thinkpads.com Support Community Forum Index Bill Morrow's thinkpads.com Open Forum - The Original Thinkpad Support Forum
Follow ThinkpadsForum on Twitter
Goodbye Lorita, wherever you've gone..

If you've found this forum useful, please consider donating a dollar or two

It is currently Wed Mar 29, 2017 5:46 pm

All times are UTC-05:00




Post new topic  Reply to topic  [ 297 posts ]  Go to page 1 2 3 4 510 Next
Author Message
PostPosted: Wed Apr 13, 2016 1:37 pm 
Offline
Junior Member
Junior Member

Joined: Fri Mar 04, 2016 8:38 am
Posts: 366
Location: Moscow, Russia
Hi folks,
You may have remember some attempts to install classic X220 keyboard into X230 - they were not quite successful.

Recently I stumbled upon a story of removing lenovo battery authentity check, which as it turned out was implemented in the Embedded Controller firmware. The author published a toolset required to reproduce his work. Someone used these tools to try make X220 keyboard work in X230 - and reported partial success - got working Delete, PgUp, PgDn, Wback, Wfwd and Menu. However, PrtSc, ScrLk, Pause, Insert and Home were still malfunctioning.
I continued his research and found another table which is related to keyboard mappings:

Code:
0x000219E8: FF 00 7F 00 7F 00 FF 00 FF 00 FF 00 FF 00 FF 00
0x000219F8: FF 00 8A 00 FF 00 D3 00 A2 00 A0 00 48 00 41 80


Each byte of this table is a bitmask, which enables handling of corresponding cells in keyboard matrix.
To make new mapping work, I modified this mask table as follows:

Code:
0x000219E8: FF 00 7F 00 7F 00 FF 00 FF 00 FF 00 FF 00 FF 00
0x000219F8: FF 00 8B 00 FF 00 D3 00 E3 00 A6 00 48 00 41 80


After I flashed modified EC image, all keys are working.
Now all that left is Fn keys (and, probably, CapsLock led). I'll post here once we get progress with that.

A guide on how to patch and flash EC firmware on Reddit - thanks to theamdman

WARNING

X220/X230 keyboard pinouts are slightly different, so first thing you need to do is to isolate pins #25 and #29 (grab a schematic to see where they are [Page 63]). The reason for it is that in X230 keyboard these pins are separated, but in X220 one they are connected all together, shorting VCC5M_KBD (pin #25) to ground through the keyboard cable. I disassembled the keyboard and covered #25, #27 and #29 with a piece of scotch tape (#27 is redundant since it's connected directly to ground on the motherboard).

nitrocaster wrote:
You need to disassemble the keyboard.
I got a cheapass chinese keyboard (don't buy these) and took some pictures that can help to understand the process: http://imgur.com/a/YLW83

MOD edit: there are two layers of gold-contacts. The tape goes on the right-hand side of the layer closest to the keyboard-metal.
Check again: http://i.imgur.com/Lx41VMw.jpg

Ignoring this thing will cause keyboard overheating and damage.

_________________
For those who interested in buying X220/X230 FHD kit: Read this before sending me a PM!
X230: i7-3520M | 16GB RAM | 512GB M.2 Micron M600 | LG LP125WF2-SPB4 FHD IPS | 9c Li-Ion | Win8.1 Pro 64


Last edited by nitrocaster on Sun Jun 05, 2016 4:50 am, edited 5 times in total.

