hamishcoleman/thinkpad-ec

Infrastructure for examining and patching Thinkpad embedded controller firmware

COMPATIBILTY WARNING:

As the result of CVE-2019-6171, newer Lenovo firmware update files have added a digital signature. If you upgrade to locked version you will not be able to patch your EC without downgrading it.

laptop	last modifiable	first protected version
t430	BIOS 2.81 (G1ETC1WW) EC 1.13 (G1HT35WW)	BIOS 2.82 (G1ETC2WW) EC 1.14 (G1HT36WW)
t430s	BIOS 2.75 (G7ETB5WW) EC 1.16 (G7HT39WW)	BIOS 2.76 (G7ETB6WW) EC 1.16 (G7HT40WW)
t530, t530i	BIOS 2.76 (G4ETB6WW) EC 1.13 (G4HT39WW)	BIOS 2.77 (G4ETB7WW) EC 1.14 (G4HT40WW)
w530	BIOS 2.75 (G5ETB5WW) EC 1.13 (G4HT39WW)	BIOS 2.76 (G5ETB6WW) EC 1.14 (G4HT40WW)
x230	BIOS 2.75 (G2ETB5WW) EC 1.14 (G2HT35WW)	BIOS 2.77 (G2ETB7WW) EC 1.15 (G2HT36WW)
x230t	BIOS 2.73 (GCETB3WW) EC 1.14 (GCHT25WW)	BIOS 2.75 (GCETB5WW) EC 1.15 (GCHT26WW)

Basically, any BIOS update package where the changelog mentions CVE-2019-6171 will have this lockdown.

Lenovo is tracking their response to this CVE at: https://support.lenovo.com/gb/en/solutions/len-27764

If you upgraded your BIOS to the locked version:

• Ensure that downgrading is possible in BIOS settings (Security/UEFI BIOS Update Option/Secure Rollback Prevention -> Disable)
• Downgrade it to the latest supported version. EC will be automatically downgraded as well

Intro

The main purpose of this software is to patch the EC on xx30 series thinkpads to make the classic 7-row keyboards work. There are also patches included (but disabled by default) to disable the authentic battery validation check.

With the patches included here, you can install the classic keyboard hardware on many xx30 series laptops and make almost every key work properly. The only keys that are not working are Fn+F3 (Battery) and Fn+F12 (Hibernate).

The xx30 keyboards do not have a Caps Lock Indicator and the motherboard has no hardware support for a Caps Lock Indicator, so the replacement classic keyboard will never turn on the Indicator on any laptop.

• A full writeup of the hardware modifications needed can be found at: http://www.thinkwiki.org/wiki/Install_Classic_Keyboard_on_xx30_Series_ThinkPads

• More information for hacking on this can be found in the HACKING doc.

• A video presenting how these thinkpad laptops were hacked is online: https://www.youtube.com/watch?v=Fzmm87oVQ6c

• Reverse engineering details for the L430, L530, B580, V480, V480c, V580, V580c and E330 models can be found in the thinkpad-Lx30-ec project. Patches for patching the genuine battery check on these have been contributed from that project. (These all have an Nuvotron EC, with a different architecture to the original "classic" thinkpad models).

Step-by-step instructions:

This software expects to be run under Linux (real Linux, not Microsoft Windows Linux subsystem). For best results, ensure you have updated your BIOS to a recent version before starting. If there is too large a difference between the BIOS and EC versions then the flash process will not complete.

A little more detail about the BIOS versions: It is not so much a question about upgrading to a recent BIOS version, but more of ensuring you are using a compatible EC firmware version. For safety, ensure that the EC version you are running is the same as the EC version used by the patched image you build. The version used to build the patch is shown at the end of the build process and during the pre-flash warning message.

1. Ensure you have installed the minimum required packages On Debian, this can be done with:

   sudo apt-get update
   sudo apt-get install make git
   

   On Fedora, you could install it with dnf:

   sudo dnf install git mtools openssl-devel
   sudo dnf group install "C Development Tools and Libraries"
   

   On OpenSUSE, try:

   sudo zypper in git mtools libressl-devel
   

2. Clone a copy of this repo on to your computer:

   cd ~/
   git clone https://github.com/hamishcoleman/thinkpad-ec
   

3. Change to the directory created by the clone:

   cd ~/thinkpad-ec
   

4. Install the prerequisite packages On Debian, this can be done with:

   sudo make build-deps
   

5. Show the list of laptops and USB image file names:

   make list_laptops
   

6. Choose your laptop model name from the list shown. E.G. "patched.x230.img" for a x230 laptop.

7. Optionally, the configuration can be changed from the defaults at this point. Read the CONFIG doc for details of the available config options.

8. Using the name chosen in the previous step, make the fully patched image for this laptop (this will download the original file from Lenovo and patch it):

   make patched.x230.img
   

9. Insert your USB stick and determine what device name it has. (Note: chose a USB stick with nothing important on it, it will be erased in the next step) This command should help you find the right device:

   lsblk -d -o NAME,SIZE,LABEL
   

   Note: Do not mount the USB stick. If your desktop environment automatically mounts devices for you, you will need to unmount the stick. You may find that using the "Eject" option does not work as it may turn the power off to the stick, which will stop the next step from working.

