Contribute
Register

[Guide] Lenovo G50-70 and Z50-70 Bios whitelist removal

Joined
Oct 21, 2012
Messages
206
Motherboard
Gigabyte GA-B85M-HD3 - F12
CPU
i5-4460
Graphics
GT 710
Mac
  1. iMac
Mobile Phone
  1. Android
  2. iOS
There may even be a possibility to create a script that will automatically do this. Whatever the model is....

Code:
UEFIFind imagefile {header | body | all} {list | count} pattern
UEFIExtract imagefile GUID_1 ... [ -o FILE_1 ... ] [ -m MODE_1 ... ] [ -t TYPE_1 ... ]

But I don't have time to deal with that.
 
Last edited:
Joined
Nov 16, 2015
Messages
194
Motherboard
Lenovo G50-70-Clover
CPU
i5-4210U
Graphics
HD 4400 1920x1080
Mac
  1. MacBook Air
  2. MacBook Pro
Mobile Phone
  1. Android
There may even be a possibility to create a script that will automatically do this. Whatever the model is....

Code:
UEFIFind imagefile {header | body | all} {list | count} pattern
UEFIExtract imagefile GUID_1 ... [ -o FILE_1 ... ] [ -m MODE_1 ... ] [ -t TYPE_1 ... ]

But I don't have time to deal with that.
Each bios have a different implementation, a script is not enough to get all the job done.
 
Joined
Oct 21, 2012
Messages
206
Motherboard
Gigabyte GA-B85M-HD3 - F12
CPU
i5-4460
Graphics
GT 710
Mac
  1. iMac
Mobile Phone
  1. Android
  2. iOS
Each bios have a different implementation, a script is not enough to get all the job done.
I was thinking of Lenovo models where the insyde BIOS all have string of “Unauthorized Wireless network card is plugged in” and also 74 to EB to be modified..

Thanks for the Donovoan link.
 
Last edited:
Joined
Feb 21, 2020
Messages
1
Motherboard
Laptop make & model # > See Rules!
CPU
i5-4200U
Graphics
HD 4400
Mobile Phone
  1. Android
hi, i have problem with thise guide
evrything gonna be ok except final work - trying to flash the bios on lenovo (g50-70)

when i tried to flash modified bios (on windows 10) i get:
Error 366: fail to load driver (PCI access for windows)
Tool needs to run with an administrator priviledge account.

im running administrator account,
im Running command line aa Administrator, i check flash program in properties to run as administrator

what can i do? anyone can help me? where i can get the newest version of intel flash programming tool ?
 
Joined
Oct 21, 2012
Messages
206
Motherboard
Gigabyte GA-B85M-HD3 - F12
CPU
i5-4460
Graphics
GT 710
Mac
  1. iMac
Mobile Phone
  1. Android
  2. iOS
A few days ago a new board for the g50-70 arrived at my place from ebay. There was no Mac Address, UUID, serial, Computer Model ... in the Bios.

"9acn28ww" installed ...i downgrade it to version 9ACN26WW - then used same sleep bug to clone my old motheboard - backup of bios.bin

Now i have two laptops with cloned bios - with identical serial, UUID... macOS works perfectly on both.

Otherwise I have a couple of bios chips in reserve if i bricked Bios - i know to solder them nicely....
 
Joined
Oct 21, 2012
Messages
206
Motherboard
Gigabyte GA-B85M-HD3 - F12
CPU
i5-4460
Graphics
GT 710
Mac
  1. iMac
Mobile Phone
  1. Android
  2. iOS
when i tried to flash modified bios (on windows 10) i get:
Error 366: fail to load driver (PCI access for windows)
Tool needs to run with an administrator priviledge account.

im running administrator account,
im Running command line aa Administrator, i check flash program in properties to run as administrator

what can i do? anyone can help me? where i can get the newest version of intel flash programming tool ?

Sleep bug only works for Bios version 9ACN26WW.

Also You need to have a video driver installed from here

Otherwise you cannot go to sleep mode.
When you go to sleep mode, wait for the left led to start blink.
After 20 seconds get out of sleep - and then enter cmd as admin.
 
Joined
Oct 21, 2012
Messages
206
Motherboard
Gigabyte GA-B85M-HD3 - F12
CPU
i5-4460
Graphics
GT 710
Mac
  1. iMac
Mobile Phone
  1. Android
  2. iOS
if something go wrong when you start this command
Code:
fptw64.exe -f bios.bin -bios
(if any flashing error occurs)
don't restart your computer!

start 9ACN26WW.exe again.
 
Joined
Oct 21, 2012
Messages
206
Motherboard
Gigabyte GA-B85M-HD3 - F12
CPU
i5-4460
Graphics
GT 710
Mac
  1. iMac
Mobile Phone
  1. Android
  2. iOS
@daigosx

You asked me before how I managed to unlock this BIOS (Advanced settings menu).

