- Initial commit

.gitignore

@@ -0,0 +1,3 @@
+*.o
+*.so
+ibm_pw_clear.efi

LICENSE.md

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2018 Brett Dutro
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

Makefile

@@ -0,0 +1,30 @@
+ARCH            = $(shell uname -m | sed s,i[3456789]86,ia32,)
+
+OBJS            = main.o
+TARGET          = ibm_pw_clear.efi
+
+EFIINC          = /usr/include/efi
+EFIINCS         = -I$(EFIINC) -I$(EFIINC)/$(ARCH) -I$(EFIINC)/protocol
+LIB             = /usr/lib
+EFILIB          = /usr/lib
+EFI_CRT_OBJS    = $(EFILIB)/crt0-efi-$(ARCH).o
+EFI_LDS         = $(EFILIB)/elf_$(ARCH)_efi.lds
+
+CFLAGS          = $(EFIINCS) -fno-stack-protector -fpic \
+		  -fshort-wchar -mno-red-zone -Wall 
+ifeq ($(ARCH),x86_64)
+  CFLAGS += -DEFI_FUNCTION_WRAPPER
+endif
+
+LDFLAGS         = -nostdlib -znocombreloc -T $(EFI_LDS) -shared \
+		  -Bsymbolic -L $(EFILIB) -L $(LIB) $(EFI_CRT_OBJS) 
+
+all: $(TARGET)
+
+ibm_pw_clear.so: $(OBJS)
+	ld $(LDFLAGS) $(OBJS) -o $@ -lefi -lgnuefi
+
+%.efi: %.so
+	objcopy -j .text -j .sdata -j .data -j .dynamic \
+		-j .dynsym  -j .rel -j .rela -j .reloc \
+		--target=efi-app-$(ARCH) $^ $@

README.md

@@ -0,0 +1,41 @@
+# IBM x3550/x3560 M3 Password Clear Tool
+
+Small EFI utility that clears the power-on and setup passwords in IBM x3550/x3650 M3 servers
+
+## Getting Started
+
+### Prerequisites
+
+You'll need the GNU-EFI headers and libraries installed if you want to build this from source. Alternatively, you can just download a precompiled binary from the release page.
+
+### Building
+
+Just run
+```
+make
+```
+The resulting binary is named `ibm_pw_clear.efi`
+
+### Running
+
+* You can directly boot to the binary if you rename it to `shellx64.efi` and place it on a USB drive. The server should automatically reboot after clearing the passwords.
+* Alternatively, you can also boot into a UEFI shell and run `ibm_pw_clear.efi` manually
+
+### FAQ
+
+* **Wait, how am I supposed to run this tool if the boot and setup passwords are both set?**
+**Boot Password**
+This can be disabled with a switch on the motherboard.
+**Setup Password**
+This one is harder, because you can't change boot options unless you know the setup password. If you're lucky, USB UEFI boot might already be enabled. If it isn't, you can try resetting the CMOS settings. PXE boot is enabled in the default settings, and it's relatively simple to PXE boot an EFI binary (either a shell or this tool).
+
+## License
+
+This project is licensed under the MIT License - see the [LICENSE.md](LICENSE.md) file for details
+
+## Acknowledgments
+
+* Nikolaj Schlej's [UEFITool](https://github.com/LongSoft/UEFITool) made all this possible
+* Pedro Vilaça's [EFISwissKnife IDA plugin](https://github.com/gdbinit/EFISwissKnife) and [blog post](https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/) on Apple EFI reverse engineering were both enormously helpful
+* Jethro Beekman's [blog post](https://jbeekman.nl/blog/2015/03/reverse-engineering-uefi-firmware/) on UEFI reverse engineering
+

main.c

@@ -0,0 +1,35 @@
+#include <efi.h>
+#include <efilib.h>
+
+EFI_STATUS
+EFIAPI
+efi_main (EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable) {
+	InitializeLib(ImageHandle, SystemTable);
+	Print(L"Hello, world!\n");
+
+	//EFI_GUID guid={0x73e47354,0xb0c5,0x4e00,{0xa7,0x14,0x9d,0x0d,0x5a,0x4f,0xdb,0xfd}};
+	EFI_GUID guid={0x67BE7D8A,0xFD0D,0x4DDF,{0xAE,0x65,0xBB,0x11,0x5C,0xCA,0x66,0xAE}};
+    	void* intf;
+
+    	if (uefi_call_wrapper(SystemTable->BootServices->LocateProtocol, 3, &guid,NULL,&intf)==EFI_SUCCESS)
+    	{
+    	    Print(L"Loaded DxeIBMUserSecurity\n");
+	    void* fn = (void*)((char*)intf+0x18);
+	    // Calling with 0 will clear the boot password
+	    // Calling with 1 will clear the setup password
+
+    	    Print(L"Clearing boot password\n");
+    	    uefi_call_wrapper((INTN(*)(void*,int))(*(void**)fn), 2, intf,0);
+    	    Print(L"Clearing setup password\n");
+    	    uefi_call_wrapper((INTN(*)(void*,int))(*(void**)fn), 2, intf,1);
+    	}
+    	else
+    	{
+    	    Print(L"Unable to load DxeIBMUserSecurity\n");
+    	}
+
+    	Print(L"Press any key to continue\n");
+	EFI_INPUT_KEY key;
+	uefi_call_wrapper(SystemTable->ConIn->ReadKeyStroke, 2, SystemTable->ConIn, &key);
+	return EFI_SUCCESS;
+}