10. Write the bootable patched image onto the USB stick device (replace the "sdx" in this command with the correct name for your usb stick)

    WARNING: if you do not have the right device name, you might overwrite your hard drive!

    sudo dd if=patched.x230.img of=/dev/sdx bs=4M status=progress conv=fsync
    

Your USB stick is now ready to boot and install the patched firmware.

Notes:

• You can also create a bootable CDROM image for burning to a disk by asking for a ".iso" file instead of the ".img" in step 6 above. Then you can use your normal CDROM burning tools to put this image on a blank cd and boot it up, skipping steps 7 and 8.

• The configuration is applied during the building of the patched image. If you wish to change the configuration, the patched image will need to be rebuilt.

Booting the stick and flashing the firmware:

While flashing the firmware is as simple as booting the USB stick created above, there are a couple of steps that can help the process. This is more a list of issues that the community has discovered as the patch was applied in different circumstances than a hard and fast set of requirements.

The flashing process takes place in two distinct steps (these are outlined below, but explained in more detail in firmware_flashing doc)

1. Booting the USB stick:

   • First shows a page with information about the patch, including which laptop type it was built for.
   • Then it hands the new EC update to the BIOS, "staging" it for a future flashing into the EC hardware
   • Finally it reboots the system.

2. Under the BIOS control, during a bootup:

   • During the boot, the BIOS notices that it has a new EC update staged
   • It then checks if it is safe to flash this update to the EC.
   • If everything is safe, it will show a screen saying "Flashing EC"
   • The system will bootup normally with the new EC code running.

If you don't see this second screen with the "Flashing EC" message, your EC has not been flashed, and you should continue reading below to see what steps you can take to ensure the EC is properly flashed with the patched firmware. In this cases everything might look like it was successful but after the reboot the keys are not remapped.

• For best results, ensure you have the power charger plugged in during the flashing process.

  • Some chargers seem to have issues with actually performing the flashing procedure after the flash process reboots. So, if you have - or can borrow - other chargers, try that.

• The firmware flash process generally requires you to have a charged battery plugged in to the laptop before it will complete.

  • It may be possible to bypass the requirement for a charged battery if you unplug the battery completely.
  • Alternatively, it might be simply looking for any battery /and/ the power charger plugged in.

  Yes, this is contradictory, but it is worth trying both options.

• An ultrabay battery is not considered by the update mechanism to be a suitable source of power - when trying different battery options, ensure you are trying batteries in the main battery slot.

• Ensure your BIOS has been configured to boot from "Legacy" and not "UEFI" before trying to boot.

• If you do normally use UEFI boot, there has been at least one case where the EC does not get flashed until the BIOS is switched back into UEFI mode - after which the EC was automatically flashed on the next reboot.

thinkpad-ec's Issues

Whitelist

Can this project be expanded to whitelist cards, or even unlock overclock?
I can provide the changes needed on the FL1 file.

T430s new BIOS 2.69

Lenovo has recently released a new BIOS for the T430s. 2.69. this replaces the 2.67 version I currently have running on my Thinkpad. It seems it includes new Embedded Controller Firmware. I have the battery validator check patched and this update would probably remove that. Can we see an updated script for 2.69 for the T430s?

thank you.

https://pcsupport.lenovo.com/de/en/products/LAPTOPS-AND-NETBOOKS/THINKPAD-T-SERIES-LAPTOPS/THINKPAD-T430S/downloads/DS029725

T530 support?

Just found this beautiful repo. Any plans to add T530 support?

Does FN+Space still control the light on x230 with the EC firmware flashed?

I have installed the x220 keyboard into my x230 but I have not flashed the EC firmware mod yet. Right now, the FN+Space controls my Thinklight, which I really do like. My question then is, if I flash the EC firmware, will my FN+Space still work afterwards and control my Thinklight?

x230 BIOS 2.70

I have my thinkpad updated to the latest version. The bootable image that was made automatically wouldnt proceed - BIOS flash utility said it didn't match the hardware. The bios ISO is g2uj26us.iso. I can take a whack at it if I have an outline of the procedure.

Upgrade from SHA1 to SHA2-256 for checksums

This would provide cryptographically strong checksums. Alongside with OpenPGP signatures on commits and tags (my PRs are signed) this would improve the overall authenticity of files downloaded from remote servers. (OK, git still relays on SHA1 but that will hopefully get fixed one day).

Would you be ok with that? Can I do this?

W530 modification not working

Yesterday I found this wonderful project. I applied W530 EC update, which I built by marking 001-005 to .OFF and enabled 006 by removing .OFF. I build the image and followed the output and 006 patch was applied properly.

After this I rebooted from the USB and EC update was programmed and after reboot laptop programmed EC firmware with high fan speed as normally.

My 9 cell battery works normally (which was working before), but third party 6-cell battery which was the reason why I made the modification, is still not working. I'm not getting any warnings / messages about non-Lenovo battery, but battery is not charging.

If I power off the laptop, put 6-cell battery in and then insert power supply, green led is blinking couple times, then orange led starts blinking "slow" and after couple blinks it starts to blink faster. After blinking for a while it blinks once in green again and then all led activity stops.

In Windows battery state is 0% and after inserting the battery it shows for maybe 2 seconds that it's charging, but then stops and just shows that battery with 0% is inserted but it's not charging.

Any ideas? Could this be a faulty battery or could it be that I need to adjust acpi battery limits to get the battery charging (if it's on too low voltage)?

