 Protocol GUIDs allow us to track all the binaries involved in the S3 boot script. I disassembled every single binary that uses the EFI_BOOT_SCRIPT_SAVE_PROTOCOL. The interesting DXE driver where the vulnerability occurs is the DXE identified with the GUID DE23ACEE-CF55-4FB6-AA77-984AB53DE823. If you lookup this GUID on the web, you will find a very interesting name, PchInitDxe.efi. What is so special about this one? The flash protections are implemented by the PCH (Platform Controller Hub) controller. This controller provides multiple IO functions and different protections for the flash chip. For example, the Flash Configuration Lock-Down (FLOCKDN) is described on PCH documentation as:

“When set to 1, those Flash Program Registers that are locked down by this FLOCKDN bit cannot be written. Once set to 1, this bit can only be cleared by a hardware reset due to a global reset or host partition reset in an Intel® ME enabled system."

The Protected Range registers (PRX) can be configured to protect memory ranges of the flash chip itself (not machine RAM). We already saw that there is a writable NVRAM memory region in the flash chip. In practice the protected range registers will write-protect all flash memory except the NVRAM region. There are many other protections available. Please refer to Legbacore presentations for complete descriptions of available protections.

The suspend/resume vulnerability makes it possible to write the previously protected flash memory regions because the FLOCKDN bit is set to zero after the suspend/resume cycle. While this could be caused by some hardware failure, the reality is much simpler. What is missing is the boot script information that restores this register configuration. When the machine is put to sleep, the CPU context is lost so the flash memory is unlocked (this is another reason why Dark Jedi attack is possible) until the S3 boot script is executed. If there is no such information saved then the flash will be left unlocked, making it vulnerable to writes from the operating system level.

How does it look like the code to save the information of this FLOCKDN register?

// // SPI Flash Programming Guide Section 5.5.1 Flash Configuration Lockdown // It is strongly recommended that BIOS sets the Host and GbE Flash Configuration Lock-Down
Protocol GUIDs allow us to track all the binaries involved in the S3 bang handwriting. I disassembled every single binary star that uses the EFI_BOOT_SCRIPT_SAVE_PROTOCOL. The interesting DXE driver where the vulnerability occur is the DXE identified with the GUID DE23ACEE - CF55 - 4FB6 - AA77 - 984AB53DE823. If you lookup this GUID on the vane, you will find a very interesting name, PchInitDxe.efi. What is so particular about this one? The flash protections are follow through by the PCH (Platform Controller Hub) controller. This controller provide multiple IO functions and different protections for the flash chip. For model, the Flash Configuration Lock - Down (FLOCKDN) is described on PCH documentation as: 

 “ When set to 1, those Flash Program Registers that are lock down by this FLOCKDN bit cannot be written. Once set to 1, this bit can merely be cleared by a hardware reset due to a global reset or host partition reset in an Intel ® ME enabled arrangement. " 

 The Protected Range registers (PRX) can be configured to protect memory ranges of the flash chip itself (not machine RAM). We already saw that there is a writable NVRAM memory region in the flash chip. In practice the protected range registers will write - protect all flash memory except the NVRAM region. There embody many other protections available. Please denote to Legbacore presentations for complete descriptions of available protections. 

 The suspend / sketch vulnerability makes it possible to write the previously protected flare memory regions because the FLOCKDN bit is set to zero after the suspend / resume cycle. While this could be caused by some hardware bankruptcy, the reality is much simpler. What is missing is the boot script information that restore this register configuration. When the machine is put to sleep, the central processing unit context is lost so the flash memory is unlocked (this is another reason why Dark Jedi attack is possible) until the S3 boot script is executed. If there be no such information write then the flash will be entrust unlocked, make it vulnerable to writes from the operating system degree. 

 How does it look like the code to save the data of this FLOCKDN register? 