Top
   
PostPosted: Thu Apr 14, 2016 1:33 am 
Offline
Senior ThinkPadder
Senior ThinkPadder

Joined: Sat Oct 29, 2005 6:20 am
Posts: 6546
This is actually an amazing achievement. :thumbs-UP:

_________________
Current: X220 4291-4BG, T410 2537-R46, T60 1952-F76, T60 2007-QPG, T42 2373-F7G
Collectibles: T430s (IPS FHD + Classic Keyboard), X32 (IPS Screen)
Retired: X61 7673-V2V, A31p w/ Ultrabay Numpad
Past: Z61t 9440-A23, T60 2623-D3U, X32 2884-M5U


Top
   
PostPosted: Thu Apr 14, 2016 5:19 am 
Offline
Freshman Member

Joined: Thu Apr 14, 2016 4:08 am
Posts: 80
Location: Melbourne, Australia
Full, step-by-step instructions for patching your firmware: README

This README file is part of the project that creates a bootable USB stick to update your firmware (Essentially automating the same process that zmatt described in his blog posts about hacking his battery)

I also recommend reading the thinkwiki page that extensively documents the hardware steps for keyboard replacement


Last edited by hamish on Sun Aug 28, 2016 9:11 am, edited 2 times in total.

Top
   
PostPosted: Thu Apr 14, 2016 11:25 am 
Offline
Freshman Member

Joined: Fri Jun 13, 2014 6:28 pm
Posts: 63
Location: Manchester, England
Now if only this method could be replicated to remove the wlan whitelist....


Top
   
PostPosted: Thu Apr 14, 2016 2:14 pm 
Offline
Admin
Admin

Joined: Mon Sep 18, 2006 5:17 am
Posts: 17127
Location: Mt. Cobb, PA USA
For X230T it has already been done: https://www.bios-mods.com/forum/Thread- ... ware-Flash
The X230 BIOS can't be too far off.

_________________
Lovely day for a Guinness! (The Real Black Stuff)

Check out The Boardroom for Parts, Mods and Other Services.
And don't forget the Motherboards! Refreshing webpages is advised!


Top
   
PostPosted: Thu Apr 14, 2016 2:55 pm 
Offline
Freshman Member

Joined: Fri Jun 13, 2014 6:28 pm
Posts: 63
Location: Manchester, England
RealBlackStuff wrote:
For X230T it has already been done: https://www.bios-mods.com/forum/Thread- ... ware-Flash
The X230 BIOS can't be too far off.


Modified bioses exist for the X230 as well, but that method involves hardware flashing, while the modified EC can be software flashed. The difference is that the EC is in the .FL2 file, the bios (and the whitelist) in the .FL1 file which, if I understood correctly, uses crc and encryption.


Top
   
PostPosted: Thu Apr 14, 2016 6:24 pm 
Offline
Junior Member
Junior Member

Joined: Fri Mar 04, 2016 8:38 am
Posts: 366
Location: Moscow, Russia
harryK wrote:
The difference is that the EC is in the .FL2 file, the bios (and the whitelist) in the .FL1 file which, if I understood correctly, uses crc and encryption.

As far as I can see, BIOS comes without encryption.

_________________
For those who interested in buying X220/X230 FHD kit: Read this before sending me a PM!
X230: i7-3520M | 16GB RAM | 512GB M.2 Micron M600 | LG LP125WF2-SPB4 FHD IPS | 9c Li-Ion | Win8.1 Pro 64


Top
   
PostPosted: Fri Apr 15, 2016 8:02 am 
Offline
Freshman Member

Joined: Fri Jun 13, 2014 6:28 pm
Posts: 63
Location: Manchester, England
nitrocaster wrote:
harryK wrote:
The difference is that the EC is in the .FL2 file, the bios (and the whitelist) in the .FL1 file which, if I understood correctly, uses crc and encryption.

As far as I can see, BIOS comes without encryption.


True. But apparently (software) flashing a BIOS with a modified .FL1 results in a "SecureFlash Error" on X230 and subsequent models :-/
https://www.bios-mods.com/forum/Thread- ... val?page=2


Top
   
PostPosted: Sat Apr 16, 2016 5:08 am 
Offline
Freshman Member

Joined: Tue Feb 17, 2009 8:13 am
Posts: 70
Location: Jørpeland, Norway
Will this modification be possible to perform on a T430s, or is the EC firmware different?

