Lenovo Ideapad N581 bricked

[suho]

Hi,

I am in a bit of a predicament. I had a working and moddifed (whitelist removed) BIOS installed on my Lenovo Ideapad N581 and all I wanted to do was to change the amount of shared GPU RAM. Yet somehow I must have done something wrong such that my device seems to be bricked now

Looking for ways to resolve this issue I found a whole lot of information about the recovery mode. The recovery mode itself seems to be working just fine. I extracted the ROM from the official v96 Lenovo BIOS update executable, put it on a freshly formatted USB-Stick and renamed it to QIWG5.BIN, which I believe is the correct name for the recovery image.

While in recovery mode the USB-Stick is accessed and the file seems to be read. Then the LED of the stick turns dark for approx. 3 seconds after which it comes back online and the whole process starts again and again and again ...
If I change the filename to something else the reading process is much shorter which leads me to believe that the filename I used is the correct one. It seems to me that the recovery mode somehow refuses to flash the ROM.

The same v96 BIOS update file is being offered as download not just for all variants of the N581 but also the N580 and N585 products. Could the behaviour of the recovery mode have something to do with this? Do I need to extract a certain part from the ROM?

As a second measure I took my whole notebook apart in order to get access the to CMOS battery and disconnect it. For this I even had to use my soldering iron because the battery was hard-hooked to the board ...
Unfortunately disconnecting the battery for approx. 30-60 minutes did not work either ...

As a measure of last resort I would try to manually flash something onto the chip itself, but for that I would of course need the exact data. Ideally it would be nice to get my hand on an exact BIOS dump (backup) from someone who has the same variant of the N581 notebook, that at least should work if I am not mistaken?



EDIT: I just realized that BIOS settings are nowadays stored in a non-volatile RAM and the CMOS battery is mostly just for the RTC. Is there some way to corrupt the data of the NVRAM? Is the NVRAM integrated along with BIOS ROM itself or is it most likely an extra external chip? If it is an extra chip it should be easy to corrupt the data which would then give a CMOS checksum error, forcing it to reset to default values.

[BDMaster]

You have to read your Full Dump Firmware from Eeprom Chips and I will check them
to correct It using Original Bios Files !
Let me know
Regards

P.S. Recovery Procedure is a bet on Lenovo

[suho]

I did find two flash Flash-EEPROMs in close priximity to the chipset, one 4MByte (EN25Q32B) and one 2MByte chip (EN25QH16). Am I assuming correctly that the 32Mbit chip probably holds the code of the BIOS while leaving the settings to the 16Mbit chip to store? Anyway, I will try to get a complete data-dump from both. However I need to try this in-situ because at the moment I do not have access to the neccessary SMD soldering hardware. Unfortunatly I neither have a SPI programmer but I shall try to repurpose an 8bit Atmel microcontroller to get a readout, might have to order a 5V to 3.3V level shifter though ... we shall see, it's all I have rigth now so wish me luck

[suho]

Alright I made some progress: I was able to read and flash some other BIOS IC that I found on an old mainboard which I no longer need using an 8-bit AVR µC and the flashrom linux tool. Since that worked rather nicely I unsoldered the 4MB flash chip from my notebook. That eon IC is a nasty little bugger and flashrom had som trouble correctly identifying it at first. Lowering the SPI frequency and getting the supply voltage down to 3.3V did wonders, however I had to lower the serial frequ to 9600 Baud as well ause the lvl shifter doesnt like 3.3V.

Anyway, I did read the flash chip 3 times which took one hour each. Now the weird thing is that the chip seems empty. Except for one instance every single Byte reads 0xFF. I don't think there was a problem with reading process, flashrom did not say anything and as I said I did read it 3 times giving me same result each time.

Is there any way to get the 4MB of data from the official BIOS update that are supposed to go onto that chip?

[BDMaster]

Lenovo ThinkPad N581 FPT -d ... -bios

W25Q32BV 4MB 1st ---> 4096 KB +
W25Q16BV 2MB 2nd ---> 2048 KB


W25Q32BV 4MB 1st ---> Starting Offset FullDump Firmware 6144 KB = 0x00000000 physical address
W25Q16BV 2MB 2nd ---> Ending Offset FullDump Firmware 6144 KB = 0x00600000 physical address


This Fimware has two chunks and start into 1st Chip, these the Offsets :

0x00000000 - 0x00600000

0x00000000 - 0x00001000 = Descriptor Size 0x00001000
0x00001000 - 0x00180000 = ME (GbE) Size 0x0017F000
0x00180000 - 0x00600000 = BIOS (PDR) size 0x00480000

So Bios Firmware is splitted into two chunks :

1st Chip from 0x00180000 until 0x00400000 End of 1st Chip then continue into (Size 0x00280000)
2nd Chip from 0x00000000 until 0x00200000 End of 2nd Chip (Size 0x00200000)
Total (size 0x00480000)

The EC firmware is allocated before Bios Region and usually into 2nd Chip when It is 4096 KB.
In your case is into 1st Chip before Bios Region.

Like You can see your Bios Regios is splitted between two Eeprom Chips so I have to replace
your data (UUID, Serial, Model, Win License) into Bios Region and then into Full Dump Firmware
and at last I can split again your files to reprogram Eeprom Chips !
I have the Firmware but You have to reprogram all two Chips and will loose your Significant Data.
Let me know
Regards

Doante to me for my work and time . . . look into my Signature

[suho]

Oh oh, this is all more complicated than I thought really. I was just browsing through some the intel application notice "Intel 7 Series Chipset and Intel C216 Chipset SPI Programming Guide" and it pretty much says the same you were laying out

Do you need any more information other than what is in the attached picture? You can erase any of the Windows SLICs and whatever else there is on the flash regarding the windows license cause I don't need it and I don't use windows a lot either.

I just donated to you for your help

What I really don't get however is, why the freakin chip seems to be empty ... Maybe there was a problem when I first tried to access it, cause I was using a supply voltage of 3.7V which is slighty above the spec. Now with just 3.3V it takes roughly 60 minutes to read the [censored] thing cause I can't use a higher speed for the µC <-- RS232 --> PC connection. Maybe there still is a problem with the SPI connection, i don't know ... but the winbond SPI flash I was using just to test the process did not give me any headaches whatsoever.

[suho]

I managed to get a dump of both flash-ics using a raspberry pi. It looks as if during my previous attempts at accessing the flash the first 4K block was erased but everything else remained untouched, probably because the voltagelvls and timings were not within the specs.

I'd say that everything is still in order except that the Descriptor region is empty ... what are my options? Is there any way to get my hands on just the BIOS ROM so I can hack together two new binary files with the Intel Flash Image Tools?

[BDMaster]

In which Eeprom Chip is been erased the 4KB ( i can rebuild It) ?
If You will be more detailed I can rebuild all Firmware
Let me know
Regards

[suho]

The data of the 2MB EEPROM should be alright because I have not touched the chip since yesterday. I did play around with 4MB chip about a month ago and tried to read it but since I did not have the raspberry pi, just some atmel µC SPI Interface, I had some trouble with it. It looks as if (luckily) just the descriptor region (0h - FFFh) has been erased, everything else looks fine to me.

[BDMaster]

I tried to rebuild all !
Here You go (your files were just NWL + AVD) :

http://rghost.net/8GrVL8Nlg

let me know
Regards

Donate to me for my work and my time . . . look into my Signature