Thomas Schmitt wrote:
>
> In Legion7iG5-*_modified.esp the suspect lost its ID card at the crime scene:
> At byte 39072 (0x98a0) the changes go from 0-bytes to the text "LENOVO".
> At byte 9711680 (0x943040) i see a change from 0-bytes to "BIOS".
> [...]
> Diffing the result of "find" on the mounted unmodified.esp filesystem and> Legion7iG5-*_modified.esp shows that a new branch of directoriies with a
> new file is in each of the modified filesystems:
> > ./efi/Lenovo
> > ./efi/Lenovo/BIOS
> > ./efi/Lenovo/BIOS/SelfHealing.fd
> The file is empty.
This seems to make a lot of sense, since for the Legion 7i gen 5 whenever I started the system on the USB drive, it showed text
Self Healing BIOS Backup Progressing... __%
Or something like that. I probably should have said something about that earlier, but never thought about it. Sorry.
> In ThinkpadX1CarbonG5-0_modified.esp there is no company name to see in
> the changed bytes. I see UTF-16 strings "mation", "System", and
> "Volum\000me". ASCII texts "SYSTEM~1", "WPSETT~1DAT". The latter might
> possibly be "WPSettings.dat", which causes questions in the internet.
I think that this could possibly be explained by flaws in my testing. Some of the computers were using Windows, and for those computers I plugged in the USB drive, shut down the computer, and booted the USB drive from the BIOS. In the time the USB drive was connected to the computer when Windows was in use, it may have written files to it. I realized this could be a problem towards the end of the testing, which is why I started shutting down Windows first before testing the USB. This can be shown in the bottom right results on the table, which are the most recent ones, and the ones where I shut down windows first had no modifications.
So it seems to be that the only modifications of the installer caused by firmware is with the Legion 7i gen 5's self healing BIOS backup. I don't think there is any problem with the debian installer itself, and I don't think there's anything to change in it. When I get home, I'll look for an option to disable the bios backup, and then install debian on my computer. Thank you for your help.
Maybe this problem could be listed on the Debian Installer FAQ? I think it could save some time for others finding it.
Have an awesome day,
Ram