[REQUEST] Lenovo IdeaPad P400, P500, Z400, Z500 (71CNxxWW) BIOS Unlock

[ratdude747]

[censored]! This is where I'm stuck with these kind of bios. Insyde Secure Flash is used by the previous rom to verify the newly flashed rom before passing control to it. Since we can't modify the currently installed rom, then we can't bypass this. and the flash descriptor sets a lock on writing to your bios region, so we can't use fptw to flash it. Lol it seems like the hardest part about bios modding now is actually flashing it

Until we discover more about Insyde Secure Flash, then these kind of bios are unmoddable at the moment. Sorry

I wonder what part of the BIOS is actually being checked... since clearly the existing BIOS can't predict the checksum of the next BIOS... as that would defeat the purpose of a BIOS update. I wonder if there is a way to spoof that (like swap the checksum)...

Or, perhaps, find a way to make intel flash override the protection...


(just thinking of workarounds... I'll do some research and experiment...)

edit- we're not the first to hit this wall... but this may have promise... Either way, it looks like windows 8 is to blame (as the p400 comes with 8 stock).

[donovan6000]

Ok, did some work trying to get a good way to bypass secure flash. Thought of two ideas:

1. This one asks the flasher nicley to not use secure flash.

2. This one forces the flasher to not use secure flash by tricking it into believing that the platofrm doesn't support it. Since this hasn't been tested, then it might result in a brick.

[ratdude747]

Ok, did some work trying to get a good way to bypass secure flash. Thought of two ideas:

1. This one asks the flasher nicley to not use secure flash.

2. This one forces the flasher to not use secure flash by tricking it into believing that the platofrm doesn't support it. Since this hasn't been tested, then it might result in a brick.

Neither of those made any obvious difference.

However, this time I was smart, and got a picture of the error screen that has popped up every time:

   

What a piece of Ship this thing has been to deal with. @#$%!

edit- would this method be of any use:

http://forums.lenovo.com/t5/tkb/articlep...icle-id/19

(tried it, but my DOS USB stick didn't want to boot. I may remaster a win98 .iso and try that later)

[donovan6000]

Hey ratdude. I think I've got it this time. As I said before, since these kind of modifications haven't been tested then they might result in a brick. Be careful. Here. Turns out some of the settings are hardcodded instead of being read in. Insyde was being sneaky

[ratdude747]

Hey ratdude. I think I've got it this time. As I said before, since these kind of modifications haven't been tested then they might result in a brick. Be careful. Here. Turns out some of the settings are hardcodded instead of being read in. Insyde was being sneaky

Nope, still giving the invalid image routine.

[censored].

[donovan6000]

Here's another one. I have a good feeling about this one!

[ratdude747]

Sadly, it still whines about an invalid image.

Thanks for the effort so far...

[ratdude747]

Success!

I was able to use your output_mod.bin file with this:
http://forum.techinferno.com/general-not...flash.html



Thanks for whipping up the .bin. FWIW I did donate to your blog fund last week... But whatever Slv7 did to override the lock (in 16 bit code, I know that much) in his prr2 program did it. I wish the download rules were a little more lax (you ahve to pay or give 5 technical posts to download) or else I'd upload them here and give all due credit.

Still, again, thanks donovan. Now to go home and see if the whitelist works... I do know the unlocked tabs is a go.

[ratdude747]

whitelist removal works too. Many thanks!

too bad the solution was split between two different modders... I take it it's not cool if I uploaded the file to the other place so it and the oter half (prr2.exe) can be hosted together as a complete fix.

[acampbell128]

not to bump an old thread, but ratdude you seem to be the only one to have gotten this to work. I have a P500 laptop. Was about to buy an intel 7260 to go with my ac router. Will the method you linked work? and did you just use donovans output_mod.bin file? i tried to use prr2 and gave me a "unsupported 16-bit application"