The method is very similar to the first post here so I'll quote it.


Decompile and Modify Bios

Launch PhoenixTool.exe and open your bios image with it.

179109

Your image is now being extracted, be patient and press OK to the two info popup.
When the extraction process finishes, in the Manufacturer dropdown list choose Lenovo and once done press the Advanced button. In the Options window check the options marked with red in the image

179110

Press Done. You’ll go back to the previous window where you have now to press Go. Wait until it finishes working and shows you this message:

179111

DO NOT PRESS OK YET!!!!
Open the workspace folder where was and you should find the DUMP directory, navigate into it and look for a file named


FE3542FE-C1D3-4EF8-657C-8048606FF670_

it is about 672kb.....


That is "DriverSampleDXE-SetupUtility PE32 "BODY"
File GUID: FE3542FE-C1D3-4EF8-657C-8048606FF670 (When viewed through raw bios in UEFITool)

Capture0.PNG


Offset (h) 00000920

5F >> Change to >> 00
55 >> Change to >> 00

Capture1.PNG

Capture2.PNG



Offset (h) 00000930

Capture3.PNG


4F >> Change to >> 00

if you found the very same values and modified the file as instructed, save the file and close the hex editor.
You can now press OK on the PhoenixTool popup. It will repack your bios and after a while you will find LENOVO-9ACN32WW_SLIC.rom besides the backup one in the workspace folder.


Flash Modified Bios

Code:
fptw64.exe -f bios.bin -bios

Please be careful with change any settings in advanced bios setup menu! Before you change any settings in bios, you must absolutely exactly know what you want change and how! Don't try to disable Intel graphic card!

If you set any settings to wrong value, then laptop break and can't start!
 
Joined
Oct 21, 2012
Messages
206
Motherboard
Gigabyte GA-B85M-HD3 - F12
CPU
i5-4460
Graphics
GT 710
Mac
  1. iMac
Mobile Phone
  1. Android
  2. iOS
Example of using BIOS (Advanced settings menu).

If you have, for example, a BCM94350ZAE / DW1820A card to work ...

20200424_171613.jpg


1028:0021 (part # CN-0VW3T3) -> 100% Ok with ASPM L0s
1028:0021 (part # CN-096JNT) -> 100% Ok with ASPM L0s
1028:0022 (part # CN-096JNT) -> 100% Ok with ASPM L0s
1028:0023 ( part# CN-0VW3T3) -> 100% Ok with ASPM L0s
1028:0023 (part # CN-08PKF4) -> 100% Ok with ASPM L0s

(I tested all these cards - I have them in my collection.)

You can disable ASPM now without

<key>PciRoot(0x0)/Pci(0x1C,0x0)/Pci(0x0,0x0)</key>
<dict>
<key>AAPL,slot-name</key>
<string>WLAN</string>
<key>compatible</key>
<string>pci14e4,4331</string>
<key>device_type</key>
<string>Airport Extreme</string>
<key>model</key>
<string>BCM4350 802.11ac Wireless Network Adapter</string>
<key>name</key>
<string>Airport</string>
<key>pci-aspm-default</key>
<integer>0</integer>
</dict>


Code:
L0 – All PCI Express transactions and other operations are enabled.



L0s – A low resume latency, energy saving “standby” state.



L1 – Higher latency, lower power “standby” state (optional).



L0sL1 - Activate both L0s and L1 support.

Above WiFi cards works OOBE with L0s or full Disabled (The battery will last shorter with disabled) . With Auto and L1/L0sL1 WiFi will not work OOBE

20200501_070531.jpg

PCI Express Root Port 4 is WiFi /BT card slot....
20200501_070549.jpg

20200501_070609.jpg


after this BT kexsts still needed for BT working...

Please be careful with change any other settings in advanced bios setup menu.
I briked one BIOS chip myself playing with VIDEO Configuration.. So I know what I'm talking about.
 
Joined
Oct 21, 2012
Messages
206
Motherboard
Gigabyte GA-B85M-HD3 - F12
CPU
i5-4460
Graphics
GT 710
Mac
  1. iMac
Mobile Phone
  1. Android
  2. iOS
Today I managed to do one more thing successfully.

To have same BIOS and EC version with all modifications from the entire topic.

20200501_145500.jpg


Leaving 9AEC26WW is not safe at all on the laptop.
Because a sleep bug is a potential threat and is known as Wake-from-sleep vulnerability leaving UEFIs open to attack

look --- > http://blog.cr4.sh/2015/02/exploiting-uefi-boot-script-table.html

So, in the end when you flash modified BIOS with

Code:
fptw64.exe -f bios.bin -bios

Extract 9acn32ww.exe with 7-Zip.

You will have similiar folder
Capture.PNG


put inside folder this platform.ini from attachment

start InsydeFlash.exe

It will only flash EC - over the old one:wave:
 

Attachments

  • platform.ini.zip
    9.1 KB · Views: 77
Top