[REQUEST] Lenovo Thinkpad X230(i) (G2ETxxWW) Whitelist Removal

[BDMaster]

Hi friend,
Bios is compressed in a Tiano LZa compression form so You have to extract
all Modules form in to get Them all into a DUMP folder !
Use PhoenixModTool 2.59 Andy's program :

http://forums.mydigitallife.info/threads...EFI-BIOSes

http://forums.mydigitallife.info/threads...and-editor

Then You can edit the Module regarding Whitelist :

79E0EDD7-9D1D-4F41-AE1A-F896169E5216_2208.ROM

When You done all modifies You have to repack this one into
Bios Mod file using always PMT2.59 !

Regards

[mhaedo]

Thanks BDMaster. Can you explain what changes are made to 79E0EDD7-9D1D-4F41-AE1A-F896169E5216_2208.ROM?

Also, my SPI programmer and SOIC-8 clip arrived. When attempting to read from the chip, I received "ID check failed." I ordered a higher quality Pamona clip which should arrive in a few days. Hopefully this will work.

[BDMaster]

79E0EDD7-9D1D-4F41-AE1A-F896169E5216_2207.ROM LenovoWmaPolicyDxe.efi (X230 2.62 BDMaster)

0C39 : 75 19 to 75 00 jnz short loc_C54 to jnz $+2
0C4E : 0F 84 9F 01 00 00 to 90 E9 9F 01 00 00 jz loc_DF3 to nop + jmp loc_DF3
0CA2 : 75 16 to 75 00 jnz short loc_CBA to jnz $+2
0CB8 : 74 1B to EB 1B jz short loc_CD5 to jmp short loc_CD5
0CCD : 0F 84 0A FF FF FF to 90 E9 00 00 00 00 jz loc_BDD to nop + jmp $+6
0CD3 : EB B6 to EB 00 jmp short loc_C8B to jmp $+2

Regards

[HelloWorldCoder]

79E0EDD7-9D1D-4F41-AE1A-F896169E5216_2207.ROM LenovoWmaPolicyDxe.efi (X230 2.62 BDMaster)

0C39 : 75 19 to 75 00 jnz short loc_C54 to jnz $+2
0C4E : 0F 84 9F 01 00 00 to 90 E9 9F 01 00 00 jz loc_DF3 to nop + jmp loc_DF3
0CA2 : 75 16 to 75 00 jnz short loc_CBA to jnz $+2
0CB8 : 74 1B to EB 1B jz short loc_CD5 to jmp short loc_CD5
0CCD : 0F 84 0A FF FF FF to 90 E9 00 00 00 00 jz loc_BDD to nop + jmp $+6
0CD3 : EB B6 to EB 00 jmp short loc_C8B to jmp $+2

Regards

Hi,BDMaster, T61 whitelist module is not a .PE file. How to use IDApro remove it?Press C?The process can be converted into graphics process?

[BDMaster]

Hi friend,
this isi a Phoenix Bios (EFI Old Style) so You will find different Modules than UEFI !

It's an 16 Bit Code :

BIOSCOD5.ROM

48EC : F9 to F8

seg000:48EC stc
seg000:48ED jmp short loc_48F5

to

seg000:48EC clc
seg000:48ED jmp short loc_48F5


Idem for these two

4923 : F9 to F8

494F : F9 to F8

Look for Zender Mod !

I will reply in PM !
Regards

[mhaedo]

My Pamona SOIC8 clip arrived today. Unfortunately, it will not read from my chip while on-board. I receive the "ID check failed" error from my GQ-4X programmer. I will have to resort to removing the chip from the board.

BDmaster, you mention that you require the "full dump firmware." How do I retrieve this full dump?

[BDMaster]

Ok my friend,
You can try modifying timing on SW to read Chip on Board You have to slowdown the
reading so operate on control at right position on SW !
Then if You cannot read the Chip You have to remove !
Full Dump Firmware is the sum of two chips

--- Flash Devices Found ---
MX25L6405D ID:0xC22017 Size: 8192KB (65536Kb)
MX25L3205D ID:0xC22016 Size: 4096KB (32768Kb)

into MX25L3205D there is first Firmware part (Descriptor - ME - GbE) and
into MX25L6405D there is Bios Region !
So if You cannot read on Bosrd and for You It's Dangerous to desolder chips
from MoBo do It only for Bios Chip as It will be enough for modify, but for future
modify or recover It will be better get all Full Dump Firmware !
Let me know if You understand all !
Regards

[mhaedo]

here You go (corrected file) :

http://rghost.net/6SbgccxfG

let me know
regards

P.S. this is only a preview file as I need the Full Dump Firmware to modify It !

I do not know what you mean by preview file. Is this file ready for me to flash to my MX25L3206E chip, or do you need a full dump first?

Ok my friend,
You can try modifying timing on SW to read Chip on Board You have to slowdown the
reading so operate on control at right position on SW !
Then if You cannot read the Chip You have to remove !
Full Dump Firmware is the sum of two chips

--- Flash Devices Found ---
MX25L6405D ID:0xC22017 Size: 8192KB (65536Kb)
MX25L3205D ID:0xC22016 Size: 4096KB (32768Kb)

into MX25L3205D there is first Firmware part (Descriptor - ME - GbE) and
into MX25L6405D there is Bios Region !
So if You cannot read on Bosrd and for You It's Dangerous to desolder chips
from MoBo do It only for Bios Chip as It will be enough for modify, but for future
modify or recover It will be better get all Full Dump Firmware !
Let me know if You understand all !
Regards

Changing the read speed did not work. I received all of my soldering supplies today and am ready to remove the chip from the motherboard.

Does this mean I can flash the file http://rghost.net/6SbgccxfG to my MX25L3206E chip and my whitelist will be removed? What is the purpose of also removing the MX25L6405D and reading from this chip?

What can we change in a full dump that we cannot change from the backup ROM from BIOS Backup Toolkit?

[BDMaster]

The Full Dump Firmware is the join form of two chunks the 1st is MX25L6405D ID:0xC22017 Size: 8192KB (65536Kb)
and the 2nd is MX25L3205D ID:0xC22016 Size: 4096KB (32768Kb) = Bios Region !
To You will be enough modify just the second 4096 KB size !
But You have to read and backup the Eeprom's contains as or You upload It for me to check all
yours modifies or You do by yourelf and have to backup all to get the roll back possibility !
I don't know what eeproms contains as I haven't the full Dump Frmware for this laptop so
I cannot help without see anything ?!?!
let me know
Regards

[mhaedo]

Ok, so just so I understand, I have to read from the chip itself using the SPI programmer, upload the backup I get from the SPI programmer, and then you modify that?

And you recommend I do this for both MX25L3206E and MX25L6406E, not just MX25L3206E?

BIOS backups:
results.rar (obtained with BACKUP_Tools.exe): https://www.sendspace.com/file/95z86g
LENOVO-G2ETA2WW(2.62).rom (obtained with Universal BIOS Backup Toolkit v2.0): https://www.sendspace.com/file/h0c2t8

These are not enough?