[REQUEST] Lenovo Thinkpad T430 (G1ETxxWW) Whitelist Removal

[BDMaster]

sovem please help me for e420 at my post http://www.bios-mods.com/forum/Thread-le...-whitelist posted this here bcoz no one replied so far

I replied on your original post.
Regards

[ucupsz]

BDMaster,
these are what i changed:
- 75 2B at offset C7D into 90 90
- 75 16 at offset C92 into 90 90
- 74 1B at offset CA8 into EB 1B
below is how i remove the whitelist check using some tools.
i had difficulties when dealing with softwares for the first time.
so i try to put the instruction that way. hope it helps anyone want to learn removing whitelist and how to use of IDA and HxD.
removing whitelist check on T430 bios
i'll post more on how i use my True GQ 4X to flash the BIOS when i get back home.

regards.

wohoooo...!!!!
we've made it.... )

based on your explanation, i changed the two jnz to nop, and one jz to jmp.
and it works!
i type this from T430 with broadcomm wifi card. )

i'll post more detail steps tomorrow.
getting late here, need to drive early morning tomorrow.

zillion thanks BDmaster!! you're my hero!

Finally thanks for your reply !
I think these would be the mods :

unlock infinite loop :
0BEB : 75 F5 to 75 00 or 90 90 jnz short loc_BE2 to jnz $+2

unlock whitelist :
0C7D : 75 2B to 75 00 or 90 90 jnz short loc_CAA to jnz $+2

0C92 : 75 16 to 75 00 or 90 90 jnz short loc_CAA to jnz $+2

0CA8 : 74 1B to EB 1B jz short loc_CC5 to jmp short loc_CC5

Let me know, if It's right !

Can You explain how to flash and setting to use Soic Clamp Adapter ? as You said You will
write a new Tutorial detailed about use of SPI Programmer and I am interesting to it !
Regards

[BDMaster]

Ok Thanks, and I will wait Your tutorial about using SPI programmer
without desoldering chips ! (I will buy SPIPGM so iwould be shure I will use on-board as You done).
Regards

[ucupsz]

BDMaster,
sure... will do it.
btw, another issue with Thinkpad starting T430 and next release is the keyboard.
thinkpad veteran like old keyboard.
do you know how to find which .ROM module contains keyboard command/mapping?

i'm thinking of swapping .rom module in T420 BIOS with .rom module in T430.
want to see if that might enable all T420 keyboard in T430 hardware.

Ok Thanks, and I will wait Your tutorial about using SPI programmer
without desoldering chips ! (I will buy SPIPGM so iwould be shure I will use on-board as You done).
Regards

[BDMaster]

Ok We can try, but explain to me better the keyboard problem, I will find all I can
about the control keyboard module.
Regards

[ucupsz]

BDMaster,
i documented my learning process of removing whitelist and flashing the bios in following document. hope it helps you and others in learning how to remove whitelist and flashing the bios in T430.
http://rg.to/file/3dd7839752dc2a42442cc8....docx.html

regards.

Ok We can try, but explain to me better the keyboard problem, I will find all I can
about the control keyboard module.
Regards

[BDMaster]

BDMaster,
i documented my learning process of removing whitelist and flashing the bios in following document. hope it helps you and others in learning how to remove whitelist and flashing the bios in T430.
http://rg.to/file/3dd7839752dc2a42442cc8....docx.html

regards.

Ok We can try, but explain to me better the keyboard problem, I will find all I can
about the control keyboard module.
Regards

Thanks friend,
It's a superb tutorial and shown all I need to know about SPIPGM to use on-board (only missing your experiences with timing problems ?!?) !
So now We can try to mod module keyboard driver . . .
Regards

[ucupsz]

BDMaster, Rehabman, and others who must use hardware solution for T430 (and perhaps other series??),
i have tried to see how lenovo's official bios update works, looks like the authentification for secure capsule is in winflash64.exe.
(i used win7 64bit).
it's in the oem check section.
kind a hard to understand all of the assembly. IMO, this is much more complicated than removing whitelist.
i will write how i setup my system to be able to debug and patch the winflash64.exe in .docx format.
hope someone with better understanding of assembly language and programming than me can fix the oem check.
Then hardware based flash update for T430, x230 (and perhaps other lenovo series) is not necessary anymore.
------------------------------------
this is the file.

