[Request] Fujitsu T732 (TUSV106.cap) 3G WWAN Whitelist removal

[P@S@f]

Model: Fujitsu Lifebook T732 non-vPro version (HM76 chipset)
BIOS: http://www.fujitsupc.com/downloads/mobil...4bit_17.7z
Type: Phoenix SecureCore Tiano
RSA signed: no? (no Decryption string in Phoenix Tool)
PCI ID: USB\VID_1199&PID_9015 (original)
USB\VID_413C&PID_818E (want to install)

[P@S@f]

Figured out it by myself.. seems like community is 'on vacation' (actually mean BDMaster).
So, basically I was not able to find way to flash modified bios without programmer (but I've modified tool that now could downgrade even if it denied from bios - useless for me). Maybe there is a way with some tricky cert-signing or through EFI hacking (I even seen EFI Phoenix Crisis, but file was paid and not available anymore). Although you could do full dump with FPT by shorting 1 and 5 pins of HDA chip (pic).
And even with programmer I wasn't able to do in-circuit flash, only desoldering of flash chip helped.
It located on backside of PCB so you need completely disassemble laptop and dismount mainboard to turn around it. 2 Winbond flash chips W25Q32BV and W25Q80BV located near south-bridge next to each other. You need only W25Q32BV. Dump it, make sure you did it correctly (verify), then took phoenix tool and load dump there. You need C13AE648-252D-488E-923E-739D55367C3B module (WwanDxe.efi). Open up it with Hex editor and replace

Code:

75 21 0F B7 84 24 84 00 00 00 48 8B 4C 24 30 48 6B C9 0C 48 8D 15 F5 FA FF FF 0F B7 4C 0A 02 3B C1 74 0E 83 BC 24 80 00 00 00 00 0F 84 C5 00 00 00

with

Code:

EB 21 0F B7 84 24 84 00 00 00 48 8B 4C 24 30 48 6B C9 0C 48 8D 15 F5 FA FF FF 0F B7 4C 0A 02 3B C1 74 0E 83 BC 24 80 00 00 00 00 90 90 90 90 90 90

or if you have Fujitsu T732 non-vPro (HM76 chipset) bios version 1.0.5 here is mine already modified module:

  C13AE648-252D-488E-923E-739D55367C3B.zip (Size: 1.97 KB / Downloads: 8)
I'm not sure if it will work on other laptops, so USE IT ONLY AND ONLY IF YOU HAVE SAME LAPTOP AND BIOS VERSION.

If you can't find sequence in your version - load module to IDA, needed place was located in start function here for me:
   
I've removed this check and bam - WWAN was detected by Windows (don't know actually if all functions work as intended, as you see inside loop there some additional check which I think might enable additional functions, so..
(if you know what it means - then you know what you need to do with it)
If not - don't try, I can't help you, you're out of luck, wait for BDMaster return (or burn with fire those greedy peoples which won't share their modified BIOSes).
Good luck.

[P@S@f]

Oh yeah, proofs, I forgot:
https://imgur.com/gallery/NTcdu

[P@S@f]

For those who want to unlock hidden settings:
Replace

Code:

E6 8B EC B2 8C A6 BF 4F 9D 0A 45 97 E8 9E 49 79

with

Code:

77 8B 1D 82 6D 24 96 4E 8E 10 34 67 D5 6A B1 BA

twice
in SystemFormBrowserCoreDxe.efi (32442D09-1D11-4E27-8AAB-90FE6ACB0489)
This will replace Info tab with Debug where all hidden settings present.
Here is modified module:
  32442D09-1D11-4E27-8AAB-90FE6ACB0489.zip (Size: 35.9 KB / Downloads: 4)
CPU microcodes are in FFF12B8D-7696-4C8B-A985-2747075B4F50.
Have fun.