[REQUEST] Lenovo IdeaPad U330, U430 & U530 (7CCNxxWW) Whitelist Removal

[BDMaster]

Hi,

i extracted the module where the setup utility sits in (FE3542FE-C1D3-4EF8-657C-8048606FF670_907) and used the IFR-Extractor(https://www.bios-mods.com/software-relea...extractor/) to analyse it. This gives you a list of all options available in setup, even the hidden ones. I found 1 interesting setting: BIOS LOCK
(after the Variable comes the ID and after that the hex-code representing the variable for modding the module)

Code:

0x9D35B Grayout If: {19 82}
0x9D35D Variable 0x12 equals 0x2 {12 86 12 00 02 00}
0x9D363 Variable 0x11 equals 0x1 {12 06 11 00 01 00}
0x9D369 And {15 02}
0x9D36B End {29 02}
0x9D36D Setting: BIOS Lock, Variable: 0x4AB {05 A6 4C 07 4D 07 1F 01 34 12 AB 04 00 10 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
0x9D393 Option: Disabled, Value: 0x0 {09 0E 23 00 00 00 00 00 00 00 00 00 00 00}
0x9D3A1 Option: Enabled, Value: 0x1 (default) {09 0E 24 00 10 00 01 00 00 00 00 00 00 00}
0x9D3AF End of Options {29 02}
0x9D3B1 End If {29 02}

We are able to modify any setting revealed through ifr-extractor without modding the bios through a special EFI-Shell with the command setup_var (the clover efi shell is not working). Heres the working one (its some patched grub) https://dl.dropboxusercontent.com/u/1832..._Shell.zip .
To see the current setting of a variable the command is setup_var 0x4ab
To set it to Off for example command would be: setup_var 0x4ab 0x00
Can anyone try if changing the bios lock setting unlocks anything? maybe giving permission to FPT flashing? For me it didn't worked, but i can imagine that maybe other things preventing write actions in my case (maybe because of *IG ship instead of *IQ chip or the resistor i shorted out while repairing my board) and i don't understand anything about SPI, QSPI, registers and so on.

So maybe someone else can try this method?

PS: Maybe Rehabman finds some other useful settings for OSX use on this computer in the IFR dump (i attached mine)?

Ok friend,
Many thanks

Read this : http://rghost.net/58274256

[sebold]

Thanks BDMaster,

this was very informative though i didn't understand a lot.

But thank you more for pointing at svl7´s prr.exe and prr2.exe . (why did you delete them from your reply?)

I would like to try them or is there a 100% guarantee that they don't work on such a new device?

I already obtained the executables, but i can't find a DOS version of FPT wich is new enough. It has to be at least 9.5 but all links i found are dead.

Is here someone who can upload it?

[BDMaster]

Thanks BDMaster,

this was very informative though i didn't understand a lot.

But thank you more for pointing at svl7´s prr.exe and prr2.exe . (why did you delete them from your reply?)

I would like to try them or is there a 100% guarantee that they don't work on such a new device?

I already obtained the executables, but i can't find a DOS version of FPT wich is new enough. It has to be at least 9.5 but all links i found are dead.

Is here someone who can upload it?

I removed as It did seem to be not right for this thread, may be, and It's not my intentions to publicate docs unuseful !
Here is FPT 9.5 with prr.exe and pp2.exe :

http://rghost.net/58290858

regards

[sebold]

Thank you for helping out again and again BDMaster,

unfortunately it looks like we are out of luck. prr and prr2 are not working in our case. I read somewhere that people with newer Thinkpads have the same problem.

So it seems that flashing with external spi programmer stays the only solution.

Maybe someday someone like svl7 develops a new prr tool or something, but who knows.

[RehabMan]

I managed to work around this problem by rebranding an AR5BHB92 (AR9280) as 168c:0034 17aa:3114, which are the IDs for the Lenovo WB222 (AR946x). The rebranding allows the computer to boot with the AR9280 card present. Then I implemented some patches for the Atheros driver on OS X such that it accepts the 168c:0034 device, but treats it as an 168c:002a.

It does not work on Windows, but on Windows I can just use USB WiFi. USB WiFi on Windows is not painful as USB WiFi on OS X is...

The details are here: http://www.tonymacx86.com/laptop-compati...post917057

Since I don't plan on keeping the laptop much longer, I didn't want to risk patching BIOS with a hardware programmer.

[smccully]

I have replaced the Intel 7260-N Wifi Chip in my Lenovo U530 Ideapad with the Intel 7260-AC.

I have finally been able to create a Bios Backup, http://rghost.net/60140005

Original Bios Installer: http://support.lenovo.com/us/en/products...h-notebook

Original WLan Device [Image-Attached] [PCI\VEN_8086&DEV_08B2&SUBSYS_42628086&REV_73]

I would like to be able to figure out how to dissassemble and modify the Binary Bios, but have yet been able to determine the best way to do this.

If somebody could either point me in the right direction, or make the modifications it would be appreciated.

