Contribute
Register

[Guide] Lenovo G50-70 and Z50-70 Bios whitelist removal

Joined
Oct 21, 2012
Messages
209
Motherboard
Gigabyte GA-B85M-D3H-A
CPU
i5-4460
Graphics
HD 7770
Mac
iMac
Mobile Phone
Android, iOS
if something go wrong when you start this command
Code:
fptw64.exe -f bios.bin -bios
(if any flashing error occurs)
don't restart your computer!

start 9ACN26WW.exe again.
 
Joined
Oct 21, 2012
Messages
209
Motherboard
Gigabyte GA-B85M-D3H-A
CPU
i5-4460
Graphics
HD 7770
Mac
iMac
Mobile Phone
Android, iOS
@daigosx

You asked me before how I managed to unlock this BIOS (Advanced settings menu).

The method is very similar to the first post here so I'll quote it.


Decompile and Modify Bios

Launch PhoenixTool.exe and open your bios image with it.

179109

Your image is now being extracted, be patient and press OK to the two info popup.
When the extraction process finishes, in the Manufacturer dropdown list choose Lenovo and once done press the Advanced button. In the Options window check the options marked with red in the image

179110

Press Done. You’ll go back to the previous window where you have now to press Go. Wait until it finishes working and shows you this message:

179111

DO NOT PRESS OK YET!!!!
Open the workspace folder where was and you should find the DUMP directory, navigate into it and look for a file named

FE3542FE-C1D3-4EF8-657C-8048606FF670_

it is about 672kb.....


That is "DriverSampleDXE-SetupUtility PE32 "BODY"
File GUID: FE3542FE-C1D3-4EF8-657C-8048606FF670 (When viewed through raw bios in UEFITool)

Capture0.PNG


Offset (h) 00000920

5F >> Change to >> 00
55 >> Change to >> 00

Capture1.PNG

Capture2.PNG



Offset (h) 00000930

Capture3.PNG


4F >> Change to >> 00

if you found the very same values and modified the file as instructed, save the file and close the hex editor.
You can now press OK on the PhoenixTool popup. It will repack your bios and after a while you will find LENOVO-9ACN32WW_SLIC.rom besides the backup one in the workspace folder.


Flash Modified Bios

Code:
fptw64.exe -f bios.bin -bios
Please be careful with change any settings in advanced bios setup menu! Before you change any settings in bios, you must absolutely exactly know what you want change and how! Don't try to disable Intel graphic card!

If you set any settings to wrong value, then laptop break and can't start!
 
Joined
Oct 21, 2012
Messages
209
Motherboard
Gigabyte GA-B85M-D3H-A
CPU
i5-4460
Graphics
HD 7770
Mac
iMac
Mobile Phone
Android, iOS
Example of using BIOS (Advanced settings menu).

If you have, for example, a BCM94350ZAE / DW1820A card to work ...

20200424_171613.jpg


1028:0021 (part # CN-0VW3T3) -> 100% Ok with ASPM L0s
1028:0021 (part # CN-096JNT) -> 100% Ok with ASPM L0s
1028:0022 (part # CN-096JNT) -> 100% Ok with ASPM L0s
1028:0023 ( part# CN-0VW3T3) -> 100% Ok with ASPM L0s
1028:0023 (part # CN-08PKF4) -> 100% Ok with ASPM L0s

(I tested all these cards - I have them in my collection.)

You can disable ASPM now without

<key>PciRoot(0x0)/Pci(0x1C,0x0)/Pci(0x0,0x0)</key>
<dict>
<key>AAPL,slot-name</key>
<string>WLAN</string>
<key>compatible</key>
<string>pci14e4,4331</string>
<key>device_type</key>
<string>Airport Extreme</string>
<key>model</key>
<string>BCM4350 802.11ac Wireless Network Adapter</string>
<key>name</key>
<string>Airport</string>
<key>pci-aspm-default</key>
<integer>0</integer>
</dict>


Code:
L0 – All PCI Express transactions and other operations are enabled.



L0s – A low resume latency, energy saving “standby” state.



L1 – Higher latency, lower power “standby” state (optional).



L0sL1 - Activate both L0s and L1 support.
Above WiFi cards works OOBE with L0s or full Disabled (The battery will last shorter with disabled) . With Auto and L1/L0sL1 WiFi will not work OOBE

20200501_070531.jpg

PCI Express Root Port 4 is WiFi /BT card slot....
20200501_070549.jpg

20200501_070609.jpg


after this BT kexsts still needed for BT working...

Please be careful with change any other settings in advanced bios setup menu.
I briked one BIOS chip myself playing with VIDEO Configuration.. So I know what I'm talking about.
 
Joined
Oct 21, 2012
Messages
209
Motherboard
Gigabyte GA-B85M-D3H-A
CPU
i5-4460
Graphics
HD 7770
Mac
iMac
Mobile Phone
Android, iOS
Today I managed to do one more thing successfully.

To have same BIOS and EC version with all modifications from the entire topic.

20200501_145500.jpg


Leaving 9AEC26WW is not safe at all on the laptop.
Because a sleep bug is a potential threat and is known as Wake-from-sleep vulnerability leaving UEFIs open to attack

look --- > http://blog.cr4.sh/2015/02/exploiting-uefi-boot-script-table.html

So, in the end when you flash modified BIOS with

Code:
fptw64.exe -f bios.bin -bios
Extract 9acn32ww.exe with 7-Zip.

