pfSense on Watchguard M370

requiemshymn

@stephenw10 Thanks very much! That worked for me and thanks again!

HangmansNoose001380

In case anyone is interested or would like to work with me on unlocking I believe I've managed to get a .bin backup of the bios from an M370. SPI header layout is the same as the M400 & XTM5 series but a programmer won't read the chip until the CMOS jumper is set to reset (pins 2+3). Please let me know if anyone is interested. Current screenshots of bios in BCP5:

stephenw10

Ah, that's fun! I assume it won't boot in that state?

HangmansNoose001380

Not sure yet, still working up the courage to try and change it and re-flash it. Those images are from the extracted bios. I've been going through the settings in BCP and the UBU tool and it looks like it should boot in that state. Console redirection appears to be turned off so I can't Freedos for flashing and it looks like it'll have to be via SPI. I've never flashed one via SPI before so I'm being thorough before making the attempt. If you would like I can post a link to the .bin file?

Here's some of the output from the UBU Tool in case anyone finds it helpful:

ac072a05-77a1-4089-ad66-53cd79947993-UBU_InitialScan.JPG
ed70bbe4-3509-4f65-89a5-31558d253ecc-UBU_InitialScan_P2.JPG
970fdcdd-5d05-453f-8af5-3624cfd81f79-UBU_MCExtractor2.JPG
e88f893d-a0ad-42fb-84bf-04c01d86642e-UBU_IFR_Extractor.JPG

stephenw10

Sure I'll poke at it if you have a link. Maybe PM it.
It's been a while but IIRC flashrom could not read it at all.
I would have though FreeDOS would work but I'm not sure any version of AFUDOS will read that. It might require the uefi version which I've never tried via serial console...

HangmansNoose001380

@stephenw10 So far I haven't been able to get FreeDOS to redirect anything but garbage over serial. I'll PM you the file, from what I'm seeing the bios doesn't appear to be heavily locked down (ME is disabled) but it looks like the only way to flash over a new rom is with SPI or a PCIE video card and/or soldering on a VGA header.

soupman

@hangmansnoose001380

I have an m370 and tried to unlock it.

I booted from a windows 10 disk that I moved to the m370 and used rdp to log in.
Flashrom for windows can't read the chip. However ami AFUWIN tool can read the flash and I tried to remove the password with Uefitool ( not sure anymore). The password is located at 2 locations and I blanked both. Reflashed with AFUWIN.
After a reboot the system is strangely slow and will reset, after that the password is back. I checked and reflashed multiple times and always ended up back to the password on boot.

I gave up...too much time wasted on this. I still have the bios bin somewhere. Anybody ?

HangmansNoose001380

@soupman I'm going to admit I've been lazy about doing my write up on this. From what I've read the Aptio V Bios can store the setup password in the TPM and regen it if it's cleared out of the bios file. I tried the same method and was not able to get it cleared out. I did manage to modify a Lanner original bios (no password) and flash it/overwrite the stock bios on 2 M370's successfully using a CH341A Black. I've been running the modified bios for the last few months now. If you're interested I can write up the steps and post them on here and DM you a link for the bios file?

soupman

@hangmansnoose001380

sure I will try it. DM me the link. I will flash it with afuwin and see what happens...

The lanner bios is unlocked ? Can boot from usb ?

thx

HangmansNoose001380

@soupman Nope can't boot from usb, you have to use one of the CH341 SPI programmers and attach it to the SPI pin outs on the motherboard or at least that has been my experience so far. After flashing you can boot from usb.

soupman

@hangmansnoose001380

dead now. Flashed ok, but does no longer boot.

Did you connect to the spi pin connector or a soic clip ? Any guide ?

Thx

HangmansNoose001380

@soupman I'm working on the documentation, but it won't be until tomorrow or this weekend. I had to wire from the pins on the SPI programmer directly to the SPI pins on the mobo. I flashed it without power to the device and I had some issues until I used a USB 3.0 outlet. I did not use a SOIC clip because the chip is not labeled on the board and won't fit on what I suspect is the chip because it butts up against a heatsink. It is a Winbond chip (Bios_Chip: Winbond W25Q128). I had to use ASProgrammer (or whatever SPI programmer software you prefer) to wipe the chip, then verify it was wiped, then write the new bios. I should have documentation posted in the next few days.

HangmansNoose001380

I assume no responsibility for damage to the device. Follow the instructions below at your own risk. Instructions below should only be used for M370 model and may not work for other models in the Mx70 series.

Part 1: Connecting SPI programmer to SPI header

Picture of SPI Header on board:

Image of SPI Programmer pins:

Note: 5v is not used.

Unplug power from the M370
Remove the CMOS battery
Using the chart above connect the cable from the SPI programmer pins to the corresponding pins on the mobo listed in the chart above (Note: Pins 1,2,6, & 7 are not used, Pin3 is CS (CS0), and Pin4 is your 3.3v power).
Plug the programmer into a USB 3.1 port or plug into a USB extension cable plugged into a USB 3.1 port. This may work on USB 3.0 port as I believe a 3.0 port should provide the necessary power but I used a 3.1 port.

HangmansNoose001380

Image of CH341A Black SPI programmer plugged into the header on the board:
434a9494-738c-44a7-bed2-47b5a0a5336e-image0 (2).jpeg

Part 2 coming soon

stephenw10

As far as I know the boards are identical across the series so I would expect it to work on any. But that remains untested.

HangmansNoose001380

@stephenw10 The documentation from Watchguard indicates that the M670 will take a Xeon processor which I believe requires the Intel C236 series chipset and the M370 has a B150 series chipset. The microcode is there on the M370 but I was unable to get it to run the Xeon processor which makes me suspect that at least the M670 has a different chipset, hence the warning. This part is all speculation and should not be referred to as fact. I defer to @stephenw10 here as he has more experience with the Watchguard devices than I do.

stephenw10

Well not really with this. If you've tried the same Xeon as fitted in the 670 and it doesn't work in the 370 that seems pretty conclusive evidence it must be different to me.