_________________
IBM X20, X40, X41T, X60s, X61s, R52, T40, T42-IPS, T43, T60, T60p-IPS, T61, T61 QXGA-IPS (T60 body + T9500, Intel GPU, 250GB SSD, 8GB, Win 10 Pro)
Lenovo X201i-AFFS, X230-IPS, X301, T410s, T420s, T430s-IPS, T440s-IPS, W500, T520, Slate Tablet

Non-TP: Google Chromebook Pixel 2013


Top
   
PostPosted: Sat Apr 16, 2016 7:41 am 
Offline
Junior Member
Junior Member

Joined: Fri Mar 04, 2016 8:38 am
Posts: 366
Location: Moscow, Russia
Frobe70 wrote:
Will this modification be possible to perform on a T430s, or is the EC firmware different?

It has the same EC and similar firmware, so - yes, should be possible.

_________________
For those who interested in buying X220/X230 FHD kit: Read this before sending me a PM!
X230: i7-3520M | 16GB RAM | 512GB M.2 Micron M600 | LG LP125WF2-SPB4 FHD IPS | 9c Li-Ion | Win8.1 Pro 64


Top
   
PostPosted: Sat Apr 16, 2016 8:51 am 
Offline
SuperUserGeorge
SuperUserGeorge

Joined: Sun Feb 25, 2007 11:28 am
Posts: 15649
Location: Brodheadsville, Pennsylvania
dr_st wrote:
This is actually an amazing achievement. :thumbs-UP:


Indeed it is. Way above my pay grade, unfortunately....

_________________
...Knowledge is a deadly friend when no one sets the rules...(King Crimson)

Cheers,

George (your grouchy retired FlexView farmer)

AARP club members:A31p, T43pSF

Abused daily: R61

PMs requesting personal tech support will be ignored.


Top
   
PostPosted: Sun Apr 17, 2016 11:40 pm 
Offline

Joined: Tue Aug 02, 2011 8:52 pm
Posts: 23
Location: Doylestown, PA
subscribed. I've lazily googled this several times over the last year. I lack the skillset to figure it out but I applaud those that can! Keep up the good work.

I will build an x230 with a real keyboard when the toolset is available. Heck, I'd chip in to pay for the development. I'd wager others would, too.

Jamie


Top
   
PostPosted: Mon Apr 18, 2016 1:14 am 
Offline
Freshman Member

Joined: Tue Feb 17, 2009 8:13 am
Posts: 70
Location: Jørpeland, Norway
imaradiostar wrote:
subscribed. I've lazily googled this several times over the last year. I lack the skillset to figure it out but I applaud those that can! Keep up the good work.

I will build an x230 with a real keyboard when the toolset is available. Heck, I'd chip in to pay for the development. I'd wager others would, too.

Jamie


Yes, an easy software tool for modification is needed for us with more experience in handling soldering irons and mechanical tools. I paid Middleton for his BIOS modification before I had bought a T61 board to modify.

_________________
IBM X20, X40, X41T, X60s, X61s, R52, T40, T42-IPS, T43, T60, T60p-IPS, T61, T61 QXGA-IPS (T60 body + T9500, Intel GPU, 250GB SSD, 8GB, Win 10 Pro)
Lenovo X201i-AFFS, X230-IPS, X301, T410s, T420s, T430s-IPS, T440s-IPS, W500, T520, Slate Tablet

Non-TP: Google Chromebook Pixel 2013


Top
   
PostPosted: Mon Apr 18, 2016 1:21 am 
Offline

Joined: Tue Aug 02, 2011 8:52 pm
Posts: 23
Location: Doylestown, PA
Frobe70 wrote:
imaradiostar wrote:
subscribed. I've lazily googled this several times over the last year. I lack the skillset to figure it out but I applaud those that can! Keep up the good work.

I will build an x230 with a real keyboard when the toolset is available. Heck, I'd chip in to pay for the development. I'd wager others would, too.

Jamie


Yes, an easy software tool for modification is needed for us with more experience in handling soldering irons and mechanical tools. I paid Middleton for his BIOS modification before I had bought a T61 board to modify.


Good call. I'm an electronics tech but not much of a programmer.

