlin.com/linux/v6.5/source/drivers/usb/roles/class.c

elixir.bootlin.com

https://elixir.bootlin.com/linux/v6.5/source/drivers/usb/host/xhci-ext-caps.c

elixir.bootlin.com

https://elixir.bootlin.com/linux/v6.5/source/drivers/usb/host/xhci-pci.c

elixir.bootlin.com

https://lore.kernel.org/all/CAGR4S9HQiZCsA7Y5_47j-xBOkydKiT2Exam=36L=-vwRjt+UWA@mail.gmail.com/t/

lore.kernel.org

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html

kernel.org

https://en.wikipedia.org/wiki/Semiconductor_intellectual_property_core

en.wikipedia.org

https://www.synopsys.com/dw/ipdir.php?ds=dwc_usb_3_0_controllers

synopsys.com

https://www.phoronix.com/news/USB-Thunderbolt-Linux-5.19

phoronix.com

https://en.wikipedia.org/wiki/BIOS

en.wikipedia.org

https://en.wikipedia.org/wiki/IBM_PC_compatible

en.wikipedia.org

https://projectacrn.github.io/latest/developer-guides/hld/usb-virt-hld.html

projectacrn.github.io

https://en.wikipedia.org/wiki/ACPI

en.wikipedia.org

https://elixir.bootlin.com/linux/v6.5/source/drivers/usb/dwc3/dwc3-pci.c

elixir.bootlin.com

https://www.kernel.org/doc/html/latest/admin-guide/abi-testing.html

kernel.org

https://pcsupport.lenovo.com/us/de/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x1-carbon-6th-gen-type-20kh-20kg/downloads/ds502281

pcsupport.lenovo.com

https://wiki.archlinux.org/title/Lenovo_ThinkPad_X1_Carbon_(Gen_10

wiki.archlinux.org

https://github.com/LongSoft/UEFITool

github.com

https://github.com/tianocore-docs/edk2-UefiDriverWritersGuide/blob/master/3_foundation/35_guids.md

github.com

https://tylernguyen.github.io/x1c6-hackintosh/BIOS/modding-the-BIOS/

tylernguyen.github.io

https://github.com/tylernguyen/x1c6-hackintosh

github.com

https://tylernguyen.social/@tylernguyen

tylernguyen.social

https://www.adafruit.com/product/4726

adafruit.com

https://brs.im/

brs.im

https://ftdichip.com/products/ft2232h-mini-module/

ftdichip.com

https://en.wikipedia.org/wiki/USB-to-serial_adapter

en.wikipedia.org

http://blog.cr4.sh/2016/10/exploiting-ami-aptio-firmware.html

blog.cr4.sh

https://twitter.com/d_olex

twitter.com

https://www.amazon.de/-/en/DollaTek-200-208mils-Socket-Adapter-OTS-20-1-27-01/dp/B07DK2TNYV

amazon.de

https://www.amazon.de/-/en/EL-CP-004/dp/B01EV70C78/

amazon.de

https://ftdichip.com/wp-content/uploads/2020/07/DS_FT2232H_Mini_Module.pdf

ftdichip.com

https://github.com/digmorepaka/thinkpad-firmware-patches/blob/master/xx70_xx80_patches_v7.txt

github.com

https://habr.com/en/articles/250611/

habr.com

https://github.com/tylernguyen/x1c6-hackintosh/issues/85

github.com

https://en.wikipedia.org/wiki/Intel_vPro

en.wikipedia.org

https://electronics.stackexchange.com/questions/644717/are-usb-2-0-type-a-male-male-cables-compliant-with-usb-specification

electronics.stackexchange.com

https://www.amazon.de/gp/product/B094FYL9QT/

amazon.de

https://www.amazon.de/-/en/gp/product/B07NSM1XTL/

amazon.de

https://www.datapro.net/products/usb-3-0-super-speed-a-a-debugging-cable.html

datapro.net

https://www.amazon.de/-/en/gp/product/B007XTHD4M/

amazon.de

https://elixir.bootlin.com/linux/v6.5/source/drivers/usb/gadget/legacy/Kconfig

elixir.bootlin.com

https://twitter.com/h0t_max

twitter.com

https://www.thinkwiki.org/wiki/Category:X1_Carbon_(6th_Gen

thinkwiki.org

https://en.wikipedia.org/wiki/Platform_Controller_Hub

en.wikipedia.org

https://en.wikipedia.org/wiki/List_of_Intel_chipsets

en.wikipedia.org

https://en.wikipedia.org/wiki/Kaby_Lake

en.wikipedia.org

https://www.intel.com/content/www/us/en/content-details/332691/intel-100-series-chipset-family-platform-controller-hub-pc

intel.com

https://github.com/tianocore/edk2-platforms

github.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/Include/Register/PchRegsPmc.h

github.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/Library/PeiDxeSmmPchCycleDecodingLib/PchCycleDecodingLib.c

github.com

https://wiki.osdev.org/PCI_Express

wiki.osdev.org

https://elixir.bootlin.com/linux/v6.5/source/drivers/platform/x86/intel/pmc/pltdrv.c

elixir.bootlin.com

https://elixir.bootlin.com/linux/v6.5/source/include/linux/platform_device.h

elixir.bootlin.com

https://elixir.bootlin.com/linux/v6.5/source/drivers/platform/x86/intel/pmc/core.h

elixir.bootlin.com

https://elixir.bootlin.com/linux/latest/source/drivers/platform/x86/intel/pmc/core.c

