Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Look before you leap?

Before using the PS scripts I would like to know before hand if something goes wrong can I recover? That might be "refreshing" the BIOS firmware via a re-installation of the firmware and then being able to reboot into the OS. Or it could be a matter of replacing the keys using the factory default variables and, again, booting into the OS. And once that set of experiences and know-how is under my belt, then try using the Garlin PS scripts.

DJinSD said:

....I have found size of the NVRAM chips in the technical specifications for all. .....

be able to determine those details: Intel CSME: Drivers, Firmware and Tools for ME 16+ or Intel® Processor Diagnostic Tool .

Click to expand...

Machines don't have a NVRAM- chip. You find the size for the firmware chip(s), but the NVRAM is an EFI- volume in the firmware (with it's own defined size), and- depending on manufacturer- there are different configurations. Intel firmware can be dumped using the tools mentionend and there are parsing tools to display the structure of the firmware.

For Intel machines the bios vendor is only responsible for the part that is named Bios region. Flash descriptor, ME region are created with the mentioned Intel tools.

Firmware with AMI Bios region for 10 Gen Intel Asus q470- 2 NVRAM 192 kB each (24 MB size of firmware):


Firmware with AMI Bios region for Gigabyte B760 board - 2 NVRAM 256 kB each (16 MB size of firmware):


Intel firmware with Phoenix Bios region for 13th gen Intel Laptop - one NVRAM divided in sections, main volume ~380 kB (32 MB size of firmware):


In addition the NVRAM is not only a store for the certificates, it's almost constantly written to by the OS and stores a lot more of settings. The invalid entries are old outdated entries. And there's normally a routine for emptying/ cleaning the NVRAM when it's full, it's not meant that one size the NVRAM should last the machines life and if NVRAM is full, the machine is finished...

That't the Lenovo Notebook NVRAM expanded - full length:



(Sorry for the length of this post...)

I stand corrected: I should have said volume.

Unless AMD, the future is legacy BIOS (half kidding half not).

Jimbo93 said:

Disregard my question above. Windows just took care of it without my help.

Click to expand...

Not sure why you had a problem. Looks like the CA 2023 certs got updated.

I wonder if there is a way to clear that NVRAM thing and clear certs if the system is unable to boot... there's a jumper for CMOS, but this?
In our prior particular case... I dunno if there's a way to boot a Linux distro via USB and clear that... or in the worst case, a jumper.
That should be included in BIOSes... you could save yourself lots of headaches.

Also Dual BIOS with a secondary set of NVRAM should be mandatory for this kind of things...

Since someone mentioned AMD- it's still UEFI, just the prorietary part (the complement to Intels ME) is different and looks less structured at first look. The bios code volumes look quite similar. AMD sometimes has two complete firmwares for different cpus (so it's not reduncacy) in one firmware chip, looks like this is one of those.

X570, AMI. 1 NVRAM 128 kB (2 x 16 MB firmware):


There are solutions to add a layer of redundancy. Many machines from HP, Lenovo, ... do come with kinda dual bios, but it's not simply a complete 'dual' firmware solution, it's meant to add safety and security. So it's made from what the manufacturer / bios vendor means is relavant firmware parts which are stored on a second chip often the same size as the chip for the working firmware.

Recovery chip of an Intel 11th/12th gen firmware. The coloured parts are bios code areas (no NVRAM backup), the unstructured parts in the beginning and end contain other critical parts like parts of the ME and Flash descriptor. These elements can have a checksum in the TPM.
Have a look at the size of the area without EFI structure in the end- over 18 MB. The size of the padding in the beginning is just ~1.3MB.


Problem with these solutions is that they're not only made for redundancy but for security = 'anti fiddling'.

Some machines do have the capability to restore parts of the NVRAM or at least to restore the basic settings. But it's unclear how it's done, maybe they use a storage outside the firmware, maybe they have really a solution for working on the firmware chip non- booted. This was seen mostly with people tampering with undervolting. A low voltage works fine when the chip is 'warm', but no longer on cold boot. Values stored in NVRAM, so...