JT


Top
   
PostPosted: Mon Apr 18, 2016 6:53 am 
Offline
Freshman Member

Joined: Thu Apr 14, 2016 4:08 am
Posts: 80
Location: Melbourne, Australia
Frobe70 wrote:
imaradiostar wrote:
subscribed. I've lazily googled this several times over the last year. I lack the skillset to figure it out but I applaud those that can! Keep up the good work.

I will build an x230 with a real keyboard when the toolset is available. Heck, I'd chip in to pay for the development. I'd wager others would, too.

Jamie


Yes, an easy software tool for modification is needed for us with more experience in handling soldering irons and mechanical tools. I paid Middleton for his BIOS modification before I had bought a T61 board to modify.


The difficult bit comes from not knowing if we have the right to distribute the EC firmware file. It should be possible to make a bootable USB image that simply flashes the firmware, but there would still be an awkward step to download the original firmware from lenovo and patch it - even if that was fairly well automated, it can start to get quite fragile.

That being said, It sure can be made simpler than it currently is :-)


Top
   
PostPosted: Mon Apr 18, 2016 7:17 am 
Offline
Freshman Member

Joined: Thu Apr 14, 2016 4:08 am
Posts: 80
Location: Melbourne, Australia
Update on my progress:

I have found most of the missing Fn key combo tables and patched them too - Currently, the only keys missing are Fn+F2 (Lock), Fn+F3 (Battery), Fn+F12 (Hibernate) and Fn+Space (Magnify?). Actually, the Lock function is there, but it is in the wrong spot at Fn+F3.

So, it is essentially fully working :-)

I have updated the details on the thinkwiki page with the exact patch needed.


Top
   
PostPosted: Mon Apr 18, 2016 12:08 pm 
Offline
Junior Member
Junior Member

Joined: Fri Mar 04, 2016 8:38 am
Posts: 366
Location: Moscow, Russia
Fn+F2 and Fn+F3 can be swapped (so that Fn+F2 will do screenlock) with this patch:

Code:
 00021668 B4 8E 01 00
-0002166C C0 70 C0 71
-00021670 C0 72 C7 73
+0002166C C0 70 C0 72
+00021670 C0 71 C7 73
 00021674 E4 50 E5 51

_________________
For those who interested in buying X220/X230 FHD kit: Read this before sending me a PM!
X230: i7-3520M | 16GB RAM | 512GB M.2 Micron M600 | LG LP125WF2-SPB4 FHD IPS | 9c Li-Ion | Win8.1 Pro 64


Top
   
PostPosted: Mon Apr 18, 2016 7:14 pm 
Offline
Junior Member
Junior Member

Joined: Fri Mar 04, 2016 8:38 am
Posts: 366
Location: Moscow, Russia
Just installed the keyboard, it feels awesome! Had to cut some plastic on top side to fit into X230 keyboard bezel, cut notches in the palmrest and remove bottom nub.
Ideally, X220 keyboard bezel and palmrest are required.

_________________
For those who interested in buying X220/X230 FHD kit: Read this before sending me a PM!
X230: i7-3520M | 16GB RAM | 512GB M.2 Micron M600 | LG LP125WF2-SPB4 FHD IPS | 9c Li-Ion | Win8.1 Pro 64


Top
   
PostPosted: Tue Apr 19, 2016 2:42 am 
Offline
Freshman Member

Joined: Fri Jun 13, 2014 6:28 pm
Posts: 63
Location: Manchester, England
It works perfectly! I only had to cut away the three small nubs at the bottom of the keyboard and it fitted perfectly. It's awesome, I had almost forgotten the feeling of the classic keyboard :-)
Thank you hamish and nitrocaster!

http://imgur.com/a/DzeXy

Since I was at it I also patched the bios to edit the wlan whitelist. When reflashing, the EC portion went through fine and the bios portion failed with "SecureBIOS error" as expected. So, it is clear that only the first 8Mb of the firmware (the BIOS portion) are write protected.


