Skip to content

GbE-region MAC randomisation #2171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
FckBigTch wants to merge 3 commits into
base: master
Choose a base branch
from
Open

GbE-region MAC randomisation #2171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f13365f
add nvmutil and ifdtool
FckBigTch Jun 1, 2026
320ad33
add menu option to gui-init.sh
FckBigTch Jun 1, 2026
b04ba37
add tools to the config
FckBigTch Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -758,6 +758,7 @@ bin_modules-$(CONFIG_KBD) += kbd
bin_modules-$(CONFIG_ZSTD) += zstd
bin_modules-$(CONFIG_E2FSPROGS) += e2fsprogs
bin_modules-$(CONFIG_EXFATPROGS) += exfatprogs
bin_modules-$(CONFIG_NVMUTIL) += nvmutil

$(foreach m, $(bin_modules-y), \
$(call map,initrd_bin_add,$(call bins,$m)) \
Expand All @@ -782,6 +783,9 @@ ifeq ($(CONFIG_COREBOOT),y)
$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/cbmem/cbmem))
#$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/superiotool/superiotool))
#$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/inteltool/inteltool))
ifeq ($(CONFIG_IFDTOOL),y)
$(eval $(call initrd_bin_add,$(COREBOOT_UTIL_DIR)/ifdtool/ifdtool))
endif
endif

$(COREBOOT_UTIL_DIR)/cbmem/cbmem \
Expand All @@ -797,6 +801,14 @@ $(COREBOOT_UTIL_DIR)/superiotool/superiotool: \
$(build)/$(zlib_dir)/.build \
$(build)/$(pciutils_dir)/.build \

$(COREBOOT_UTIL_DIR)/ifdtool/ifdtool: $(build)/$(coreboot_dir)/.configured musl-cross-make
+$(call do,MAKE,$(notdir $@),\
$(MAKE) -C "$(dir $@)" \
DOTCONFIG="$(build)/$(coreboot_dir)/.config" \
$(CROSS_TOOLS) \
EXTRA_CFLAGS="-Wno-error" \
)

#
# --- INITRD IMAGE CREATION ---
#
Expand Down
4 changes: 4 additions & 0 deletions boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,8 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
export CONFIG_BOARD_NAME="Thinkpad T480-hotp-maximized"
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"

#tools for mac-ramdomization
export CONFIG_NVMUTIL=y
export CONFIG_IFDTOOL=y

BOARD_TARGETS := t480_me_blobs
4 changes: 4 additions & 0 deletions boards/EOL_t480-maximized/EOL_t480-maximized.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,8 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
export CONFIG_BOARD_NAME="Thinkpad T480-maximized"
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"

#tools for mac-ramdomization
export CONFIG_NVMUTIL=y
export CONFIG_IFDTOOL=y

BOARD_TARGETS := t480_me_blobs
4 changes: 4 additions & 0 deletions boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,8 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
export CONFIG_BOARD_NAME="Thinkpad T480S-hotp-maximized"
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"

#tools for mac-ramdomization
export CONFIG_NVMUTIL=y
export CONFIG_IFDTOOL=y

BOARD_TARGETS := t480s_me_blobs
4 changes: 4 additions & 0 deletions boards/EOL_t480s-maximized/EOL_t480s-maximized.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,8 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
export CONFIG_BOARD_NAME="Thinkpad T480S-maximized"
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"

#tools for mac-ramdomization
export CONFIG_NVMUTIL=y
export CONFIG_IFDTOOL=y

BOARD_TARGETS := t480s_me_blobs
4 changes: 4 additions & 0 deletions boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,10 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
export CONFIG_BOARD_NAME="Thinkpad X230-hotp-maximized"
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"

#tools for mac-ramdomization
export CONFIG_NVMUTIL=y
export CONFIG_IFDTOOL=y

#Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
BOARD_TARGETS := xx30_me_blobs

Expand Down
4 changes: 4 additions & 0 deletions boards/EOL_x230-maximized/EOL_x230-maximized.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,10 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
export CONFIG_BOARD_NAME="Thinkpad X230-maximized"
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"

#tools for mac-ramdomization
export CONFIG_NVMUTIL=y
export CONFIG_IFDTOOL=y

#Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
BOARD_TARGETS := xx30_me_blobs

Expand Down
4 changes: 4 additions & 0 deletions boards/novacustom-v540tu/novacustom-v540tu.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,3 +88,7 @@ export CONFIG_BOOT_KERNEL_ADD=""
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
export CONFIG_BOARD_NAME="NovaCustom V540TU"
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"