[BDMaster]

BDMaster, Rehabman, and others who must use hardware solution for T430 (and perhaps other series??),
i have tried to see how lenovo's official bios update works, looks like the authentification for secure capsule is in winflash64.exe.
(i used win7 64bit).
it's in the oem check section.
kind a hard to understand all of the assembly. IMO, this is much more complicated than removing whitelist.
i will write how i setup my system to be able to debug and patch the winflash64.exe in .docx format.
hope someone with better understanding of assembly language and programming than me can fix the oem check.
Then hardware based flash update for T430, x230 (and perhaps other lenovo series) is not necessary anymore.
------------------------------------
this is the file.

Hi Ucupsz,
The Big expert in Insyde Reversing is Donovan6000 and He tried to bypass Secure Flash check in his experiments,
so I would to ask to Donovan for contribute at this study !
I will write to him about your research and I will push this link to this discussion with the hope He could partecipate too.
Many thanks for your efforts.
Regards

[donovan6000]

Insyde secure flash is certainly annoying lol

I guess I'll contribute a little bit. Get ready for a long post! When a new rom is flashed via Insyde's programs, it is flashed to a reserved space on the bios chip which is 20MB ( according to the source code). Then immedialey after the computer restarts, then old bios verifies the new bios before overwiriting itself with it. Then the new bios is fully in place.

Since it is the old bios which is verifying the new bios, we can't modify the secure flash verification process since it would require modifying the old rom somehow. Here's some of the code that the old rom preforms at the end of the verifccation process.

Code:

if (*ErrorStatus == EFI_ACCESS_DENIED) {
do {
IfrLibCreatePopUp (8,
&Key,
L"",
L" InsydeH2O - Secure Flash ",
L"",
L" Error : Invalid firmware image!!! ",
L"",
L"",
L" Please press any key to reset system...... ",
L""
);
} while (Key.UnicodeChar == CHAR_NULL);
} else if (*ErrorStatus == EFI_SUCCESS) {
do {
IfrLibCreatePopUp (8,
&Key,
L"",
L" InsydeH2O - Secure Flash ",
L"",
L" Status : Finish!!! ",
L"",
L"",
L" Please press any key to reset system...... ",
L""
);
} while (Key.UnicodeChar == CHAR_NULL);
} else {
do {
IfrLibCreatePopUp (8,
&Key,
L"",
L" InsydeH2O - Secure Flash ",
L"",
L" Error : Firmware update failed!!! ",
L"",
L"",
L" Please press any key to reset system...... ",
L""
);
} while (Key.UnicodeChar == CHAR_NULL);
}

The digital signature for the new rom isn't limited to a fixed hash algorithm. It can be any of the following. Most manufacturers go with one of the asymmetric encryption algorithms, so it's something we can easily change accuratley

Code:

Sha1
Sha224
Sha245
Sha384
Sha512
Md5
Tdes
Aes
Rsa
Pkcs7
X509

This digital signature is stored in the extra space in the bios rom. You'll notice that the Insyde secure roms are slightly bigger than what they should be. They are also PE32 programs, which you can verify by looking at their header. This program is run by Insyde's flasher programs and it will usually overwrite platforms.ini with an unmodified version to make modifying platforms.ini useless. However my tests have shown that any modifications to platforms.ini's secure flash settings is useless anyway.

So what if we extract the pure rom from the securre flash rom and try to flash that? Thanks to the research done by BDMaster, this is simple Unfortunatley InsydeFlash.exe will make sure the rom is secure before flashing it. Special thanks to the person who was willing to test out my ideas on their computer lol

So lets bypass that error to make it flash the pure rom.

So we look up what that error message corresponds to in Iscflash.dll, and we find out that it is a write permission error. And here's where I'm stuck lol The region of the bios chip that contains the current bios is locked. So we can't directly overwrite it with InsydeFlash.exe. I have some more ideas, but nothing I want to make public right now If I ever buy a laptop that has Insyde Secure bios, then I'll be able to experiment more