[REQUEST] Lenovo Thinkpad X230 Whitelist removal

[JimmyZ]

Lenovo X230

BIOS Version: 2.63

BIOS Download Link:
http://download.lenovo.com/ibmdl/pub/pc/...uj20us.EXE

BIOS backups:
http://rghost.net/78XDGhb4R ("fptw64 -bios -d dump.bin", Intel FPT 8.1.51.1476, it still report the EEPROM chips as MX25L6405D/MX25L3205D, later versions doesn't work)
I didn't use Universal BIOS update toolkit since it triggers the antivirus alarm, notify me if it's needed

BIOS chips:
MX25L6406E, MX25L3206E

Current Wi-Fi Adapter:
Model: Intel® Centrino® Ultimate-N 6300 AGN
PCI ID: PCI\VEN_8086&DEV_4238&SUBSYS_11118086&REV_35

New Wi-Fi Adapter to be installed
Model: Intel Dual Band Wireless-AC 7260 Plus Bluetooth

Tools to be used:
Raspberry Pi as a SPI programmer, http://flashrom.org/RaspberryPi
SOP8 clip, http://item.taobao.com/item.htm?id=19345119855
3.3V DC2DC step down module, http://item.taobao.com/item.htm?id=41156440197
spare M25L3206E to test the programmer/clip setup

I've seen kemod's successful mod on a X230t but I don't have the soldering skills
https://www.bios-mods.com/forum/Thread-T...ware-Flash
I've seen mhaedo(from whom I copied most of his request post) tried to do this with a clip but failed
https://www.bios-mods.com/forum/Thread-R...val--18404
there is an article about this on coreboot wiki so the clip should work
http://www.coreboot.org/Board:lenovo/x230
I'm guessing mhaedo failed because he did not provide separate 3.3V power

and I do have some questions to ask:
1, if the whitelist is removed, do I have to use Wi-Fi adapters from Lenovo with FRU label or any generic Wi-Fi adapters(like the gigabyte branded 7260) will work? I don't care if the hardware wireless switch doesn't work.

2, again, will broadcom adapters work? I want this because 7260 is only 2x2 MIMO, there are broadcom 3x3 MIMO adapters, and maybe I'll try a Hackingtosh mod later.

3, I have not ordered the adapter yet so suggestions are welcomed.

4, I know TPM module must be disabled, but are there any other consequences beside this?

5, some Wi-Fi adapters like 7260 comes with bluetooth integrated, I assume I should remove the old bluetooth module after this, again are there any other consequences?

as of now (2015-04-16) I'm waiting for the SOP8 clip and spare MX25L3206E, I'll update my progress, thank you all for reading this long post

[BDMaster]

These are the causes about bad working SPI PGM :

insufficient power supply (I tried to give external Power and this is relative)
bad contacts (more probably and sure like Soic Clip are very bad)
too long wires (sure)
bad pinout (not probably)

So the best way to make a good use is to get :

http://www.digikey.co.uk/product-detail/...-ND/528233

and the soic8 ocket :

http://siliconkit.com/ocart/index.php?ro...uct_id=169

Then all is over

To get the Bios Mod You have to read your Full Dump Firmware and upload It here,
then I will modify for You !
Let me know
Regards

[JimmyZ]

thanks, I'm waiting for the clip, I'll upload the full dump then.

[JimmyZ]

the clip arrived, I dumped twice and they are identical, here is the dump
http://rghost.net/8wDm4C2FR

I wrote a script to print hashes of every 1M chunk of the dumps:
$ node chunk_hash.js dump/32.dump.1.bin
input file name: dump/32.dump.1.bin
chunk size: 1048576, hash: sha256
c6306b09ce874760fc9b4c3051330d35ef7280da5688fccecc20e03f778e5c09
bb6b64de2610cda82f5497fd0acbcda512a5838484bb4f661021f0ac7e16c58b
91d51d2abb3da6a6c81798de679cea0f68786fb3fd46d5382858a906fbb449ee
bdf5ddc96772074bb51671b5dbecbccaee7240809f04cabba19ce63fff5d22b4
$ node chunk_hash.js dump/64.dump.1.bin
input file name: dump/64.dump.1.bin
chunk size: 1048576, hash: sha256
9e1b8251d38d2bd00a4d7b5412427bd331a3d4cef4c69f0c3d215a2dbe5f23b3
2d191377790411accfa1b96fe562b1df6931839e52e742adc9e78ce78e6a0b53
3b66013731a69197a7c99a2ad771520a1022bb80d29d4e04e90d5cb1a908a864
9cec2e308ee7af733c3a637148886a241ec04664ac1e992490cfc5d995f9533d
07d68863d906f816077425ae19ceffb0e165d0d9027853a14990d0e0e1347c68
f5fb04aa5b882706b9309e885f19477261336ef76a150c3b4d3489dfac3953ec
f5fb04aa5b882706b9309e885f19477261336ef76a150c3b4d3489dfac3953ec
f5fb04aa5b882706b9309e885f19477261336ef76a150c3b4d3489dfac3953ec
$ node chunk_hash.js dump/x230.2.63.fpt.bin
input file name: dump/x230.2.63.fpt.bin
chunk size: 1048576, hash: sha256
f5fb04aa5b882706b9309e885f19477261336ef76a150c3b4d3489dfac3953ec
f5fb04aa5b882706b9309e885f19477261336ef76a150c3b4d3489dfac3953ec
f5fb04aa5b882706b9309e885f19477261336ef76a150c3b4d3489dfac3953ec
c6306b09ce874760fc9b4c3051330d35ef7280da5688fccecc20e03f778e5c09
bb6b64de2610cda82f5497fd0acbcda512a5838484bb4f661021f0ac7e16c58b
87623e640efc6feb3d98272ac3f3e0d6531268538f4a71690843e840bff5a32a
bdf5ddc96772074bb51671b5dbecbccaee7240809f04cabba19ce63fff5d22b4