#tools for mac-ramdomization
export CONFIG_NVMUTIL=n
export CONFIG_IFDTOOL=n
5 changes: 5 additions & 0 deletions boards/novacustom-v560tu/novacustom-v560tu.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,3 +88,8 @@ export CONFIG_BOOT_KERNEL_ADD=""
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
export CONFIG_BOARD_NAME="NovaCustom V560TU"
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i me -i fd"

#tools for mac-ramdomization
export CONFIG_NVMUTIL=n
export CONFIG_IFDTOOL=n

180 changes: 163 additions & 17 deletions initrd/bin/gui-init.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -628,23 +628,44 @@ show_main_menu() {

show_options_menu() {
TRACE_FUNC
whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
--menu "" 0 80 10 \
'b' ' Boot Options -->' \
't' ' TPM/TOTP/HOTP Options -->' \
'i' ' Investigate integrity discrepancies -->' \
'h' ' Change system time' \
'u' ' Update checksums and sign all files in /boot' \
'c' ' Change configuration settings -->' \
'f' ' Flash/Update the BIOS -->' \
'g' ' GPG Options -->' \
'F' ' OEM Factory Reset / Re-Ownership -->' \
'C' ' Reencrypt LUKS container -->' \
'P' ' Change LUKS Disk Recovery Key passphrase ->' \
'R' ' Check/Update file hashes on root disk -->' \
'x' ' Exit to recovery shell' \
'r' ' <-- Return to main menu' \
2>/tmp/whiptail || recovery "GUI menu failed"
if [ "$CONFIG_NVMUTIL" = "y" ] && [ "$CONFIG_IFDTOOL" = "y" ]; then
whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
--menu "" 0 80 10 \
'b' ' Boot Options -->' \
't' ' TPM/TOTP/HOTP Options -->' \
'i' ' Investigate integrity discrepancies -->' \
'h' ' Change system time' \
'u' ' Update checksums and sign all files in /boot' \
'c' ' Change configuration settings -->' \
'f' ' Flash/Update the BIOS -->' \
'm' ' Ethernet MAC address randomization -->'\
'g' ' GPG Options -->' \
'F' ' OEM Factory Reset / Re-Ownership -->' \
'C' ' Reencrypt LUKS container -->' \
'P' ' Change LUKS Disk Recovery Key passphrase ->' \
'R' ' Check/Update file hashes on root disk -->' \
'x' ' Exit to recovery shell' \
'r' ' <-- Return to main menu' \
2>/tmp/whiptail || recovery "GUI menu failed"
else
whiptail_type $BG_COLOR_MAIN_MENU --title "$CONFIG_BRAND_NAME Options" \
--menu "" 0 80 10 \
'b' ' Boot Options -->' \
't' ' TPM/TOTP/HOTP Options -->' \
'i' ' Investigate integrity discrepancies -->' \
'h' ' Change system time' \
'u' ' Update checksums and sign all files in /boot' \
'c' ' Change configuration settings -->' \
'f' ' Flash/Update the BIOS -->' \
'g' ' GPG Options -->' \
'F' ' OEM Factory Reset / Re-Ownership -->' \
'C' ' Reencrypt LUKS container -->' \
'P' ' Change LUKS Disk Recovery Key passphrase ->' \
'R' ' Check/Update file hashes on root disk -->' \
'x' ' Exit to recovery shell' \
'r' ' <-- Return to main menu' \
2>/tmp/whiptail || recovery "GUI menu failed"
fi

option=$(cat /tmp/whiptail)
case "$option" in
Expand All @@ -669,6 +690,9 @@ show_options_menu() {
f)
flash-gui.sh
;;
m)
mac_randomization_options_menu
;;
g)
gpg-gui.sh
;;
Expand Down Expand Up @@ -905,6 +929,128 @@ force_unsafe_boot() {
fi
}

clean_up_mac(){
# Don't leave temporary files lying around
if [ "$pwd" != "/tmp" ]; then
cd /tmp | return 1
fi

rm -f backup.* flashregion_*.bin
}

mac_randomization_options_menu() {
TRACE_FUNC
whiptail_type $BG_COLOR_MAIN_MENU --title "Ethernet MAC randomization" \
--menu "Select An Option" 0 80 10 \
'r' 'Generate a fully randomized ethernet MAC address' \
'i' 'Use a intel based universal pattern (OUI) to generate a random ethernet MAC address' \
's' 'Show the current ethernet MAC address' \
'm' ' <-- Return to main menu' \
2>/tmp/whiptail || recovery "GUI menu failed"