elixir.bootlin.com

https://i.blackhat.com/asia-19/Thu-March-28/bh-asia-Goryachy-Ermolov-Intel-Visa-Through-the-Rabbit-Hole.pdf

i.blackhat.com

https://twitter.com/_markel___

twitter.com

https://patents.google.com/patent/EP2778930A2/en

patents.google.com

https://kakaroto.ca/2019/11/exploiting-intels-management-engine-part-2-enabling-red-jtag-unlock-on-intel-me-11-x-intel-sa-00086/

kakaroto.ca

https://kakaroto.ca/2020/08/exploiting-intels-management-engine-part-3-usb-hijacking-intel-sa-00086/

kakaroto.ca

https://twitter.com/KaKaRoToKS

twitter.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/LibraryPrivate/PeiDxeSmmPchPsfPrivateLib/PchPsfPrivateLib.c

github.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/Include/Register/PchRegsPcr.h

github.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/Include/Register/PchRegsPsf.h

github.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/Library/PeiDxeSmmPchPcrLib/PchPcrLib.c

github.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/Include/PchReservedResources.h

github.com

https://www.intel.com/content/www/us/en/content-details/332691/intel-100-series-chipset-family-platform-controller-hub-pch-datasheet-volume-2.html

intel.com

https://elixir.bootlin.com/linux/v6.5/source/arch/x86/mm/ioremap.c

elixir.bootlin.com

https://github.com/chipsec/chipsec/issues/527

github.com

https://lab.whitequark.org/notes/2017-11-08/accessing-intel-ich-pch-gpios/

lab.whitequark.org

https://twitter.com/whitequark

twitter.com

https://elixir.bootlin.com/linux/v6.5/source/drivers/edac/pnd2_edac.c

elixir.bootlin.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/LibraryPrivate/PeiDxeSmmPchInitCommonLib/PchInitCommon.c

github.com

https://github.com/tianocore/edk2-platforms/blob/14b8c793e685422bf32ada10acf74e0ff1cf52fc/Silicon/Intel/KabylakeSiliconPkg/Pch/Include/Register/PchRegsP2sb.h

github.com

https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/comet-lake-u/intel-400-series-chipset-on-package-platform-controller-hub-register-database/p2sb-control-p2sbc-offset-e0/

edc.intel.com

https://en.wikipedia.org/wiki/Nonvolatile_BIOS_memory

en.wikipedia.org

https://github.com/datasone/setup_var.efi

github.com

https://github.com/chipsec/chipsec

github.com

https://github.com/LongSoft/IFRExtractor-RS

github.com

https://github.com/LongSoft/IFRExtractor-RS.git

github.com

https://wiki.gentoo.org/wiki/Efivarfs

wiki.gentoo.org

https://docs.kernel.org/filesystems/efivarfs.html

docs.kernel.org

https://elixir.bootlin.com/linux/v6.5/source/drivers/firmware/efi/efi.c

elixir.bootlin.com

https://uefi.org/sites/default/files/resources/UEFI_Spec_2_10_Aug29.pdf

uefi.org

https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy

elixir.bootlin.com

https://lwn.net/Articles/395712/

lwn.net

https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/inode.c

elixir.bootlin.com

https://lore.kernel.org/linux-usb/CA+fCnZcQSYy63ichdivAH5-fYvN2UMzTtZ--h=F6nK0jfVou3Q@mail.gmail.com/T/

lore.kernel.org

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3551ff7c5cfff4dc27fdcd14fa286edc08d78088

git.kernel.org

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cf9f7a6ee7b1f53f9ae13da55585b7d16aee2460

git.kernel.org

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc85c59b85d111f51b58ecf08485fa74ac5471cd

git.kernel.org

https://github.com/google/syzkaller/blob/master/docs/linux/external_fuzzing_usb.md

github.com

https://syzkaller.appspot.com/upstream?manager=ci2-upstream-usb

syzkaller.appspot.com

https://syzkaller.appspot.com/upstream/fixed?manager=ci2-upstream-usb

syzkaller.appspot.com

https://github.com/xairy/raw-gadget/tree/master/dummy_hcd

github.com

https://syzkaller.appspot.com/bug?extid=12002a39b8c60510f8fb

syzkaller.appspot.com

https://github.com/google/syzkaller/blob/master/docs/linux/setup.md

github.com

https://greatscottgadgets.com/greatfet/

greatscottgadgets.com

https://greatscottgadgets.com/cynthion/

greatscottgadgets.com

https://goodfet.sourceforge.net/hardware/facedancer21/

goodfet.sourceforge.net

https://travisgoodspeed.blogspot.com/2012/07/emulating-usb-devices-with-python.html

travisgoodspeed.blogspot.com

https://twitter.com/travisgoodspeed

twitter.com

https://github.com/kirill9617

github.com

https://github.com/xairy/raw-gadget/commits/dev/

github.com

https://github.com/greatscottgadgets/Facedancer/issues/79

github.com

https://github.com/xairy/raw-gadget?tab=readme-ov-file

github.com

https://github.com/AristoChen/usb-proxy

github.com

https://github.com/AristoChen

github.com

https://twitter.com/ShinyQuagsire/status/1760841811789259217

twitter.com

https://github.com/datasone/grub-mod-setup_var

github.com

https://binarly.io/posts/inside_the_logofail_poc_from_integer_overflow_to_arbitrary_code_execution/index.html

binarly.io

https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/

binarly.io

https://github.com/ufrisk/pcileech/wiki/Target-UEFI

github.com

https://brs.im/en/

brs.im

https://twitter.com/a13xp0p0v

twitter.com