Forum RSS Feed Follow @ Twitter Follow On Facebook

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Latest Threads
[REQUEST] Lenovo G510 (79CNxxWW) Whiteli...
Last Post: Sergio717
Today 05:17 AM
» Replies: 656
» Views: 167406
M2N32-SLI Deluxe AM3 Support Request
Last Post: Alxstroi
Yesterday 11:08 PM
» Replies: 105
» Views: 71420
[Request] HP Elitebook 6930P WLAN Whitel...
Last Post: Maxinator500
Yesterday 10:51 PM
» Replies: 17
» Views: 6605
[REQUEST] Lenovo G50-30 (A7CNxxWW) BIOS ...
Last Post: carmelletomato
Yesterday 07:29 PM
» Replies: 46
» Views: 22101
[REQUEST] Lenovo G50-70 (9ACNxxWW) BIOS ...
Last Post: colin89
Yesterday 06:04 PM
» Replies: 140
» Views: 41045
[REQUEST + BOUNTY] Lenovo Thinkpad P14s ...
Last Post: loadit
Yesterday 02:23 PM
» Replies: 3
» Views: 110
[REQUEST] Lenovo Yoga 2 Pro (76CNxxWW) W...
Last Post: Dudu2002
Yesterday 10:53 AM
» Replies: 845
» Views: 317324
[REQUEST] Lenovo Thinkpad E130 (H4ETxxWW...
Last Post: Dudu2002
Yesterday 10:51 AM
» Replies: 509
» Views: 101117
[REQUEST] Lenovo Yoga 11E (N15ETxxW) Whi...
Last Post: Dudu2002
Yesterday 08:15 AM
» Replies: 5
» Views: 2528
[REQUEST] CPU Support for Ryzen 5 3600 o...
Last Post: flexpavillion
Yesterday 04:32 AM
» Replies: 1
» Views: 346
Clevo P775TM1-G BIOS
Last Post: ActivatedNut
Yesterday 01:36 AM
» Replies: 145
» Views: 55361
ASUS P5G41T-M LX2/GB Unlocked Hidden Ove...
Last Post: GangsteR23
03-27-2024 04:58 PM
» Replies: 25
» Views: 64148
lenovo z570 Advanced Menu Unlocked
Last Post: Kaluva12345
03-27-2024 04:58 PM
» Replies: 7
» Views: 4109
Lenovo ThinkCentre M715q 2nd Gen & AMD R...
Last Post: RedfieldHUN1987
03-27-2024 09:23 AM
» Replies: 2
» Views: 155
L14 Gen 3 AMD , Need UEFI unlock advance...
Last Post: frankeinstein2532555
03-27-2024 04:08 AM
» Replies: 0
» Views: 105
[REQUEST] Lenovo Y400 & Y500 (6BCNxxWW) ...
Last Post: freedome
03-26-2024 11:00 PM
» Replies: 188
» Views: 52241
[Request] CPU support for Lenovo IQ57I
Last Post: DeathBringer
03-26-2024 10:02 AM
» Replies: 5
» Views: 247
unlocked Bios for Machenike s16
Last Post: Dudu2002
03-26-2024 09:06 AM
» Replies: 5
» Views: 338
[REQUEST] Bios Unlock Whitelist HP DV6-6...
Last Post: DimanTLT63
03-26-2024 03:03 AM
» Replies: 0
» Views: 154
[REQUEST] HP Pavilion G6-1252ss Whitelis...
Last Post: joseefitness
03-26-2024 01:40 AM
» Replies: 0
» Views: 140

[GUIDE] Removing Wi-Fi/WWAN whitelist on Lenovo (Insyde) BIOS
#1
Photo 
Hello,
As I haven't personally found any good or recent guide on this, I decided to give it a go and write my own.

Here's a link to the article:
https://medium.com/@p0358/removing-wlan-...033a5a5e5a

It is based on Lenovo G510 (where all mods are personal), and involves using SPI programmer + SOIC8 clip, since BIOS on this model is write-protected, so it is the only way to modify it.
Hope it's useful.
find
quote
#2
I've read you just need to remove the module with GUID starting with 11D378C2 and you're good to go. No need for digging deeper into it. Not sure if it works on this model though...
find
quote
#3
This could work tbh, since the whole module is dedicated to whitelist, haven't thought of it, that's pretty nice idea to speed things up. (that is unless something else checks for its presence)
find
quote
#4
I've read reports about this working that way. I can confirm it on a Yoga 2 13 20344. I just removed the whole module and new WiFi card was accepted. Didn't see any negative side effects so far.
find
quote
#5
Thank you for this guide.

