"1vyrain" - xx30 ThinkPad Jailbreak - Overclocking, Advanced Menu, ME Disable, Whitelist automated unlock with software!

[E350]

Well I stumbled my way through the process of Ivyprep and 1vyrain and everything seems to be working great. I installed the Intel AC 7260 wifi card and the newest Bluetooth Daughter card. And Bluetooth is definitely better!

[E350]

Update: This morning I used Lenovo Vantage to update the drivers. And now the Bluetooth is acting choppy again.

Any suggestions how I can get last night's Bluetooth drivers back?

[E350]

Update: Went into Device Manager and deleted Bluetooth then restarted and scanned for hardware changes and Bluetooth is working perfectly again.

[strider]

Does 1vyrain remove battery check for original in T430s or still need to do Hamishcoleman Thinkpad-EC hack?

If still need Hamishcoleman Thinkpad-EC hack, can it be done AFTER 1vyrain install? (I already 1vyrain v5)
Thank you.

[ianyp]

I'm trying to follow the instructions on the 1vyrain github to have a custom splash screen on my T430. I've spent about 6 hours on this now. I'm reticent to raise an issue on Github because I searched all the issues and online and no-one else seems to have this issue,... so it must be me?

I downgraded to BIOS 2.64 using the original Lenovo tool applying the LOGO1 / LOGO2 files and it works fine. Nice splash screen.

I read back the BIOS that has the custom splash screen.

Code: Select all

sudo flashrom -r TEST.FL1 -p internal --ifd -i bios -VVV  

verbose output

Code: Select all

 sudo flashrom -r TEST.FL1 -p internal --ifd -i bios -VVV                                                  
flashrom v1.2 on Linux 6.1.31-2-MANJARO (x86_64)
flashrom is free software, get the source code at https://flashrom.org

