Skip to content

Commit f2079db

Browse files
tlauriontlaurion
committed
blobs/xx30 scripts: cleanup and don't continue if hash is good
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
1 parent de951f7 commit f2079db

File tree

2 files changed

+73
-53
lines changed

2 files changed

+73
-53
lines changed

‎blobs/xx30/download_clean_me.sh

Lines changed: 41 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -6,47 +6,54 @@ function printusage {
66

77
ME_BIN_HASH="c140d04d792bed555e616065d48bdc327bb78f0213ccc54c0ae95f12b28896a4"
88

9-
if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
10-
if [[ "${1:-}" == "--help" ]]; then
11-
usage
12-
else
13-
if [[ -z "${COREBOOT_DIR}" ]]; then
14-
echo "ERROR: No COREBOOT_DIR variable defined."
15-
exit 1
16-
fi
17-
18-
output_dir="$(realpath "${1:-./}")"
19-
20-
if [[ ! -f "${output_dir}/me.bin" ]]; then
21-
# Unpack Lenovo's Windows installer into a temporary directory and
22-
# extract the Intel ME blob.
23-
pushd "$(mktemp -d)"
9+
if [ -e "${output_dir}/me.bin" ]; then
10+
echo "me.bin already exists"
11+
if echo "${ME_BIN_HASH} ${output_dir}/me.bin" | sha256sum --check; then
12+
echo "SKIPPING: SHA256 checksum for me.bin matches."
13+
exit 0
14+
fi
15+
echo "me.bin exists but checksum doesn't match. Continuing..."
16+
fi
2417

25-
curl -O https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe
26-
innoextract g1rg24ww.exe
18+
if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
19+
if [[ "${1:-}" == "--help" ]]; then
20+
usage
21+
else
22+
if [[ -z "${COREBOOT_DIR}" ]]; then
23+
echo "ERROR: No COREBOOT_DIR variable defined."
24+
exit 1
25+
fi
2726

28-
mv app/ME8_5M_Production.bin "${COREBOOT_DIR}/util/me_cleaner"
27+
output_dir="$(realpath "${1:-./}")"
2928

30-
popd
29+
if [[ ! -f "${output_dir}/me.bin" ]]; then
30+
# Unpack Lenovo's Windows installer into a temporary directory and
31+
# extract the Intel ME blob.
32+
pushd "$(mktemp -d)" || exit
3133

32-
# Neutralize and shrink Intel ME. Note that this doesn't include
33-
# --soft-disable to set the "ME Disable" or "ME Disable B" (e.g.,
34-
# High Assurance Program) bits, as they are defined within the Flash
35-
# Descriptor.
36-
# https://github.com/corna/me_cleaner/wiki/External-flashing#neutralize-and-shrink-intel-me-useful-only-for-coreboot
37-
pushd "${COREBOOT_DIR}/util/me_cleaner"
34+
curl -O https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe
35+
innoextract g1rg24ww.exe
3836

39-
python me_cleaner.py -r -t -O me_shrinked.bin ME8_5M_Production.bin
37+
mv app/ME8_5M_Production.bin "${COREBOOT_DIR}/util/me_cleaner"
38+
rm -rf ./*
39+
popd || exit
4040

41-
mv me_shrinked.bin "${output_dir}/me.bin"
42-
#rm ./*.bin
41+
# Neutralize and shrink Intel ME. Note that this doesn't include
42+
# --soft-disable to set the "ME Disable" or "ME Disable B" (e.g.,
43+
# High Assurance Program) bits, as they are defined within the Flash
44+
# Descriptor.
45+
# https://github.com/corna/me_cleaner/wiki/External-flashing#neutralize-and-shrink-intel-me-useful-only-for-coreboot
46+
pushd "${COREBOOT_DIR}/util/me_cleaner" || exit
4347

44-
popd
45-
fi
48+
python me_cleaner.py -r -t -O me_shrinked.bin ME8_5M_Production.bin
49+
rm -f ME8_5M_Production.bin
50+
mv me_shrinked.bin "${output_dir}/me.bin"
51+
popd || exit
52+
fi
4653

47-
if ! echo "${ME_BIN_HASH} ${output_dir}/me.bin" | sha256sum --check; then
48-
echo "ERROR: SHA256 checksum for me.bin doesn't match."
49-
exit 1
50-
fi
54+
if ! echo "${ME_BIN_HASH} ${output_dir}/me.bin" | sha256sum --check; then
55+
echo "ERROR: SHA256 checksum for me.bin doesn't match."
56+
exit 1
5157
fi
58+
fi
5259
fi

‎blobs/xx30/download_clean_me_manually.sh

Lines changed: 32 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,53 +4,66 @@ function printusage {
44
echo "Usage: $0 -m <me_cleaner>(optional)"
55
}
66

7-
BLOBDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
7+
BLOBDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
8+
FINAL_ME_BIN_SHA256SUM="c140d04d792bed555e616065d48bdc327bb78f0213ccc54c0ae95f12b28896a4 $BLOBDIR/me.bin"
9+
ME_EXE_SHA256SUM="f60e1990e2da2b7efa58a645502d22d50afd97b53a092781beee9b0322b61153 g1rg24ww.exe"
10+
ME8_5M_PRODUCTION_SHA256SUM="821c6fa16e62e15bc902ce2e958ffb61f63349a471685bed0dc78ce721a01bfa app/ME8_5M_Production.bin"
811

912
if [ "$#" -eq 0 ]; then printusage; fi
1013

1114
while getopts ":m:" opt; do
1215
case $opt in
13-
m)
14-
if [ -x "$OPTARG" ]; then
15-
MECLEAN="$OPTARG"
16-
fi
17-
;;
16+
m)
17+
if [ -x "$OPTARG" ]; then
18+
MECLEAN="$OPTARG"
19+
fi
20+
;;
21+
*)
22+
;;
1823
esac
1924
done
2025

21-
FINAL_ME_BIN_SHA256SUM="c140d04d792bed555e616065d48bdc327bb78f0213ccc54c0ae95f12b28896a4 $BLOBDIR/me.bin"
22-
ME_EXE_SHA256SUM="f60e1990e2da2b7efa58a645502d22d50afd97b53a092781beee9b0322b61153 g1rg24ww.exe"
23-
ME8_5M_PRODUCTION_SHA256SUM="821c6fa16e62e15bc902ce2e958ffb61f63349a471685bed0dc78ce721a01bfa app/ME8_5M_Production.bin"
24-
26+
if [ -e "$BLOBDIR/me.bin" ]; then
27+
echo "$BLOBDIR/me.bin found..."
28+
if ! echo "$FINAL_ME_BIN_SHA256SUM" | sha256sum --check; then
29+
echo "$BLOBDIR/me.bin doesn't pass integrity validation. Continuing..."
30+
rm -f "$BLOBDIR/me.bin"
31+
else
32+
echo "$BLOBDIR/me.bin already extracted and neutered outside of ROMP and BUP"
33+
exit 0
34+
fi
35+
fi
2536

2637
if [ -z "$MECLEAN" ]; then
27-
MECLEAN=`command -v $BLOBDIR/../../build/x86/coreboot-*/util/me_cleaner/me_cleaner.py 2>&1|head -n1`
38+
MECLEAN=$(command -v "$BLOBDIR/../../build/x86/coreboot-"*/util/me_cleaner/me_cleaner.py 2>&1 | head -n1)
2839
if [ -z "$MECLEAN" ]; then
2940
echo "me_cleaner.py required but not found or specified with -m. Aborting."
30-
exit 1;
41+
exit 1
3142
fi
3243
fi
3344

3445
echo "### Creating temp dir"
3546
extractdir=$(mktemp -d)
36-
cd "$extractdir"
47+
cd "$extractdir" || exit
3748

3849
echo "### Downloading https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe..."
39-
wget https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe || { echo "ERROR: wget not found" && exit 1; }
50+
wget https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe || { echo "ERROR: wget not found" && exit 1; }
4051
echo "### Verifying expected hash of g1rg24ww.exe"
4152
echo "$ME_EXE_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on downloaded binary..." && exit 1; }
4253

4354
echo "### Extracting g1rg24ww.exe..."
44-
innoextract ./g1rg24ww.exe || { echo "Failed calling innoextract. Tool installed on host?" && exit 1;}
55+
innoextract ./g1rg24ww.exe || { echo "Failed calling innoextract. Tool installed on host?" && exit 1; }
4556
echo "### Verifying expected hash of app/ME8_5M_Production.bin"
4657
echo "$ME8_5M_PRODUCTION_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on extracted binary..." && exit 1; }
4758

48-
echo "###Applying me_cleaner to neuter+deactivate+maximize reduction of ME on $bioscopy, outputting minimized ME under $BLOBDIR/me.bin... "
49-
$MECLEAN -r -t -O "$BLOBDIR/me.bin" app/ME8_5M_Production.bin
59+
bioscopy="some_value" # Assign a value to the bioscopy variable
60+
61+
echo "### Applying me_cleaner to neuter+deactivate+maximize reduction of ME on $bioscopy, outputting minimized ME under $BLOBDIR/me.bin... "
62+
"$MECLEAN" -r -t -O "$BLOBDIR/me.bin" app/ME8_5M_Production.bin
5063
echo "### Verifying expected hash of me.bin"
5164
echo "$FINAL_ME_BIN_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on final binary..." && exit 1; }
5265

66+
echo "### Cleaning up..."
67+
cd - >/dev/null
5368

54-
echo "###Cleaning up..."
55-
cd -
5669
rm -r "$extractdir"

0 commit comments

Comments
 (0)