bootguard keys are oem specific

The MSI leak comments like https://sizeof.cat/post/leak-intel-private-keys-msi-firmware... mentioned the bootguard keys maybe have been common to other manufacturers: "It is assumed that the keys for downloading the guard are not limited to compromising MSI products and can also be used to attack equipment from other manufacturers using Intel’s 11th, 12th and 13th generation processors (for example, Intel, Lenovo and Supermicro boards are mentioned)"

Those are board that MSI OEMed for other vendors.

So servers and desktops only, which crushes my hope of getting rid of bootguard on my laptop.

What worked for some older think machines (haven't tried it on my thinkpad though) is to update the bios (can be to the same version) and change the serial nr.to all zeroes (the update script asks if you want that). That got rid of the wifi whitelist i encountered.

Very interesting!

Could you please explain which serial? Can you do dmidecode and tell me which Handle/ UUID is all zeroes?

Even if it may not directly apply to current thinkpads, it implies the UEFI module might have other conditionals before going on checking the positive list - something that should be easy to check by reversing the LenovoWmaPolicyDxe.sct PE32.

If you’re interested, I have a dump of my TP bios flash unmodified and then the same version I paid some Russian guy to modify so the whitelist is removed and an extra menu unlocked. I basically sent them the dump, and after a “donation” I got the patches dump back.

Would love to learn how to figure out what the changes are because with my limited knowledge I didn’t figure anything out.

Which thinkpad model?

If you want to learn, https://erfur.github.io/2019/03/28/down_the_rabbit_hole_pt3.... is a good guide!

Thanks, I am so going down this rabbit hole.

It's for an X230, I wanted 802.11ac wifi in it.

If you are interested in doing other modifications yourself, also read about UEFI variables, how they control menu options and can be tweaked with just grub

x230 is easy, just install coreboot instead of messing with bios patches.

I've run coreboot for a while but had issues with USB3 and the docking station so I unfortunately had to revert back to the Lenovo BIOS.

I'd love to buy a AMD Ryzen 3 Pro 5350g, but I don't want to deal with the stupid locked CPUs floating around from Lenovo pulls.