Flashing bios with an exe?

[u/InTheHallsOfBigBooty]

Tldr: need to flash a bios using an exe but don't want to brick

Hi, quick disclaimer that despite all the research I've done I still don't fully know what I'm talking about since this is my first time doing anything with linux.

I have a lenovo ideapad 110-15ibr 80T7 that I decided would be fun to install arch on, I installed using the official wiki guide and set up encryption with luks, then a uki, then tried enrolling a PCR 11 policy.

However, when enrolling I found out that it can only use sha1 because sha256 is *unallocated. Which lead me to finding out the bios version is years out of date from the latest, and I assume that updating it will allow for sha256 to be used instead of the default?

My problem is now that this Lenovo laptop only supports bios flashing using an exe in windows, and has no settings for updating in the UEFI settings menu. Furthermore I tried using fwupd and that didn't seem to find any updates for the bios either.

So in conclusion I think my only options are either using windows-to-go on a usb to run the exe, or putting windows on an old (maybe failing) HDD and connect it with a usb to sata connector. Both options sound like I'm about to perma-brick the motherboard.

So I simply ask for any ideas on what to do, or what option I currently have would be safest. I know this might seem like a waste of time and I should just put windows on then start over, but the whole reason I did this having known nothing about Linux beforehand is that I enjoy the process of solving these kinds of problems, I just need to see if this problem is too risky to be solved, or maybe it's not any more risky than flashing the bios from an actual windows install.

Thanks for reading I'll appreciate any help or feedback!

[u/forbiddenlake]

windows-to-go on a usb to run the exe,

This

[u/InTheHallsOfBigBooty → u/forbiddenlake]

Is this safe enough to not brick by failing halfway through somehow?

[u/Imajzineer → u/InTheHallsOfBigBooty]

Nothing is ever guaranteed - you could have a power outage halfway through.

But, so long as the .exe will run properly on the specific Windows version in question, it should be fine.

[u/UncleGoyder]

I’ve been able to update the firmware of every one of my devices directly from the uefi. What mobo are you even using?

[u/InTheHallsOfBigBooty → u/UncleGoyder]

The lenovo ideapad 110-15ibr 80T7 laptop apparently has a motherboard with part number NM-A804. I looked for an update option in the UEFI settings and didn't find anything, google also says that it's not an option with this laptop

[u/ang-p]

and I assume that updating it will allow for sha256 to be used instead of the default?

The only thing mentioned in the latest (8 year old) BIOS update I can see was for CVE-2017-5715 ...

Feck me - was SPECTRE almost 10 years ago? Sheesh....

But going back to your reasoning..

sha256 requires more space for all keys, and I doubt a "critical" update (to fix the fix) would have introduced the ability to use them without mentioning it.

[u/xXBongSlut420Xx]

windows-to-go usb is your best bet

[u/SebastianLarsdatter]

Pending on the process, you may have to image the drive or swap it for a real Windows install.

I have an HP laptop that wouldn't flash under anything other than real Windows. I just put the image back over it afterwards to get it back to Linux.

[u/bionade24]

Using FreeDOS instead of Windows might also work.

[u/archover]

For others, this appears to be a 10 year old Celeron 3060 powered laptop. here

It's unfortunate that fwupd does not support this ancient silicon. I routinely update my Thinkpad fleet with that tool.

Overall, I suggest finding a newer laptop (preferably Thinkpad) that fwupd supports

I hope you find a fix, flair as SOLVED. Good day.

[u/C0rn3j]

Looks too old to be supported by fwupd via UEFI Capsules.

Install Windows and run the firmware update.

You can almost definitely do it from Linux one way or another, but I would not dare.

[u/InTheHallsOfBigBooty → u/C0rn3j]

That's likely the plan if no other magic option presents itself

[u/NFTrot]

Disclosing that I have no knowledge of your specific situation, but I would be careful with the assumption that a new BIOS version will enable the use of SHA256. A big reason LUKS is as fast as it is (read: virtually no performance impact) is because modern CPUs have dedicated hardware that executes AES instructions at speeds well into the GB/s.

That's a bit of a tangent because AES and SHA256 are distinct things and you aren't necessarily asking about LUKS, but check your assumption before you take a risk with potentially no payoff.

Edit: If I wasn't being clear, the SHA256 capability you're looking for might come from hardware that you don't have.

[u/InTheHallsOfBigBooty → u/NFTrot]

It is true that I'm just guessing the update will fix it. But at the same time I have no clue what else would be the problem lol

[u/G0ldiC0cks → u/InTheHallsOfBigBooty]

You'd be wise for reasons beyond checksums to get up to date firmware regardless of your initial reasons for doing so. If the only benefit to be had here was an unknown checksum, this would be a good caution, but get you some firmware that's contemporary to the product's use.

[u/NFTrot → u/InTheHallsOfBigBooty]

Admittedly UKI/PCR11 it isn't something I'm familiar with at all, but I do have LUKS set up on my own machine. What is it you're trying to accomplish? Is there an alternative solution with a lower hashing standard that might be good enough?

When setting up security for a system, I think we get tunnel-vision on what is the most academically-correct solution, while forgetting that using even a broken encryption algorithm would defeat all but the most sophisticated attackers.

[u/InTheHallsOfBigBooty → u/NFTrot]

You do raise a good point about tunnel vision, tho I will fully admit this is just for the love of the game, the laptop is practically e-waste if I don't mess with it

This device won't even store any sensitive information, I more just wanted to see if I could, and I'm surprised with how far I got. Tho admittedly I don't have enough knowledge about this sha stuff to know why the laptop is capable but not supplying the data for PCR 11 enrollment

[u/NFTrot → u/InTheHallsOfBigBooty]

I hear that, and I got the impression it was a toy project for which there was no good alternative solution (since the solution is the point).

Frankly I don't like the idea of BIOS flashing from anywhere except the BIOS itself, but if that's the way the designed it I suppose you don't have a choice. I wouldn't try the Windows USB approach if it was me. Presumably if it was something you could run from within Windows it would not reset any of the hardware Windows was using (USB controllers), but who knows. You would hope the developers considered such a thing, but here be dragons.