option=$(cat /tmp/whiptail)
case "$option" in
r)
change_mac "random"
;;
i)
change_mac "intel"
;;
s)
show_mac
clean_up_mac
;;
m) ;;

esac
}

# Show current MAC address
show_mac(){
TRACE_FUNC
# Backup rom
flashprog -p internal -r /tmp/backup.rom
# test if file is > 0 byte
if [ ! -s /tmp/backup.rom ]; then
whiptail_error --title 'ERROR' --msgbox "Unable to read BIOS" 0 80
recovery
fi

cd /tmp
# Extract GBE from ifdtool
ifdtool -x backup.rom
if [ ! -s flashregion_3_gbe.bin ]; then
whiptail_error --title 'ERROR' --msgbox "Unable to extract gbe region" 0 80
recovery
fi

# Show just the current MAC, cut the rest
DUMP_OUTPUT=$(nvm flashregion_3_gbe.bin dump)
CURRENT_MAC=$(printf "%s\n" "$DUMP_OUTPUT" | sed -n '2p')
whiptail_type $BG_COLOR_MAIN_MENU --title "Show current MAC address" --msgbox "Current MAC address: $CURRENT_MAC" 0 80
}

change_mac() {
TRACE_FUNC
local mac_type="$1"

show_mac

# Change MAC address randomly
# "nvmutil cannot specify multicast addresses"
# "nvmutil cannot specify 00:00:00:00:00:00"
# "randomly generated addresses are always unicast and local"
# See https://libreboot.org/docs/install/nvmutil.html

# Change MAC address randomly with intel OUI
# MAC Prefix: 00:1F:3B
# MAC Range: 00:1F:3B:00:00:00 - 00:1F:3B:FF:FF:FF
# See https://uic.io/en/mac/address/001f3b/
# There are a lot of prefixes from intel, this one is randomly picked

case "$mac_type" in
"random")
MAC_PATTERN="??:??:??:??:??:??"
;;
"intel")
MAC_PATTERN="00:1f:3b:??:??:??"
;;
*)
return 0
;;
esac

# Set mac to users choice
nvm flashregion_3_gbe.bin setmac "$MAC_PATTERN"

# Show MAC address to be flashed
NEWDUMP_OUTPUT=$(nvm flashregion_3_gbe.bin dump)
CHANGED_MAC=$(printf "%s\n" "$NEWDUMP_OUTPUT" | sed -n '2p')
whiptail_warning --title "Change ethernet MAC" --msgbox "Changed ethernet MAC address: $CHANGED_MAC" 0 80

# Decision: flash the new MAC address?
if whiptail_warning --title "Change ethernet MAC" --yesno "Do you really want to change the ethernet MAC address?" 0 80 --no-button "Do not change" --yes-button "Change"; then
# Insert modified GBE into backup.rom
if ! ifdtool -i gbe:flashregion_3_gbe.bin backup.rom; then
whiptail_error --title "Error" --msgbox "Failed to insert modified GBE!" 0 80
recovery
fi

# Flash back modified GBE only
if flashprog -p internal --ifd -i gbe -w backup.rom.new; then
whiptail_type $BG_COLOR_MAIN_MENU --title "Change ethernet MAC" --msgbox "Flashing completed successfully!" 0 80
else
whiptail_error --title "Error" --msgbox "Flashing FAILED!" 0 80
recovery
fi
else
whiptail_warning --title "Canceled" --msgbox "Ethernet MAC address change canceled." 0 80
clean_up_mac
fi

clean_up_mac
}

# gui-init start
TRACE_FUNC

Expand Down
18 changes: 18 additions & 0 deletions modules/nvmutil
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
modules-$(CONFIG_NVMUTIL) += nvmutil

nvmutil_version := 26.01rev1
nvmutil_base_dir := lbmk
nvmutil_dir := lbmk/util/nvmutil
nvmutil_tar := $(nvmutil_version).tar.gz
nvmutil_url := https://codeberg.org/libreboot/lbmk/archive/$(nvmutil_version).tar.gz
nvmutil_hash := 05ad4171b211258afc4bc2211fac274566e63726016c735b9ca6742302488e3c


nvmutil_configure :=
nvmutil_target := \
$(MAKE_JOS) \

@tlaurion tlaurion Jul 29, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo, doesn't parallelise build

@tlaurion tlaurion Jul 30, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MAKE_JOBS needed, (not MAKE_JOS)

@FckBigTch FckBigTch Jul 30, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, no problem i will fix the typo

$(CROSS_TOOLS) \
CFLAGS="$(CFLAGS) -Os -Wall -Wextra -std=c99 -pedantic"

nvmutil_output := nvm
nvmutil_depends := $(musl_dep)