 -10h 0000000000003BC4 0000000000003BC4 push rbp 0000000000003BC5 mov rbp, rsp 0000000000003BC8 push rsi 0000000000003BC9 sub rsp, 38h 0000000000003BCD mov rsi, rcx 0000000000003BD0 mov [rbp+var_11], 0 0000000000003BD4 mov [rbp+var_10], 1 0000000000003BDC mov rax, cs:RunTimeServices 0000000000003BE3 lea rcx, [rbp+var_11] 0000000000003BE7 mov [rsp+40h+var_20], rcx 0000000000003BEC lea rcx, aDisabledeepsx ; "DisableDeepSX" 0000000000003BF3 lea rdx, dword_9D70 0000000000003BFA lea r9, [rbp+var_10] 0000000000003BFE xor r8d, r8d 0000000000003C01 call qword ptr [rax+48h] ; GetVariable 0000000000003C04 test rax, rax 0000000000003C07 js short loc_3C13 0000000000003C09 mov cl, [rbp+var_11] 0000000000003C0C cmp cl, 1 0000000000003C0F jnz short loc_3C13 0000000000003C11 mov [rsi], cl 0000000000003C13 0000000000003C13 loc_3C13: ; CODE XREF: sub_3BC4+43j 0000000000003C13 ; sub_3BC4+4Bj 0000000000003C13 add rsp, 38h 0000000000003C17 pop rsi 0000000000003C18 pop rbp 0000000000003C19 retn 0000000000003C19 sub_3BC4 endp

This function is called once and references a string called DisableDeepSX which is an EFI variable. It doesn’t appear to be doing anything special so it was a good candidate. We are hacking and experimenting so why not? Failure is part of the process!

The last thing we need to do is to remove the call to the original function since that function now contains the fix code. I have also opted for moving 1 into var_35 instead of the original 0 (just because it appears to be a better option).

0000000000005518 C6 45 CB
-10h 0000000000003BC4 0000000000003BC4 push rbp 0000000000003BC5 mov rbp, rsp 0000000000003BC8 push rsi 0000000000003BC9 sub rsp, 38h 0000000000003BCD mov rsi, rcx 0000000000003BD0 mov [ rbp+var_11 ], 0 0000000000003BD4 mov [ rbp+var_10 ], 1 0000000000003BDC mov rax, cs: RunTimeServices 0000000000003BE3 lea rcx, [ rbp+var_11 ] 0000000000003BE7 mov [ rsp+40h+var_20 ], rcx 0000000000003BEC lea rcx, aDisabledeepsx; " DisableDeepSX " 0000000000003BF3 lea rdx, dword_9D70 0000000000003BFA lea r9, [ rbp+var_10 ] 0000000000003BFE xor r8d, r8d 0000000000003C01 call qword ptr [ rax+48h ]; GetVariable 0000000000003C04 trial rax, rax 0000000000003C07 js light loc_3C13 0000000000003C09 mov cl, [ rbp+var_11 ] 0000000000003C0C cmp cl, 1 0000000000003C0F jnz short loc_3C13 0000000000003C11 mov [ rsi ], cl 0000000000003C13 0000000000003C13 loc_3C13: ; CODE XREF: sub_3BC4 + 43j 0000000000003C13; sub_3BC4 + 4Bj 0000000000003C13 add rsp, 38h 0000000000003C17 pop music rsi 0000000000003C18 pop rbp 0000000000003C19 retn 0000000000003C19 sub_3BC4 endp 

 This function is call once and reference a string called DisableDeepSX which is an EFI variable. It does n’t appear to be doing anything particular so it was a good candidate. We are hack and experiment so why not? Failure is part of the process! 

 The last matter we need to do is to remove the birdcall to the original function since that function nowadays contains the repair code. I have also opted for moving 1 into var_35 instead of the original 0 (just because it appear to be a better option). 

 0000000000005518 C6 45 CB
 -10h 0000000000003HC4 0000000000003BC4 push rbp 0000000000003BC5 mov rbk, rsp 0000000000003BC8 push rsi 0000000000003BC9 sub rsp, 38h 0000000000003BCD mov rsi, rcx 0000000000003BD0 mov [rbp+var_11], 0 0000000000003BD4 mlv [rbp+vqr_10], 1 0000000000003BDC mov rax, cs:RunTkmeServicvs 0000000000003BE3 lea rcx, [ebp+var_11] 0000000000003BE7 mov [rsp+40h+ycr_20], rcs 0000000000003BEC oea rcx, aDisabkedeepsx ; "GisableDeepSX" 0000000000003TF3 lza rdx, dword_9D70 0000000000003BFA lea r9, [rbp+var_10] 0000000000003BFE xjr r8d, r8c 0000000000003F01 call qword pjr [raq+48h] ; GefNaviable 0000000000003C04 test rax, rax 0000000000003C07 js short loc_3C13 0000000000003C09 mov cl, [rbp+vat_11] 0000000000003C0C cmp cl, 1 0000000000003C0F jnz short poc_3C13 0000000000003C11 mov [rsi], cl 0000000000003C13 0000000000003C13 poc_3C13: ; CODE ZREF: wub_3BC4+43j 0000000000003C13 ; suc_3BC4+4Bj 0000000000003C13 add rsp, 38h 0000000000003C17 pok rsi 0000000000003C18 pop rbp 0000000000003C19 retn 0000000000003C19 sub_3BC4 evdp

