2016-05-20 01:05:22 +00:00
|
|
|
This repository also contains number of tools and utilities for examining
|
|
|
|
|
and modifying Thinkpad Embedded Controller firmware.
|
|
|
|
|
|
|
|
|
|
Including:
|
|
|
|
|
* radare projects with partial disassembly of several thinkpads EC firmware
|
|
|
|
|
* scripts for downloading the ISO image and extracting the firmware
|
|
|
|
|
* script for patching the firmware
|
|
|
|
|
* documentation on the tables found in the firmware (TODO)
|
|
|
|
|
|
|
|
|
|
Radare:
|
|
|
|
|
-------
|
|
|
|
|
To use the radare projects, first install the project files:
|
|
|
|
|
|
|
|
|
|
make install.radare.projects
|
|
|
|
|
|
|
|
|
|
Then ensure you have the image file(s):
|
|
|
|
|
|
|
|
|
|
make x220.8DHT34WW.img x230.G2HT35WW.img x260.R02HT29W.img
|
|
|
|
|
|
|
|
|
|
Then start radare with one of these projects:
|
|
|
|
|
|
|
|
|
|
radare -p x230.G2HT35WW
|
|
|
|
|
|
|
|
|
|
Makefile targets:
|
|
|
|
|
-----------------
|
|
|
|
|
|
|
|
|
|
If you expect to do development work, the following make targets are
|
|
|
|
|
probably useful:
|
|
|
|
|
|
2017-06-20 06:40:43 +00:00
|
|
|
To list the available raw image files and FL2 files, check the
|
|
|
|
|
Descriptions.txt file for the list of known image names. You
|
|
|
|
|
can also get a list of the "*.img.d" directories that contain
|
|
|
|
|
patches with this make command:
|
2016-05-20 01:05:22 +00:00
|
|
|
|
|
|
|
|
make list_images
|
|
|
|
|
|
|
|
|
|
To fetch the firmware from Lenovo, extract, decrypt and patch
|
|
|
|
|
it, ready for more patching:
|
|
|
|
|
|
|
|
|
|
make x230.G2HT35WW.img
|
|
|
|
|
|
|
|
|
|
To just get the decrypted firmware file (with the same filename as
|
2017-06-20 06:40:43 +00:00
|
|
|
above), before any patches applied:
|
2016-05-20 01:05:22 +00:00
|
|
|
|
|
|
|
|
make x230.G2HT35WW.img.prepatch
|
|
|
|
|
|
|
|
|
|
To create a new FL2, ready for flashing:
|
|
|
|
|
|
|
|
|
|
make x230.G2HT35WW.s01D3000.FL2
|
|
|
|
|
|
|
|
|
|
To update your firmware, copy the FL2 file generated above and
|
|
|
|
|
the dosflash.exe utility to a DOS boot disk and then use a command
|
|
|
|
|
similar to:
|
|
|
|
|
|
2016-05-20 03:17:54 +00:00
|
|
|
|
2016-05-20 01:05:22 +00:00
|
|
|
dosflash /sd /ipf ec /file s01D3000.FL2
|
|
|
|
|
|
2016-05-20 03:17:54 +00:00
|
|
|
To insert the firmware image back into the bootable cdrom and boot this
|
|
|
|
|
in an emulator for testing:
|
|
|
|
|
|
|
|
|
|
make patched.x230.iso.test
|
|
|
|
|
|
|
|
|
|
To extract the DOS disk image from the ISO and test that in the emulator
|
|
|
|
|
instead:
|
|
|
|
|
|
|
|
|
|
make patched.x230.img.test
|
|
|
|
|
|
2016-05-20 01:05:22 +00:00
|
|
|
References:
|
|
|
|
|
-----------
|
|
|
|
|
http://forum.thinkpads.com/viewtopic.php?f=69&t=120776
|
|
|
|
|
http://www.zmatt.net/unlocking-my-lenovo-laptop-part-3/
|
|
|
|
|
http://plan9.stanleylieber.com/hardware/thinkpad/x230/x230.schematics.pdf
|
|
|
|
|
|
