Disabling Security Features in a Locked BIOS

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://mdsec.co.uk/2026/03/disabling-security-features-in-a-locked-bios
• Blog Title: Disabling Security Features in a Locked BIOS
• Suggested Section: Hardware/Physical Access > Firmware Analysis > UEFI IFR and NVRAM Security-Setting Patching, with cross-references from Physical Attacks and Windows Local Privilege Escalation/DMA attacks

🎯 Content Summary

Overview and security impact
The post demonstrates a physical-access attack against a password-locked Dell UEFI/BIOS. Instead of authenticating to the firmware interface, the attacker reads the SPI flash, identifies the NVRAM byte controlling pre-boot IOMMU protection, changes it directly in the firmware image, and writes the modified image back to the chip. The effective security setting becomes disabled even though the UEFI interface continues to display it as enabled.<...

🔧 Technical Details

Recover security-sensitive UEFI settings from IFR metadata
Dump the target firmware, extract the Setup PE32 module with UEFITool, and process its HII package list with IFRExtractor. Search the resulting IFR text for feature names such as DMA, IOMMU, Secure Boot, or other security controls. A matching question exposes its VarStoreId, VarOffset, size, valid range, question ID, and visibility conditions. Map the VarStore ID to the variable's GUID and name in the IFR header, then locate the corresponding NVRAM object in the firmware image. This technique reveals the storage of settings that are hidden, renamed by the vendor interface, or inaccessible because of a setup password.

Validate and patch a locked configuration through differential firmware analysis
When possible, obtain one firmware dump with the target option enabled and another with it disabled. Compare the byte a...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added uefi-ifr-nvram-security-setting-patching.md covering:
  • SPI firmware acquisition and dump verification.
  • UEFITool/IFRExtractor mapping of IFR questions to NVRAM.
  • Differential firmware analysis and targeted patching.
  • Dell UEFI Patcher and NVRAMap usage.
  • DMAReaper DMAR corruption and PCILeech SYSTEM-access chain.
  • Firmware-specific offsets, Boot Guard, BitLocker, VBS, and validation caveats.
• Added navigation and cross-references from:
  • Firmware Analysis
  • Physical Attacks/DMA
  • Windows Local Privilege Escalation
  • SUMMARY.md

Technical details were verified against the MDSec research, DMAReaper, and NVRAMap.

Validation passed for Git whitespace, internal references, citation numbering, page structure, code fences, and forbidden-source exclusion. mdbook was not installed, so a full book build could not be run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://mdsec.co.uk/2026/03/disabling-security-features-in-a-locked-bios

Content Categories: Based on the analysis, this content was categorized under "Hardware/Physical Access > Firmware Analysis > UEFI IFR and NVRAM Security-Setting Patching, with cross-references from Physical Attacks and Windows Local Privilege Escalation/DMA attacks".

Repository Maintenance:

• MD Files Formatting: 1030 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0