[Конкурс 2022] Coreboot и настоящее полнодисковое шифрование вкл. /boot

1. run sudo ./skulls.sh -b t440p on your current T440P Linux system
2. Power down, remove the battery. Remove the keyboard and palmrest. Connect a hardware flasher to an external PC (or a Raspberry Pi with a SPI 8-pin chip clip can directly be used), and run sudo ./external_install_bottom.sh on the lower chip and sudo ./external_install_top.sh -b t440p on the top chip of the two.
3. For updating later, run ./skulls.sh -b t440p. No need to disassemble.

set prefix=(memdisk)/boot/grub

insmod ahci
insmod crypto
insmod cryptodisk
insmod btrfs
insmod ext2
insmod gcry_rijndael
insmod gcry_sha256
insmod luks
insmod lvm
insmod nativedisk
insmod part_gpt
insmod part_msdos
insmod password_pbkdf2
insmod pbkdf2
insmod regexp
insmod usb_keyboard
insmod usb
insmod usbms

set gfxpayload=keep
set default="0"
set timeout=3
set pager=1

menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o' {
cryptomount -a
set root='(lvm/matrix-rootvol)'
configfile (lvm/matrix-boot)/grub/grub.cfg
}
menuentry 'Poweroff  [p]' --hotkey='p' {
	halt
}
menuentry 'Reboot  [r]' --hotkey='r' {
	reboot
}

1. First make sure you have a coreboot rom for your laptop ready, then copy it to a usb drive. (you'll need two drives for this)

2. Download 1vyra1n and IVprep

3. copy IVprep on a windows installation and run downgrade.bat NOT as administrator. the laptop will reboot and downgrade itself to the last vulnerable bios

4. prepare a bootable USB with 1vyra1n using rufus

5. reboot to bios setup and do the following:

6. if you have a bios password set, disable it.

7. enable UEFI boot (Boot Options -> UEFI Mode)

8. disable CSM (Boot Options -> Launch CSM)

9. enable bios flashing from non-supervisors and bios rollback (Security -> BIOS)

10. disable secure boot

11. Now connect your laptop to the internet using lan and reboot to the usb drive with 1vyra1n. When prompted, press enter and wait until your device goes to sleep. wake it up (press the power button), then you'll be greeted with a menu.

12. I'm assuming you don't have a web server ready to use with option 2 from 1vyra1n menu. so, like i did, we'll replace the existing unlocked bios rom with coreboot manually.

13. Press Control+C to exit out of the menu, run "lsblk" to find the other usb drive with coreboot on it. now let's say this usb drive is 32gb, you'll find something like this:

14. NAME MAJ:MIN RM SIZE RO TYPE

15. sdX(where X is a letter) 259:0 0 32G 0 DISK

16. now what you need is name and size to make sure you're working with the correct usb drive

17. once you find it, run "mount /dev/sdX /mnt" where X is a letter

18. then, "***** /mnt/coreboot* ~/patched-bioses/ && rm ~/patched-bioses/T430.rom && mv ~/patched-bioses/coreboot* ~/patched-bioses/T430.rom"

19. now run ". ~/start.sh" and press 1 when prompted to flash patched lenovo bios

20. reboot and, assuming you did everything right, welcome to coreboot

sudo apt update && sudo apt upgrade
sudo apt install -y git libpci-dev zlib1g-dev
git clone --depth=1 https://review.coreboot.org/coreboot
cd coreboot/util/intelmetool
make
sudo ./intelmetool -m

GRUB_CMDLINE_LINUX="cryptdevice=/dev/mapper/matrix-rootvol:root"
GRUB_ENABLE_CRYPTODISK=y