[REQUEST] Lenovo Yoga 2 Pro (76CNxxWW) Whitelist Removal

[Simonettore]

Hi mate,
on your actual version 1.15 You can flash the Bios Mod using the Sleep Bug

Here You go :

http://rghost.net/6bhRQg6Zq

Unpack the Bios Mod and copy the "modified" folder into C: HD root place !
Then open Command Promt with Admin Rights (CLI window C:\), put your laptop
into Sleep Mode (just close the Lid) and then Wacke-Up It (reopen the Lid),
after this execute these comands from CLI window :

cd \

cd modified

fptw -f bios.bin -bios

(or fptw64 for Windows x64)

Let me know
Regards

No way!!! Error 7 again!! 

[PeterQuinn]

Yoga 2 Pro, bios 76CN43WW
Sleep bug seems to work


https://www.sendspace.com/file/pezt3t

Please help with whitelist removal

[PeterQuinn]

I did some research and found an interesting article on changing hidden BIOS settings http://habrahabr.ru/post/182676/ (in Russian). By following the steps from the article I was able to dump BIOS menus and it looks like there is a hidden 'Advanced' page where lots of interesting stuff can be changed:

Code:

┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Form Name: 'Advanced'                                                                              [ ID: '0x0001' ]│
└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
Reference: 'Boot Configuration' [ FormID: '0x0021', QuestionId: '0x01', VarStore: '0xffff' ]
Reference: 'Peripheral Configuration' [ FormID: '0x0022', QuestionId: '0x02', VarStore: '0xffff' ]
Reference: 'SATA Configuration' [ FormID: '0x0023', QuestionId: '0x03', VarStore: '0xffff' ]
Reference: 'Thermal Configuration' [ FormID: '0x0024', QuestionId: '0x04', VarStore: '0xffff' ]
Reference: 'Video Configuration' [ FormID: '0x0025', QuestionId: '0x05', VarStore: '0xffff' ]
Reference: 'USB Configuration' [ FormID: '0x0026', QuestionId: '0x06', VarStore: '0xffff' ]
Reference: 'Chipset Configuration' [ FormID: '0x0027', QuestionId: '0x07', VarStore: '0xffff' ]
Reference: 'ACPI Table/Features Control' [ FormID: '0x0028', QuestionId: '0x08', VarStore: '0xffff' ]
Reference: 'PCI Express Configuration' [ FormID: '0x0030', QuestionId: '0x09', VarStore: '0xffff' ]
Reference: 'Intel(R) Anti-Theft Technology Support' [ FormID: '0x0038', QuestionId: '0x0a', VarStore: '0xffff' ]
Reference: 'Overclocking Performance Menu' [ FormID: '0x0037', QuestionId: '0x500', VarStore: '0xffff' ]
Reference: 'Extended ICC' [ FormID: '0x1cc0', QuestionId: '0x0b', VarStore: '0xffff' ]
Reference: 'Intel Rapid Start Technology' [ FormID: '0x0040', QuestionId: '0x0c', VarStore: '0xffff' ]
Reference: 'DPTF Configuration' [ FormID: '0x3610', QuestionId: '0x0d', VarStore: '0xffff' ]
Reference: 'Serial IO Configuration' [ FormID: '0x3700', QuestionId: '0x0e', VarStore: '0xffff' ]
Reference: 'Audio DSP Configuration' [ FormID: '0x3710', QuestionId: '0x0f', VarStore: '0xffff' ]
Reference: 'ISCT Configuration' [ FormID: '0x1e00', QuestionId: '0x10', VarStore: '0xffff' ]

Full dump is here https://www.sendspace.com/file/k5v8ad

Somewhere under the Advanced menu there is an interesting switch which might be responsible for the whitelist:

Code:

┌- Suppress IF:
|    LIST [ ID: '0x24c' ] in ('0x00')
|    Select option: '  Wifi'                         [ VarStore: '0x460', QuestionId: '0x24d',   Help: 'Enables/Disables the Vendor Sensor.']
|      Option: 'Disabled'                            [ Value: '0'   Default: 'true'     Type: 'int8'  ]
|      Option: 'Enabled'                             [ Value: '1'   Default: 'false'    Type: 'int8'  ]
└- END IF Suppress;

I tried to make USB boot stick, boot to grub and change the value of this switch using 'setup_var 0x460 0x1' but the command fails with error 0x00001a. Need to do some more research here but this looks rather interesting

Also it is very interesting to find a way to enable this hidden page in the BIOS. There should be an EFI var to enable it.
One other thing is that in linux I have the following EFI var
/sys/firmware/efi/vars/SCUShowHiddenPage-8be4df61-93ca-11d2-aa0d-00e098032b8c/ which might be it but I haven't yet found a way to change it.