flashrom was built with libpci 3.8.0, GCC 12.1.0, little endian
Command line (8 args): flashrom -r TEST.FL1 -p internal --ifd -i bios -VVV
Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Initializing internal programmer
/sys/class/mtd/mtd0 does not exist
No coreboot table found.
Using Internal DMI decoder.
page_size=1000
pre-rounding:  start=0x00000000000f0000, len=0x10000, end=0x0000000000100000
post-rounding: start=0x00000000000f0000, len=0x10000, end=0x0000000000100000
page_size=1000
pre-rounding:  start=0x00000000dae9c000, len=0xa28, end=0x00000000dae9ca28
post-rounding: start=0x00000000dae9c000, len=0x1000, end=0x00000000dae9d000
DMI string chassis-type: "Notebook"
page_size=1000
pre-rounding:  start=0x00007fb55065b000, len=0xa28, end=0x00007fb55065ba28
post-rounding: start=0x00007fb55065b000, len=0x1000, end=0x00007fb55065c000
page_size=1000
pre-rounding:  start=0x00007fb55065c000, len=0x10000, end=0x00007fb55066c000
post-rounding: start=0x00007fb55065c000, len=0x10000, end=0x00007fb55066c000
Laptop detected via DMI.
DMI string system-manufacturer: "LENOVO"
DMI string system-product-name: "23511F4"
DMI string system-version: "ThinkPad T430"
DMI string baseboard-manufacturer: "LENOVO"
DMI string baseboard-product-name: "23511F4"
DMI string baseboard-version: "Not Defined"
W836xx enter config mode worked or we were already in config mode. W836xx leave config mode had no effect.
Active config mode, unknown reg 0x20 ID: 00.
Found chipset "Intel QM77" with PCI ID 8086:1e55.
Enabling flash write... Root Complex Register Block address = 0xfed1c000
page_size=1000
pre-rounding:  start=0x00000000fed1c000, len=0x4000, end=0x00000000fed20000
post-rounding: start=0x00000000fed1c000, len=0x4000, end=0x00000000fed20000
GCS = 0xc21: BIOS Interface Lock-Down: enabled, Boot BIOS Straps: 0x3 (SPI)
Top Swap: not enabled
0x7fffffff/0x7fffffff FWH IDSEL: 0x0
0x7fffffff/0x7fffffff FWH IDSEL: 0x0
0x7fffffff/0x7fffffff FWH IDSEL: 0x0
0x7fffffff/0x7fffffff FWH IDSEL: 0x0
0x7fffffff/0x7fffffff FWH IDSEL: 0x0
0x7fffffff/0x7fffffff FWH IDSEL: 0x0
0x7fffffff/0x7fffffff FWH IDSEL: 0x0
0x7fffffff/0x7fffffff FWH IDSEL: 0xf
0x7fffffff/0x7fffffff FWH IDSEL: 0x4
0x7fffffff/0x7fffffff FWH IDSEL: 0x5
0x7fffffff/0x7fffffff FWH IDSEL: 0x6
0x7fffffff/0x7fffffff FWH IDSEL: 0x7
0x7fffffff/0x7fffffff FWH decode enabled
0x7fffffff/0x7fffffff FWH decode enabled
0x7fffffff/0x7fffffff FWH decode enabled
0x7fffffff/0x7fffffff FWH decode enabled
0x7fffffff/0x7fffffff FWH decode enabled
0x7fffffff/0x7fffffff FWH decode enabled
0x7fffffff/0x7fffffff FWH decode enabled
0x7fffffff/0x7fffffff FWH decode enabled
0x7fffffff/0x7fffffff FWH decode disabled
0x7fffffff/0x7fffffff FWH decode disabled
0x7fffffff/0x7fffffff FWH decode disabled
0x7fffffff/0x7fffffff FWH decode disabled
Maximum FWH chip size: 0x380000 bytes
SPI Read Configuration: prefetching enabled, caching enabled, 
BIOS_CNTL = 0x2a: BIOS Lock Enable: enabled, BIOS Write Enable: disabled
Warning: BIOS region SMM protection is enabled!
Warning: Setting Bios Control at 0xdc from 0x2a to 0x09 failed.
New value is 0x2a.
SPIBAR = 0x00007fb550668000 + 0x3800
0x04: 0xe009 (HSFS)
HSFS: FDONE=1, FCERR=0, AEL=0, BERASE=1, SCIP=0, FDOPSS=1, FDV=1, FLOCKDN=1
SPI Configuration is locked down.
Reading OPCODES... done
        OP        Type      Pre-OP
op[0]: 0x05, read  w/o addr, none
op[1]: 0x35, read  w/o addr, none
op[2]: 0x00, write w/o addr, none
op[3]: 0x03, read  w/  addr, none
op[4]: 0x02, write w/  addr, none
op[5]: 0xd8, write w/  addr, none
op[6]: 0x20, write w/  addr, none
op[7]: 0x9f, read  w/o addr, none
Pre-OP 0: 0x06, Pre-OP 1: 0x06
0x06: 0x0004 (HSFC)
HSFC: FGO=0, FCYCLE=2, FDBC=0, SME=0
0x08: 0x00af5cc3 (FADDR)
0x50: 0x00000a0b (FRAP)
BMWAG 0x00, BMRAG 0x00, BRWA 0x0a, BRRA 0x0b
0x54: 0x00000000 FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
0x58: 0x0bff0500 FREG1: BIOS region (0x00500000-0x00bfffff) is read-write.
0x5C: 0x04ff0003 FREG2: Management Engine region (0x00003000-0x004fffff) is locked.
0x60: 0x00020001 FREG3: Gigabit Ethernet region (0x00001000-0x00002fff) is read-write.
0x64: 0x00001fff FREG4: Platform Data region is unused.
Not all flash regions are freely accessible by flashrom. This is most likely
due to an active ME. Please see https://flashrom.org/ME for details.
0x74: 0x00000000 (PR0 is unused)
0x78: 0x8bff0b40 PR1: Warning: 0x00b40000-0x00bfffff is read-only.
0x7C: 0x8b100b10 PR2: Warning: 0x00b10000-0x00b10fff is read-only.
0x80: 0x8ade0ad0 PR3: Warning: 0x00ad0000-0x00adefff is read-only.
0x84: 0x8aaf0800 PR4: Warning: 0x00800000-0x00aaffff is read-only.
At least some flash regions are read protected. You have to use a flash
layout and include only accessible regions. For write operations, you'll
additionally need the --noverify-all switch. See manpage for more details.
0x90: 0xc4 (SSFS)
SSFS: SCIP=0, FDONE=1, FCERR=0, AEL=0
0x91: 0xf94000 (SSFC)
SSFC: SCGO=0, ACS=0, SPOP=0, COP=0, DBC=0, SME=0, SCF=1
0x94: 0x0606     (PREOP)
0x96: 0x3f90     (OPTYPE)
0x98: 0x03003505 (OPMENU)
0x9c: 0x9f20d802 (OPMENU+4)
0xa0: 0x00000000 (BBAR)
0xc4: 0x00802005 (LVSCC)
LVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20, VCL=1
0xc8: 0x00002005 (UVSCC)
UVSCC: BES=0x1, WG=1, WSR=0, WEWS=0, EO=0x20
0xd0: 0x00000000 (FPB)
Reading flash descriptors mapped by the chipset via FDOC/FDOD... done.
=== Content Section ===
FLVALSIG 0x0ff0a55a
FLMAP0   0x03040103
FLMAP1   0x12100206
FLMAP2   0x00210120

