[REQUEST] Lenovo X220 (8DETxxWW) Whitelist Removal

[Maxinator500]

I have full blown modded v1.46 BIOS but it says unauthorised wlan card

Now there are at least two reports on faulty BIOS mod.

I tried this Bios and I still get the error

I can remake it.

[temp3l]

Hi,

Both v1.46 patches failed on my hardware!


Solution:
1) install v1.45 official Bios (https://download.lenovo.com/pccbbs/mobiles/8duj30us.iso)
2) install v1.45 mod Bios (https://files.catbox.moe/qdj4n0.7z)



Without installing Windows:

1) Create USB-stick
* geteltorito -o 8duj30us.img 8duj30us.iso
* dd if=8duj30us.img of=/dev/sdX

2) Create USB-stick: Windows 7 Trial installer (no key required)
* i used: 7600.16385.090713-1255_x86fre_enterprise_en-us_EVAL_Eval_Enterprise-GRMCENEVAL_EN_DVD.iso

3) Create a small Fat32 or NTFS partition
* extract the mod Bios to that partition

4) Now boot Win7
* abort the installation immediately
* click: Repair->Command-Prompt
* change dir: C:/mod
* run: flash.bat



This page is completely f'd up in Firefox+Chrome

[iTOsky]

Just Flashed modded BIOS 1.4.6 using Windows P.E  ( i use arch BTW! )
After a few 'flash failed' 'reflashing' messages it came good in the end, thanks for the MOD
regards

我也是这样情况 Thanks  ValdikSS、nailzuk

[johnfzc]

I want to remove whitelist protections on a X220 to I can use a new ax210 card in it. I am by nature very cautious however, and wanted to look at what changed in the "no whitelist only" image.

I was expecting to see only a few address changed, to bypass the whitelist logic, as is described in this medium post.

However, when I compare the images I see that 1 out of 8 MB are changed:

Code:

johnf@johnf-nuc:~/tmp/x220-bios$ cmp -l '8duj31us/8DET76WW/$01CB000.FL1' 'modded/8DET76WW/$01CB000.FL1' | wc -l
1043216

This can of course be quite inaccurate, as a small change that moves some code will report everything as changed, but I'm still wondering why there is such a large change in the binary blob.

Thanks very much for your work on this BIOS ValdikSS . I'm sorry to trouble you with this question and appreciate any guidance you can offer me.

[johnfzc]

I've looked at another modded firmware image for version 1.40 posted by another user earlier in this thread.

I see a much more modest 9813 bytes of change between the two images; about 2000 characters of code have also been removed from the image:

Code:

johnf@johnf-nuc:~/tmp/x220-bios/140$ ls -l "8duj31us/206A7.PAT" "Lenovo ThinkPad x220_1.40-(8DET70WW)-8duj26us_NWL_ADV_AES_PM_Speedo/Modified/206A7.PAT"
-rwxrwxr-x 1 johnf johnf 12288 Jun  1  2018  8duj31us/206A7.PAT
-rw-rw-r-- 1 johnf johnf 10240 Jun 23 12:05 'Lenovo ThinkPad x220_1.40-(8DET70WW)-8duj26us_NWL_ADV_AES_PM_Speedo/Modified/206A7.PAT'
johnf@johnf-nuc:~/tmp/x220-bios/140$ cmp -l "8duj31us/206A7.PAT" "Lenovo ThinkPad x220_1.40-(8DET70WW)-8duj26us_NWL_ADV_AES_PM_Speedo/Modified/206A7.PAT" | wc -l
cmp: EOF on Lenovo ThinkPad x220_1.40-(8DET70WW)-8duj26us_NWL_ADV_AES_PM_Speedo/Modified/206A7.PAT after byte 10240
9813

[johnfzc]

ValdikSS replied by email and said that it was necessary to extract the firmware using uefiextract in order to properly compare the changes. Doing so, I've found the changes are much smaller than I had documented above and inline with my expectations for this type of modification. We can see 23 bytes of change in something named LenovoWmaPolicyDxe.efi and some minor changes in volume free space and padding.

You can see the analysis here below.

Code:

johnf@johnf-nuc:~/tmp/x220-bios/extracted$ diff -qr stock/\$01CB000.FL1.dump/ modded/\$01CB000.FL1.dump/ | grep -v txt
Files stock/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/8 4A538818-5AE0-4EB2-B2EB-488B23657022/0 Compressed section/1 Volume image section/0 7A9354D9-0468-444A-81CE-0BF617D890DF/199 LenovoWmaPolicyDxe.efi/0 FC1BCDB0-7D31-49AA-936A-A4600D9DD083/0 PE32 image section/body.bin and modded/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/8 4A538818-5AE0-4EB2-B2EB-488B23657022/0 Compressed section/1 Volume image section/0 7A9354D9-0468-444A-81CE-0BF617D890DF/199 LenovoWmaPolicyDxe.efi/0 FC1BCDB0-7D31-49AA-936A-A4600D9DD083/0 PE32 image section/body.bin differ
Files stock/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin and modded/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin differ
Files stock/$01CB000.FL1.dump/2 FFF12B8D-7696-4C8B-A985-2747075B4F50/0 Padding/body.bin and modded/$01CB000.FL1.dump/2 FFF12B8D-7696-4C8B-A985-2747075B4F50/0 Padding/body.bin differ
johnf@johnf-nuc:~/tmp/x220-bios/extracted$ cmp -l 'stock/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/8 4A538818-5AE0-4EB2-B2EB-488B23657022/0 Compressed section/1 Volume image section/0 7A9354D9-0468-444A-81CE-0BF617D890DF/199 LenovoWmaPolicyDxe.efi/0 FC1BCDB0-7D31-49AA-936A-A4600D9DD083/0 PE32 image section/body.bin' 'modded/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/8 4A538818-5AE0-4EB2-B2EB-488B23657022/0 Compressed section/1 Volume image section/0 7A9354D9-0468-444A-81CE-0BF617D890DF/199 LenovoWmaPolicyDxe.efi/0 FC1BCDB0-7D31-49AA-936A-A4600D9DD083/0 PE32 image section/body.bin' | wc -l
23
johnf@johnf-nuc:~/tmp/x220-bios/extracted$ cmp -l 'stock/$01CB000.FL1.dump/2 FFF12B8D-7696-4C8B-A985-2747075B4F50/0 Padding/body.bin' 'modded/$01CB000.FL1.dump/2 FFF12B8D-7696-4C8B-A985-2747075B4F50/0 Padding/body.bin' | wc -l
404
johnf@johnf-nuc:~/tmp/x220-bios/extracted$ cmp -l 'stock/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin' 'modded/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin' | wc -l
cmp: EOF on modded/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin after byte 131624
0
johnf@johnf-nuc:~/tmp/x220-bios/extracted$ ls -l 'stock/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin' 'modded/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin'
-rw-rw-r-- 1 johnf johnf 131624 Jun 24 08:40 'modded/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin'
-rw-rw-r-- 1 johnf johnf 131656 Jun 24 08:37 'stock/$01CB000.FL1.dump/1 7A9354D9-0468-444A-81CE-0BF617D890DF/9 Volume free space/body.bin'

I now feel comfortable installing the modified firmware. Thanks very much for your work on this firmware update and for taking the time to reply ValdikSS.