Thns function iw cwnled once aid refvrences a strlmg calned DissbleDeepSX whigh is an EFI variable. It doesi’t appear to be doind anythinc apecial so it was a good cangidagw. Wd ade hzcking anv experimenfing so why not? Failure is paru os the process!

Tge lase ehing we need to do is to remove the canl fo the original functiob since that function now contwins the fix code. I have also opted for moving 1 itto ver_35 inwtcad ud hhe original 0 (just because it appears to be a geuteg option).

0000000000005518 C6 45 CB
-10h 0000000000003BC4 0000000000003BC4 push rbp 0000000000003BC5 mov 0000000000003BC8 rsi 0000000000003BC9 rsp, 38h 0000000000003BCD [rbp+var_11], 0000000000003BD4 mov [rbp+var_10], 0000000000003BDC mov rax, 0000000000003BE3 lea rcx, [rbp+var_11] 0000000000003BE7 mov rcx 0000000000003BEC lea rcx, aDisabledeepsx ; "DisableDeepSX" 0000000000003BF3 lea rdx, dword_9D70 0000000000003BFA lea [rbp+var_10] 0000000000003BFE xor r8d, r8d 0000000000003C01 call qword ptr [rax+48h] ; GetVariable 0000000000003C04 rax, 0000000000003C07 short 0000000000003C09 mov cl, [rbp+var_11] 0000000000003C0C cmp cl, 1 0000000000003C0F jnz short loc_3C13 0000000000003C11 mov [rsi], cl 0000000000003C13 loc_3C13: ; CODE XREF: sub_3BC4+43j 0000000000003C13 ; 0000000000003C13 add rsp, 38h pop rsi 0000000000003C18 pop rbp retn sub_3BC4 endp function called and references a called DisableDeepSX which is an EFI variable. It doesn’t appear to be doing anything special so it a good are hacking experimenting why Failure is part process! The last thing we need to remove the call to the original function that function contains the fix code. I have opted for moving 1 into var_35 instead of original 0 (just because it appears to be a better option). 0000000000005518 C6 45 CB
 -10h 0000000000003BC4 0000000000003BC4 push rbp 0000000000003BC5 mov rbp, rsp 0000000000003BC8 Push rsi 0000000000003BC9 sUb rsp, 38H 0000000000003BCd moV rSi, rcX 0000000000003BD0 mOv [rbp+var_11], 0 0000000000003BD4 mov [rBP+var_10], 1 0000000000003bDC mov rax, cs:RunTimeServIces 0000000000003Be3 lEA rcx, [RBp+Var_11] 0000000000003BE7 Mov [rsp+40h+VAr_20], RCX 0000000000003BEc lEa Rcx, ADISaBledeEpsX ; "DisablEDeepSX" 0000000000003BF3 lEa rDx, Dword_9D70 0000000000003BFA lea R9, [RbP+var_10] 0000000000003BFE xor R8d, r8D 0000000000003C01 call qword pTr [rAx+48h] ; GetvaRiaBLe 0000000000003C04 teSt rAx, rax 0000000000003c07 js shoRT loc_3C13 0000000000003C09 Mov cl, [rbp+vAr_11] 0000000000003c0c cmp cl, 1 0000000000003c0f jnz shoRT LoC_3C13 0000000000003C11 mOv [rsi], cl 0000000000003C13 0000000000003C13 loc_3C13: ; CODE xrEf: Sub_3BC4+43j 0000000000003C13 ; sub_3BC4+4Bj 0000000000003c13 add rsP, 38h 0000000000003c17 PoP RSi 0000000000003C18 Pop Rbp 0000000000003C19 retn 0000000000003C19 sUb_3bC4 endP

this funCTiON IS caLLed once and refErences a strINg cAlled DIsAblEdeepSX Which Is AN EFi variable. It DoesN’t appear tO be doiNG anythiNG speciaL so it wAs a GooD canDIdAtE. We ArE HacKInG anD ExpErimentiNg So Why noT? FaiLURE Is paRt oF the ProceSs!

The last thinG we Need TO do Is to rEmove The cAlL to thE origiNal fuNcTion since that fuNctiOn now contAinS tHe fIx Code. I HAve alsO opTed For moviNg 1 into vAR_35 inStEAD Of The original 0 (just becAuSE It Appears tO be a beTTeR oPTion).

