[REQUEST] Lenovo Thinkpad X230(i) (G2ETxxWW) Whitelist Removal

[Simpetus]

Sorry for off-topic.

I am trying to make a dump of X220 BIOS, but have not succeeded yet. I am using SO8 clip and using GZUt EZP XPro as a programmer (http://item.taobao.com/item.htm?spm=a230r.1.14.1.UFVm4f&id=39239453212&ns=1&_u=rmg8fi6d6f5&abbucket=12#detail).

On seller's page it is said that the programmer supports 3v chips, but I still want to ask whether I should using rst1024 method to power up the circuit?:

The X230 will power up the LAN/flash 3.3V domain with the computer turned off if Wake-On-LAN is active and an AC source is plugged in. You need to activate WoL in the BIOS and (in my experience) plug in a live ethernet cable. If the X230's RJ45 lights are on then the flash chip will be supplied with 3.3V.

Or, if I will try to do this there is a possibility that I burn the chip? (programmer supports 3v + 3.3v from circuit)

Thanks in advance.

[BDMaster]

I don't think You can shortcircuit the Chip but I haven't tried as I have Always desolder Chips and
didn't get the RaspBerry SPI PGM !
Regards

[rst1024]

My recommendation: only connect GND and the data/clock lines from your programmer. Do not connect the laptop 3.3V to the programmer 3.3V/3V. Then, try the method with Wake-on-LAN, AC and live ethernet cable to supply the 3.3V. This worked for me and is the lowest risk option by far. You are only coupling weak data signals and not power. Any short circuit or mis-wiring with this set of signals is unlikely to damage anything.

The main reason I'd choose not to drop an external 3.3V across the SPI flash in place is that it results in powering up other chips in the laptop that run off the same supply rail - mostly Ethernet related things in this case. This will:
A) Consume more current than you (or the programmer tool) might expect
B) Risk some expensive and impossible-to-replace BGA chips with your poorly regulated external 3.3V supply

If you do use an external 3.3V, be sure to disconnect the laptop battery and AC supply.

[Simpetus]

My recommendation: only connect GND and the data/clock lines from your programmer. Do not connect the laptop 3.3V to the programmer 3.3V/3V. Then, try the method with Wake-on-LAN, AC and live ethernet cable to supply the 3.3V. This worked for me and is the lowest risk option by far. You are only coupling weak data signals and not power. Any short circuit or mis-wiring with this set of signals is unlikely to damage anything.

The main reason I'd choose not to drop an external 3.3V across the SPI flash in place is that it results in powering up other chips in the laptop that run off the same supply rail - mostly Ethernet related things in this case. This will:
A) Consume more current than you (or the programmer tool) might expect
B) Risk some expensive and impossible-to-replace BGA chips with your poorly regulated external 3.3V supply

If you do use an external 3.3V, be sure to disconnect the laptop battery and AC supply.

Many thanks for reply and preventing me doing stupid steps. I have got this http://item.taobao.com/item.htm?spm=a230r.1.14.1.UFVm4f&id=39239453212&ns=1&_u=rmg8fi6d6f5&abbucket=12#detail programmer. As I said before, I did not manage to make a dump of BIOS yet, so I have two more questions:

1. Does removing BIOS battery before making dump make any difference?
2. If I remove BIOS battery will I lost my BIOS settings and Fingerprint data?

[rst1024]

No need to remove the BIOS/CMOS (coin cell type) battery. It's a very separate power supply and function to the BIOS program flash chips. I don't know where settings and fingerprints are stored.

Do you really need to do all of this for an X220 though? I thought that the Intel protection function that requires hardware flash was only enabled on Lenovo Xx30's and later?

If so, you should be able both to dump and reprogram using software tools. You may have to truncate/offet a dump file before reprogramming, but it'll be standard X220 stuff that is discussed elsewhere. Even on Xx30's, the command line dump tools still work OK, only the reprogram fails.

[Simpetus]

No need to remove the BIOS/CMOS (coin cell type) battery. It's a very separate power supply and function to the BIOS program flash chips. I don't know where settings and fingerprints are stored.

Do you really need to do all of this for an X220 though? I thought that the Intel protection function that requires hardware flash was only enabled on Lenovo Xx30's and later?

If so, you should be able both to dump and reprogram using software tools. You may have to truncate/offet a dump file before reprogramming, but it'll be standard X220 stuff that is discussed elsewhere. Even on Xx30's, the command line dump tools still work OK, only the reprogram fails.

Wait-wait, let me explain. I have a nasty problem every time I flash BIOS-MOD - 5-5 beeps on the system start up. As much as I understand, every X220 with TPM on board have RSA signature, RSA key and Check-sums in the BIOS. Every X220 has it own pack of RSA key and signature, as well as check-sums, so if you need to get rid of this 5-5 beeps, you should make a dump with a SPI programmer. Not with software flasher. Am I wrong?

[rst1024]

I don't know those details - sorry.

I'd speculate that if the beeps are due to an RSA signature failure, you will have limited options:

1. Figure out how to RSA-sign your modified BIOS as if it had come from Lenovo. If you do this, you'll be a hero: it'd probably allow X230's to software-flash modified BIOS images too, assuming the same keys are used across models.
2. Modify the firmware to suppress the beeps. This check is probably somewhere in the Intel ME firmware rather than the X86 BIOS. Although Embedded Controller beep is mixed with the PCH (Intel) beep channel (either can beep the speaker), I'm guessing that the Hitachi/Renesas H8S EC CPU doesn't have access to the 4Mb BIOS image in order to run checks.
3. Make up a small circuit hack to mute the beep channel for X seconds after power up.
4. Remove a resistor somewhere, permanently disabling the beep channel, but allowing normal audio through.
5. Learn to live with the beeps!

Maybe (2) is possible for somebody here? This page (http://www.coreboot.org/Board:lenovo/x230) suggests that the ME flash area isn't software readable, which is probably why you're looking at this hardware path now.

Good luck in any case. I think reading the flash chips will be the easiest part.

[Simpetus]

Good luck in any case. I think reading the flash chips will be the easiest part.

Thanks man.

So you think it will be easier if I just find someone with good solder skills, unsolder the gdmn chip, make a full dump with a programmer (because I cannot do this with clip. I connect it right and I know it.), then solder the chip back, find another person who do BIOS-MOD with all stuff that I need for me and then I will be golden? I got you right?

[Simpetus]

BTW, I found out that Flashrom supports the chip on my notebook, but I was scared away by the message it gave to me "We do not recommend to use Flashrom with notebooks because of EC. Even using Prob and Read command could lead to Fan failure and so on...". Should I give Flashrom a try, even if it gives me that message? Or it is possible to brick my X220 even using Read option?

[rst1024]

Sorry - I don't know for sure.

As to desoldering: it's far riskier for your motherboard than using a clip, even for someone experienced with soldering. At best, it'll take a lot longer.

This might be OK for a one-off reflash of a known mod (e.g. WiFi whitelist). However if you're working on something new (i.e. TPM beeps) and can't SW flash the required device, then you'll really need to be able to HW flash in-place using a clip. You'll end up doing quite a few iterations of the mod along the way as you try things out.