Update README

Fix typos, add section about working devices, provide additional
information regarding the source of `bootmgfw.efi`.

README.md

@@ -5,7 +5,7 @@ existed since October 2005, was discovered in August 2022 and publicly [disclose
 Rairii](https://mastodon.social/@Rairii@haqueers.com/109817927808486332) after which it was assigned
 [CVE-2023-21563](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21563).
 
-The full attach chain was demonstrated by Thomas in his [38C3 talk](https://events.ccc.de/congress/2024/hub/en/event/windows-bitlocker-screwed-without-a-screwdriver/)
+The full attack chain was demonstrated by Thomas in his [38C3 talk](https://events.ccc.de/congress/2024/hub/en/event/windows-bitlocker-screwed-without-a-screwdriver/)
 which was followed up by two blog posts:
 
 - [Windows BitLocker -- Screwed without a Screwdriver](https://neodyme.io/en/blog/bitlocker_screwed_without_a_screwdriver/)
@@ -19,7 +19,7 @@ written by [@notselwyn](https://twitter.com/notselwyn).
 Parallel to this work [Andreas Grasser](https://github.com/andigandhi/bitpixie) also 
 attempted to reproduce the original research, ending up with a very similar approach.
 
-## Pre-Requirements
+## Prerequisites
 
 BitLocker must be configured without pre-boot authentication also sometimes referred 
 to as unattended/transparent mode i.e. without a PIN or a key file.
@@ -153,7 +153,15 @@ The device should now reboot over PXE, fail to fully load the Windows boot confi
 > 
 > This typically means something did not work as expected.
 
-Login with the `root` user, no password is needed. Follow the instructions printed in the logon message. Replace `XXX` with device file representing your encrypted BitLocker volume:
+Login with the `root` user, no password is needed. Follow the instructions printed in the logon message.
+Replace `XYZ` with device file representing your encrypted BitLocker volume:
 ```
 exploit && ./mount.sh /dev/XYZ && ls mnt
 ```
+
+## Success Stories
+
+Windows 11 devices which were successfully exploited, after manually enabling the TCP stack in the UEFI settings:
+
+- Lenovo ThinkPad T460s 20FAA01100
+- Lenovo ThinkPad X280 20KES6C42B

pxe/README.md

@@ -1,12 +1,25 @@
 This prepares a PXE boot environment to exploit the bitpixie vulnerability.
 
 The kernel (`linux`) and initramfs (`alpine-initrd.xz`) is expected to be provided externally,
-e.g. by running the scripts in the (corresponding linux directory](../linux).
+e.g. by running the scripts in the [corresponding linux directory](../linux).
 
-The `download.sh` script fetches the required components from public sources:
+The `download.sh` script fetches some of the required components from public sources:
  - `shimx64.efi` signed Debian shim
  - `grubx64.efi` signed Debian GRUB boot loader
- - TODO: `bootmgfw.efi` vulnerable Windows boot manager
+
+Unfortunately, the vulnerable Windows boot manager `bootmgfw.efi` is not available
+as a convenient standalone download. Its SHA256 hash can be looked up in
+[Winbindex](https://winbindex.m417z.com/?file=bootmgfw.efi) to get the following
+metadata:
+
+ - Update: KB5019311 (OS Build 22621.525) released on 2022-09-27
+ - File version: 10.0.22621.457
+ - Signing date: 2022-08-11
+
+```
+$ sha256sum bootmgfw.efi
+b5632b54120f887ec3d1f1f405ad75c71a2c066ddb34e54efa374c4f7190b2c1  bootmgfw.efi
+```
 
 The `start-smb.sh` script starts an impacket based SMB server providing the 
 [`create-bcd.bat`](./smb/create-bcd.bat) script to generate a device specific