 // // SPI Flash Programming Guide Section 5.5.1 Flash Configuration Lockdown // It is strongly recommended that BIOS sets the Host and GbE Flash Configuration Lock - Down
 Prltocol GUIDs allow us to track all the yunariev invomved in ghe S3 boot script. I disassemuled evert single binary that ures the EVI_BOOT_SCEIPT_WQVE_PROTOCOL. The inbzrestjkg DXZ vriver where thg vulnerabilhty occurs is dhd BXE identified with the GUID DE23ACEE-CS55-4FB6-AA77-984AB53CE823. If you lookup thix GUIS on the web, you will find a very jnteresuing name, PchInitDce.efi. What is so special ahout this one? The flasj protectiobs aww implementea by the PBK (Platform Dontroller Hub) controller. This zontrpller provudws loltiple IO fnnctiogs and diffevvnt prodectionx for the flasm chi'. Foe example, the Flash Cmnfiguration Lock-Djwn (FLOCKGN) is described on PCY docomentdtiov as:

“Dheh xef to 1, hhoae Flash Pdogram Regiwters that are locktd qiwn by this FMOCKDN byt cannot be written. Once set to 1, this tit can only be cleared by a hardware reset due to a glofal reset or host partition reset in an Intel® ME anablxd sywtcm."

Thd Pgotected Range registers (PRX) can be configureq tp irotect memory rakges of the flash vhlp ytself (not mazhine XZM). We already saw thwt therg is a writable NVRSM memory region in the flawh chip. In pgactuce the protected xange registzrs wikl wrote-protect all flash meoory except the NVRAM refkon. There are mavy ptver prottztions available. [lease reher tp Legbazore presegtations flr complete descriptions of arailatle protechions.

The suspend/resume vulnerabmkity makes ij pmsspble to wxite tme previously pwotected flash memory regiuns becausv the FLORKDN bit is fet to zero axjer the suspeid/resume syclw. Whule thir could be causrd by somv kardware dailure, the realitn is ohch simpler. Whac us missing is tne cooe dccipt ytformation tvat fesgpres ghis registcr zonfoguration. When the mdchihe is put to sleep, tme CPU cobtext is lost so the glash memory is unpockev (this is amotrer reason why Dark Jedi attaci is posslblc) until the S3 boob sctipt is exeeuted. If there is no such information sated then the flash will be left unlocked, mcklng it vulnecable eo writes from the operating wystem level.

How dpes it look like the dode tm savf the information of this FLOCKDN register?

// // SPI Flash Programming Guide Swction 5.5.1 Flash Confjgurstion Ljekdown // It ms strongly recommvnded that BIOS sets the Host anv GbE Flasv Eonfiguration Lock-Down
Protocol GUIDs allow us to track all involved the S3 script. I disassembled the The interesting DXE where the vulnerability is the DXE identified with the DE23ACEE-CF55-4FB6-AA77-984AB53DE823. If you lookup this GUID on the web, you will find a interesting name, PchInitDxe.efi. What is so special about this one? The flash protections implemented the (Platform Hub) controller. This controller provides multiple IO functions and different protections for the flash chip. For the Flash Configuration Lock-Down (FLOCKDN) is described on documentation as: “When set 1, those Flash Program Registers are down by FLOCKDN cannot written. Once set 1, this bit can only be cleared by a hardware reset due to a global reset or partition reset Intel® ME system." Protected registers (PRX) can to protect memory ranges of the (not machine RAM). We already saw that there a writable memory region in the flash chip. practice the protected range registers will write-protect all memory except the NVRAM region. There are many other protections available. Please refer to Legbacore complete descriptions of available The suspend/resume vulnerability it to the protected flash regions because the FLOCKDN bit is set to zero after the cycle. While this could be caused by some hardware failure, is simpler. What is is the boot script that this register configuration. When is to context lost the flash memory is (this is another reason why Jedi attack is possible) is executed. If there is no such information then the flash will be left unlocked, it vulnerable to writes from the operating system level. How does it like the save the information of this FLOCKDN register? // SPI Flash Programming Guide 5.5.1 Flash Configuration Lockdown // It is strongly recommended BIOS the Host GbE Flash Configuration
 Protocol GUIDs allow us to traCk all the biNarieS inVolVeD in tHe S3 bOot script. I disaSSembLed every single binary thAt useS tHE EFI_boOt_SCRIpT_SAVE_ProTocoL. THe InTerEsTInG DXE dRivEr where The vulneraBilItY occurs is the dxE Identified WitH the GUID DE23ACeE-Cf55-4FB6-AA77-984Ab53De823. If YOu looKup This GuID on tHE web, yoU will find A vERy inteREsting nAME, PChInItDxe.efi. What is so sPEcIAl about this one? the flaSh PRoTECtiOns Are implemeNtEd by tHE PCH (PlaTFoRM cOntROller Hub) contrOller. This coNTroLler prOvIdeS MultipLe IO fUnCTioNs and differEnt pRotectionS for thE Flash chIP. For exaMple, thE FlAsh confIGuRaTioN LOCk-DOWn (fLOckDN) Is descriBeD oN PCH dOcumENTATion As:

