TPM I set to off before the dump, I hate TPM but really turning it off seems impossible. Just like ME is "off" but runs until you set the HAP bit. I know you say the RSA check is different but if you look at the dump and the guide you will see what I mean about there being only one key and it signs the TPM too. In that guide only 1 volume image is signed

Here is what is really signed:




And both use same key.. because only one key in the file besides bootguard key.


Anyways, I thought maybe my patch is bad but the screen whitelist patch was reported successful by other X250/T450 users on reddit with much less bios editing experience, some got the TPM beeps but that's it. You have more experience than me so if you don't mind update the microcode and then I can do the same and I'll compare the 2 files to make sure my process isn't wrong.

I'll then test and see if it boots or not. I'll try coderush's guide as well when I get done with work and see where that takes me.

I finally got the module open in ida and in my patch the code makes sense:

 else
  {
    v5 = 0i64;
    v1 = 0;
    while ( 1 )
    {
      result = dword_140(&MenuPTr_380[2 * v1], 0i64, &v5);
      v2 = result < 0;
      if ( !result )
        break;
      if ( ++v1 >= 4 )
        goto LABEL_9;
    }
 

asm:

Sorry, I can't understand any of what you posted?? And, when you said Date+Time replaced with Advanced, I was really lost, have no clue what you are talking about, if that's referring to a BIOS menu mod, sounds like it's all wrong.

On your # items
1. You can't mix and match modules from one BIOS version to another, sounds like you did, so no boot expected there.
3. If you edit NVRAM and all OK, but insert some other NVRAM see #1 above.
4. Lost me again, too non-specific

If you want me to update microcodes, link me to the exact file you want edited and I will update.

I only changed 4 bytes in the BIOS I sent you, when I mentioned that, so however you are comparing is the issue probably. BIOS modules are compressed, so when you change some bytes, it looks like way more than your actual changes, especially once you insert the module and recompile the BIOS.
I edited 4 bytes at GUID CFEF94C4-4167-466A-8893-8779459DFA86 (PE32 body) Extract before and after you will see the four bytes I edited. Below is the before/after file if you are still not sure


I changed default profile (x2) value for BIOS and SMI Lock - new.php?thread=5423&forum=16&reply=1&replyid=94902

Also, I don't know assembly or coding like that, so I can't look at code like you display and make any sense of it. I know it may seem like I maybe know a lot about that, but I really don't
I know a little in IDA, how to bypass things in various ways, change jumps in various ways etc, and I can follow along and do an edit in assembly if there is given examples that match or at least resemble the code of file I'm looking into.
But to look at it like you presented it's gibberish to me - I never use that view in IDA I only use the flow view and then hex edit

For #4 I removed MeInfo module which bios complains about since ME is disabled. Computer doesn't boot same way as patching any other module.

#1 Other people have success and me previously using other versions/modules inside as single modules. I.e. changing the SATA module to raid, etc. Not in this version. Previously lots of success on reddit on T450, X250 and others. I took the entire volume of non protected modules so all should work together, this bios version ran on this machine previously.

For the patch, coderush actually wrote a guide on it exactly. https://translate.googleusercontent.com/...UquJd1GGODsBhng

Bios has 4 or 5 main pages. Info, Date/Time, Security, etc. As in the guide from coderush, you point one of those pages at advanced menu instead of what it was originally. Writing the code I'm just showing that I didn't modify some random instruction and break the module. It still disassembles and decompiles correctly.

In Ida I always use decompiled code and assembly view and then I change instructions in hex edit.Then see again if they are correct in those 2 views. I'm not that great either but patched a few different styles of firmware before.

I'm beginning to think there is something checking integrity like in the other 2 coderush guides but I'm not smart enough to figure out what it is and afraid that its in the RSA signed section. I posted on bios mods, the dude took the bin and said it was complicated then never came back.

I assume if you remove ME region = no boot, sorry, not sure what MEInfo module is, never heard of that. If you want to disable ME FW set the reserved bit to Yes (HAP bit, you know)

I patched BIOS for you and it booted, so it's not just not booting if you "patch any other module"

SATA module, if present as that, can be updated, RAID Can be updated etc, but you can't swap one for the other, and you have to use ones compatible with your chipset and do the update properly.

Sorry, I still have no idea about the coding you have above. But yes, I get what you mean about swapping main menu 1 for the other. Sorry, I wish I knew more about Phoenix BIOS

I can update microcodes for you if you want, that should be OK since the other test edit I did for you was OK.

Good experiment would be to find a newer sata module and try to change it. I will have to do some research. I actually did swap sata module for raid module in my dell and old style phoenix bios.

This is what I removed and it didn't boot, even though hap bit is disabled and the bios complains that it cannot load this module anymore.



When you patch it was with UEFI tool, right? Just making sure that's not the problem.



This is MC:



I found 1 update for D4 and its easy to change inside the NV.

Only replacement modules I see posted are intelgopdriver and maybe the ethernet. Gop driver listed is older or at least smaller but might be worth trying just to see if it can boot.