[BDMaster]

I have replaced the Intel 7260-N Wifi Chip in my Lenovo U530 Ideapad with the Intel 7260-AC.

I have finally been able to create a Bios Backup, http://rghost.net/60140005

Original Bios Installer: http://support.lenovo.com/us/en/products...h-notebook

Original WLan Device [Image-Attached]

I would like to be able to figure out how to dissassemble and modify the Binary Bios, but have yet been able to determine the best way to do this.

If somebody could either point me in the right direction, or make the modifications it would be appreciated.

Hi friend,
here You go :

http://rghost.net/60152887

Let me know
Regards

P.S. I think  You got Error 280 so Eeprom Write Protect = not Flashable, in this case You need an SPI Programmer

https://www.bios-mods.com/forum/Thread-R...5#pid74575

[lispad]

Hi.
I have U430 Touch and bcm94352hmb, but can't use it, because of whitelist.
I have flashed last bios 62, managed to get WinUx30.bin and backup of dump with old flash utility.
Also i have pair of winbond 25q64 flash chips for testing and USBASP, flashed with alternative firmware for supporting SPI flashes. The only problem - i have no idea about how to patch rom file. I opened it with UEFI tool and found block with error messages about wifi card, but what next?...
Can anyone help with patching rom?
Here are WinUx30.bin with digital sign
https://yadi.sk/d/DTWiv-QVdo6gZ
and backup of newest 62 bios:
https://yadi.sk/d/6MF_TDRrdo6iP
Thanks for any replies.

[smccully]

[Update] I hadn't seen BDMaster's reply, looking into it now

Using the Phoenix SLIC Mod Tool, I was able to find the Module UEFiL05BIOSLock [11D378C2-B472-412F-AD87-1BE4CD8B33A6], which contains the error string for the UnAuthorized Wireless Card.

Though I am still unable to determine where the actual PCI Identification is stored.

Hex Bytes

Code:

0A 00 55 00 6E 00 61 00 75 00 74 00 68 00 6F 00 72 00 69 00 7A 00 65 00 64 00 20 00 57 00 57 00 41 00 4E 00 20 00 6E 00 65 00 74 00 77 00 6F 00 72 00 6B 00 20 00 63 00 61 00 72 00 64 00 20 00 69 00 73 00 20 00 70 00 6C 00 75 00 67 00 67 00 65 00 64 00 20 00 69 00 6E 00 2E 00 20 00 50 00 6F 00 77 00 65 00 72 00 20 00 6F 00 66 00 66 00 20 00 61 00 6E 00 64 00 20 00 72 00 65 00 6D 00 6F 00 76 00 65 00 20 00 69 00 74 00 00 00 00 00 25 00 30 00 38 00 78 00 2D 00 25 00 30 00 34 00 78 00 2D 00 25 00 30 00 34 00 78 00 2D 00 25 00 30 00 32 00 78 00 25 00 30 00 32 00 78 00 2D 00 25 00 30 00 32 00 78 00 25 00 30 00 32 00 78 00 25 00 30 00 32 00 78 00 25 00 30 00 32 00 78 00 25 00 30 00 32 00 78 00 25 00 30 00 32 00 78 00 00 00 00 00 00 00 00 00 25 00 30 00 32 00 64 00 2F 00 25 00 30 00 32 00 64 00 2F 00 25 00 30 00 34 00 64 00 20 00 20 00 25 00 30 00 32 00 64 00 3A 00 25 00 30 00 32 00 64 00 00 00 00 00 00 00 3C 00 6E 00 75 00 6C 00 6C 00 20 00 73 00 74 00 72 00 69 00 6E 00 67 00 3E 00 00 00 00 00 00 00 3C 6E 75 6C 6C 20 73 74 72 69 6E 67 3E 00 00 00 25 00 58 00 00 00 00 00 25 00 61 00 00 00 00 00

Unicode

Code:

..U.n.a.u.t.h.o.r.i.z.e.d. .W.W.A.N. .n.e.t.w.o.r.k. .c.a.r.d. .i.s. .p.l.u.g.g.e.d. .i.n... .P.o.w.e.r. .o.f.f. .a.n.d. .r.e.m.o.v.e. .i.t.....%.0.8.x.-.%.0.4.x.-.%.0.4.x.-.%.0.2.x.%.0.2.x.-.%.0.2.x.%.0.2.x.%.0.2.x.%.0.2.x.%.0.2.x.%.0.2.x.........%.0.2.d./.%.0.2.d./.%.0.4.d. . .%.0.2.d.:.%.0.2.d.......<.n.u.l.l. .s.t.r.i.n.g.>.......<null string>...%.X.....%.a.....

[smccully]

I did get Error Error 280 so Eeprom Write Protect when trying to Flash, it seems to me that using the Insyde Flash program should work somehow, but I am unsure.

If I need to buy an SPI Programmer, how should I know which one to buy?

Thanks again to @BDMaster for the help so far.