Sorry about the long report and thanks from this great project!

latest update placed t430 info into t430s sections

I left comments on the code. i dont know how to use github, but i hope it can be resolved easily

Broken filename during flash

Hey,

I just created a W530 image according to the README (tried both .iso and .img), but flashing fails.

"This disc will flash the file "

dosflash /sd /ipf ec /file \

That backslash can't be right.

X230 keyboard in X220

Hi,

So I've been happily using these patches for a while to use an X220 keyboard in my X230.

I have a friend who uses an X220, who has a problem with their keyboard, and instead of getting a new one, I thought it would be nice if I could reuse the X230 keyboard that came with my laptop (which I still have) in their X220 (which I think they would be inclined to prefer anyway).

Now I don't have a good understanding of the mechanics of how the stuff in this repository works, but is it possible that this would be a simple thing to do with what's already there?

Documentation unclear

Hi,

when cloning the thinkpad-ec repo the files in mec-tools are not downloaded. The files files have to be downloaded seperately.

Best Regards

Thomas

Port battery validation patch to other machines

Hello and thank you very very much for this project! I'm going to upgrade to a W530 just for this reason :)

However for the far future I see problems with battery availability from Lenovo. You have Zmatt's patch for the X230 in your repo, but only for that machine. Cold the same be ported to other machines? Or would that involve different or hard to find offsets?

Thanks!

Patch for L430

Edit: Ignore the issue. Now I've read the readme carefully and found the answer.

Hi!

I've been reading through the info here and at zmatt's original post. I've tried to replicate the process for my L430, but I cannot find a FL2 file for this model. Also, I failed to decrypt the FL1 file using his method.

In all the available BIOS updates (http://pcsupport.lenovo.com/no/en/products/laptops-and-netbooks/thinkpad-l-series-laptops/thinkpad-l530/downloads/ds029124) there are only FL1 files. It makes no sense to me that the ECP version changes with some updates, without it actually including an FL2 file for it? Could it be that the ECP firmware is encoded in the FL1 file for these models? If so how could the patches be reproduced?

Thanks in advance

T430s - Make failed

Getting error with "make patched.t430s.img"

Here is the output:

https://i.imgur.com/eKsZ4kq.png

Any solution?

I am using T430s and the bios is 2.70.

Thanks.

How to repatch EC for keyboard after patching battery and keyboard

Hello.
Half a day trying to get a 55+ battery to work. everything worked out.
did it in Ubuntu 17.10
but, unfortunately, the keyboard functions changed. how to get the working keyboard back. t430 (fn + hot keys)
for example now Fn+ Del - turn on keyboard backlight (original Fn + Space)

I think I did something in vain - after the patch I updated the BIOS to 2.75. I thought that the EU would recover.
Now I have a bios of 2.75 and patches on the keyboard and battery.
So, how to unpach EC but leave 55+ battery working?
Thanks

==I have to do next? -
make patch_enable_battery clean
make patch_disable_keyboard clean
make patched.t430.img

t430s: BIOS 2.70/2.67 seem to result in unresponsive keyboard

I've tried both 2.70 and 2.67, it seems that the keyboard is utterly unresponsive (aside from the power switch and power/mute LEDs) once the patch is applied. Disappointingly, applying an unpatched version does not seem to fix this issue.

My board happily claims to apply to EC update, including the reboot and "applying EC firmware" stage...

This really feels like a hardware problem, but the only thing I did before the failure was apply this patch. If it helps, I can manually reflash to 2.6x (2.70 prevents software-based downgrades) and attempt again, but I figured I'd open an issue in order to see if anyone else has had a similar problem first.

7-Row keyboard trackpoint non-functional

Following the recommended procedure, where pins 25, 27, and 29 are covered on the X220 keyboard's internal connector, the trackpoint buttons do not work with the X220 keyboard on an X230.

Instruction wrong?

Says here that a T420 palmrest can be used: https://www.thinkwiki.org/wiki/Install_Classic_Keyboard_on_xx30_Series_ThinkPads#The_replacement_.28T430.29

But a video contradicting the info can be found here: https://www.youtube.com/watch?v=V74pSO8of4M

I am about to buy a 7-row keyboard for T430, but unsure if I should get anything else.

Thoughts?

Thanks in advance.

T430 2.72 bios

Hi folks, I updated my BIOS to last one
(dmesg msg:
[ 0.000000] DMI: LENOVO 2349GCG/2349GCG, BIOS G1ETB2WW (2.72 ) 01/31/2017
)

But found out that battery patch for it from previous version is not applycable:
(I just replcaed filename for iso of bios that is downloaded and used)

./hexpatch.pl t430.G1HT35WW.img t430.G1HT35WW.img.d/*.patch
Attempting to patch t430.G1HT35WW.img
Address 115504 mismatched data
The binaryfile does not match the context bytes from t430.G1HT35WW.img.d/006_battery_validate.patch

How to approach this?

Does this work with non US layouts?

I'm considering getting a Japanese layout keyboard because of the extra modifiers, will this work with other layouts or just US?