You will have similiar folder
Capture.PNG


put inside folder this platform.ini from attachment

start InsydeFlash.exe

It will only flash EC - over the old one:wave:
 

Attachments

Joined
Oct 21, 2012
Messages
209
Motherboard
Gigabyte GA-B85M-D3H-A
CPU
i5-4460
Graphics
HD 7770
Mac
iMac
Mobile Phone
Android, iOS
Final step on the saga. I completely disabled the intel ME :)

Code:
python me_cleaner.py bios.bin -S -O bios1.bin

miko@mikos-MacBook-Pro me_cleaner-master % python me_cleaner.py bios.bin -S -O bios1.bin
Full image detected
Found FPT header at 0x1010
Found 1 partition(s)
Found FTPR header: FTPR partition spans from 0x4b000 to 0xd1000
ME/TXE firmware version 9.5.15.1730 (generation 2)
Public key match: Intel ME, firmware versions 9.5.x.x, 10.x.x.x
The AltMeDisable bit is NOT SET
Reading partitions list...
FTPR (0x0004b000 - 0x0000d1000, 0x00086000 total bytes): NOT removed
Removing partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0x04)...
Reading FTPR modules list...
UPDATE           (LZMA   , 0x0b09a3 - 0x0b0aad       ): removed
ROMP             (Huffman, fragmented data, ~1 KiB   ): NOT removed, essential
BUP              (Huffman, fragmented data, ~80 KiB  ): NOT removed, essential
KERNEL           (Huffman, fragmented data, ~215 KiB ): removed
POLICY           (Huffman, fragmented data, ~97 KiB  ): removed
FTPM             (LZMA   , 0x0b0aad - 0x0bec2b       ): removed
HOSTCOMM         (LZMA   , 0x0bec2b - 0x0c725f       ): removed
TDT              (LZMA   , 0x0c725f - 0x0cc590       ): removed
FPF              (LZMA   , 0x0cc590 - 0x0ce0a5       ): removed
The ME minimum size should be 434176 bytes (0x6a000 bytes)
The ME region can be reduced up to:
00001000:0006afff me
Setting the AltMeDisable bit in PCHSTRP10 to disable Intel ME...
Checking the FTPR RSA signature... VALID
Done! Good luck!

look
 
Last edited:
Joined
Oct 21, 2012
Messages
209
Motherboard
Gigabyte GA-B85M-D3H-A
CPU
i5-4460
Graphics
HD 7770
Mac
iMac
Mobile Phone
Android, iOS
I bought this SOIC8 SOP8 Test Clip + CH341A Flash BIOS USB Programmer
s-l1600.jpg.b27c0710519c3c4fe4478c968183750e.jpg

It costs about 10 bucks. Interestingly, when a full G50-70 Bios dump is made with it, it is about 8MB (8192 kB, SPI)
 
Joined
May 31, 2020
Messages
1
Motherboard
ASUS P5Q
CPU
Intel Q9650
Graphics
ASUS GTX1650-O4G-LP-BRK GeForce GTX 1650 4 GB GDDR5
Mobile Phone
Android
Thank you for this wonderful guide!

I finally succeeded on changing my Lenovo G50-70 default single band wi-fi network card with a Lenovo SW10A11648 / 00JT482 Realtek RTL8821AE 802.11AC + Bluetooth 4.0 NGFF P/N SW10A11648.

I updated my laptop with latest bios available from Lenovo (9ACN29WW V29 - 9acn30ww.exe) and then modified it following your guide: all went exactly as you described.

I have to admit the hardest part of the task was to find a fptw64.exe copy working on my Windows 10 x64 2004 version.

Fortunately, after very long and unsuccessful Google searches, I found it on the package Intel ME System Tools v10.0 r7.rar available on the following page:


I also found Phoenixtool256.zip tool at the following link:


A very strong hearthbeat while flashing modded BIOS and restarting laptop, but all went OK!

Thank you again!!
 
Last edited:
Joined
May 15, 2019
Messages
19
Motherboard
Lenovo G50-70-Clover (Lancer 5A2)
CPU
i5-4210U
Graphics
HD 4400
Mobile Phone
Android
Hi, I am currently using the modified version of BIOS v26 for my Lenovo G50-70. I had no intention of updating it, because everything works perfectly, but I also have Windows 10 Home in dual boot and the May update did not arrive. So I contacted support and they told me to update the BIOS. If anyone has had this same problem, his opinion is welcome. So at this point my question is: (omitting the part where I find the links and I can correctly perform all the other steps of the procedure) to install the updated original version of the BIOS (v32), starting from my modified version of the v26, I have to do some particular steps or just update it normally?
I apologize for writing so much, and thank you in advance for anyone who can help me.
 
Joined
Nov 16, 2015
Messages
155
Motherboard
Lenovo G50-70-Clover
CPU
i5-4210U
Graphics
HD 4400 1920x1080
Mac
MacBook Air, MacBook Pro
Mobile Phone
Android
Hi, I am currently using the modified version of BIOS v26 for my Lenovo G50-70. I had no intention of updating it, because everything works perfectly, but I also have Windows 10 Home in dual boot and the May update did not arrive. So I contacted support and they told me to update the BIOS. If anyone has had this same problem, his opinion is welcome. So at this point my question is: (omitting the part where I find the links and I can correctly perform all the other steps of the procedure) to install the updated original version of the BIOS (v32), starting from my modified version of the v26, I have to do some particular steps or just update it normally?
I apologize for writing so much, and thank you in advance for anyone who can help me.
Downgrade to original v26
Update to v32
Dump and modify v32
Downgrade again to original v26
Flash modified v32
 
Joined
May 15, 2019
Messages
19
Motherboard
Lenovo G50-70-Clover (Lancer 5A2)
CPU
i5-4210U
Graphics
HD 4400
Mobile Phone
Android
Downgrade to original v26
Update to v32
Dump and modify v32
Downgrade again to original v26
Flash modified v32
OK understood. Thank you so much.
 
Top