Knogle

Ahoy!

Thanks for the previous mod.

I got the same request again, could you unlock the WiFi Whitelist as well as the hidden menus?

 

https://repo.openknogle.eu/Johannes_Bios/bios_original.bin

I got it working already, there was some problem with the connection only. It's not that easy to get a good connection using the clip. But now it works.

Here i got the .bin file of Chip 2 (4096kb) which has been verified as well.

 

Sometimes it failed because of connection loss during the transfer. So i verified them and now everything is alright.

I also would like to honor the work of the modder by the contribution of some money..

 

https://repo.openknogle.eu/T540p_Original/bios_right_chip.bin

Thanks! I got them. But unfortunately i don't know how to detach this connector.

So somehow i got the clip attached to the chip, but only go this message:

 

Does someone know how to get this connector removed? It may be easier this way.

 

And what exactly do you guys do to remove the whitelist? I would like to know, but i also don't want to steal your job.

I'd be happy if someone could mod my BIOS to remove the whitelist and enable the hidden stuff.

 

Is it possible to include e.g. iPXE instead of the default PXE ROM?

 

//edit: Got it working now somehow. What do you guys need? Just the BIOS dump or also the ME one?

 

Output of binwalk

 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             UEFI PI Firmware Volume, volume size: 2818048, header size: 0, revision: 0, EFI Firmware File System, GUID: 7A9354D9-0468-444A-CE81-0BF617D890DF
105           0x69            LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 10072068 bytes
2822144       0x2B1000        UEFI PI Firmware Volume, volume size: 417792, header size: 0, revision: 0, Variable Storage, GUID: FFF12B8D-7696-4C8B-85A9-2747075B4F50
2822656       0x2B1200        Intel x86 or x64 microcode, sig 0x000306c1, pf_mask 0x32, 2012-06-14, rev 0x-ffed, size 24576
2847232       0x2B7200        Intel x86 or x64 microcode, sig 0x000306c2, pf_mask 0x32, 2012-10-17, rev 0x-fffa, size 22528
2869760       0x2BCA00        Intel x86 or x64 microcode, sig 0x000306c3, pf_mask 0x32, 2019-02-26, rev 0x0027, size 23552
2915895       0x2C7E37        Certificate in DER format (x509 v3), header length: 4, sequence length: 1552
2917495       0x2C8477        Certificate in DER format (x509 v3), header length: 4, sequence length: 1495
2919038       0x2C8A7E        Certificate in DER format (x509 v3), header length: 4, sequence length: 942
2920028       0x2C8E5C        Certificate in DER format (x509 v3), header length: 4, sequence length: 899
2924755       0x2CA0D3        Certificate in DER format (x509 v3), header length: 4, sequence length: 937
2925740       0x2CA4AC        Certificate in DER format (x509 v3), header length: 4, sequence length: 1512
2927416       0x2CAB38        Certificate in DER format (x509 v3), header length: 4, sequence length: 935
3014919       0x2E0107        GIF image data, version "89a", 600 x 260
3021322       0x2E1A0A        Copyright string: "Copyright (C) By Lenovo"
3045644       0x2E790C        GIF image data, version "89a", 546 x 78
3049586       0x2E8872        Copyright string: "Copyright (C) By Lenovo"
3239936       0x317000        UEFI PI Firmware Volume, volume size: 167936, header size: 0, revision: 0, GUID: 00504624-8A59-4EEB-0FBD-6B36E96128E0
3244418       0x318182        Certificate in DER format (x509 v3), header length: 4, sequence length: 1552
3246018       0x3187C2        Certificate in DER format (x509 v3), header length: 4, sequence length: 1495
3247561       0x318DC9        Certificate in DER format (x509 v3), header length: 4, sequence length: 942
3248551       0x3191A7        Certificate in DER format (x509 v3), header length: 4, sequence length: 899
3249630       0x3195DE        Certificate in DER format (x509 v3), header length: 4, sequence length: 937
3250615       0x3199B7        Certificate in DER format (x509 v3), header length: 4, sequence length: 1512
3252203       0x319FEB        Certificate in DER format (x509 v3), header length: 4, sequence length: 935
3407872       0x340000        UEFI PI Firmware Volume, volume size: 786432, header size: 0, revision: 0, EFI Firmware File System, GUID: 7A9354D9-0468-444A-CE81-0BF617D890DF
3408032       0x3400A0        Microsoft executable, portable (PE)
3418016       0x3427A0        Microsoft executable, portable (PE)
3444000       0x348D20        Microsoft executable, portable (PE)
3444639       0x348F9F        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
3461536       0x34D1A0        Microsoft executable, portable (PE)
3464896       0x34DEC0        Microsoft executable, portable (PE)
3472976       0x34FE50        SHA256 hash constants, little endian
3512024       0x3596D8        SHA256 hash constants, little endian
3681600       0x382D40        Microsoft executable, portable (PE)
3686848       0x3841C0        SHA256 hash constants, little endian
3767104       0x397B40        Microsoft executable, portable (PE)
3775808       0x399D40        Microsoft executable, portable (PE)
3788872       0x39D048        SHA256 hash constants, little endian
3818528       0x3A4420        Microsoft executable, portable (PE)
3852448       0x3AC8A0        Microsoft executable, portable (PE)
3856928       0x3ADA20        Microsoft executable, portable (PE)
3859104       0x3AE2A0        Microsoft executable, portable (PE)
3874912       0x3B2060        Microsoft executable, portable (PE)
3877600       0x3B2AE0        Microsoft executable, portable (PE)
3880224       0x3B3520        Microsoft executable, portable (PE)
3881280       0x3B3940        Microsoft executable, portable (PE)
3883936       0x3B43A0        Microsoft executable, portable (PE)
3896128       0x3B7340        Microsoft executable, portable (PE)
3910048       0x3BA9A0        Microsoft executable, portable (PE)
3910912       0x3BAD00        Microsoft executable, portable (PE)
3913184       0x3BB5E0        Microsoft executable, portable (PE)
3916352       0x3BC240        Microsoft executable, portable (PE)
3949608       0x3C4428        SHA256 hash constants, little endian
3967040       0x3C8840        Microsoft executable, portable (PE)
4017216       0x3D4C40        Microsoft executable, portable (PE)
4028576       0x3D78A0        Microsoft executable, portable (PE)
4030016       0x3D7E40        Microsoft executable, portable (PE)
4033184       0x3D8AA0        Microsoft executable, portable (PE)