X230 whitelist thirdparty battery

As described the problem previously in ticket x230 BIOS 2.70
I continued my try to patch my bios

As suggested by Hamishcoleman I have installed git in my portable USB still I could not get the completed iso patch file. Here is the message shown

mint@mint ~/thinkpad-ec $ make patched.x230.img
./scripts/generate_deps Descriptions.txt >.d/generated.deps
Downloading x230 BIOS 2.66 (G2ETA6WW) EC 1.14 (G2HT35WW)
wget -O g2uj23us.iso.orig https://download.lenovo.com/pccbbs/mobiles/g2uj23us.iso
--2018-02-06 01:59:32-- https://download.lenovo.com/pccbbs/mobiles/g2uj23us.iso
Resolving download.lenovo.com (download.lenovo.com)... 23.35.220.108
Connecting to download.lenovo.com (download.lenovo.com)|23.35.220.108|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 33927168 (32M) [application/octet-stream]
Saving to: ‘g2uj23us.iso.orig’

g2uj23us.iso.orig 100%[===================>] 32.36M 2.01MB/s in 19s

2018-02-06 01:59:51 (1.69 MB/s) - ‘g2uj23us.iso.orig’ saved [33927168/33927168]

scripts/checksum --rm_on_fail g2uj23us.iso.orig g2uj23us.iso
touch g2uj23us.iso.orig
./scripts/ISO_copyFL2 from_iso g2uj23us.iso.orig x230.G2HT35WW.s01D3000.FL2.orig 01D3000.FL2
git submodule update --init --remote
Submodule 'mec-tools' (https://github.com/eigenmatt/mec-tools) registered for path 'mec-tools'
Cloning into 'mec-tools'...
remote: Counting objects: 29, done.
remote: Total 29 (delta 0), reused 0 (delta 0), pack-reused 29
Unpacking objects: 100% (29/29), done.
Checking connectivity... done.
Submodule path 'mec-tools': checked out '07a1b1407326488376afed6c596d37c53d7432b6'
git submodule update
make -C mec-tools
make[1]: Entering directory '/home/mint/thinkpad-ec/mec-tools'
cc -Wall -O2 mec_csum_boot.c -o mec_csum_boot
mec_csum_boot.c:5:19: fatal error: stdio.h: No such file or directory
compilation terminated.
Makefile:8: recipe for target 'mec_csum_boot' failed
make[1]: *** [mec_csum_boot] Error 1
make[1]: Leaving directory '/home/mint/thinkpad-ec/mec-tools'
Makefile:275: recipe for target 'mec-tools/mec_encrypt' failed
make: *** [mec-tools/mec_encrypt] Error 2

Flash goes through on X230 but keys are the same

Edit: Disregard! It was my damn charger. The charger was the legit one that came with the laptop and was charging but it would not flash while charging. I used my generic one and that did the trick!

I constructed the image following the instructions to the letter in arch linux. I then enabled legacy boot mode in order to boot the drive. It booted and flashed everything fine. It showed the patch in there before it flashed. I've done this about three times now. I switched back to UEFI mode afterword and rebooted several times. My keys did not change. Is there something I am missing or something I can check? I'm on bios version 2.7.

Edit: Decided to put some more detail in here. I've currently remade the boot usb and am flashing my ec again. Everything looks good. There are three patches applied. x230...dead keys, x230... replacements, and x230 key swap. Image flashing done. Ok. Switching back to UEFI boot. Keys Don't work. Rebooting. Keys don't work. All the keys are still x230 keys.

Anyway, I'm going to include the log of all the processes I did to make the image. I'd love to hear if you have any ideas about this. Thanks.

[matt@brobox ~]$ git clone https://github.com/hamishcoleman/thinkpad-ec
Cloning into 'thinkpad-ec'...
remote: Counting objects: 1254, done.
remote: Total 1254 (delta 0), reused 0 (delta 0), pack-reused 1254
Receiving objects: 100% (1254/1254), 591.80 KiB | 2.47 MiB/s, done.
Resolving deltas: 100% (770/770), done.
[matt@brobox ~]$ cd thinkpad-ec/
[matt@brobox thinkpad-ec]$ make list_laptops
./scripts/generate_deps Descriptions.txt >.d/generated.deps

The following make targets are the supported usb images:

patched.t430.img\t- for patching Thinkpad T430
patched.t430s.img\t- for patching Thinkpad T430s
patched.t530.img\t- for patching Thinkpad T530
patched.t530i.img\t- for patching Thinkpad T530i
patched.w530.img\t- for patching Thinkpad W530
patched.x230.img\t- for patching Thinkpad X230
patched.x230t.img\t- for patching Thinkpad X230t

[matt@brobox thinkpad-ec]$ make patched.x230.img
Downloading x230 BIOS 2.66 (G2ETA6WW) EC 1.14 (G2HT35WW)
wget -O g2uj23us.iso.orig https://download.lenovo.com/pccbbs/mobiles/g2uj23us.iso
--2018-01-15 07:08:39--  https://download.lenovo.com/pccbbs/mobiles/g2uj23us.iso
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving download.lenovo.com... 23.49.15.137
Connecting to download.lenovo.com|23.49.15.137|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 33927168 (32M) [application/octet-stream]
Saving to: ‘g2uj23us.iso.orig’

g2uj23us.iso.orig           100%[========================================>]  32.36M  4.67MB/s    in 7.4s    

