Personal computing discussed

Moderators: Flying Fox, Thresher

 
Muggerprime
Gerbil In Training
Topic Author
Posts: 1
Joined: Mon Apr 16, 2018 10:38 am

Disabling CompuTrace

Mon Apr 16, 2018 10:41 am

Greetings everyone,

I refurbish computers for a living. An office in my area upgraded their laptops and sent the old ones to a recycling center in my area. The recycling center plans to scrap them for metal, because they all have Computrace active. If I can disable the Computrace, they're willing to sell them to me for cheap. They gave me one of them to play with and try to disable it. If I can't, they're going to throw these otherwise perfectly good I5 laptops in the shredder.

They are all Dell Latitude E5430. The one I got had bios A11 on it, and I flashed it to A18 (non-vPro).

Computrace has 3 settings in the Bios - "Disabled", "Deactivated", and "Activated". "Deactivated" means it's ready to be set to "Disabled" or "Activated". Once set to one of those two, it can "never" be changed, and the setting in the Bios is grayed out. I want to change the setting from "Activated" to "Deactivated" so I can then go in and disable it.

I found a video of someone doing this on a different Dell (this is exactly what I'm trying to do):
(I can't post links on this forum because I'm too new, but go to Youtube, video code kwsM51V0SXc )

What I've tried:
- I tried extracting the Bios from the "5430A18.exe" file using the /writehdrfile and /writeromfile flags, but got errors and it didn't work.
- I used "Universal BIOS Backup ToolKit 2.0" to try to backup my Bios to a file. I ended up with "DellInc.-A18.rom", which is 14MB. I'd attach it here, but there doesn't seem to be a way to attach files.
- I then used "UEFITool_0.22.4_win" to try to edit the Rom. I found 2 Computrace modules, and a lot a Computrace references in "SetupPrep". The modules were easy enough to remove, but wasn't sure if I should remove SetupPrep or leave it. I don't know enough to edit it. I decided to leave it.
- I got stuck when it came time to try to flash the Rom file back. Dell has no separate flash utility for Rom/Bin/HDR files; their Bios files are all EXE. I tried a few flashing programs, but they all said my Rom was an invalid file.

Can anyone please help me?
 
deruberhanyok
Gerbil XP
Posts: 495
Joined: Sat Jul 17, 2004 9:30 am

Re: Disabling CompuTrace

Mon Apr 16, 2018 11:23 am

We've run into this with some Dells at the office. Motherboards were replaced for unrelated issues and then our monitoring tools detected computrace activity where none had been before.

In every instance Dell has had to send someone out to replace the motherboard again. They swear there's no way to turn it off, but from what I can see that isn't true. It's just that they don't want to disable it once it is turned on, so they do a replacement instead. I don't understand why, it has to cost more to replace a part, but I guess that's part of the "security" of the solution.

I looked at the video you mention and it looks like what he has done is either created or gotten hold of one of the provisioning tools Dell uses when they do a motherboard replacement - as there is no other way to change the service tag of the system embedded in the BIOS. But if you can delete it then the system will boot up in an initial configuration kind of mode, and it appears as if that defaults the computrace to disabled. Or possibly it's the act of changing the service tag to a different value than it had been previously.

Either way, if this is like other Dell "help me unlock it" kind of stuff out there (and judging from the youtube comments it is), it's going to be model specific, and that would mean someone would have to have a way to erase the service tag data from an E5430 so you can get it into this default state. Maybe the tool the guy is using recognizes that model or maybe it doesn't.

Dunno if that helps you but your best bet is probably contacting the guy who posted the video (his email is in the video description) and getting a copy of the software.
<3 TR
 
Chrispy_
Maximum Gerbil
Posts: 4462
Joined: Fri Apr 09, 2004 3:49 pm
Location: Europe, most frequently London.

Re: Disabling CompuTrace

Mon Apr 16, 2018 11:36 am

You are S-outta-L; They really do belong in the scrap heap!

https://securelist.com/absolute-computr ... ted/58278/
Congratulations, you've noticed that this year's signature is based on outdated internet memes; CLICK HERE NOW to experience this unforgettable phenomenon. This sentence is just filler and as irrelevant as my signature.
 
Glorious
Gold subscriber
Gerbilus Supremus
Posts: 11283
Joined: Tue Aug 27, 2002 6:35 pm

Re: Disabling CompuTrace

Mon Apr 16, 2018 11:36 am

Well, I can help with this:

Muggerprime wrote:
- I tried extracting the Bios from the "5430A18.exe" file using the /writehdrfile and /writeromfile flags, but got errors and it didn't work.


Those flags will only ever work if that EXE (which is a basically a flasher with embedded firmware data) was intended to let you extract the ROM. They won't do anything otherwise, their function is 100% intrinsic to the program contained in that EXE, not extrinsic. That is, they aren't an operation you do on the file, they are on operation that file does on itself.

Muggerprime wrote:
- I got stuck when it came time to try to flash the Rom file back. Dell has no separate flash utility for Rom/Bin/HDR files; their Bios files are all EXE. I tried a few flashing programs, but they all said my Rom was an invalid file.


As discussed above, this is because they *are* a specific flasher program with embedded firmware data. Like a bundle.

The biggest problem here is that you have no idea if your "DellInc.-A18.rom" won't just brick your computer if you did manage to flash it. Even if you do find some flashing program which says the file is valid that doesn't mean it'll actually work, much less after you start editing it.

Fundamentally, CompuTrace (or LoJack) is intended to *not* let you do this. That is, if it was *easy* to just *disable*, there isn't much point to it as a feature. Are there flaws? Certainly, but unless they really goofed it up on this one model the kind of thing you are doing really shouldn't even work.

Who is online

Users browsing this forum: No registered users and 1 guest