2

Is it possible to find the BIOS password hash in a BIOS dump and decrypt it?

For instance, a person could use flashrom Live CD to dump the BIOS with flashrom -r but how would you find the BIOS password hash in the bios dump?

4
  • 1
    why would it be a hash?
    – dandavis
    Aug 5, 2019 at 21:39
  • That's what they use
    – user213834
    Aug 5, 2019 at 22:49
  • 1
    Assuming the BIOS isn't using a TPM or other hardware security module, then it should indeed be possible to find the password verifier. The verifier is hopefully a hash digest, ideally a slow and salted one (but I bet that varies from implementation to implementation; some are probably unsalted MD5 or something even more broken, or even plain text).
    – CBHacking
    Aug 6, 2019 at 2:30
  • 2
    Sadly, many BIOSes store the password without even hashing it...
    – forest
    Sep 5, 2019 at 8:42

2 Answers 2

1

You would have to disassemble the BIOS image to be sure.

Assuming you have access to a decrypted ROM image, you might get a head start by scanning for a block of bytes that are statistically random. You should expect to find a series of exactly 20 (SHA-1) or 32 (SHA-256) bytes. Then, if you can find a reference to that location, you might have a quick place to set a breakpoint to prove your theory.

0

Historically, no, BIOS password was stored in CMOS memory preserved by battery. I doubt things have changed much (there's still a battery on motherboards and a clear CMOS jumper). Dumping CMOS memory usually would give you the password or its hash.

You can have a look at this tool to "decrypt" passwords: CmosPwd

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .