Computerdores

UEFI Crackme

jann.stute@protonmail.com (Jann Stute) — Sun, 28 Jun 2026 00:00:00 +0000

Recently, my laptop (an Acer A315-23) decided to randomly enable secure boot and since my linux install is obviously not signed, it proceeded to not boot anymore. Given that I had work to do, I immediately went to disable it, only to realise I had at some point set a password for my UEFI. The only problem: I didn't remember it, only that I had set something simple. And so it happened that I tried 3 incorrect UEFI passwords and was greeted with this:</p>

┌────────────────────────────────────────┐
</span>│ Enter Unlock Password(Key: xxXXxxXXxx) │
</span>├────────────────────────────────────────┤
</span>│█                                       │
</span>└────────────────────────────────────────┘
</span></code></pre>
Which immediately prompted the question: "What the hell is an Unlock Password and why is it telling me about a key?"
After a bit of googling, it seemed to me that this is intended to be a way for Acer to sell UEFI unlocks to people, with the key being used as a nonce.</p>
And while, later the same day, I managed to guess my UEFI password (it was "1"), I was immediately hooked on reversing this.
Afterall, this is basically an in-the-wild crackme and with CTF kinda, sorta, maybe being dead</a>, I am a rev-starved rev-addict.</p>
Extracting UEFI image</h2>
The first step was of course getting my hands on a UEFI image I can reverse.
Luckily, Acer provides a seemingly complete list of released versions of the UEFI firmware with download links on their website.</p>
After downloading the image for the version currently installed on my Laptop (1.19), it took me quite a bit to actually get something to reverse.
Because as all manufacturers seem to do, Acer ships a single executable UEFI updater that you are supposed to run.
Using binwalk's --extract</code> functionality quickly yielded me a bunch of files, whose names seemed reminiscent of extracted Insyde UEFI's I had found online</a>.
After some googling, I was able to identify two of the included files as UEFI image files: Z8E_multi.fd</code> and Z8E2_multi.fd</code>.</p>
At this point I found the uefitool</code> package with the uefiextract</code> tool.
I used this to extract a bunch of PE32 EFI modules from the image (I used Z8E2_multi.fd</code>, the stuff relevant to this post seemed to be the same in both files).
Looking through those modules, it wasn't long until I found my target: A01UnlockPassword</code>.</p>
Reversing the UEFI Module</h2>
Looking into the UEFI module my first step was to look for the strings I had already seen while interacting with the unlock mechanism.
I was quickly able to identify this formatting call:</p>
sub_4014d0</span>(</span></span></span>msg,</span> 0x</span>200</span>,</span> u</span>"</span>%s</span>(Key:%s</span>)"</span></span>,</span> buffer</span>)</span></span></span>;</span>
</span></code></pre>
Which lead me to this string comparison of a string computed in the same method:</p>
generate_upw_bin</span>(</span></span></span>&</span>buf,</span> 0x</span>a</span>,</span> &</span>out</span>)</span></span></span>;</span>
</span>bytes_to_wstr</span>(</span></span></span>&</span>out,</span> unlock_password</span>)</span></span></span>;</span>
</span>//</span> ...
</span></span>else</span> if</span> (</span>wstrcmp</span>(</span></span></span>unlock_password,</span> input?</span></span></span>)</span></span></span>)</span></span>
</span>    rsi =</span> EFI_SECURITY_VIOLATION;</span>
</span></code></pre>
And while I had obviously not named these methods as you see them here yet, it did immediately seem like this comparison would be the actual check.
From here I discovered that the only input for the generation (the "Key" we are shown) seemed to be a value loaded from a UEFI Variable in the parent function:</p>
VariableName =</span> u</span>"</span>AUPS"</span></span>;</span> //</span> with fallback to u"AUPH" and u"AUPU" if variable is not set
</span></span>status =</span> gRT</span>-></span>GetVariable</span>(</span></span></span>VariableName,</span> &</span>UnknownVendorGuid,</span> 0</span>,</span> &</span>DataSize,</span> &</span>variable_data</span></span>)</span></span></span>;</span>
</span>result_1 =</span> ask_unlock_pw</span>(</span></span></span>(</span>char</span>*</span>)</span></span>arg1 -</span> 0x</span>30</span>,</span> variable_data,</span> arg2,</span> r9_2</span></span>)</span></span></span>;</span>