--- Details ---
NR          (Number of Regions):                     4
FRBA        (Flash Region Base Address):         0x040
NC          (Number of Components):                  2
FCBA        (Flash Component Base Address):      0x030
ISL         (ICH/PCH/SoC Strap Length):             18
FISBA/FPSBA (Flash ICH/PCH/SoC Strap Base Addr): 0x100
NM          (Number of Masters):                     3
FMBA        (Flash Master Base Address):         0x060
MSL/PSL     (MCH/PROC Strap Length):                 1
FMSBA       (Flash MCH/PROC Strap Base Address): 0x200

=== Component Section ===
FLCOMP   0x4990001c
FLILL    0x00000000

--- Details ---
Component 1 density:            8 MB
Component 2 density:            4 MB
Read Clock Frequency:           20 MHz
Read ID and Status Clock Freq.: 33 MHz
Write and Erase Clock Freq.:    33 MHz
Fast Read is supported.
Fast Read Clock Frequency:      50 MHz
Dual Output Fast Read Support:  disabled
No forbidden opcodes.

=== Region Section ===
FLREG0   0x00000000
FLREG1   0x0bff0500
FLREG2   0x04ff0003
FLREG3   0x00020001

--- Details ---
Region 0 (Descr. ) 0x00000000 - 0x00000fff
Region 1 (BIOS   ) 0x00500000 - 0x00bfffff
Region 2 (ME     ) 0x00003000 - 0x004fffff
Region 3 (GbE    ) 0x00001000 - 0x00002fff

=== Master Section ===
FLMSTR1  0x0a0b0000
FLMSTR2  0x0c0d0000
FLMSTR3  0x08080118

--- Details ---
      Descr. BIOS ME GbE Platf.
BIOS    r     rw      rw     
ME      r         rw  rw     
GbE                   rw     