Otherwise the hard way is to buy a programmer, was typically CH341, about 5 to 15 $ from China. Edit your firmware dump, replace the NVRAM with the (empty) NVRAM of a stock firmware / bios update for the corresponding machine. NVRAM is getting rebuilt automatically (may require several boots).
If there's machine specific data (forexample some Intel NUC) and the Windows OEM license stored in the NVRAM it's a little more tricky since this information is most often not rebuilt automatically.

As written earlier, there's a lot of firmware repair in the badcaps forum and on winraid.

DarkShadowMD said:

.... In our prior particular case... I dunno if there's a way to boot a Linux distro via USB and clear that... ....

Click to expand...

Since his machine doesn't get through POST it doesn't boot anything....

DarkShadowMD said:

I wonder if there is a way to clear that NVRAM thing and clear certs if the system is unable to boot... there's a jumper for CMOS, but this?

Click to expand...

It's not that easy. CMOS is battery dependant, but these firmware- chips don't depend on any battery voltage. And this would be the same 'delicate' write operation that might've bricked the machine, so it'd require some kind of stable 'minimal booted state' for any write operation, even if you just copy an empty default NVRAM- volume into place. Even more complicated if there's relevant information like Windows OEM activation and machine specific information like serial, service tag somewhere in the NVRAM...

Is NVRAM located on a EEPROM chip?

Not always. While some types of NVRAM (Non-Volatile Random Access Memory) use EEPROM internally as a backup, many others use a traditional battery-backed SRAM (Static RAM) chip or newer solid-state technologies like FRAM. [1, 2, 3, 4]


The relationship between NVRAM and EEPROM depends entirely on the design of the chip:

• Hybrid NVRAM (SRAM + EEPROM): Many older hardware configurations use a chip that combines both. It functions as a standard, fast RAM during normal operation. If power fails, the contents of the RAM are quickly saved into a built-in EEPROM layer to prevent data loss.
• Battery-Backed NVRAM: Many computer motherboards and older arcade or synthesizer systems use a regular SRAM chip connected to a small internal watch battery. As long as the battery holds a charge, the RAM retains its data without needing an EEPROM.
• Standalone EEPROM: An EEPROM chip is technically a type of non-volatile memory itself, but it is typically used for Read-Only memory (like BIOS storage) because it writes data too slowly to act like standard, dynamic RAM. [1, 2, 7, 8, 9]

Are you trying to replace or troubleshoot a specific piece of hardware (like a motherboard, arcade game, or synthesizer)? If you specify the device or chip model, I can help you figure out exactly what kind of memory it uses.
AI can make mistakes, so double-check responses
[1] https://www.eeeguide.com/nvram-non-volatile-random-access-memory/
[2] https://techterms.com/definition/nvram
[3] https://pcbstore.com.bd/glossary/nvram
[4] https://itpod.com/glossary/nvram
[5] https://www.reddit.com/r/beneater/comments/qh25u2/nvram_as_faster_eeprom/
[6] https://forums.arcade-museum.com/threads/replacing-nvram-with-eeprom.510866/
[7] https://www.lenovo.com/gb/en/glossary/nvram/
[8] https://www.edaboard.com/threads/difference-between-nvram-and-eeprom.306965/
[9] https://au.rs-online.com/web/content/discovery/ideas-and-advice/eeprom-guide

Asus272 said:

Are you trying to replace or troubleshoot a specific piece of hardware (like a motherboard, arcade game, or synthesizer)? If you specify the device or chip model, I can help you figure out exactly what kind of memory it uses.

Click to expand...

t2s50 said:

As written earlier, there's a lot of firmware repair in the badcaps forum and on winraid.
Since his machine doesn't get through POST it doesn't boot anything....

Click to expand...

Could there still be hope for @NikosD Lenovo M700 Tiny, it would be great news for him !

But this is really getting off topic for Garlin's Secure Boot update...