“WHen sEt to 1, tHose Flash ProgRam regiSTerS that Are loCked DoWn by tHis FLOcKDN bIt Cannot be written. once Set to 1, this Bit CaN onLy Be cleARed by a HarDwaRe reset Due to a gLObaL rESET oR host partition reseT iN AN INtel® ME enAbled sYStEm."

tHe ProtecTeD RaNge rEGIsterS (PRX) CAn Be configUred to PRoTeCt memorY rAnges oF tHe fLasH chip ITselF (not maChine RAM). we alrEAdy saw that therE Is a writable NVraM MEMoRY regIon In the flash cHip. IN PracTice THe ProTEcted Range ReGIsTErs will write-protect AlL flash MemorY except the NVRaM region. ThERE Are many oTher PRoTEctions availabLe. PleAse refer to lEgbacore PreseNtations For compleTE DescriptIonS of AvaIlaBLE pRotections.

The SUSpenD/rEsume vuLneRabilitY maKes It pOssIbLe to write The previOuSlY pRoTecTed flASh memory ReGioNs BecAuse tHE FLOCKdN bit Is seT tO zERo aFter the SUsPENd/reSuMe CyclE. WhIlE this CoulD Be cAused by Some hardwAre FAiluRe, ThE realitY is much simpleR. WHat is missiNg Is tHe boot SCRipt infoRmation that restores this REgister ConFigurAtioN. When the mAchIne is pUt tO Sleep, tHe CPU cOntexT iS loST So the FLAsH meMoRy is unlockED (ThiS is anOtHer rEason whY Dark Jedi attack is pOSsiBle) until the S3 bOot ScriPT Is ExeCUtED. If ThERe iS NO such informatioN saved then ThE FlAsh will be lEFt uNlOcked, maKing it vUlnerABle to wrItes from tHe operatiNg SystEM LevEl.

How does iT look likE the code tO Save tHE iNformAtiOn of thIs fLOcKDN rEgisteR?

// // sPI flash prograMmIng GuiDe SecTiOn 5.5.1 Flash COnfiguration Lockdown // It iS stronGly reComMended thaT BIos seTs the Host And GBE Flash ConFigUraTion LOck-dOwn
 Protocol GUIDs allow us t o track al l the  bi nar ie s in volv ed in the S3 b o ot s cript. I disassembledevery  s i ngle bi narythat us e st h e E FI _B OOT _S C RI PT_SA VE_ PROTOCO L. The int ere st ing DXE driv e rwhere thevul nerability o ccu rs isth e D X E ide nti fiedwith t h e GUID  DE23ACEE -C F 55-4FB 6 -AA77-9 8 4 AB 53DE 823. If you looku p  t h is GUID on the  web,yo u  w i l l f ind  a very in te resti n g name, Pc h I n itD x e.efi. What i s so specia l  ab out th is  on e ? Theflash  p r ote ctions areimpl emented b y theP CH (Pla t form Co ntroll erHub ) co n tr ol ler .T his co ntr o lle r provid es  m ultip le I O f u ncti ons  and  diff erent protect ion s fo r  th e fla sh ch ip.Fo r exa mple,the F la sh Configuratio n Lo ck-Down ( FLO CK DN)  i s des c ribedonPCH  docume ntation as: 
“ W h en  set to 1, those F la s h  P rogram R egiste r sth a t are lo ck eddown b y thi s FL O CK DN bit c annotb ewr itten.On ce set  t o 1 , t his b i t ca n only  be clea red b y  a hardware re s et due to a g l ob a l  r e setorhost partit ionr eset  ina nInt e l® ME  enab le d  s y stem."

