[REQUEST] Lenovo Z40-75 & Z50-75 (A4CNxxWW) Whitelist Removal

[adde88]

And if i insert the original wifichip the Lenovo logo displays, it hangs forever on a black screen, with a flashing white underscore. No error message though.
The same happens without any wifichip inserted. It just hangs forever.

[BDMaster]

Yes I know that as this Bios is hostic and I am going to make some tests !
I will reply quickly with new mod !
Can You please get Original WiFi Card PCI / VEN ID and new WiFi Card too and
post here please . . .
Look here how to :

http://forums.mydigitallife.info/threads...d-requests

I will wait your post, thanks
Let me know
Regards

P.S. this Bios has two Modules for Witelist . . . and not standard . . .

79E0EDD7-9D1D-4F41-AE1A-F896169E5216_1236.ROM HookBeforeBoot

B3DE4F97-4FB3-67C9-A4CD-E38150A7F5BF_1258.ROM UsbLockDxe

[adde88]

Thanks for your reply, buddy!
I really appreciate you taking your time to help me/us.

I have two identical Lenovo Z50-75 laptops.
I just discovered that they have different wifi-chips. Mine uses a Broadcom chip, and the other one an Atheros chip.
They have the same BIOS, so both wifi cards is on the whitelist.

Here are the ID's!
[Broadcom] - Whitelisted
Model: BCM943142Y
ID: PCI\VEN_14E4&DEV_4365&SUBSYS_062117AA&REV_01

[Atheros] - Whitelisted
Model: AR956X
ID: PCI\VEN_168C&DEV_0036&SUBSYS_402617AA&REV_01

[Intel] - Not Whitelisted!
Model: 7260NGW
ID: PCI\VEN_8086&DEV_08B2&SUBSYS_C2708086&REV_83

This Intel chip actually works, if i "hotswap" the original Broadcom chip before the OS starts.
But i'd much rather be able to just boot the computer normally!
I have another ac7260ngw chip, but the hot-swapping doesn't work with it. Not in Windows, and not in Linux.
It just says that Windows cannot start the driver.
It also has a different ID compared to the Intel chip above.
If you are able to put both of these Intel chips in the whitelist, i'd be very happy, because i'd be able to use the Intel chips on both laptops!
But if you are only able to put one chip in the whitelist, use the Intel chip ID's above this text! :O

[Second Intel Chip] - Not Whitelisted!
Model: 7260NGW
ID: PCI\VEN_8086&DEV_08B1&SUBSYS_C4708086&REV_BB

Thank you very much again!!

[adde88]

By the way, regarding those two modules you listed that contains the whitelists:
{79E0EDD7-9D1D-4F41-AE1A-F896169E5216_1236.ROM} - HookBeforeBoot
{B3DE4F97-4FB3-67C9-A4CD-E38150A7F5BF_1258.ROM} - UsbLockDxe

I couldn't find either them or the GUID's.
I tried using Andy's Phoenix Tool to extract all the modules from the image i got with the SPI programmer, but those modules and GUID's wasn't listed there. Am i doing something wrong while trying to find it?

[BDMaster]

Let me see your DUMP folder please (pack by winrar all) so upload It
for me and I will check what You get !
Let me know
Regards

[adde88]

Allright.
Here's my DUMP folder from Andys' Phoenix Tool v. 2.56
Extracted from the SPI programmer image.

https://www.sendspace.com/file/s5ycpj

[BDMaster]

Please write to me a PM with your skype account so When I get more time I will
be of there and We can make more tests !
Regards

[BDMaster]

Could You upload all please (Bios file Slic.log etc) ?
It's very strange ?!?! which PMT version You used ?
Use the PMT 2.64 (latest one) !
Let me know
Regards

[adde88]

I thought i'd give an update on my progress.
I managed to [censored] up the motherboard on my computer, because of sloppy de-soldering and soldering of the SOIC chip. I had the CH341A programmer, but not the clips.
However, i've replaced the motherboard now, and gotten the clips. So i'm testing like crazy here!

There seems to be two modules within the BIOS, that contains something of interest.
79E0EDD7-9D1D-4F41-AE1A-F896169E5216_1236.ROM - (HookBeforeBoot)
B3DE4F97-4FB3-67C9-A4CD-E38150A7F5BF_1258.ROM - (UsbLockDxe)

The first one HookBeforeBoot contains 6 "scrambled" PCI vendor ID's, starting at offset: 0x0240.
Here they are: 8C 16 41 00 E4 14 65 43 EC 10 23 B7 8C 16 3E 00 E4 14 AE 43 8C 16 36 00
Each card is 4 byte. And it's scrambled this way: AABB CCDD --> BBAA DDCC
So to replace my Broadcom card (ID: 14E4:4365) with the Intel 7260ac (ID: 8086:08B2)
I simply locate: E4 14 65 43, and replace it with 86 80 B2 08

If the module is opened with a disassembler like IDA, we can graph out the function, and the inner workings of the module.
There seems to be an infinite loop at offset: 0x07B3, and also something similar at: 0x07C9.
But disabling these loops, and replacing/adding the vendor ID does not work.
I'am still greeted by the annoying "Unauthorized Wireless Network Card Plugged In" message, everytime i boot.

So there has to be something else....
I know the second module: 1258.ROM (UsbLockDxe) contains the error-message, and some loops, but this modules is a little complicated for me to work on alone. So if anyone with skills in assembly, or someone has other tricks up their sleeves, could help me out with this, i'd be very thankful!

I think we'd all bios-modders/whitelisters could gain something out of this, because Lenovo is probably doing everything they can to prevent us from doing this. And we need to beat em'!

PS: Here's my slic.log (sendspace)

[adde88]

After several hours research, lots of trial and error, i made it! 
Here is a working BIOS for the Lenovo Z50-75 (AMD CPU), with no whitelist at all!
You can use every friggin' wifi-card you want!
You will need the SPI-programmer to flash the BIOS to the chip!
Download Link (Sendspace)
Download Link (Dropbox)

It's 100% working!
Thanks to BDMaster, who helped me alot in the beginning, and inspired me to learn more!