Whitelist

[edmalho]

Can this project be expanded to whitelist cards, or even unlock overclock?
I can provide the changes needed on the FL1 file.

[hamishcoleman]

That sounds useful! It's flexible enough that we could probably add that in, yes.

Nothing in the current build touches the FL1 files, so I think it would end up being a second build output.

Do you have a sample set of FL1 changes? I could look and see if anything suggests itself

[m-kozlowski]

As much as I would like you guys to succeed, I'm rather sceptical.
I have no experience with unlocking overclocking, but i did remove whitelist from my t430 and t430s and there are few things that in my opinion make automation of this task non-trivial.

The point is to modify few JMPs from single bios module. Simple hex find&replace won't work here, as instruction opcodes differ between the bios versions. But even considering that we could sort this out with some heuristics, resulting module must be repacked back into some propertiary bios format.
I don't know any details on this, as i've used this windows tool that did the job for me. I don't know if there are any linux equivalents.
You can read more about the procedure here

Another problem is that series xx30 and up "introduced new Intel security features that make it impossible to flash the [unsigned] BIOS using software". So users will end up with FL1 file that fails flashing.

[hamishcoleman]

The bios update FL1 file is in a UEFI capsule format, the difficulty in patching it is usually because it needs to be signed (which can be side-stepped if you use a hardware programmer - that is what a lot of people seem to suggest). So at least, there is some hope of automating it - just the signing that is difficult.

If there is a process for creating valid patches, then the repo could just store a different patch for each BIOS version - the moving instructions and limits on find&replace all apply to the EC firmware too, and just keeping a patch set for each version has worked there. Event if we cannot create signed updates, it might be useful to provide a resource for people to create binaries to use with a hardware programmer.

Thanks for the links - I'll have a look at them when I next get a chance.

[edmalho]

The UEFIPatch can already change the bios. The thing is UEFIPatch it's a generic tool to change a bit for Hackintosh Power management. I didn't get into the code to understand how it does it, but since the EC is already "unlocked" maybe it isn't so far fetch to try change the bios.
I found a russian blog with some modifications explained https://habrahabr.ru/post/211879/
This one https://habrahabr.ru/post/182676/ explain how to get the full unencrypted bios without a programmer.
The procedure now is like this:
-Read the chip.
-Use the UEFITool to extrat the body of the sections we want to modify
-Patch the bodies.
-Replace the bodies with the patched ones in the UEFITools
-And write the moded dump to the chip.
UEFITools simply compress the sections and checksum everything. Neat'n easy!

[hamishcoleman]

Unfortunately, the BIOS and the EC use completely different "locking" systems. So our success with the EC does not help with modding the BIOS - and I am fairly sure that there is some signature that needs to be correctly added to the BIOS to allow it to be uploaded without an external programmer.

Also problematic is that the UEFITool is a GUI interface that is not automatable.

However, if you had patches that apply to the UEFI sections, there might be a way to add and automate some or all of this.

[rad4day]

The only way to really mod the bios on some of the Thinkpads seems to be actually disassembling the Notebook and hooking the chip up to an external flasher. (Which in some cases isn't really possible without a hot air station and desoldering the chip). Which is quite a shame.

[hamishcoleman]

@rad4day you are right - but we could still start collecting repository of known patches to help with building a new flash image once you have downloaded (and backed up) your current image.

[edmalho]

well i have a w530 and on the schematics i found a solder pad (CN100) on the motherboard with spi and jtag connections. There is no necessity to fully disassembly the laptop anymore, now we only need to remove the palmrest to solder cables and leave them hidden bellow the keyboard. It is possible that other laptops with "hidden" bios chips have this kind of shortcuts. Do you want me to create a list of laptops with easier places to connect a programmer?
it is possible to remove the bios write protection, so even we don't find the signature key now we only need to use a programmer one time:

BIOS lock removal
What : removal of protection from the firmware of modified UEFI images by the built-in programmer.
Why : with a large number of experiments with UEFI get every time the programmer quickly gets bored, and firmware is faster (using QuadSPI protocol instead of the usual SPI in the case of an external programmer).
Where to search : in chipset drivers, most often in PchInitDxe (another version of the mod is in BiosWriteProtect)
Modification method : the modification version of PchInitDxe is fully described here in English, so I'll just give an idea. It is necessary to find the BIOS Lock Enable (BLE) bit entry in the BIOS_CNTL register of the chipset and prevent it. You can do this in several places, for example, here:
48 8B 4C 24 40 mov rcx, qword ptr [rsp + 40h]; Load the RCX address of the PchPlatformData structure
48 8B 41 50 mov rax, qword ptr [rcx + 50h]; And in RAX, the address of the child structure of LockdownConfig
F6 00 10 test byte ptr [rax], 10h; Check if the fifth bit is set (BiosLock)
74 25 je 0000000180001452; If not installed, jump over the entire code below
8A 50 01 mov dl, byte ptr [rax + 1]
B9 B2 00 00 00 mov ecx, 0B2h;
E8 A2 5A 00 00 call 0000000180006EDC
4C 8D 87 DC 00 00 00 lea r8, [rdi + 000000DCh]; In RDI, the base address of the LPC chipsets is the base address, and 0xDC is the BIOS_CNTL
33 C9 xor ecx, ecx
4C 8B CD mov r9, rbp
33 D2 xor edx, edx
4C 89 44 24 20 mov qword ptr [rsp + 20h], r8
E8 AA 76 00 00 call 0000000180008AFC; Install the lock
You can change JE to JMP, but sometimes, instead of a short jump, you get a long one that has to calculate the offset in addition, so it's better to change the test to any command that sets the ZF flag, for example to xor rax, rax (48 31 C0), and the possible size difference correct commands by adding NOPs.
If you did not find the desired code in PchInitDxe, you can change the BiosWriteProtect driver so that you can bypass the registration of the SMI handler located in it, which sets the BLE bit when trying to reset it, and then it is enough to reset this bit to unlock the firmware. I have worked perfectly the above method, so I have not tried this option yet, and therefore I will not describe it in detail.

[edmalho]

https://drive.google.com/drive/folders/1C-60q2ndgsqU4J1NZqyiwrCvRM4vNDKL?usp=sharing

[edmalho]

some intel me info:
www . mediafire . com/?iwscmnadf5icnxq

[edmalho]

Ok it's possible to show the hidden advance tab without rewriting the bios, but its necessary write access to nvram(it's unlock on thinkpads?):
https://github.com/bobafetthotmail/insydeH20-advanced-settings-tools

[edmalho]

this is the patch file(UEFIPatch) to implement the wifi whitlist, advance tab, cpu multiplier and hackintosh power.
patches.txt

[edmalho]

This one change the Date Tab with the Advance Tab
#SystemFormBrowserCoreDxe | W530

32442D09-1D11-4E27-8AAB-90FE6ACB0489 10 P:04320b483cc2e14abb16a73fadda475f:778b1d826d24964e8e103467d56ab1ba

[edmalho]

ok for cpu multiplier management:
F7731B4C-58A2-4DF4-8980-5645D39ECE58 10 P:30488b4338f6000874080fba6c243014:30488b4338f60008eb080fba6c243014

[edmalho]

Hackintosh Power management:
F7731B4C-58A2-4DF4-8980-5645D39ECE58 10 P:44243080fb0175080fbae80f89442430:44243080fb01eb080fbae80f89442430