Is it possible to find the BIOS password hash in a BIOS dump and decrypt it?

For instance, a person could use flashrom Live CD to dump the BIOS with flashrom -r but how would you find the BIOS password hash in the bios dump?

  • 1
    why would it be a hash?
    – dandavis
    Aug 5 '19 at 21:39
  • That's what they use
    – user213834
    Aug 5 '19 at 22:49
  • Assuming the BIOS isn't using a TPM or other hardware security module, then it should indeed be possible to find the password verifier. The verifier is hopefully a hash digest, ideally a slow and salted one (but I bet that varies from implementation to implementation; some are probably unsalted MD5 or something even more broken, or even plain text).
    – CBHacking
    Aug 6 '19 at 2:30
  • 1
    Sadly, many BIOSes store the password without even hashing it...
    – forest
    Sep 5 '19 at 8:42

You would have to disassemble the BIOS image to be sure.

Assuming you have access to a decrypted ROM image, you might get a head start by scanning for a block of bytes that are statistically random. You should expect to find a series of exactly 20 (SHA-1) or 32 (SHA-256) bytes. Then, if you can find a reference to that location, you might have a quick place to set a breakpoint to prove your theory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.