Top
   
PostPosted: Tue Apr 19, 2016 2:59 am 
Offline
Junior Member
Junior Member

Joined: Fri Mar 04, 2016 8:38 am
Posts: 366
Location: Moscow, Russia
harryK wrote:
I only had to cut away the three small nubs at the bottom of the keyboard and it fitted perfectly.

Only three? It has 5 nubs, while palmrest has 4 notches for smaller nubs. As I understand, you either cut all of them or cut the one near trackpoint buttons and adjust 4 notches in the palmrest.

_________________
For those who interested in buying X220/X230 FHD kit: Read this before sending me a PM!
X230: i7-3520M | 16GB RAM | 512GB M.2 Micron M600 | LG LP125WF2-SPB4 FHD IPS | 9c Li-Ion | Win8.1 Pro 64


Top
   
PostPosted: Tue Apr 19, 2016 3:13 am 
Offline
Freshman Member

Joined: Fri Jun 13, 2014 6:28 pm
Posts: 63
Location: Manchester, England
nitrocaster wrote:
harryK wrote:
I only had to cut away the three small nubs at the bottom of the keyboard and it fitted perfectly.

Only three? It has 5 nubs


You're right, 5 nubs. Sorry.
I did the cutting a while ago and forgot about it because I couldn't use the keyboard with the wrong mapping, until today :-)

I didn't touch the palmrest though, I am sure. With the five nubs removed the keyboard fits well with the X230 palmrest. it's easier if you install the keyboard first and then the palmrest.


Top
   
PostPosted: Fri Apr 22, 2016 2:34 am 
Offline
Freshman Member

Joined: Thu Apr 14, 2016 4:08 am
Posts: 80
Location: Melbourne, Australia
imaradiostar wrote:
Frobe70 wrote:

Yes, an easy software tool for modification is needed for us with more experience in handling soldering irons and mechanical tools. I paid Middleton for his BIOS modification before I had bought a T61 board to modify.


Good call. I'm an electronics tech but not much of a programmer.

JT


I've been trying to think of ways to make this process simpler - but one of my stumbling blocks is that I cannot distribute the copyrighted firmware file, so I still need to distribute a patch file - and cannot just have a "click on this to fix" all-in-one tool. I can cut out all the mucking about with downloading and compiling the mec_tools though.

I have rolled all the patches into one - including the checksums and encryption, which ends up with a >550 line patch file. I have a tool to apply this binary patch, but it needs perl to use. Then there is still the flash tool to run.

I'm happy to try and make it more accessible for people, but I'm looking for some advice on how much complexity you want to handle..


Top
   
PostPosted: Fri Apr 22, 2016 8:12 am 
Offline
Junior Member
Junior Member

Joined: Fri Mar 04, 2016 8:38 am
Posts: 366
Location: Moscow, Russia
I ported mec-tools to Windows and uploaded a binary release - see here (requires VC140 runtime).

_________________
For those who interested in buying X220/X230 FHD kit: Read this before sending me a PM!
X230: i7-3520M | 16GB RAM | 512GB M.2 Micron M600 | LG LP125WF2-SPB4 FHD IPS | 9c Li-Ion | Win8.1 Pro 64


Top
   
PostPosted: Fri Apr 22, 2016 8:34 pm 
Offline
Freshman Member

Joined: Thu Apr 14, 2016 4:08 am
Posts: 80
Location: Melbourne, Australia
nitrocaster wrote:
Frobe70 wrote:
Will this modification be possible to perform on a T430s, or is the EC firmware different?

It has the same EC and similar firmware, so - yes, should be possible.


I've just downloaded the t430s g7uj18us.iso bios update, extracted the EC firmware and had a look - all the same keyboard tables are there, and it looks totally patchable


Top
   
PostPosted: Sat Apr 23, 2016 4:13 pm 
Offline

Joined: Sun Jan 17, 2016 12:17 pm
Posts: 11
Location: Haifa, Israel
hamish wrote:
nitrocaster wrote:
It has the same EC and similar firmware, so - yes, should be possible.


