Hey folks,

I'm crossposting this from /r/thinkpad/ (can't post full link, since I'm new) where a user pointed me to this forum.

The situation: I have ThinkPad T480 with a failed BIOS update. It beeps a few times when turned on (can't remember the pattern), the display backlight turns on, the keyboard backlight turns on, but otherwise nothing happens, no output, not even the fans spinning.

What I've tried so far
After a lot of research I got myself a CH341A, dumped the chip with the BIOS on it and I'm now trying to replace the BIOS section with a downloaded version from Lenovo (n24ul26w).

I thought I could get away with ifdtool, but no:

$ ifdtool -i bios:firmware.bin chip2.bin
 
File chip2.bin is 16777216 bytes
File firmware.bin is 9455008 bytes
Region BIOS is 9437184(0x900000) bytes. File is 9455008(0x9045a0) bytes. Not injecting.
 

So I had a look at the dumps with UEFITool:



The overall structure of the BIOS section looks mostly identical on both sides, except for an extra padding on the current dump (left). So I figured I could just grab everything else from the downloaded firmware and overwrite it in the existing one.

So i did Right Click -> Extract as is on each section with the same name in the downloaded firmware, and then Right Click -> Replace as is within the current firmware.

After playing the edited image back onto the chip with

sudo flashrom -p ch341a_spi -w edited_firmware.bin
 

...Nothing happens. The beeps are gone, and the keyboard backlight turns off after a second. Otherwise nothing happens.

After writing the bricked firmware back on it, it at least beeped again.

So, my questions are:

- Am I doing something wrong or misunderstanding something? To be fair, I'm a software guy and have no clue about low level hardware stuff.
- Could it possibly work if somebody dumped the firmware from their working T480 and I just wrote it onto my chip?
- Is there something else I could try or to be aware of?
- How to tell if the laptop is dead for good and I'm just wasting my time?

Thanks!

Edit by Fernando: Thread title customized and shortened

Please, try the dumped firmware.

Source.

Holy crap, it worked!

Well, sort of... It does seem to start normally. I get a splashscreen with the Lenovo logo and a text saying "To interrupt normal stratup, press Enter".

Then I get this output:

Zitat

---

0271: Check Date and Time settings
0183: Bad CRC of Security Settings in EFI variable.
1802: Unauthorized Network Card is plugged in. Power off and remove the network card.

System is halted.

---

So my guess is, I'll have to swap some parts of the original image to the new one until it works, right? But is there a way to triangulate what those parts could be?

From looking at it with UEFITool, there's one obvious difference:



So i tried swapping that out, with the "as is" as well as with just the "body" option, but none of them worked.

But - thanks for that image, at least now I know that it's not dead yet an that maybe there is hope.

Zitat von quasdunk im Beitrag #3

---

I'll have to swap some parts of the original image to the new one until it works, right?

---

Thanks for bearing with me!

It's a company laptop that they let me keep after it got bricked. I've been using it for a year now, but during that time no parts were replaced, so I'm not sure why it would complain about that.

Maybe I should mention that it has additional security measures like BitLocker and a BIOS password (if I remember correctly), but I do know all the passwords so that shouldn't be an issue (I guess).

I removed the wireless module and tried again. The 1802 error is now gone, but the other 2 are still there. Is there maybe a way to get rid of the 0183 error, or shouldn't that be the one causing the issue?

Zitat von quasdunk im Beitrag #5

---

The 1802 error is now gone

---

Zitat von quasdunk im Beitrag #5

---

but the other 2 are still there

---

Zitat von Sweet Kitten im Beitrag #4

---

You really should swap one module (FFF12B8D...)

---

Did you do your 'volume by volume' replacements with same version bios region? Different version won't work. It'd be helpful to look into the bricked bios, find the place where the brick happened and repair instead of trying randomly.

Take the bios SweetKitten provided and 'replace as is' the volume he mentioned. That will (possibly) give you your 'settings' and 'machine identity' back and resolve the errors (if NVRAM isn't corrupted) or post the dump of the bricked bios to repair your own firmware.

Zitat

---

You really should swap one module (FFF12B8D...),

---

I did that @Sweet Kitten / @lfb6 , with "Extract as is" on the bricked image and "Replace as is" on the image you linked. But it stays dead with that modification.

What I noticed though: When I remove the WiFi module, the system is not halted anymore after the errors, but I can "Press F1 to enter settings" - I did that, but I get prompted for a password, which is none of the ones I know.

Zitat

---

If this swap won't work out, I will try to change the BIOS so that these errors do not appear.

---

I would highly appreciate that!

Zitat

---

Different version won't work.

---

Here's what strings gives me:

Bricked one:

strings bricked.bin | head -30
\2!B`
yUUU
E E 
% %  
N24RM09W
11.8.55.3510
16MB
SIGNED
CORP
N24RE03WLMLAN
N24RE03WLMLAN
$FPT
FTPR
FTUP
DLMP
PSVN
IVBP
NFTP
ROMB
WCOD
LOCL
FLOG
UTOK
ISHC
$CPD/
rFTPRFTPR.man
rbe.met
fptemp
fptemp.met
kernel
 

Potentcially working one (with errors):

strings maybe.bin | head -30
\2!B`
yUUU
E E 
% %  
R06NB15W
11.0.12.1008
16MB
SIGNED
CONS
$FPT
FTPR
FTUP
DLMP
PSVN
IVBP
NFTP
ROMB
WCOD
LOCL
FLOG
UTOK
ISHC
$CPD/
FTPRFTPR.man
rbe.met
fptemp
fptemp.met
kernel
kernel.met
syslib
 

So assuming that

R06NB15W
11.0.12.1008
 

and

N24RM09W
11.8.55.3510
 

are related to the version, they indeed are different.

I can't upload the images or post links, so here the mega.nz/file/{hashes}:

- bricked.bin: F8twjSRL#pTFpTKpasrNFq-hH3CcGdEiUYQF75MkbfxZQd-rHD2Q
- potentially_working.bin: h1tWBACB#q9fyHuwXI2IoQcZUKNt8AenkoiTz-bNTMmFeYe3iFPc

Any help would be much, much appreciated!