[BDMaster]

This is same like FlaseClock Method :

https://www.bios-mods.com/forum/Thread-R...-EFI-shell

Regards

P.S. What do You want to unlock ?

[BDMaster]

Here You go :

http://rghost.net/8wDPqWlnX

Unpack the Bios Mod and copy the "modified" folder into C: HD root place !
Then open Command Promt with Admin Rights (CLI window C:\), put your laptop
into Sleep Mode (just close the Lid) and then Wacke-Up It (reopen the Lid),
after this execute these comands from CLI window :

cd \

cd modified

fptw -f bios.bin -bios

(or fptw64 for Windows x64)

Let me know
Regards

[PeterQuinn]

Here You go :

http://rghost.net/8wDPqWlnX

Unpack the Bios Mod and copy the "modified" folder into C: HD root place !
Then open Command Promt with Admin Rights (CLI window C:\), put your laptop
into Sleep Mode (just close the Lid) and then Wacke-Up It (reopen the Lid),
after this execute these comands from CLI window :

cd \

cd modified

fptw -f bios.bin -bios

(or fptw64 for Windows x64)

Let me know
Regards

Just want to double check that this is the correct version?
bindiff shows a big 1.5MB area (0x0002D0E0-0x001A20F0) that is different between the original and patched versions. I thought that disabling whitelist check is a mater of changing/adding a jmp in the right place.

[PeterQuinn]

This is same like FlaseClock Method :

https://www.bios-mods.com/forum/Thread-R...-EFI-shell

Regards

P.S. What do You want to unlock ?

I managed to unlock Advanced tab in the BIOS. And even though 'Wifi' option that I mentioned had nothing to do with the whitelist the Advanced tab turned out to be very useful. In particular there is 'BIOS Lock' option that disables write protection and allows to flash BIOS from Windows (still need to do sleep/wakeup).

Enabling advanced tab turned out rather simple in Linux - just hexedit the EFI var:

Code:

sudo ghex /sys/firmware/efi/efivars/SCUShowHiddenPage-8be4df61-93ca-11d2-aa0d-00e098032b8c

Here is a screenshot: http://bit.ly/1NIki9M

Then in 'Advanced' -> 'Chipset Configuration' one can disable BIOS lock. Some more screenshots:
http://bit.ly/1OmUWvf
http://bit.ly/1NIkaqP
http://bit.ly/1Vl6p48

Also there are many other interesting settings to tweak there

[BDMaster]

Hi mate,
Many thanks for all your report and efforts (super) !!!
I forget to say that It was easy to get as Stinger2k publicated the way to get the
CUSTOM Menu and enable Advanced then switch off Bios Lock option !
Look here :

https://www.bios-mods.com/forum/Thread-S...a-2-13-Pro

Regards

[PeterQuinn]

Hi mate,
Many thanks for all your report and efforts (super) !!!
I forget to say that It was easy to get as Stinger2k publicated the way to get the
CUSTOM Menu and enable Advanced then switch off Bios Lock option !
Look here :

https://www.bios-mods.com/forum/Thread-S...a-2-13-Pro

Regards

Yep, I saw that thread, but fn+f2+r didn't work on my yoga 2 pro, it just opened the normal Setup

[cfb44]

thanks PeterQuinn for this method to unlock the bios! works great, as I was unable to get the fn+f2+r method to work. comes in handy when installing OS X, as the DMVT Pre-Allocated memory needs to be set to 96MB. would be great if we could remove the whitelist using a menu option, but guess I will just need to flash a modified bios...