Enabling hardware sequencing due to multiple flash chips detected.
OK.
The following protocols are supported: Programmer-specific.
Probing for Programmer Opaque flash chip, 0 kB: Hardware sequencing reports 2 attached 
SPI flash chips with a combined density of 12288 kB.
There is only one partition containing the whole address space (0x000000 - 0xbfffff).
There are 3072 erase blocks with 4096 B each.
Found Programmer flash chip "Opaque flash chip" (12288 kB, Programmer-specific) mapped at 
physical address 0x0000000000000000.
Found Programmer flash chip "Opaque flash chip" (12288 kB, Programmer-specific).
page_size=1000
pre-rounding:  start=0x00000000ff400000, len=0xc00000, end=0x0000000100000000
post-rounding: start=0x00000000ff400000, len=0xc00000, end=0x0000000100000000
programmer_map_flash_region: mapping Opaque flash chip from 0x00000000ff400000 to 0x00007fb54f693000
Reading ich descriptor... Reading 4096 bytes starting at 0x000000.
done.
Assuming chipset '6 series Cougar Point'.
page_size=1000
pre-rounding:  start=0x00007fb54f693000, len=0xc00000, end=0x00007fb550293000
post-rounding: start=0x00007fb54f693000, len=0xc00000, end=0x00007fb550293000
programmer_unmap_flash_region: unmapped 0x00007fb54f693000
Looking for region "bios"... found.
Using region: "bios".
page_size=1000
pre-rounding:  start=0x00000000ff400000, len=0xc00000, end=0x0000000100000000
post-rounding: start=0x00000000ff400000, len=0xc00000, end=0x0000000100000000
programmer_map_flash_region: mapping Opaque flash chip from 0x00000000ff400000 to 0x00007fb54f693000
Reading flash... Reading 7340032 bytes starting at 0x500000.
done.
page_size=1000
pre-rounding:  start=0x00007fb54f693000, len=0xc00000, end=0x00007fb550293000
post-rounding: start=0x00007fb54f693000, len=0xc00000, end=0x00007fb550293000
programmer_unmap_flash_region: unmapped 0x00007fb54f693000
Restoring MMIO space at 0x7fb55066b8a0
Restoring PCI config space for 00:1f:0 reg 0xdc

Looks fine? Executing without -VVV produces no errors.

I download the latest 1vyrain repo and run the .sh script, which chops off 4megs of the file, then puts it into the patcher binary.

Code: Select all

./patch.sh
4194304+0 records in
4194304+0 records out
4194304 bytes (4.2 MB, 4.0 MiB) copied, 35.4726 s, 118 kB/s
Error 
Patched BIOS saved as patched.rom

But it doesn't create a patched.rom file.

The script doesn't do anything special.

mv *.FL1 BIOS.FL1
dd if=BIOS.FL1 bs=1 of=BIOS.rom skip=464 count=4194304

printf "32442D09-1D11-4E27-8AAB-90FE6ACB0489 10 O:02A0:778B1D826D24964E8E103467D56AB1BA \nF7731B4C-58A2-4DF4-8980-5645D39ECE58 10 P:44243080fb0175080fbae80f89442430:44243080fb01eb080fbae80f89442430 \nF7731B4C-58A2-4DF4-8980-5645D39ECE58 10 P:30488b4338f6000874080fba6c243014:30488b4338f60008eb080fba6c243014 \n" > patches.txt

if grep -q "GCET\|G7ET" *.FL1; then
printf "79E0EDD7-9D1D-4F41-AE1A-F896169E5216 10 P:41390C240F84:41390C2490E9 \n79E0EDD7-9D1D-4F41-AE1A-F896169E5216 10 P:41390C240F858D:41390C240F8500 \n79E0EDD7-9D1D-4F41-AE1A-F896169E5216 10 P:41394C24047577:41394C24047500 \n79E0EDD7-9D1D-4F41-AE1A-F896169E5216 10 P:413AED0F8497FEFFFF:413AED0F8400000000 " >> patches.txt
else
printf "79E0EDD7-9D1D-4F41-AE1A-F896169E5216 10 P:C8390F0F84:C8390F90E9 \n79E0EDD7-9D1D-4F41-AE1A-F896169E5216 10 P:C8390F7516:C8390F7500 \n79E0EDD7-9D1D-4F41-AE1A-F896169E5216 10 P:C8394F0474:C8394F04EB" >> patches.txt
fi

./patcher ./BIOS.rom ./patches.txt -o ./patched.rom

echo "Patched BIOS saved as patched.rom"

[strider]

Does 1vyrain remove battery check for original in T430s or still need to do Hamishcoleman Thinkpad-EC hack?

If still need Hamishcoleman Thinkpad-EC hack, can it be done AFTER 1vyrain install? (I already 1vyrain v5)
Thank you.

Still have the questions above

[TPFanatic]

you still need the EC hack.

I'd do the EC hack first.

I'd actually not recommend doing 1vyrain since the 802.11n cards work just fine and 1vyrain has a bad habit of wiping out SLIC tables.