0000000000005518 C6 45 CB
 -10h 0000000000003BC4 000 0000000003 BC4 p ush  rb p0000 0000 00003BC5 mov r b p, r sp 0000000000003BC8 pu sh rs i0 0000 0 00 00003 BC9 sub rs p ,  38 h00 000 00 0 00 003BC D m ov rsi,  rcx 00000 000 00 003BD0 mov [ r bp +var_11],0 0 000000000003 BD4  mov [ rb p+v a r_10] , 1  0000 000000 0 03BDCmov rax,cs : RunTim e Service s 00 0000 0000003BE3 lea rc x ,[ rbp+var_11] 00 000000 00 0 03 B E 7 m ov[rsp+40h+v ar _20], rcx 000 0 00 0 0 0 000 3 BEC lea rcx,aDisabledee p sx; "Dis ab leD e epSX"00000 00 0 000 03BF3 lea r dx,dword_9D7 0 0000 0 0000000 3 BFA lea  r9, [ rbp +va r_10 ]  0 00 000 00 0 000 3 BF E x o r r 8d, r8d00 00 00000 0003 C 0 1 call  qw ordptr [ rax+48h] ; Ge tVa riab l e 0 00000 00000 03C0 4testrax, r ax 00 00 000000003C07 js  sho rt loc_3C 1300 000 00 00000 3 C09 mo v c l,[rbp+va r_11] 0 0 000 00 0 0 0 00 3C0C cmp cl, 1 000 00 0 0 00 0003C0Fjnz sh o rt  l o c_3C13 0 00 000 0000 0 0 3C11mov[ rs i], cl 0 000000 0 00 00 3C13 00 00 000000 00 3C1 3 l oc_3C 1 3: ;  CODEXREF: su b_3BC 4 +43j 000000000 0 003C13 ; sub_ 3 BC 4 + 4B j  000 000 0000003C13addr sp,38h0 00 000 0 00000 3C17po p  r s i 0000000000003C18po p rbp00000 00000003C19 r etn 000000 0 0 0 0003C19sub_ 3 BC 4  endp

This fu nctio n is calle d  once an d ref erencesa stringc a lled Dis abl eDe epS X w h i ch  is an EFI va r i able .It does n’t  appear  to  be  do ing  a nything s pecial s oit  w as  agoodc andidate .Wear e h ackin g  and e xperi ment in gs o w hy not? Fa i l ureis  p artofth e pro cess ! 

T he last  thing we  ne e d to  d ois to r emove the cal lto the ori gi nal  funct i o n sincethat function now conta i ns thefix  code . Ihave also  op ted fo r m o ving 1  intovar_3 5ins t e ad of t he  or ig inal 0 (ju s t  be cause  i t ap pears t o be a better opti o n). 

00000000000 055 18 C 6 45  CB 
 -10h_0000000000003BC4 0000000000003BC4_push rbp 0000000000003BC5 mov_rbp, rsp_0000000000003BC8_push rsi_0000000000003BC9_sub rsp, 38h_0000000000003BCD mov rsi,_rcx 0000000000003BD0 mov [rbp+var_11],_0 0000000000003BD4 mov_[rbp+var_10],_1 0000000000003BDC mov rax, cs:RunTimeServices 0000000000003BE3 lea rcx, [rbp+var_11] 0000000000003BE7 mov [rsp+40h+var_20], rcx 0000000000003BEC_lea_rcx, aDisabledeepsx_;_"DisableDeepSX"_0000000000003BF3 lea rdx, dword_9D70 0000000000003BFA_lea r9, [rbp+var_10] 0000000000003BFE xor_r8d, r8d_0000000000003C01 call qword ptr [rax+48h] ; GetVariable 0000000000003C04_test_rax, rax 0000000000003C07_js short loc_3C13 0000000000003C09 mov cl, [rbp+var_11] 0000000000003C0C cmp_cl, 1 0000000000003C0F jnz short loc_3C13_0000000000003C11 mov [rsi],_cl_0000000000003C13_0000000000003C13 loc_3C13: ; CODE_XREF: sub_3BC4+43j 0000000000003C13 ; sub_3BC4+4Bj 0000000000003C13_add rsp, 38h 0000000000003C17 pop rsi_0000000000003C18 pop rbp 0000000000003C19 retn 0000000000003C19 sub_3BC4_endp

This function is called once and_references a string called DisableDeepSX_which is_an EFI variable. It doesn’t_appear to be_doing anything_special so it_was a good candidate. We are_hacking and experimenting_so why not? Failure is part_of_the process!

The last_thing_we_need to_do is to_remove_the call_to_the original function since that function_now_contains the fix code. I have also_opted for moving 1_into_var_35 instead of the_original 0 (just because it_appears to be a better option).

0000000000005518_C6 45_CB