1vyrain, skulls and clean/disable/break the Intel ME

[brunocek]

On a X230, I am trying to get 1vyrain, skulls and clean/disable/break the Intel ME.

I would like to avoid making mistakes, troubleshooting, using the jumper cables (I have them), or flashing multiple times/versions.

Any help is welcome. Some questions, please, in order of perceived priority:

1. What is the order so that I get the three objectives?

Is it 1vyrain with the skulls custom BIOS, then run me_cleaner from a Live Linux (https://github.com/corna/me_cleaner)?
I am not sure me_clener will work in this case.

And from what I read, if I run me_cleaner from a Live Linux before 1vyrain, it won't work either.

Is it possible to first flash the 1vyrain modified bios with no payload and after cleaning ME with it, install skulls? Will this be a second round of boot-from-usb-and-flash 1vyrain (this second time on option 2 Flash from Custom BIOS)?

2. Does the direct internet URL to the tar.xz release file of skulls (https://github.com/merge/skulls/releases) work (option 2 Flash from Custom BIOS)? Or should I download it, untar it and make it available on the local network?

3. 1vyrain guide has a section on examining protections that uses chipsec_main. (https://github.com/gch1p/thinkpad-bios-software-flashing-guide?tab=readme-ov-file#examining-protections-theory)

Is it (https://github.com/chipsec/chipsec/tree/main)?

When should this be run during the process? Is it fine if I boot from Live Linux to run this before flashing the 1vyrain with skulls?

To be able to flash, we need SMM_BWP=0, BIOSWE=1, BLE=0, FLOCKDN=0 or SPI protected ranges (PRx) to have a WP bit set to 0.

Thank you in advance.

This question has been also posted on:

• https://forum.qubes-os.org/t/how-to-use-ivprep-and-1vyrain-and-disable-intel-me-on-a-lenovo-x230/18162/5
• 1vyrain, skulls and clean/disable/break the Intel ME merge/skulls#302
• X230 stuck on 2.75 - I cannot downgrade to 2.60! hamishcoleman/thinkpad-ec#266

[digmorepaka]

skulls and clean/disable/break the Intel ME

As is stated in FAQ, any modification to the ME region requires external flash https://medium.com/@n4ru/1vyrain-an-xx30-thinkpad-jailbreak-fd4bb0bdb654

What is the order so that I get the three objectives?

First update ec to version without battery whitelist, if you have 7row also the 7row patch if you haven't done that already using https://github.com/hamishcoleman/thinkpad-ec/, then use an external flasher to backup and write the flash chips - coreboot and software based on it doesn't have an update mechanism for the EC.

[brunocek]

Thank you for the initial and quick help @digmorepaka

I think I got myself in trouble stuck on 2.75 - I cannot downgrade to 2.60 (X230) via IVprep or the lenovo tool (I get "This app can't run on your PC"). Is there a way forward, please?
Here is what I did and was planning to do:

1. EC Patching (accept all batteries and keyboards)

https://github.com/hamishcoleman/thinkpad-ec/
It recomends using on the last modifiable version: x230 -BIOS 2.75 (G2ETB5WW) EC 1.14 (G2HT35WW)

Therefore I upgraded from my 2.55 to 2.75, by downloading g2uj31us.exe, saving on a usb stick and running on the target machine's windows (the bootable iso would not dd well to the usb stick).
https://support.lenovo.com/ec/en/downloads/ds029187

2. Downgrade from 2.75 to 2.60 (X230) (I cannot perform from here onwards):

https://github.com/n4ru/IVprep/tree/master

Downloaded both IVprep and g2uj17us.exe and saved on the usb stick to run on target machine's windows but then I get I get "This app can't run on your PC".

I have tested with both:
BIOS Setup -> Security -> UEFI BIOS Update Option. Set Flash BIOS Updating by End-Users to Enabled, and Secure RollBack Prevention to Disabled
BIOS Setup -> Security -> UEFI BIOS Update Option. Set Flash BIOS Updating by End-Users to Enabled, and Secure RollBack Prevention to Enabled

3. Get rid of the ME

https://github.com/corna/me_cleaner
I gues for this one, I should boot the target machine with a Live Linux, clone the repo and execute

4. Install Skulls via 1vyrain

https://github.com/n4ru/1vyrain

This would be burn the usb stick to the 1vyrain, use the ethernet cable and the skulls release URL
https://github.com/merge/skulls/releases

Extra question step 4

• Here I have another question, please, which format to give as URL? zip, tar.gz, tar.xz? or should I host the rom file on the local network? (and decompress it myself?)