2018-01-15 07:08:47 (4.35 MB/s) - ‘g2uj23us.iso.orig’ saved [33927168/33927168]

scripts/checksum --rm_on_fail g2uj23us.iso.orig g2uj23us.iso
touch g2uj23us.iso.orig
./scripts/ISO_copyFL2 from_iso g2uj23us.iso.orig x230.G2HT35WW.s01D3000.FL2.orig 01D3000.FL2
git submodule update --init --remote
Submodule 'mec-tools' (https://github.com/eigenmatt/mec-tools) registered for path 'mec-tools'
Cloning into '/home/matt/thinkpad-ec/mec-tools'...
Submodule path 'mec-tools': checked out '07a1b1407326488376afed6c596d37c53d7432b6'
git submodule update
make -C mec-tools
make[1]: Entering directory '/home/matt/thinkpad-ec/mec-tools'
cc -Wall -O2 mec_csum_boot.c -o mec_csum_boot 
cc -Wall -O2 mec_csum_flasher.c -o mec_csum_flasher 
cc -Wall -O2 mec_csum_outer.c -o mec_csum_outer 
cc -Wall -O2 mec_encrypt.c -o mec_encrypt -lcrypto
make[1]: Leaving directory '/home/matt/thinkpad-ec/mec-tools'
./scripts/FL2_copyIMG from_fl2 x230.G2HT35WW.s01D3000.FL2.orig x230.G2HT35WW.img.enc.tmp
IMG at offset 0x500000 size 0x30000 (FL2::prefix_ff x230.G2HT35WW.s01D3000.FL2.orig)
mec-tools/mec_encrypt -d x230.G2HT35WW.img.enc.tmp x230.G2HT35WW.img.orig.tmp
mec-tools/mec_csum_flasher -c x230.G2HT35WW.img.orig.tmp
64c4 64c4 OK
mec-tools/mec_csum_boot -c x230.G2HT35WW.img.orig.tmp
b4b73a78 b4b73a78 OK
f02cdcf8 f02cdcf8 OK
3ff064dd 3ff064dd OK
40da02e2 40da02e2 OK
rm x230.G2HT35WW.img.enc.tmp
mv x230.G2HT35WW.img.orig.tmp x230.G2HT35WW.img.orig
cp --reflink=auto x230.G2HT35WW.img.orig x230.G2HT35WW.img
./scripts/hexpatch.pl --rm_on_fail --report x230.G2HT35WW.img.report x230.G2HT35WW.img x230.G2HT35WW.img.d/*.patch
Attempting to patch x230.G2HT35WW.img
Applying x230.G2HT35WW.img.d/001_keysym.patch keysym
Applying x230.G2HT35WW.img.d/002_dead_keys.patch dead_keys
Applying x230.G2HT35WW.img.d/003_keysym_replacements.patch keysym_replacements
Applying x230.G2HT35WW.img.d/004_fn_keys.patch fn_keys
Applying x230.G2HT35WW.img.d/005_fn_key_swap.patch fn_key_swap
./scripts/xx30.encrypt x230.G2HT35WW.img x230.G2HT35WW.img.enc.tmp
+ cd mec-tools
+ ./mec_repack ../x230.G2HT35WW.img ../x230.G2HT35WW.img.enc.tmp
building ../x230.G2HT35WW.img.enc.tmp from ../x230.G2HT35WW.img
b4b73a78 b4b73a78 OK
f02cdcf8 f02cdcf8 OK
3ff064dd 3ff064dd OK
40da02e2 6d3996cc FIXED
64c4 7ac6 FIXED
98e8 a614 FIXED

reverifying
a614 a614 OK
7ac6 7ac6 OK
b4b73a78 b4b73a78 OK
f02cdcf8 f02cdcf8 OK
3ff064dd 3ff064dd OK
6d3996cc 6d3996cc OK
cp --reflink=auto x230.G2HT35WW.s01D3000.FL2.orig x230.G2HT35WW.s01D3000.FL2.tmp
./scripts/FL2_copyIMG to_fl2 x230.G2HT35WW.s01D3000.FL2.tmp x230.G2HT35WW.img.enc.tmp
IMG at offset 0x500000 size 0x30000 (FL2::prefix_ff x230.G2HT35WW.s01D3000.FL2.tmp)
rm x230.G2HT35WW.img.enc.tmp
mv x230.G2HT35WW.s01D3000.FL2.tmp x230.G2HT35WW.s01D3000.FL2
echo "Buildinfo: v1-201-gceb0fe (20180115) patched.x230.img" >x230.G2HT35WW.s01D3000.FL2.report
echo "Built: `sha1sum x230.G2HT35WW.s01D3000.FL2`" >>x230.G2HT35WW.s01D3000.FL2.report
echo "" >>x230.G2HT35WW.s01D3000.FL2.report
cat x230.G2HT35WW.img.report >>x230.G2HT35WW.s01D3000.FL2.report
sed -e "s%__DIR%`mdir -/ -b -i g2uj23us.iso.orig@@71680 |grep FL2 |head -1|cut -d/ -f3`%; s%__FL2%`mdir -/ -b -i g2uj23us.iso.orig@@71680 |grep FL2 |head -1|cut -d/ -f4`%" autoexec.bat.template >g2uj23us.iso.bat.tmp
mv g2uj23us.iso.bat.tmp g2uj23us.iso.bat
touch -d @1 g2uj23us.iso.bat
cp --reflink=auto g2uj23us.iso.orig g2uj23us.iso.tmp
./scripts/ISO_copyFL2 to_iso g2uj23us.iso.tmp x230.G2HT35WW.s01D3000.FL2 01D3000.FL2
cp x230.G2HT35WW.s01D3000.FL2.report g2uj23us.iso.report
echo "" >>g2uj23us.iso.report
echo "Description: `scripts/describe g2uj23us.iso`" >>g2uj23us.iso.report
mcopy -t -m -o -i g2uj23us.iso.tmp@@71680 g2uj23us.iso.report ::report.txt
mcopy -t -m -o -i g2uj23us.iso.tmp@@71680 g2uj23us.iso.bat ::AUTOEXEC.BAT
mdel -i g2uj23us.iso.tmp@@71680 ::EFI/Boot/BootX64.efi
mv g2uj23us.iso.tmp g2uj23us.iso
mv g2uj23us.iso patched.x230.iso
mv g2uj23us.iso.report patched.x230.iso.report


