Skip to content

CMP 40HX Windows Unlock v2.0.1

Choose a tag to compare

View all tags
@Cyridd Cyridd released this 26 Sep 12:46
· 6 commits to main since this release
v2.0.1
e4b4d46
This commit was signed with the committer’s verified signature.
Cyridd
GPG key ID: E82786A3AD987534
Verified
Learn about vigilant mode.

v2.0.1

Secure Boot coexistence, a runtime boot-manager handoff, ReBAR visibility/control, machine-readable diagnostics, and a new CI pipeline that keeps the shipped EFI provably reproducible.

Highlights

  • Secure Boot can now stay on. Sign the unlock EFI with your own key and the firmware will run it — see the new Secure Boot section.
  • No more separate "Limine" build. The single shipped 40HXUNLK.EFI now honors a runtime --return-to-bootloader load option instead of requiring a special NO_AUTO_CHAINLOAD build.
  • ReBAR is now visible and controllable, not just applied silently — 40HXCheck.exe reports it GPU-Z style, and the installer lets you opt out.
  • 40HXCheck.exe -json for scripting and ticket systems.
  • New CI rebuilds the EFI from source on every push and fails if it doesn't hash-match the committed binary.

Added

  • Secure Boot signing (windows/tools/unlock40x/sign_efi.sh): signs the built EFI with your own db key via sbctl (or sbsign as a fallback), verifies the result actually carries a certificate, and prints the signer so you can confirm it's yours.
  • 40HXInstaller.exe -efi <path> to deploy a signed EFI explicitly; a 40HXUNLK.signed.efi placed next to the installer is also picked up automatically. Deployment now prints the payload's source, SHA-256, and signature state, with an explicit warning if Secure Boot is on and the image is unsigned.
  • PE/Authenticode signature reader (40hxcore/pesign.go, read-only, no WinVerifyTrust dependency) so 40HXCheck.exe can tell you whether the deployed EFI is signed and by whom — including a dedicated secure_boot_blocks_unsigned_efi verdict instead of a generic "not unlocked".
  • --return-to-bootloader EFI load option (aliases --return-to-grub, --return-to-limine) for grub/Limine/rEFInd users: the application applies the unlock and hands control back to your boot manager instead of chainloading Windows.
  • ReBAR reporting and control: 40HXCheck.exe reads the XVE Resizable BAR Control register directly and shows whether the 8 GB resize is in effect (NVIDIA APP/Control Panel never show this for this card). New norebar load option, a "ReBar Unlock" checkbox in the installer GUI, and -rebar/-norebar on the CLI.
  • 40HXCheck.exe -json: a stable, versioned (40hxcheck/v1) machine-readable report with a fixed verdict enum and matching process exit codes (0 = unlocked, 1 = not unlocked, 2 = inconclusive).
  • CI (.github/workflows/ci.yml): builds and vets every Go module on native Windows and via Linux cross-compile, runs unit tests, rebuilds the shipped executables, diffs the generated Windows resource object, and rebuilds the EFI from source inside a pinned toolchain container to confirm 40HXUNLK.EFI still reproduces byte-for-byte.

Changed

  • Replaced the old NO_AUTO_CHAINLOAD=1 build-time experiment (separate binary, never fully reliable) with the runtime load-option handoff above.
  • Installer/checker/uninstaller version bumped to 2.0.1.0.

Upgrade notes

  • Default behavior is unchanged if you don't pass any new options: EFI stays unsigned, Secure Boot must stay off, ReBAR still applies automatically.
  • If you signed your own EFI previously via a custom process, switch to sign_efi.sh + -efi <path> (or the 40HXUNLK.signed.efi sidecar) — the installer now prints the hash/signature state so you can confirm what actually got deployed.
Assets 3
Loading