I use UEFITool 25 when I did the setup module edit. So, you updated microcode 306D4 and it boots, or not?
If not, you probably need to fix FIT first, or it needs edited differently, some Phoenix must be edited in special way when you do the ucode changes (Speaking in general, not editing your BIOS right now so not sure what applies here.)
Intel Boot Agent could be updated, as well as GOP module, and EFI Intel PXE module too + NVME Mod could be done as well

I'm guessing on the microcode because of the region its in, since I changed the logo there I think microcode will be fine. Wasn't in a hurry because linux loads its own intel microcode so I won't even feel it. I will look at the ones you listed but from what I see the gop module posted here is older than the one in my bios. I will definitely try the boot agent/nvme/pxe like you suggested and see what happens since I will open the laptop up tonight again to install some stuff. Then I'll report back.

------

I added the microcode easily, just have to test it. But most of the modules I'm finding here are for ami bios and not phoenix. Also laptop only has PCIe in the wifi slot and only plain sata in wwan slot.

-------

Microcode worked perfectly but I'm coming up short on modules to try that aren't ami bios. Can't find 306D3 either anywhere. Maybe its possible to rip it out of linux/windows microcode updates, not sure.

So some further info is found. Seems that this was considered a "vulnerability" by lenovo. https://support.lenovo.com/gb/en/solutions/len-20527


In theory:

<1.33>
 UEFI: 1.33 / ECP: 1.16
- [Important]  Security fix addresses LEN-22660 TianoCore EDK II BIOS Vulnerabilities. 
               Refer to Lenovo's Security Advisory page for additional information. 
               (https://support.lenovo.com/us/en/solutions/LEN-22660)
-[Important] Added Hyper Threading enable/disable option to ThinkPad Setup for virtualized
             system users in order to address LEN-24163 L1 Terminal Fault Side Channel
             Vulnerabilities (CVE-2018-3646). Refer to Lenovo's Security Advisory page for
             additional information.(https://support.lenovo.com/us/en/solutions/LEN-24163)
             (Note) Disabling Hyper Threading may increase system power consumption 
                    during sleep.
- (Fix) Fixed an issue where BIOS silent update might fail with system account.
 
<1.32>
 UEFI: 1.32 / ECP: 1.16
-[Important] Security fix addresses LEN-22133 Speculative Execution Side Channel Variants 4
             and 3a (CVE-2018-3639, CVE-2018-3640). Refer to Lenovo�fs Security Advisory page
             for additional information. (https://support.lenovo.com/product_security/home)
- (Fix) Fixed an issue where BIOS POST might display the error message
        "Boot Manager recover from an error."
 
 

1.32 bios should still be possible to mod. I will check how this goes on T440 and ensure I do not upgrade to EDK II BIOS vulnerability fixed version.

So great success on the T440P.

I backed up the original bios first. Then I upgraded to 2.50.

First I took the entire laptop apart and copied the 8mb chip. It was run through ME cleaner and the hap bit was set. This survives through bios updates so you won't have to take the entire computer apart again.

I started by removing some modules to get rid of spyware:

smart connect - ?? can't find it
Computrace - computrace in module name
Intel AT technology -ATAMUI ATpolicyInit ATam
 

Next I used UBU and updated the intel network firmware. It did not work on microcode, I had to manually hex edit EFISystemNVdata for that and logo.

Now to the juicy parts.
I patched: File_DXE_driver_32442D09-1D11-4E27-8AAB-90FE6ACB0489_SystemFormBrowserCoreDxe_body
Same way as I had before and the advanced menu appeared. This hack is good now 100%

I'm not sure if the whitelist was removed or is still active, but I copied pre-patched module to
File_DXE_driver_79E0EDD7-9D1D-4F41-AE1A-F896169E5216_LenovoWmaPolicyDxe_body

The system boots but it beeps! So then I followed the signing procedure from InsanelyMac, except I signed the entire FFS and not just the volume.
Beeps are gone and maybe only thing left is to do intel gop driver or some other things like that.

Zitat von NSAfarm im Beitrag #24

---

The system boots but it beeps! So then I followed the signing procedure from InsanelyMac, except I signed the entire FFS and not just the volume.

---

Edit Below

Zitat von Lost_N_BIOS im Beitrag #21

---

I use UEFITool 25 when I did the setup module edit. So, you updated microcode 306D4 and it boots, or not?
If not, you probably need to fix FIT first, or it needs edited differently, some Phoenix must be edited in special way when you do the ucode changes (Speaking in general, not editing your BIOS right now so not sure what applies here.)
Intel Boot Agent could be updated, as well as GOP module, and EFI Intel PXE module too + NVME Mod could be done as well

---

No PCIE lines in the x250 except in the wifi slot. So you lose that if you want nvme and there are not a lot of lanes. Only SATA in the wwan.

The system boots because bootguard isn't disturbed. The same key is used for BG as for the TPM so you can't "fix" the TPM on xx50 and up models. At least the beeps go away. People have modded up to T480 now using proper non-secured bios. Maybe they also patched the lenovo security check that causes the black screen but I'm not sure, I just downgraded. Info is only on discord. T440P can be re-signed because of no bootguard and the key can be freely replaced.. and has to since it keeps beeping every boot.

There is also some microcode mods now to remove TDP limits but alas none of my cooling systems support much beyond extending turbo time.