Your build has completed with the following details:

Buildinfo: v1-201-gceb0fe (20180115) patched.x230.img
Built: bb3419027a915cf3dbbaf91f857211bdfda5625e  x230.G2HT35WW.s01D3000.FL2

Patches applied:
x230.G2HT35WW.img.d/001_keysym.patch x230.G2HT35WW.img.d/002_dead_keys.patch
x230.G2HT35WW.img.d/003_keysym_replacements.patch
x230.G2HT35WW.img.d/004_fn_keys.patch x230.G2HT35WW.img.d/005_fn_key_swap.patch

Description: x230 BIOS 2.66 (G2ETA6WW) EC 1.14 (G2HT35WW)
./scripts/geteltorito -o patched.x230.img.tmp patched.x230.iso
Booting catalog starts at sector: 20 
Manufacturer of CD: NERO BURNING ROM
Image architecture: x86
Boot media type is: harddisk
El Torito image starts at sector 27 and has 65536 sector(s) of 512 Bytes

Image has been written to file "patched.x230.img.tmp".
./scripts/fix_mbr patched.x230.img.tmp
mv patched.x230.img.tmp patched.x230.img


Your build has completed with the following details:

Buildinfo: v1-201-gceb0fe (20180115) patched.x230.img
Built: bb3419027a915cf3dbbaf91f857211bdfda5625e  x230.G2HT35WW.s01D3000.FL2

Patches applied:
x230.G2HT35WW.img.d/001_keysym.patch x230.G2HT35WW.img.d/002_dead_keys.patch
x230.G2HT35WW.img.d/003_keysym_replacements.patch
x230.G2HT35WW.img.d/004_fn_keys.patch x230.G2HT35WW.img.d/005_fn_key_swap.patch

Description: x230 BIOS 2.66 (G2ETA6WW) EC 1.14 (G2HT35WW)
[matt@brobox thinkpad-ec]$ lsblk
NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda           8:0    0 465.8G  0 disk 
├─sda1        8:1    0   100M  0 part 
└─sda2        8:2    0 465.7G  0 part 
sdb           8:16   0 119.2G  0 disk 
└─sdb1        8:17   0   107G  0 part /
sdc           8:32   1   7.5G  0 disk 
└─sdc1        8:33   1    32M  0 part 
sr0          11:0    1  1024M  0 rom  
mmcblk0     179:0    0   3.7G  0 disk 
└─mmcblk0p1 179:1    0   3.6G  0 part 
[matt@brobox thinkpad-ec]$ sudo dd if=patched.x230.img of=/dev/sdc
65536+0 records in
65536+0 records out
33554432 bytes (34 MB, 32 MiB) copied, 15.1177 s, 2.2 MB/s
[matt@brobox thinkpad-ec]$ 

T430 EC flash, but without using Linux?

Hi,

I have no experience in Linux.

After following this guide: http://www.instructables.com/id/ThinkPad-T430T430sX230-Classic-Keyboard-Mod/

I was able to successfully (physically) fit a 7-row to the T430.

But the issue is that I have 0 experience on UNIX... Only windows...

I see there's option to use .iso to patch the EC, can I burn them to a USB using Rufus and do it that way? Are there specific options in Rufus I must use to make this successful?

Thanks in advance!

Unable to make patched.x230.img

I have been unsuccessful with making the patch with or without custom options for the x230

I did successfully make patches for T430 and x230T to make sure i wasn't missing something

Aswell as testing different builds

Patching image fails, T430

Image has been written to file "patched.t430.img". ./hexpatch.pl patched.t430.img fix-hdd-image.patch Attempting to patch patched.t430.img Address 448 mismatched data The binaryfile does not match the context bytes from fix-hdd-image.patch make: *** [Makefile:210: patched.t430.img] Error 1

I don't know why it's failing. Running Arch.

Mod not working on T430

Hi there, I followed all of the instructions in the Readme, I updated my BIOS using the Lenovo software, and then booted into Linux and followed all the instructions. The EC mod appears to apply the update when I boot, and says the BIOS mod has been completed, but even after rebooting the machine, my keyboard is still mapped to the T430 keyboard functions. Any help would be greatly appreciated!

Lenovo t440s invalid rfid error after flashing ec

Hi
Recently i got a lenovo t440s with svp bios password, i knew that password is encrypted into Ec MEC1633L.
I reflashed it with rt809h programmer, password was gone, but many error appear at startup, even after restoring original EC backup, errors remain.
I know that's bios bad checksum.
I will apologize if someone could help me to fix this issue.
Thanks in advance.