</span>
</span>if</span> (</span>result_1 >=</span> EFI_SUCCESS)</span></span> {</span>
</span></span>    gRT</span>-></span>SetVariable</span>(</span></span></span>VariableName,</span> &</span>UnknownVendorGuid,</span> 
</span></span></span></span>        EFI_VARIABLE_NON_VOLATILE |</span> EFI_VARIABLE_BOOTSERVICE_ACCESS
</span></span></span></span>            |</span> EFI_VARIABLE_RUNTIME_ACCESS,</span> 
</span></span></span></span>        0</span>,</span> nullptr</span></span>)</span></span></span>;</span>
</span></span>    result =</span> EFI_SUCCESS;</span>
</span></span>}</span></span>
</span></code></pre>
As you can see all candidates for the varible name contain "AUP" which probably stands for "Acer Unlock Password".
These variables are all associated with the UEFI Vendor GUID 89CB0E8D-393C-4830-BFFF65D9147E8C3B</code>, which I was not able to conclusively attribute.
I suspect that it belongs either to Acer or to Insyde, since the latter is/was also involved in the development of this UEFI FW.</p>
We can also see that the variable is cleared, if the unlock password (UPW) is entered correctly, making sure that each UPW can only be used once.
I also found the function responsible for generating new keys for the UPW generation, however, it makes use of several non-standard UEFI protocols and the current time, so I didn't look into it further.</p>
Firmware Rehosting</h2>
Before getting into the weeds on reversing the generation process, I first wanted to make sure I could validate partial findings and debug a future reimplementation of the process.
For this I turned to firmware rehosting using unicorn.</p>
I wrote up a ~100 line python script that would load the PE32 into memory and prepare the emulator for running the generate_upw_bin</code> function on its own.
For this I simply had it load the necessary parameters for the function into memory and wrote some hooks to tell me intermediate results and stop execution after the function was finished.</p>
This meant that on the second evening of this project, I was already able to generate Unlock Passwords via this rehosting setup.</p>
Reversing the UPW generation</h2>
With this context information I decided to dive into the function I called generate_upw_bin</code>.
It is responsible for generating an 8 byte value whose hex representation will be the UPW.
The only input it takes is the ascii decimal representation of the key.</p>
Looking into the function, I could see that it is made up of three steps that each yield an intermediate buffer.
Because I suspected that they didn't come up with this entirely on their own, I used an LLM to help identify these steps and was met with great success.
After validating the claims of LLM via my rehosting setup, I had already minimal python code for two thirds of the process.
It turned out that the first step was simply calculating the SHA 256 digest, while the third step was just calculating the reversed ECMA182 variant of CRC64.</p>
This left just the second step to reverse engineer, which proved a little more interesting.
It turns out that they implemented two custom shuffling routines, which produce a plaintext and a key from the SHA 256 digest.
These are then fed into 10-round AES128 and the resulting cipher text is fed into the aforementioned CRC64 to produce the final output.</p>
Password Generator</h2>
With the insights gained from reverse engineering this, it was relatively simple to write a python reimplementation of the password generation.
I was debating whether to release this, however, during my research I found a third party website where you can buy these Unlock Passswords.
And the existance of this third party site means that any modicum of a security benefit from Secure Boot is already gone on these devices anyway.
Because of that I am releasing this, because it benefits right to repair and makes sure that even if Acer shuts down their version of this, people can still unlock their UEFIs.</p>
With that said, you can find the python script on my github: Computerdores/acer-uefi-upw-gen</a>.
Also, if you have an Acer Laptop feel free to test it and let me know if it works, as I only know that it works on my Acer A315-23.</p>



Analysing the Panchan Botnet
jann.stute@protonmail.com (Jann Stute) — Sat, 23 May 2026 00:00:00 +0000
A writeup analysing a malware sample of the panchan botnet.


