Hacker News new | past | comments | ask | show | jobs | submit login

For those using the traditional DOS-style approach, there has never been a reason or need for any Dell-supplied Windows apps which can compromise the firmware, even upon reboot. Allowing only the local manual console operator to do the deed, and only when NOT booted to Windows or Linux always gave an extra layer of security by comparison.

Now we know the Windows way was far less secure than we thought, although it did seem like an obvious security compromise when they first started trying to update BIOS from Vista in addition to the DOS way.

Dell has traditionally provided BIOS firmware updates primarily in DOS-executable .EXE form, with additional Windows apps or Dell Update Package approaches becoming available over the decades as the functional reliability was thought to be almost comparable when attempting to replace the ROM file from Windows.

The most reliable way to update your firmware has always been to turn off the PC, disconnect the HDD or SSD, then boot to DOS using a floppy, CD, or USB device which contains the flashing program and the ROM file. Run the BIOS flash program from the DOS command line like usual.

The equivalent on UEFI motherboards is to boot to the UEFI Shell itself, which if built-in may just come up by default if no drives are connected. Otherwise you will need to supply your own Shell64.efi on a storage medium in a recognized filesystem like FAT32 which UEFI is required to read from.

In shell64.efi you will be in a DOS-like command line then you run the vendor-supplied UEFI-executable .EFI program also on your storage media, which then applies the updated ROM file just like it would in DOS. But no operating system needed or wanted, not even DOS any more.

Dell example option 1.3.1:

https://qrl.dell.com/Files/en-us/Html/Workstations/DellPreci...

Other motherboards have had a built-in flash routine for some time now, where it recognizes a proper ROM file on a FAT32-formatted USB drive, and you can flash it with no OS necessary either.

Also, the FreeDOS approach is just the DOS that is used for distribution to avoid copyright issues. Most of the updates distributed with a FreeDOS platform were usually developed & tested using MS-DOS, and you may have better luck burning the FreeDOS version to floppy, CD, or USB, then copying the vendor executables & files to equivalent MS-DOS-booting media rather than the supplied FreeDOS-booting approach.




is code signing not a thing on EFI or something?




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: