Knogle

Ahoy! Thanks for the previous mod. I got the same request again, could you unlock the WiFi Whitelist as well as the hidden menus? https://repo.openknogle.eu/Johannes_Bios/bios_original.bin

I got it working already, there was some problem with the connection only. It's not that easy to get a good connection using the clip. But now it works. Here i got the .bin file of Chip 2 (4096kb) which has been verified as well. Sometimes it failed because of connection loss during the transfer. So i verified them and now everything is alright. I also would like to honor the work of the modder by the contribution of some money.. https://repo.openknogle.eu/T540p_Original/bios_right_chip.bin

Thanks! I got them. But unfortunately i don't know how to detach this connector. So somehow i got the clip attached to the chip, but only go this message: Does someone know how to get this connector removed? It may be easier this way. And what exactly do you guys do to remove the whitelist? I would like to know, but i also don't want to steal your job. I'd be happy if someone could mod my BIOS to remove the whitelist and enable the hidden stuff. Is it possible to include e.g. iPXE instead of the default PXE ROM? //edit: Got it working now somehow. What do you guys need? Just the BIOS dump or also the ME one? Output of binwalk DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 UEFI PI Firmware Volume, volume size: 2818048, header size: 0, revision: 0, EFI Firmware File System, GUID: 7A9354D9-0468-444A-CE81-0BF617D890DF 105 0x69 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 10072068 bytes 2822144 0x2B1000 UEFI PI Firmware Volume, volume size: 417792, header size: 0, revision: 0, Variable Storage, GUID: FFF12B8D-7696-4C8B-85A9-2747075B4F50 2822656 0x2B1200 Intel x86 or x64 microcode, sig 0x000306c1, pf_mask 0x32, 2012-06-14, rev 0x-ffed, size 24576 2847232 0x2B7200 Intel x86 or x64 microcode, sig 0x000306c2, pf_mask 0x32, 2012-10-17, rev 0x-fffa, size 22528 2869760 0x2BCA00 Intel x86 or x64 microcode, sig 0x000306c3, pf_mask 0x32, 2019-02-26, rev 0x0027, size 23552 2915895 0x2C7E37 Certificate in DER format (x509 v3), header length: 4, sequence length: 1552 2917495 0x2C8477 Certificate in DER format (x509 v3), header length: 4, sequence length: 1495 2919038 0x2C8A7E Certificate in DER format (x509 v3), header length: 4, sequence length: 942 2920028 0x2C8E5C Certificate in DER format (x509 v3), header length: 4, sequence length: 899 2924755 0x2CA0D3 Certificate in DER format (x509 v3), header length: 4, sequence length: 937 2925740 0x2CA4AC Certificate in DER format (x509 v3), header length: 4, sequence length: 1512 2927416 0x2CAB38 Certificate in DER format (x509 v3), header length: 4, sequence length: 935 3014919 0x2E0107 GIF image data, version "89a", 600 x 260 3021322 0x2E1A0A Copyright string: "Copyright (C) By Lenovo" 3045644 0x2E790C GIF image data, version "89a", 546 x 78 3049586 0x2E8872 Copyright string: "Copyright (C) By Lenovo" 3239936 0x317000 UEFI PI Firmware Volume, volume size: 167936, header size: 0, revision: 0, GUID: 00504624-8A59-4EEB-0FBD-6B36E96128E0 3244418 0x318182 Certificate in DER format (x509 v3), header length: 4, sequence length: 1552 3246018 0x3187C2 Certificate in DER format (x509 v3), header length: 4, sequence length: 1495 3247561 0x318DC9 Certificate in DER format (x509 v3), header length: 4, sequence length: 942 3248551 0x3191A7 Certificate in DER format (x509 v3), header length: 4, sequence length: 899 3249630 0x3195DE Certificate in DER format (x509 v3), header length: 4, sequence length: 937 3250615 0x3199B7 Certificate in DER format (x509 v3), header length: 4, sequence length: 1512 3252203 0x319FEB Certificate in DER format (x509 v3), header length: 4, sequence length: 935 3407872 0x340000 UEFI PI Firmware Volume, volume size: 786432, header size: 0, revision: 0, EFI Firmware File System, GUID: 7A9354D9-0468-444A-CE81-0BF617D890DF 3408032 0x3400A0 Microsoft executable, portable (PE) 3418016 0x3427A0 Microsoft executable, portable (PE) 3444000 0x348D20 Microsoft executable, portable (PE) 3444639 0x348F9F mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit 3461536 0x34D1A0 Microsoft executable, portable (PE) 3464896 0x34DEC0 Microsoft executable, portable (PE) 3472976 0x34FE50 SHA256 hash constants, little endian 3512024 0x3596D8 SHA256 hash constants, little endian 3681600 0x382D40 Microsoft executable, portable (PE) 3686848 0x3841C0 SHA256 hash constants, little endian 3767104 0x397B40 Microsoft executable, portable (PE) 3775808 0x399D40 Microsoft executable, portable (PE) 3788872 0x39D048 SHA256 hash constants, little endian 3818528 0x3A4420 Microsoft executable, portable (PE) 3852448 0x3AC8A0 Microsoft executable, portable (PE) 3856928 0x3ADA20 Microsoft executable, portable (PE) 3859104 0x3AE2A0 Microsoft executable, portable (PE) 3874912 0x3B2060 Microsoft executable, portable (PE) 3877600 0x3B2AE0 Microsoft executable, portable (PE) 3880224 0x3B3520 Microsoft executable, portable (PE) 3881280 0x3B3940 Microsoft executable, portable (PE) 3883936 0x3B43A0 Microsoft executable, portable (PE) 3896128 0x3B7340 Microsoft executable, portable (PE) 3910048 0x3BA9A0 Microsoft executable, portable (PE) 3910912 0x3BAD00 Microsoft executable, portable (PE) 3913184 0x3BB5E0 Microsoft executable, portable (PE) 3916352 0x3BC240 Microsoft executable, portable (PE) 3949608 0x3C4428 SHA256 hash constants, little endian 3967040 0x3C8840 Microsoft executable, portable (PE) 4017216 0x3D4C40 Microsoft executable, portable (PE) 4028576 0x3D78A0 Microsoft executable, portable (PE) 4030016 0x3D7E40 Microsoft executable, portable (PE) 4033184 0x3D8AA0 Microsoft executable, portable (PE) root@workstation:/home/chairman/Dokumente/CH341A# flashrom --programmer ch341a_spi -r bios_right_chip.bin -c MX25L3273E flashrom on Linux 5.3.0-3-amd64 (x86_64) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Macronix flash chip "MX25L3273E" (4096 kB, SPI) on ch341a_spi. Reading flash... done. root@workstation:/home/chairman/Dokumente/CH341A# flashrom --programmer ch341a_spi -v bios_right_chip.bin -c MX25L3273E flashrom on Linux 5.3.0-3-amd64 (x86_64) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Macronix flash chip "MX25L3273E" (4096 kB, SPI) on ch341a_spi. Verifying flash... VERIFIED. root@workstation:/home/chairman/Dokumente/CH341A# flashrom --programmer ch341a_spi -r me_left_chip.bin -c MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F flashrom on Linux 5.3.0-3-amd64 (x86_64) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" (8192 kB, SPI) on ch341a_spi. Reading flash... done. root@workstation:/home/chairman/Dokumente/CH341A# flashrom --programmer ch341a_spi -v me_left_chip.bin -c MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F flashrom on Linux 5.3.0-3-amd64 (x86_64) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" (8192 kB, SPI) on ch341a_spi. Verifying flash... VERIFIED.

Ahoy. I got the T540p as well, but the version including a NVIDIA GT730M card. But unfortunately i'm not able to find the BIOS chip there. Does someone know where it is located on this version of the T540p?