root@workstation:/home/chairman/Dokumente/CH341A# flashrom --programmer ch341a_spi -r bios_right_chip.bin  -c MX25L3273E
flashrom  on Linux 5.3.0-3-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L3273E" (4096 kB, SPI) on ch341a_spi.
Reading flash... done.
root@workstation:/home/chairman/Dokumente/CH341A# flashrom --programmer ch341a_spi -v bios_right_chip.bin  -c MX25L3273E
flashrom  on Linux 5.3.0-3-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L3273E" (4096 kB, SPI) on ch341a_spi.
Verifying flash... VERIFIED.

root@workstation:/home/chairman/Dokumente/CH341A# flashrom --programmer ch341a_spi -r me_left_chip.bin -c MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F
flashrom  on Linux 5.3.0-3-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" (8192 kB, SPI) on ch341a_spi.
Reading flash... done.
root@workstation:/home/chairman/Dokumente/CH341A# flashrom --programmer ch341a_spi -v me_left_chip.bin -c MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F
flashrom  on Linux 5.3.0-3-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" (8192 kB, SPI) on ch341a_spi.
Verifying flash... VERIFIED.

 

Ahoy.

I got the T540p as well, but the version including a NVIDIA GT730M card. But unfortunately i'm not able to find the BIOS chip there.

Does someone know where it is located on this version of the T540p?