ThinkPad Twist S230u

[marwenius]

BIOS no longer write-protected! Your machine is compatible but, unsupported. Please report the following details to GitHub Issue:

• Machine: Twist
• BIOS: GDET92WW
• Version: 1.52
• FlashSize: 12288

I can provide you with a BIOS dump and would be willing to run tests on my device as I am not depending on it.

[digmorepaka]

Patch the file with https://github.com/digmorepaka/thinkpad-firmware-patches/ and report findings.

[marwenius]

Patching and signing works with BIOS version 1.52 (GDET92WW) and the latest version 1.81 (GDETC1WW). I used xx30_patches_v4.txt as it was.

And both patched versions worked as expected when I flashed them back --> The Advanced Menu has been unlocked.

But: The Advanced Menu has replaced the Config tab instead of the Date/Time tab.

With the stock BIOS version 1.81 (GDETC1WW) I also get the message "BIOS no longer write-protected [...]".

Do you need more information?

user@debian:~/Downloads/patch_and_sign$ sudo flashrom -p ch341a_spi -r s230u_bios_stock_v1.81.rom
flashrom v1.2 on Linux 5.18.0-3-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip "W25Q32.V" (4096 kB, SPI) on ch341a_spi.
Reading flash... done.

user@debian:~/Downloads/patch_and_sign$ ./UEFIPatch s230u_bios_stock_v1.81.rom xx30_patches_v4.txt -o s230u_bios_patch_v1.81.rom
parseVolume: unknown file system FFF12B8D-7696-4C8B-A985-2747075B4F50
parseBios: volume size stored in header 61000h differs from calculated using block map 262144h
parseVolume: unknown file system 00504624-8A59-4EEB-BD0F-6B36E96128E0
parseBios: volume size stored in header 2F000h differs from calculated using block map 196608h
patch: replaced 16 bytes at offset 2A0h A52F91612AD43F4F955DBB07B8DD1F57 -> 778B1D826D24964E8E103467D56AB1BA
patch: replaced 16 bytes at offset 4000h 44243080FB0175080FBAE80F89442430 -> 44243080FB01EB080FBAE80F89442430
patch: replaced 16 bytes at offset 476Ch 30488B4338F6000874080FBA6C243014 -> 30488B4338F60008EB080FBA6C243014
Image patched

user@debian:~/Downloads/patch_and_sign$ ./sign.py s230u_bios_patch_v1.81.rom -o s230u_bios_patch_sign_v1.81.rom
INFO: Found public key modulus at offset  0x2b0e02
INFO: FFSv2 volume offset:  0x00
INFO: TCPA block found at offset  0x2b0400
INFO: Generating new 1024 bit key with 3 as public exponent...
INFO: Volume offset: 72
INFO: Volume size: 2473410
INFO: Volume hash updated
INFO: Signature calculated
INFO: TCPA volume block signed
INFO: Public key stored

IMAGE SIGNED!

user@debian:~/Downloads/patch_and_sign$ ./verify.py s230u_bios_patch_sign_v1.81.rom
INFO: Found public key modulus at offset  0x2b0e02
INFO: FFSv2 volume offset:  0x00
INFO: TCPA block found at offset  0x2b0400
INFO: Volume offset: 72
INFO: Volume size: 2473410
INFO: TCPA volume hash verified
INFO: Volume signature verified

SIGNATURES CORRECT!

user@debian:~/Downloads/patch_and_sign$ sudo flashrom -p ch341a_spi -w s230u_bios_patch_sign_v1.81.rom
flashrom v1.2 on Linux 5.18.0-3-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip "W25Q32.V" (4096 kB, SPI) on ch341a_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

[marwenius]

Is the information enough or do you need more? :-)

I can also provide a bios dump if needed.

[digmorepaka]

Alright, only thing remaining is whitelist check, is the wwan and wlan whitelist no longer active? And yes, advanced replaces date/time, it needs to go somewhere and we can't just add a tab on phoenix.

[marwenius]

Advanced Tab

In this case: Advanced replaced Config instead of Date/Time (unfortunately the wrong tab).

WLAN & WWAN Whitelist

In both cases: "1802: Unauthorized network card is plugged in – Power off and remove the miniPCI network card."

[digmorepaka]

That means the whitelist removal did not work. Could you send the untouched dump? When I have some time tomorrow I'd like to take a look at it and have the whitelist removal working.

[marwenius]

How can I send you the file? Is it ok to upload the file in a post in this thread?

[digmorepaka]

curl -F'[email protected]' http://0x0.st

[marwenius]

http://0x0.st/oLss.rom

[digmorepaka]

Thanks. I'll comment on here once I come up with something to test

[digmorepaka]

Oh just remembered one thing. The X230t had a different whitelist patch, could you try it's patch on this first? Just uncomment it in the patches file

[marwenius]

I will try the X230t patch :-)

[marwenius]

Unfortunately, it doesn't work with that either,

[digmorepaka]

Took a look, extremely similar to the X230t whitelist - though having trouble assembling the file. But it's looking good.

[digmorepaka]

Try http://0x0.st/o9XF.rom this is whitelist removal only, no tpm, no advanced menu. md5: 1333b5d4b32af61a343f0e370cb2f082

[marwenius]

It works! :-)

But unfortunately I uploaded the wrong BIOS version (1.52 instead of 1.81).

Here is the correct version: http://0x0.st/o9Bx.81_x.rom

Sorry :-/

[digmorepaka]

Ah well, if it stayed the same(E/L/other low end) tends to stay the same between version, sometimes not even patching out known exploits. Expect a rom later today.

[digmorepaka]

Try http://0x0.st/o9SC.rom a44aa5bec4db9fbaee4a1c573aa8f1de

Not sure if WWAN whitelist removal will work - didn't bother disassembling just applied the same pattern replacement that i figured out on the old verison - primary part of it should be there. This has advanced menu, 1066/800mhz dram limit removal, msr unlock and the testing version of wlan+wwan whitelist.

[marwenius]

WWAN whitelist: works

WLAN whitelist: not working

Advanced Menu: works (but still in the wrong(?) place --> it replaces Config, since Config is the second tab; Date/Time is the third tab)

dram limit: I don't know how to test this (Sidenote: The RAM is soldered).

msr unlock: This has something to do with Mac, doesn't it?

[digmorepaka]

WWAN whitelist: works
WLAN whitelist: not working

funky. Guess it's time to disassemble the module.

[marwenius]

Any news on the project by chance? :-)

[digmorepaka]

Any news on the project by chance? :-)

Nah, did fuck all with it. Been busy recently.

[marwenius]

If your time permits, I would be happy to hear any news :-)

(Since English is not my native language, I hope I understood your answer correctly.)

[marwenius]

Do you want to give it another try? :) Would still be interested in.