Can I suggest a new thread, something like "Unbrick BIOS / Computer" ?
This way, people who have the expertise and can assist Nikos with is problem can exchange on the subject

anchamp65 said:

Could there still be hope for @NikosD Lenovo M700 Tiny, it would be great news for him !

Click to expand...

Hope theoretically yes, of course, it should be possible to repair the firmware (if it's firmware / NVRAM related and the chip still can be rewritten).

But he seems to be banned? He still can write direct message where he writes that and where he's trying to convince people to warn of the use of garlins scripts and he expresses strongly that he has no interest at all in repairing his PC. So 'great news' not so much.

anchamp65 said:

But this is really getting off topic for Garlin's Secure Boot update...

Can I suggest a new thread, something like "Unbrick BIOS / Computer" ?
This way, people who have the expertise and can assist Nikos with is problem can exchange on the subject

Click to expand...

Well, it's not so much off- topic.

- That's a discussion about a possible adverse effect of trying to update the certificates (whichever way) and
- There seems to be a lot of confusion about "the NVRAM", so it might be helpful to keep it close to the thread here and
- This thread has already more than 130 pages, full with personal experiences and problems., so probably no one will anyway read it all...

But this isn't up to me!

anchamp65 said:

Can I suggest a new thread, something like "Unbrick BIOS / Computer" ?
This way, people who have the expertise and can assist Nikos with is problem can exchange on the subject

Click to expand...

Supposedly, this is a Windows 11 forum. Keep it that way.

he just pm'd me with the same story. my pc is a hp thats over 15 years old . i am not a computer tech . i am a people tech (lol).
To make a long story short i found a firmware update from hp. and installed it . got my secure boot function enabled . my stupid self tried using mosby and i had to reset my bios lost secure boot for almost a year. Then garlin released a new script and whammo it got it back .

I dont think its the scripts issues. Its his NVRAM .

I believe it's a healthy discussion to note some particular BIOS'es can be effectively "bricked". But these problems are hard to predict externally, because you would have to know about their specific BIOS implementations.

The script isn't doing any unsupported, in fact MS provides a bare bones reference example on their Secure Boot GitHub repo. PS has supported commands for writing to the Secure Boot variables (presumably it's a pass-thru to the underlying SecureBoot.dll library). From Windows, based on what features are supported in communicating with the BIOS, you cannot get any indication of the UEFI NVRAM's free space, or how it's internally assigned.

Before writing my scripts (and after that time), I've always looked at other Windows-based UEFI tools and PS modules to see if there's room for improvements. There's compiled executables like uefivar.exe and the popular UEFIv2 PowerShell module. You don't get much beyond the standard reading & writing of variables.

If you read the UEFI specs, it's up to the BIOS run-time services to inform the calling OS whether it can comply with a write request.

8. Services — Runtime Services — UEFI Specification 2.10 documentation

Status Codes Returned

EFI_SUCCESS	The firmware has successfully stored the variable and its data as defined by the Attributes.
EFI_INVALID_PARAMETER	An invalid combination of attribute bits, name, and GUID was supplied, or the DataSize exceeds the maximum allowed.
EFI_INVALID_PARAMETER	VariableName is an empty string.
EFI_OUT_OF_RESOURCES	Not enough storage is available to hold the variable and its data.
EFI_DEVICE_ERROR	The variable could not be saved due to a hardware failure.
EFI_WRITE_PROTECTED	The variable in question is read-only.
EFI_WRITE_PROTECTED	The variable in question cannot be deleted.
EFI_SECURITY_VIOLATION	The variable could not be written due to EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS or EFI_VARI ABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS being set, but the payload does NOT pass the validation check carried out by the firmware.
EFI_NOT_FOUND	The variable trying to be updated or deleted was not found.
EFI_UNSUPPORTED	This call is not supported by this platform at the time the call is made. The platform should describe this runtime service as unsupported at runtime via an EFI_RT_PROPERTIES_TABLE configuration table.