T430s

I bought a w500 FRU 45N2211 keyboard to replace my T430s keyboard. I haven't had any luck remapping the keys via the EC flash. I have followed the steps in the wiki and the readme on the git repo but nothing changes. I have tried on a flash drive and on a CD I get a successful flash message but the key mapping doesn't change. It's almost like I'm just reflashing the stock firmware over the original and not the modified one. Any advice?

bd80d6b breaks builds for me

The change to mcopy ~2 months ago breaks building for me (opensuse Tumbleweed):

touch -d @1 g2uj25us.iso.bat
cp --reflink=auto g2uj25us.iso.orig g2uj25us.iso && ./scripts/copyFL2 to_iso g2uj25us.iso x230.G2HT35WW.s01D3000.FL2 && sed -i "s/__BUILT/sha1sum x230.G2HT35WW.s01D3000.FL2/" g2uj25us.iso.bat && mcopy -m -o -i g2uj25us.iso@@71680 g2uj25us.iso.bat ::AUTOEXEC.BAT && mdel -i g2uj25us.iso@@71680 ::EFI/Boot/BootX64.efi
Error: could not find any FL2 files in g2uj25us.iso
make: *** [Makefile:331: g2uj25us.iso] Error 1

Building from head (89483c4) is a bit less verbose, but same issue:

./scripts/generate_deps Descriptions.txt >.d/generated.deps
./scripts/ISO_copyFL2 from_iso g2uj25us.iso.orig x230.G2HT35WW.s01D3000.FL2.orig 01D3000.FL2
Error: could not find any files in g2uj25us.iso.orig matching 01D3000.FL2
make: *** [.d/generated.deps:33: x230.G2HT35WW.s01D3000.FL2.orig] Error 1

Mod + latest x230 bios causes EC freeze?

I checked out a clean repo to build the EC update and it's using G2ETA8WW / g2uj25us.exe. Has anyone else experienced this problem where the x230 will eventually not respond to the power button?

The lockup happens only after the battery is plugged in for a short amount of time. Holding the power button for 20-30 seconds w/o battery and AC to do the EC reset fixes things temporarily until the next hang, so it is a bit annoying.

I've reverted to using an older bios version (G2ETA6WW / g2uj23us.exe) to build the EC update image and this seems works fine.

Windows compatibility

Hi there.

Thanks for your work. I don't expect you to port it to Windows by any means, but I wanted to ask you whether this could work by running Linux VM in a Windows container, and if so if this should be added to the instructions.

Thanks

X230 EC Won't Flash with 2.70 BIOS

I followed the guide, created a bootable USB stick and booted from it. Once booted, I got the text saying this was my patched X230 BIOS and received the "Press any key to flash" alongside a bunch of text indicating this was a patched image.

I received a notice that the update occurred successfully (this was extremely quick and much shorter than a typical BIOS update). After that I can restart the machine, but I don't get any secondary "flashing update" text that is mentioned in the guide I've followed. Additionally, the keyboard layout doesn't appear to have changed when I boot into the OS. I've tried rebooting several times, cold power off/on, and even flipping the "UEFI/Legacy" boot mode setting.

This is all using the 2.70 BIOS. Has anyone had any success patching the EC firmware from this BIOS version? One thing that has me worried is the notice on the Thinkpad support site:

(Note) If the UEFI BIOS has been updated to version 2.70 or higher, it is no longer able to roll back to the version before 2.70 for security improvement.

Could this (rather recent) BIOS update be affecting the ability to patch the EC firmware?

.FL1 file support

You mention in readme problems with the L530 update. I downloaded it and it seems it has the $PFH trailer which contains names and offsets of the regions included in the file (in the update I downloaded it's at offset 008001D0). I documented the layout here and you can find a sample implementation in theopolis/uefi-firmware-parser@aea0eaf

Revert patched Bios

Hey, is it possible to revert the bios patch that i can use the original x230 Keyboard in my x230 again?

Best regard and thanks for the tool!

Typo

thinkpad-ec/README

Line 71 in ceb0fe1

sudo dd if=patched.x230.img of=/dev/sdx

Is this not supposed to be "patched.x230.iso" rather than "...img"

X230 - Flashed EC firmware causes constant rapid left clicking, disappears with default firmware

I don't have much else to say about this issue, it occurs regardless of operating system and keyboard used (I have several to test with from a couple of broken T410 models) but ONLY when the modified EC firmware is installed.

The classic keyboard works with all applicable hotkeys (volume, mute, media, brightness and function keys), but the left mouse button is being clicked constantly and rapidly. I have the trackpad disabled in the BIOS/UEFI which shouldn't make it a possible cause.

Please let me know if any additional information is required.

Feedback: T430, G1HT35WW battery patch

Hi, this is awesome project!

I've flashed EC on my T430 with G1HT35WW and applied battery patch only. 55+ battery started charging. Do you need some more test or is this sufficient to consider battery patch as tested and working?

Applying other patches

The directory structure and Makefile are very cluttered and complex. I'm trying to figure out how to apply the battery validation patch to a W530 image. Is it sufficient to strip the .OFF from the hexpatch filename? Because I'm still getting the same hash at the end:

echo Built: a8458abd5a26f109517968121b9a16536fd9741b w530.G4HT39WW.s01D5200.FL2

[HACK] How do I make this patch work on model B480

Hello, I'm so glad this project exist. Is there anyway I need to do to make it work on my B480? Just the battery patch would be awesome.