I have followed it up to the point where you begin using IDA pro, a software I don't have. I have opened the extracted body (I'll attach it to this post) in Ghidra, and found out that the "Unauthorized ..." string is part of a function that I'll post below, but now I have no real clue on how to proceed. I don't know what that function does and where I should best change it without messing up the whole thing and being unable to boot.

Another thing: What you write is completely understandable up to the point where you mention that "you should be able to do this in a hex editor" - which I certainly don't. I'm sorry to bother you with it, but yours seems to be the only guide that can be found on google, so I imagine other people have similar problems trying to follow it.

Anyway, here is the function I mentioned:

void FUN_00010ec4(undefined8 param_1,undefined *param_2,undefined8 param_3,undefined8 param_4)

{
if (param_2 == (undefined *)0x0) {
param_2 = &DAT_00010ec0;
}
(**(code **)(DAT_00011040 + 0x170))(0x200,param_1,param_2,param_3,&DAT_000104d0,param_4);
return;
}


And this is the entry point from which the above function is called:

longlong entry(undefined8 param_1,longlong param_2)

{
longlong lVar1;
undefined8 local_res18;
undefined8 *local_res20;
undefined local_18 [24];

FUN_00010f08(param_1,param_2);
lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010480,0,&DAT_00011058);
if (-1 < lVar1) {
lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010410,0,&DAT_00011070);
if (-1 < lVar1) {
lVar1 = (**(code **)(DAT_00011040 + 0x140))(&DAT_000103f0,0,&DAT_00011078);
if (-1 < lVar1) {
lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010460,0);
if (-1 < lVar1) {
DAT_00011060 = *local_res20;
local_res18 = 0;
_DAT_00011068 = &LAB_00010b54;
(**(code **)(DAT_00011040 + 0x80))(&local_res18,&DAT_000103d0,0,&DAT_00011068);
DAT_00011028 = local_res18;
FUN_00010ec4(0x10,FUN_00010cf8,0,local_18);
lVar1 = 0;
}
}
}
}
return lVar1;
}
find
quote
#6
(05-28-2020, 10:17 AM)bravesentry Wrote: you should be able to do this in a hex editor

This means that you preferably need to change once found in the decompiler opcode with hex editor instead of collecting all the subroutines back.
find
quote
#7
Thanks for the clarification.

Just an update on my progress: I tried using a hex editor to change the values corresponding with the line (seeabove code) "FUN_00010ec4(0x10,FUN_00010cf8,0,local_18);" all to 90. That turned out not to boot. It gave me three beeps, another time three beeps, a longer pause, then the same again until I had to to a hard reset.

I then tried using UEFITool to just delete the whole module. That kind of worked, as in the device booted and the wifi worked in Win10 and Linux Mint. Sadly, Bluetooth seems to be connected to this module too, and refused to work even with the old whitelisted card. Another downside: Booting into hackintosh did not workl. It booted up until it had the verbose part done and then got stuck on an apple logo with an empty progress bar.

Now I'm back to my backupped bios. Any ideas what I should try next?
find
quote
#8
Hello, I have the g500s version - do those models also have write - protected bios or I can use software for flasing my bios after modification?
find
quote
#9
Hello p0358,

Thanks for this guide! I am currently learning how to perform various types of UEFI mods and this was very well written and informative!

~Steven

!!!!!PLEASE READ!!!!!! Our Ukrainian friends are undergoing atrocities right now and need support. There are two things you can do for starters:

1.) Donate to one of various organizations offering medical, military, and psychological support to those impacted: Support Organizations

2.) Combat misinformation on social media. 

Also, please feel free to PM me if I have not replied again about your BIOS mod request after 5 days.
www find
quote
#10
Ok my contribute is the patch for G500 and G510 , so it will be possible to follow the modifiies to get the Bios Unlock and NoWhitelist :

Lenovo Ideapad G500 bios ver. 78CN25WW(V2.03) - ver. 78CN24WW(V2.02)

Remove Whithelist Mod :

11D378C2-B472-412F-AD87-1BE4CD8B33A6 UEFI L05 BIOS Lock

0322 : 75 17 to EB 17 jnz short loc_18000033B to jmp short loc_18000033B
0360 : 75 18 to EB 18 jnz short loc_18000037A to jmp short loc_18000037A
03F4 : 74 10 to EB 10 jz short loc_180000406 to jmp short loc_180000406

CodeRush Patch
(O:0322:EB17)
(O:0360:EB18)
(O:03F4:EB10)