PP25 - 'FTP++'
jann.stute@protonmail.com (Jann Stute) — Sat, 15 Nov 2025 00:00:00 +0000
A writeup for the 'FTP++' challenge from the Platypwn 2025.


Site Revamp
jann.stute@protonmail.com (Jann Stute) — Sun, 14 Sep 2025 00:00:00 +0000
So, one afternoon, a couple of months ago, I got bored and ended up browsing the dark web.
Against my expectations I quickly found myself back on the clear web on an obscure blog whose .onion address had been linked to on a link list.
Reading around the blog proved fascinating, not necessarily for the content of it (eventhough there was some interesting stuff there, see artemislena.eu</a>), but more so for something it linked to: A webring</u>.</p>
For those that don't know (I didn't): A webring</a> basically consists of a bunch of websites that link to each other in a circle, usually with some kind of common theme and a common navigation bar.
What fascinated me about this was that this was a relic of the old internet which I had believed to have died when social media came around.
Yet here it was, alive and well, just hidden from view waiting for one to find a website from which to start surfing</em>.</p>
After proceeding to spend the entire evening reading around various blogs, I kind of forgot about it for a while due to a lack of spare time.
Then, a couple of days before starting to write this, I remembered that afternoon and fell down the rabbit hole again</em>.
Several hours later, having already been unhappy with the uninspired, bland state my website was in at this point, I decided I would completely revamp it.</p>
For this I had a couple of things in mind that I noticed while surfing which I wanted to adopt for my website.
First of I wanted to keep any and all javascript off of my site.
This is because I don't have any ambitions for this place beyond publishing my writeups and writing the occasional blog post and such things should not require javascript.
Additionally this should hopefully make the website work properly in terminal based browsers.</p>
Another thing I came across is Jeff Huang's post "This Page is Designed to Last"</a>.
It advocates for building web sites in ways that prevent them from requiring active maintenance to keep up since this maintenance typically dries up before the hosting does.
As someone who also really likes the Stop Killing Games</a> Movement, this immediately resonated with me since it also makes archival easier.
As a part of this I also switched from Jekyll, a Static Site Generator (SSG), which I was using previously to Zola, another SSG, because it is much simpler and faster and should thus simplify maintenance.
I also switched to using a system font stack in order to speed up page loads and avoid hotlinking to external font providers like Google (also cuz fuck em that's why</a>).
In the same vein I try to avoid increasing the (compressed) size of the entire site too much to make load times faster and archival easier (also I want the 250KB club badge).</p>
Lastly, since I like getting flash banged at 01:00 o'clock as little as the next guy/girl I want my page to have a proper dark mode and light mode without people needing to use dark reader.</p>


About
jann.stute@protonmail.com (Jann Stute) — Fri, 05 Sep 2025 00:00:00 +0000
Hi! I'm Jann, a 21 year old computer science student from Germany.</p>
I am active in the cybersecurity club of my university (the Platypwnies</a>)1</a></sup> and spend some of my free time contributing to open-source projects, mainly TagStudio</a>.</p>
I also maintain a small NAS at home to host some services for myself. Said NAS also collects comment / guestbook submissions on this site for me to review later, so if that is broken you know why.</p>
If you want to reach out feel free to leave a message in the guestbook</a> or checkout my contacts</a>.</p>
^{1</sup>
As of writing this on 2026-05-27, I am also a representative and administrator of the club</p>
</div>}


Contact
jann.stute@protonmail.com (Jann Stute) — Fri, 05 Sep 2025 00:00:00 +0000
E-Mail: jann.stute [ät] protonmail.com</p>
Github: Computerdores</a></p>
Gitlab: JannStute</a></p>
Mastodon: @computerdores@chaos.social</a></p>


Guestbook
jann.stute@protonmail.com (Jann Stute) — Fri, 05 Sep 2025 00:00:00 +0000
Leave a Message!