Steve

HangmansNoose001380

Same Xeon but the device wouldn't even boot. I don't have any solid evidence on what chipset is in the M470 and M570 but I suspect they may have the C236 chipset as well. I'm currently flashing one of my M370's back to the stock bios so I can document the flash process of the unlocked/modified Lanner bios. Should have Part 2 of this documented by the end of this weekend.

soupman

@hangmansnoose001380

Ok i need to get some stuff and then reflash it.

As I remember the xeon microcode was not in the bios.

Update you when I have some progress.

THX

stephenw10

The m470 does appear to have a C230 series chipset but I've found that can be misleading:

[2.6.0-RELEASE][admin@m470-2.stevew.lan]/root: pciconf -lv
hostb0@pci0:0:0:0:	class=0x060000 card=0x20158086 chip=0x190f8086 rev=0x07 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Xeon E3-1200 v5/E3-1500 v5/6th Gen Core Processor Host Bridge/DRAM Registers'
    class      = bridge
    subclass   = HOST-PCI
pcib1@pci0:0:1:0:	class=0x060400 card=0x20158086 chip=0x19018086 rev=0x07 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '6th-10th Gen Core Processor PCIe Controller (x16)'
    class      = bridge
    subclass   = PCI-PCI
pcib2@pci0:0:1:1:	class=0x060400 card=0x20158086 chip=0x19058086 rev=0x07 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = 'Xeon E3-1200 v5/E3-1500 v5/6th Gen Core Processor PCIe Controller (x8)'
    class      = bridge
    subclass   = PCI-PCI
pcib3@pci0:0:1:2:	class=0x060400 card=0x20158086 chip=0x19098086 rev=0x07 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = 'Xeon E3-1200 v5/E3-1500 v5/6th Gen Core Processor PCIe Controller (x4)'
    class      = bridge
    subclass   = PCI-PCI
xhci0@pci0:0:20:0:	class=0x0c0330 card=0x72708086 chip=0xa12f8086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family USB 3.0 xHCI Controller'
    class      = serial bus
    subclass   = USB
none0@pci0:0:20:2:	class=0x118000 card=0x72708086 chip=0xa1318086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family Thermal Subsystem'
    class      = dasp
ig4iic0@pci0:0:21:0:	class=0x118000 card=0x72708086 chip=0xa1608086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family Serial IO I2C Controller'
    class      = dasp
ig4iic1@pci0:0:21:1:	class=0x118000 card=0x72708086 chip=0xa1618086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family Serial IO I2C Controller'
    class      = dasp
ahci0@pci0:0:23:0:	class=0x010601 card=0x72708086 chip=0xa1028086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Q170/Q150/B150/H170/H110/Z170/CM236 Chipset SATA Controller [AHCI Mode]'
    class      = mass storage
    subclass   = SATA
pcib4@pci0:0:28:0:	class=0x060400 card=0x72708086 chip=0xa1108086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib5@pci0:0:28:4:	class=0x060400 card=0x72708086 chip=0xa1148086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib6@pci0:0:28:5:	class=0x060400 card=0x72708086 chip=0xa1158086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib7@pci0:0:28:6:	class=0x060400 card=0x72708086 chip=0xa1168086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib8@pci0:0:28:7:	class=0x060400 card=0x72708086 chip=0xa1178086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib9@pci0:0:29:0:	class=0x060400 card=0x72708086 chip=0xa1188086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib10@pci0:0:29:1:	class=0x060400 card=0x72708086 chip=0xa1198086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib11@pci0:0:29:2:	class=0x060400 card=0x72708086 chip=0xa11a8086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
pcib12@pci0:0:29:3:	class=0x060400 card=0x72708086 chip=0xa11b8086 rev=0xf1 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family PCI Express Root Port'
    class      = bridge
    subclass   = PCI-PCI
isab0@pci0:0:31:0:	class=0x060100 card=0x72708086 chip=0xa1498086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'C236 Chipset LPC/eSPI Controller'
    class      = bridge
    subclass   = PCI-ISA
none1@pci0:0:31:2:	class=0x058000 card=0x72708086 chip=0xa1218086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family Power Management Controller'
    class      = memory
none2@pci0:0:31:4:	class=0x0c0500 card=0x72708086 chip=0xa1238086 rev=0x31 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '100 Series/C230 Series Chipset Family SMBus'
    class      = serial bus
    subclass   = SMBus
none3@pci0:1:0:0:	class=0x0b4000 card=0x00008086 chip=0x04348086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'DH89XXCC Series QAT'
    class      = processor
none4@pci0:1:0:1:	class=0x020000 card=0x0dc18297 chip=0x04368086 rev=0x21 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'DH8900CC Null Device'
    class      = network
    subclass   = ethernet
igb0@pci0:2:0:0:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb1@pci0:2:0:1:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb2@pci0:2:0:2:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb3@pci0:2:0:3:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb4@pci0:3:0:0:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb5@pci0:3:0:1:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb6@pci0:3:0:2:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb7@pci0:3:0:3:	class=0x020000 card=0x0000ffff chip=0x15218086 rev=0x01 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I350 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb8@pci0:5:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb9@pci0:6:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb10@pci0:7:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb11@pci0:8:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb12@pci0:9:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb13@pci0:10:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb14@pci0:11:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet
igb15@pci0:12:0:0:	class=0x020000 card=0x0000ffff chip=0x15338086 rev=0x03 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'I210 Gigabit Network Connection'
    class      = network
    subclass   = ethernet

Steve