4082D1D0-1744-4EE3-803E-B8EE3F07B2FE OEM NVS Driver

0EF1 : 7D 1A to 7D 00 jge short loc_180000F0D to jge $+2
0EF3 : EB E3 to EB 00 jmp short loc_180000ED8 to jmp $+2
0FC4 : 7D 04 to 7D 00 jge short loc_180000FCA to jge $+2
0FC6 : EB E3 to EB 00 jmp short loc_180000FAB to jmp $+2

CodeRush Patch
(O:0EF1:7D00)
(O:0EF3:EB00)
(O:0FC4:7D00)
(O:0FC6:EB00)

SetupUtility Mod :

FE3542FE-C1D3-4EF8-657C-8048606FF670 SetupUtility

Form Sets
--------------------------------------------------------------------------------
Offset: Title:
--------------------------------------------------------------------------------
0x7B964 Boot (0x53)
0x7C704 Security (0x31)
0x7CD34 Main (0x3)
0x7D264 Power (0x399)
0x7F6A4 Advanced (0x168)
0x88964 Exit (0x85)
0x88BB4 Debug (0x13A)
0x88D54 Information (0xBB)
0x88F54 Configuration (0xCD)

0814 : 78 7D to 78 00 js short loc_180000893 to js $+2
0823 : 74 6E to 74 00 jz short loc_180000893 to jz $+2
082C : 74 65 to 74 00 jz short loc_180000893 to jz $+2
0832 : 74 5F to 74 00 jz short loc_180000893 to jz $+2
0838 : 74 59 to 74 00 jz short loc_180000893 to jz $+2

CodeRush Patch
(O:0814:7800)
(O:0823:7400)
(O:082C:7400)
(O:0832:7400)
(O:0838:7400)

-----------------------------------------------------------------------------------------------------------------------------------

Lenovo Ideapad G510 ver. 79CN50WW(3.09)

Remove Whithelist Mod :

11D378C2-B472-412F-AD87-1BE4CD8B33A6 UEFIL05BIOSLock

0342 : 75 17 to EB 17
036C : 74 2C to EB 2C
039C : 74 10 to EB 10

CodeRush Patch
(O:0342:EB17)
(O:036C:EB2C)
(O:039C:EB10)

4082D1D0-1744-4EE3-803E-B8EE3F07B2FE OEM NVS Driver

0BD5 : 7D 1A to 7D 00 jge short loc_180000BF1 to jge $+2
0BD7 : EB E3 to EB 00 jmp short loc_180000BBC to jmp $+2
0B9C : 7D 53 to 7D 00 jge short loc_180000BF1 to jge $+2
0B9E : EB E0 to EB 00 jmp short loc_180000B80 to jmp $+2

CodeRush Patch
(O:0BD5:7D00)
(O:0BD7:EB00)
(O:0B9C:7D00)
(O:0B9E:EB00)


SetupUtility Mod :

FE3542FE-C1D3-4EF8-657C-8048606FF670 SetupUtility

Form Sets
--------------------------------------------------------------------------------
Offset: Title:
--------------------------------------------------------------------------------
0x91434 Boot (0x54 from string package 0x0)
0x92154 Security (0x32 from string package 0x0)
0x927B4 Main (0x3 from string package 0x0)
0x92D54 Power (0x3B5 from string package 0x0)
0x95F44 Advanced (0x164 from string package 0x0)
0xA43B4 Exit (0x88 from string package 0x0)
0xA45F4 Debug (0x135 from string package 0x0)
0xA47A4 Information (0xA9 from string package 0x0)
0xA49C4 Configuration (0xBB from string package 0x0)

0850 : 78 7D to 78 00
085F : 74 6E to 74 00
0868 : 74 65 to 74 00
086E : 74 5F to 74 00
0874 : 74 59 to 74 00

CodeRush Patch
(O:0850:7800)
(O:085F:7400)
(O:0868:7400)
(O:086E:7400)
(O:0874:7400)


About the Flashing the Bios Mod then we can say that there are others ways to do that, like using the S3 Vulnerability aka Sleep Mode or unlocking
some variables into NVRAM to reflash the bios (last is the ME disable) ...
Regards

[size=undefined]Your Brain [/size]. . . . It's the best tool U can use ! Wink
[size=undefined]Don't FLASH the Bios Mod if You get a Size Alert, You risk a Brick !!! [/size]
Donate to me for my work, click here BDM
find
quote


Forum Jump:


Users browsing this thread: 3 Guest(s)