Privacy Policy
jann.stute@protonmail.com (Jann Stute) — Fri, 05 Sep 2025 00:00:00 +0000
General</h2>
I currently use GitHub Pages to host the static content of this site so anything transmitted by your browser is subject to whatever they do with it. This may change in the future (e.g. I may decide to self-host it instead).</p>
Forms</h2>
When you submit a form on this website, the following is collected:</p>

Any data entered into the form</li>
Your IP address</li>
Your User Agent String</li>
</ul>
What happens to that data:</p>

Data entered in forms may</em> be published on the site

Typically in the form of guestbook entries, referrer statistic, comments, etc.</li>
</ul>
</li>
IP and UA String will not be published^{1</a></sup> and will be retained until I clean up my logs.

This is mostly in case of spamming/DoS/etc. so I can investigate.</li>
</ul>
</li>
</ul>
Please Note: In order to delete a message in the future you will have to be able to prove that it was you who posted it.
Typical ways of doing this would be providing a link to your website (one which you have control over) with the original message or signing your message with a public key2</a></sup>.
I have this policy, because allowing anyone to request deletion of a guestbook entry/comment would allow trolls and other bad faith actors to enact censorship on them.</p>
^{1</sup>
Nor will any third-party be allowed to access it in any way. Only exception could be if someone helps me with system maintenance, my NAS is stolen ^^, or something similar.</p>
</div>}^{2</sup>
Note that any information provided for this purpose will be stored in the public git repository of this website, so a shared secret like a password will not work.</p>
</div>}Changes</h2>
Any changes to this privacy policy will be published here.
In order to be notified of changes to this page you can subscribe to the RSS</a>/Atom</a> Feeds.</p>}


GPN - 'Honeypot'
jann.stute@protonmail.com (Jann Stute) — Wed, 09 Jul 2025 20:00:00 +0200
A writeup for the 'honeypot' challenge from the GPN 2025.


CSCG - 'echofaas'
jann.stute@protonmail.com (Jann Stute) — Thu, 01 May 2025 00:00:00 +0000
A writeup for the 'echofaas' challenge from the CSCG 2025.


0xL4ugh - 'dance'
jann.stute@protonmail.com (Jann Stute) — Mon, 24 Jun 2024 00:00:00 +0000
A writeup for a reversing challenge from the 0xL4ugh CTF involving runtime bytecode modification.


GPN - 'Archventure Time'
jann.stute@protonmail.com (Jann Stute) — Wed, 05 Jun 2024 12:00:00 +0200
A writeup for the 'Archventure Time' challenge from the GPN 2024.


0xL4ugh - 'nano'
jann.stute@protonmail.com (Jann Stute) — Tue, 21 May 2024 00:00:00 +0000
A writeup for a reversing challenge from the 0xL4ugh CTF involving assembly level obfuscation and cross process fault handling.

Computerdores

UEFI Crackme

Analysing the Panchan Botnet

PP25 - 'FTP++'

Site Revamp

About

Contact

Guestbook

Privacy Policy

General</h2> I currently use GitHub Pages to host the static content of this site so anything transmitted by your browser is subject to whatever they do with it. This may change in the future (e.g. I may decide to self-host it instead).</p>

Forms</h2> When you submit a form on this website, the following is collected:</p>

Changes</h2> Any changes to this privacy policy will be published here. In order to be notified of changes to this page you can subscribe to the RSS</a>/Atom</a> Feeds.</p>

GPN - 'Honeypot'

CSCG - 'echofaas'

0xL4ugh - 'dance'

GPN - 'Archventure Time'

0xL4ugh - 'nano'

General</h2>
I currently use GitHub Pages to host the static content of this site so anything transmitted by your browser is subject to whatever they do with it. This may change in the future (e.g. I may decide to self-host it instead).</p>

Changes</h2>
Any changes to this privacy policy will be published here. In order to be notified of changes to this page you can subscribe to the RSS</a>/Atom</a> Feeds.</p>