I've just downloaded the t430s g7uj18us.iso bios update, extracted the EC firmware and had a look - all the same keyboard tables are there, and it looks totally patchable

That is very exciting news! Just want to thank you guys for working on this. It this patch works for the T430 it will be a game changer!


Top
   
PostPosted: Sat Apr 23, 2016 4:22 pm 
Offline
Junior Member
Junior Member

Joined: Fri Mar 04, 2016 8:38 am
Posts: 366
Location: Moscow, Russia
Botticelli wrote:
It this patch works for the T430 it will be a game changer!

It has the same EC, sure it will work.

_________________
For those who interested in buying X220/X230 FHD kit: Read this before sending me a PM!
X230: i7-3520M | 16GB RAM | 512GB M.2 Micron M600 | LG LP125WF2-SPB4 FHD IPS | 9c Li-Ion | Win8.1 Pro 64


Top
   
PostPosted: Sat Apr 23, 2016 8:38 pm 
Offline
Freshman Member

Joined: Thu Apr 14, 2016 4:08 am
Posts: 80
Location: Melbourne, Australia
Botticelli wrote:
hamish wrote:

I've just downloaded the t430s g7uj18us.iso bios update, extracted the EC firmware and had a look - all the same keyboard tables are there, and it looks totally patchable

That is very exciting news! Just want to thank you guys for working on this. It this patch works for the T430 it will be a game changer!


I have created a trial patch for t430 - If you have the ability to try it: https://gist.github.com/hamishcoleman/c ... 43f3160d48

For reference, the system I am using to create patches is at https://github.com/hamishcoleman/thinkpad-ec


Top
   
PostPosted: Sun Apr 24, 2016 12:36 am 
Offline

Joined: Sun Apr 24, 2016 12:29 am
Posts: 6
Location: Berlin, DE
Wow, great work! As someone who's been desperately searching for an upgrade path from the X220 tablet for years, this is just the ray of hope I needed :)

Do you think this method could generalise to newer Thinkpads than the xx30 generation, or is the way they handle keyboards too different? (I'm thinking of software/connector differences more than the shape of the keyboard assembly; in a pinch, I imagine there's plenty you can do to plastic given access to a machine shop...)


Top
   
PostPosted: Sun Apr 24, 2016 1:40 am 
Offline
Freshman Member

Joined: Thu Apr 14, 2016 4:08 am
Posts: 80
Location: Melbourne, Australia
4bpp wrote:
Wow, great work! As someone who's been desperately searching for an upgrade path from the X220 tablet for years, this is just the ray of hope I needed :)

Do you think this method could generalise to newer Thinkpads than the xx30 generation, or is the way they handle keyboards too different? (I'm thinking of software/connector differences more than the shape of the keyboard assembly; in a pinch, I imagine there's plenty you can do to plastic given access to a machine shop...)


I've looked at the firmware for three of the xx30 generation laptops, and I was able to find the right keyboard data in all three cases, so I am hoping that it just as straight-forward to apply the same process to others in that generation.

See http://www.thinkwiki.org/wiki/Install_C ... r_Firmware for the current list of firmware I have looked at


Top
   
PostPosted: Sun Apr 24, 2016 2:18 am 
Offline

Joined: Sun Apr 24, 2016 12:29 am
Posts: 6
Location: Berlin, DE
hamish wrote:
I've looked at the firmware for three of the xx30 generation laptops, and I was able to find the right keyboard data in all three cases, so I am hoping that it just as straight-forward to apply the same process to others in that generation.

See http://www.thinkwiki.org/wiki/Install_C ... r_Firmware for the current list of firmware I have looked at

Sorry, I meant the generations that are still newer (xx40~xx60, or perhaps even the Yoga 260 for an actual digitiser machine). Did you have any chance at all to look at the firmware of those?

(Also, in the xx30 series, does the X230 tablet have the same firmware as the X230? (I wouldn't expect them to be too different, at least...))


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 297 posts ]  Go to page 1 2 3 4 510 Next

All times are UTC-05:00


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Limited