Click to expand...

From my reading of the spec, it implies the UEFI is responsible for knowing whether it could comply with any request to write more data to the DBX. It sounds like the warning posted in the Acer community forum: it's not that the DBX's content was too large, but an incorrect implementation of the expected data size within the firmware causes an unusable BIOS.

Meaning, it's a firmware bug.

A number of other Lenovo PC's have been updated without problems. That doesn't imply the script can't cause problems. But it's not the script itself, the bug would have existed regardless of whether you used another method to write the same DBX data. Could you skip the DBX update (in terms of the banned EFI signature hashes)? Yes, that doesn't directly impact the CA 2023 migration or banning of the PCA 2011.

But the normal practice (even on Linux) is to apply the DBX EFI hashes as a recommended security step (to block vulnerable boot files).

MS has some data in the Confidence Bucket JSON files for BucketID's which are blocked from updates (presumably from known firmware issues). Unfortunately, MS doesn't make it easy because you have to cross-index the blocked ID's with the HighConfidenceData CSV's on their GitHub. It's a data parsing nightmare, and the only way to efficiently deal with the data is to build a database for searching.

I'm not motivated to creating such a database because I think some of their published Confidence Bucket data is garbage. It's garbage because some data import or export process from their source database is creating nonsensical HW entries that don't make sense on review. I've reported it to MS, but they don't seem to have figured it out. (For example: a MS Surface device is reported as both an ASUS and HP device on the same line).

Back in May I noticed my Acer laptops had an issue with the cert update, found garlin's advice/scripts, and discovered that his instructions to add the KEK did not match my very simple Acer BIOS. He and some others kindly responded to my request for advice (#1977) but I realised I was out of my depth. I decided the risk of creating an instant brick was greater than not receiving potential future boot‑level security protections. Especially as Microsoft would probably declare my hardware obsolete by then (in fact it already did with one laptop).

Returning today to look at where the discussion has moved I think I made the right decision.

misar said:

Returning today to look at where the discussion has moved I think I made the right decision.

Click to expand...

Maybe... maybe not...
I initially ran Garlin's scripts on computers that were 5 and 7 years old
And that was after reading most of this thread at that time, early April, and reading up on MS guides (for what it's worth) and other forums, etc...
I then decided to take a chance on a Lenovo L440 from 2013 telling myself, if it goes horibly wrong, am I ok with letting go of this computer.
My answer was yes, I can live without it, and I jump in !

It's a mather of how important or attached to the computer you are when it's more then +/- 10 years and you try and change/update things in the BIOS...

I truly hope someone can help him
Best of luck @NikosD !

I ran the scripts on an HP ENVY that has a 2014 BIOS, they ran perfectly and it's not happily fully updated. I believe @garlin when he says that bricking the BIOS is an isolated example. As I've said before, I've bricked a machine years ago with an old Phoenix BIOS just by running their approved update procedure!

misar said:

Back in May I noticed my Acer laptops had an issue with the cert update, found garlin's advice/scripts, and discovered that his instructions to add the KEK did not match my very simple Acer BIOS. He and some others kindly responded to my request for advice (#1977) but I realised I was out of my depth. I decided the risk of creating an instant brick was greater than not receiving potential future boot‑level security protections. Especially as Microsoft would probably declare my hardware obsolete by then (in fact it already did with one laptop).

Click to expand...

The sad reality is not all BIOS'es are created equal. And some brands have more issues (Acer for example) because of the earlier BIOS implementations that were chosen. It's strange that within the next week or so, Acer is finally delivering CA 2023 support for the laptops they're supporting. Most other OEM's finished their BIOS updates by late 2025 or early 2026.

Update Your Secure Boot Certificates In June 2026 to Stay Protected - Acer Community

Makes me think that Acer knows something about their own UEFI, because you wouldn't waited this long to act. To add more certs to the factory defaults normally involves appending more bytes to the end of your existing data. It doesn't take months of engineering work to complete.