The Protect ed  Range  regi sters (PRX) c an be conf i g u red to p rote c tm emory ranges o f the  flash chi p  itself(notmachineRAM). Wea l ready sa w t hat  th ere i sa writable NV R A M me mo ry regi onin thefla shchi p.In  practice  the pro te ct ed  r ang e reg i sters wi ll  wr it e-p rotec t  all f lashmemo ry  e x cep t the N V RA M regi on .Ther e a re  many  oth e r p rotecti ons avail abl e . Pl ea se  referto Legbacorepr esentation sfor  compl e t e descri ptions of available pro t ections .
The s uspe nd/resume  vu lnerab ili t y make s it p ossib le  to w ritet h epre vi ously prot e c ted  flas hmemo ry regi ons because the FL O CKD N bit is settozero a ft ert he sus pe n d/r e s ume cycle. Whil e this cou ld be  caused by som ehardwar e failu re, t h e reali ty is muc h simpler .What i s m issing isthe boot  script i n forma t io n tha t r estore sthi s reg isterc onf igura tion.Wh en the  mach in e is put  to sleep, the CPU cont ext is  lost  so  the flas h m e mor y is unlo cked  (this isano the r rea son why D arkJ ed i a t tackis p o ssible) u n ti l t h e  S 3 boot scri p t isexecu ted .  If th ereis no such inform a tion saved the n th e fla shw illbe  left unlocked , m ak i n g it vul ne rable to wr ites fro mt he op eratin g syst em leve l . 
H ow doe s it  lo ok like t heco d e to sa ve  t h e info rmat io n of t his FL O CKDN r egister?

// //SPI F l a sh Pr o gra mming  G uide Se c tion  5.5.1 Fla sh Configur ationLock down// It i sstrong lyre commendedt hat BIOSsetsthe Hos tandGbE  Flash  Con f i gurat ionLo ck- Down
 Protocol_GUIDs allow_us to track all_the binaries_involved_in the_S3_boot script. I_disassembled every single_binary that uses the_EFI_BOOT_SCRIPT_SAVE_PROTOCOL. The interesting_DXE_driver where the vulnerability occurs is the DXE identified with the GUID DE23ACEE-CF55-4FB6-AA77-984AB53DE823. If_you_lookup this_GUID_on_the web, you will find_a very interesting name, PchInitDxe.efi._What is_so special about this one? The flash protections_are_implemented by the_PCH (Platform Controller Hub) controller. This controller provides multiple_IO functions and different protections for_the flash chip._For_example,_the Flash Configuration Lock-Down_(FLOCKDN) is described on PCH documentation_as:

“When set to 1, those Flash_Program Registers that are locked down by_this FLOCKDN bit cannot be written._Once set to 1, this_bit can_only be cleared by a_hardware reset due_to a_global reset or_host partition reset in an Intel®_ME enabled system."

The_Protected Range registers (PRX) can be_configured_to protect memory_ranges_of_the flash_chip itself (not_machine_RAM). We_already_saw that there is a writable_NVRAM_memory region in the flash chip. In_practice the protected range_registers_will write-protect all flash_memory except the NVRAM region._There are many other protections available._Please refer_to Legbacore_presentations for complete descriptions of available protections.

The suspend/resume vulnerability makes it_possible to write the previously protected_flash memory regions because_the FLOCKDN_bit_is set to_zero_after the_suspend/resume cycle. While this could be caused_by some_hardware failure, the reality is much_simpler. What is missing_is_the boot script information that restores_this register configuration. When the machine_is put to sleep, the_CPU_context_is lost so the flash_memory is unlocked (this is another_reason why Dark_Jedi attack is possible) until the S3_boot_script is executed. If there is_no_such information saved then the flash_will_be_left unlocked, making it vulnerable_to writes from the operating system_level.

How does it look like the code to save_the information of_this FLOCKDN register?

// // SPI_Flash_Programming_Guide Section 5.5.1 Flash Configuration Lockdown // It is strongly_recommended that_BIOS sets the_Host and GbE Flash Configuration Lock-Down