T430s BIOS 2.67

Hello,

Some security changes are made in the later BIOS versions that the script fetches, it fetches 2.65 but the latest on the t430s is 2.67.

Is it possible to change this in the script, and if so, how?

I assume flashing the patched 2.65, then updating to 2.67 the via the intended method wipes the ECU's patches ?

Edit: I may have been ignorant in knowing how the patch works, since i just did it and the BIOS still says it's version 2.67 (with the keyboard patches). So i guess it worked with the latest bios!

T430 revert keyboard patch?

Hello,

I patched my T430 with keyboard and battery patch in place. Works fine!
Now I want to revert the keyboard patch (leaving in place the battery patch).
With no success!

make patch_enable_battery clean
make patch_disable_keyboard clean
make patched.t430.img

"Burn" the image to a USB Stick and boot.
Updating works without noticeable errors, but the keyboard is still patched.

Am I missing something?
Current BIOS version is 2.72.

thanks
Peter

./scripts/fix_mbr with syntax error

Hi,

while creating the patched version for my t430 i ran into problems with the make process.

_Your build has completed with the following details:

Buildinfo: v1-201-gceb0fe-dirty (20180123) patched.t430.img
Built: 649d8b45b94b4fe012f72e08c7de889250545dc0 t430.G1HT35WW.s01D2000.FL2

Patches applied:
t430.G1HT35WW.img.d/006_battery_validate.patch

Description: t430 BIOS 2.72 (G1ETB2WW) EC 1.13 (G1HT35WW)
./scripts/geteltorito -o patched.t430.img.tmp patched.t430.iso
Booting catalog starts at sector: 20
Manufacturer of CD: NERO BURNING ROM
Image architecture: x86
Boot media type is: harddisk
El Torito image starts at sector 27 and has 75776 sector(s) of 512 Bytes

Image has been written to file "patched.t430.img.tmp".
./scripts/fix_mbr patched.t430.img.tmp
syntax error at ./scripts/fix_mbr line 94, near "..."
syntax error at ./scripts/fix_mbr line 97, near "..."
Execution of ./scripts/fix_mbr aborted due to compilation errors.
make: *** [patched.t430.img] Error 255_

In the script ./scripts/fix_mbr the lines 94 and 97 are somewhat strange.

TODO - bit munge things

if ($part->{start_cyl} > 0xff) {
    ...
}
if ($part->{end_cyl} > 0xff) {
    ...
}

best regards

No battery warning but no charging when both keyboard and battery mod are applied to an X230

The discovery story is here https://www.reddit.com/r/thinkpad/comments/80vp6c/help_x230_refuses_to_charge_perfectly_fine

On my X230 the mods work either-or. Keyboard patch works. Battery patch works: no warning, aftermarket battery charges. The superposition has no warning, but no charging.

Battery Patch not working T430

I have run
make patch_enable_battery clean
make patched.t430.img
sudo dd if=patched.t430.img of=/dev/sdc

from make patched.t430.img the output was:

Patches applied:
t430.G1HT35WW.img.d/001_keysym.patch t430.G1HT35WW.img.d/002_dead_keys.patch
t430.G1HT35WW.img.d/003_keysym_replacements.patch
t430.G1HT35WW.img.d/004_fn_keys.patch t430.G1HT35WW.img.d/005_fn_key_swap.patch
t430.G1HT35WW.img.d/006_battery_validate.patch

but still when booting with the usb-Stick, I get something like this:
Patches applied:

t430.G1HT35WW.img.d/001_keysym.patch t430.G1HT35WW.img.d/002_dead_keys.patch
t430.G1HT35WW.img.d/003_keysym_replacements.patch
t430.G1HT35WW.img.d/004_fn_keys.patch t430.G1HT35WW.img.d/005_fn_key_swap.patch

Any ideas how to apply this patch when booting with the USB-Stick?

How to undo a T430 mod?

Hi there, I was wondering how I can undo the mod on a T430? I'm selling my T430 and was planning on putting the original keyboard back in, is it possible to undo the mod so the correct function keys for the T430 layout are recognized?

W530 does not charge above some level

Hello :)
I applied your hack to my BIOS and I can succesfully boot to Windows, but my battery charges slower and slower and cannot get above like 75%.
I have battery with exceeded capacity.

Want to flash but already have the new firmware (G7HT39WW)

When trying to flash the EC with the .iso (modded or unmodded), I'm not prompted to flash the firmware, probably because it's already the newest. Is there a different way? I really want the classic keyboard mod.

Modding EC with latest Bios

Lenovo updated most of their BIOS for most of their business models, because of a security issue. How do I adapt the build process to use the latest BIOS version (g5uj29us for my W530)? Or does this patch just flash the EC and leaves the rest as is?
I was reading the thread on forum.thinkpads.com and was trying to find information at github, but to no avail.

Flashed wrong BIOS

Hi I flashed the BIOS for the wrong model. I know that was a very stupid thing to do but I got our computers confused. I was wondering if there's a way to flash the original back so the computer will work again. I tried using the Insyde BIOS recovery but I'm not sure I did it correctly.

Made a flash drive FAT and renamed the .fl1 file to BIOS.WPH. Held Fn and R and nothing ever happened. Please help if anyone knows how to fix this. Thank you. The computer is an X230 by the way.

X230 bios 2.68

Hi, there is new bios update on lenovo site