turns out the first 3M of the FPT dump comes from the later 3M of 64.dump.1.bin and the later 4M comes from 32.dump.1.bin but with 1 byte difference
$ dd if=dump/x230.2.63.fpt.bin of=dump/x230.2.63.fpt.part.2.bin bs=1M skip=3
4+0 records in
4+0 records out
4194304 bytes (4.2 MB) copied, 0.00490293 s, 855 MB/s
$ cmp dump/32.dump.1.bin dump/x230.2.63.fpt.part.2.bin
dump/32.dump.1.bin dump/x230.2.63.fpt.part.2.bin differ: byte 3090352, line 9498

[JimmyZ]

I didn't expect someone to reply so quickly, I just ordered 7260, hope it'll arrive before the modded BIOS

[BDMaster]

Here You go :

http://rghost.net/7V8Vwjkzs

Let me know
Regards

Doate to me . . . look into my Signature

[JimmyZ]

that is quick!

# ../source/flashrom-0.9.8/flashrom -p linux_spi:dev=/dev/spidev0.0 -c MX25L3206E/MX25L3208E -w 32.dump.1.bin.patched
flashrom v0.9.8-r1888 on Linux 3.18.0-trunk-rpi (armv6l)
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OK.
Found Macronix flash chip "MX25L3206E/MX25L3208E" (4096 kB, SPI) on linux_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

it boots with a 5-beep alarm before I disable TPM, so I think the programmer works but 7260 is still on the way so I can't test anything further...

I'd very much like to donate to you but paypal always reject my card, dunno why

[BDMaster]

I will wait your news about Whitest report !
Let me know
Regards

P.S. don't worry about donation

[JimmyZ]

finally ac7260 arrived, actually it arrived yesterday, the mailman just left it at the door and never notified me

and everything works! both Wireless AC and Bluetooth, thank you, BDMaster

[rst1024]

I want to report success using your methods and files - indirectly. I also used a RasperryPi with a $5 SO8 clip and the flashrom tool.

I'm no x86 guru, but fully understood the rest of the procedure. The part I needed to work out was the actual BIOS modification:

• I used PhoenixTool to compare the changes between JimmyZ's original upload and BDMaster's modified version of 2.63. I found the 7904 byte module that was changed to remove the whitelist.
  

• Next, I analysed a software tool dump of my original Lenovo 2.59 bios and found the same 7904 byte module with the same MD5 as JimmyZ's - different filename though. Finally, I updated to Lenovo's standard 2.64 BIOS, dumped the result and found the same 7904 byte module with the same MD5 and same filename as JimmyZ's. Lenovo apparently doesn't change this code too often.
  

• Using PhoenixTool, I merged BDMaster's modified module into my 2.64 dump.
  

The SO8 clip worked very well for in-circuit programming. I left VCC/3.3V disconnected, using just MISO, MOSI, CLK, CE and GND. These data lines have resistors between the flash chip and the Intel chipset, meaning you will have no problem driving the flash chip directly in-circuit.

The X230 will power up the LAN/flash 3.3V domain with the computer turned off if Wake-On-LAN is active and an AC source is plugged in. You need to activate WoL in the BIOS and (in my experience) plug in a live Ethernet cable. If the X230's RJ45 lights are on then the flash chip will be supplied with a safe 3.3V in the way that Lenovo intended.

PhoenixTool method: https://www.bios-mods.com/forum/Thread-S...0#pid62410
RaspberryPi flashrom: https://github.com/bibanon/Coreboot-Thin...spberry-Pi

The standard 8-pin SOP package from the MX datasheet quoted on the Coreboot page applies to the X230.
I tried flashrom SPI speeds of 512KHz and 2048KHz. Both worked 100% reliably.