Take a look at our
ThinkPads.com HOME PAGE
For those who might want to contribute to the blog, start here: Editors Alley Topic
Then contact Bill with a Private Message

Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

Performance, hardware, software, general buying and gaming discussion..
Post Reply
Message
Author
TPFanatic
ThinkPadder
ThinkPadder
Posts: 1409
Joined: Thu Jul 30, 2015 11:29 pm
Location: Boston, Massachusetts

Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#1 Post by TPFanatic » Tue Sep 10, 2019 8:45 pm

https://github.com/hamishcoleman/thinkpad-ec
hamish coleman wrote:As the result of CVE-2019-6171, it looks like newer Lenovo firmware update files are adding a digital signature. If you upgrade to a version using this, you will not be able to patch your EC.

Code: Select all

laptop 	last good 	 	 	 	  	first locked version
t430 	t430 BIOS 2.81 (G1ETC1WW) EC 1.13 (G1HT35WW) 	t430 BIOS 2.82 (G1ETC2WW) EC 1.14 (G1HT36WW)
Basically, any BIOS update package where the changelog mentions CVE-2019-6171 will have this lockdown.

Lenovo is tracking their response to this CVE at: https://support.lenovo.com/gb/en/solutions/len-27764
lenovo T420 i7 2670qm 16GB QHD + eGPU GTX 960
lenovo T430s i5 3230m 16GB QHD w/ optimus(RIP), lenovo T430 i5 3320m 8GB FHD, lenovo T500 P9700 8GB WUXGA(LED) w/ switchable graphics
Enable 2 finger scroll on old Synaptics touchpads with registry.

ajkula66
SuperUserGeorge
SuperUserGeorge
Posts: 16849
Joined: Sun Feb 25, 2007 11:28 am
Location: Brodheadsville, Pennsylvania, USA

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#2 Post by ajkula66 » Tue Sep 10, 2019 10:15 pm

Wow someone had a lot of time on their hands addressing this on a 6-7 year old generation of laptops.

:roll: :roll: :roll:
...Knowledge is a deadly friend when no one sets the rules...(King Crimson)

Cheers,

George (your grouchy retired FlexView farmer)

FlexView AARP club members:A31p, T43pSF

Abused daily: T520, X200s


PMs requesting personal tech support will be ignored.

dr_st
Moderator
Moderator
Posts: 8428
Joined: Sat Oct 29, 2005 6:20 am
Location: Israel

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#3 Post by dr_st » Tue Sep 10, 2019 11:43 pm

Wow, it actually looks like they are not addressing any real vulnerability. They actually specifically wanted to remove the ability to update the EC firmware. That's the entire point of these updates.
Thinkpad 25 (20K7), X1 Carbon (20HQ), Yoga 14 (20FY), T430s (IPS FHD + Classic Keyboard), X220 4291-4BG
X61 7673-V2V, T60 2007-QPG, T42 2373-F7G, X32 (IPS Screen), A31p w/ Ultrabay Numpad, A21m 2628-GXU

ajkula66
SuperUserGeorge
SuperUserGeorge
Posts: 16849
Joined: Sun Feb 25, 2007 11:28 am
Location: Brodheadsville, Pennsylvania, USA

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#4 Post by ajkula66 » Wed Sep 11, 2019 12:03 am

dr_st wrote:
Tue Sep 10, 2019 11:43 pm
Wow, it actually looks like they are not addressing any real vulnerability. They actually specifically wanted to remove the ability to update the EC firmware. That's the entire point of these updates.
Are you surprised ?

Removing *real* vulnerabilities was never too high on Lenovo's list of priorities. Not that other manufacturers were more diligent.

This is just...IDK...ridiculous? Childish?

I'm having difficulty describing their move and that doesn't happen very often.
...Knowledge is a deadly friend when no one sets the rules...(King Crimson)

Cheers,

George (your grouchy retired FlexView farmer)

FlexView AARP club members:A31p, T43pSF

Abused daily: T520, X200s


PMs requesting personal tech support will be ignored.

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 21170
Joined: Mon Sep 18, 2006 5:17 am
Location: Dublin, Éire
Contact:

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#5 Post by RealBlackStuff » Wed Sep 11, 2019 1:06 am

They may not have intended to stop the Classic Keyboard swap, but rather the original-battery-check removal.
Either way, Lenono proves once more that they are a bunch of arseonists!
Lovely day for a Guinness! (the Real Black Stuff). And pigs CAN fly!
Check out The Boardroom for Parts, Mods and Other Services.

dr_st
Moderator
Moderator
Posts: 8428
Joined: Sat Oct 29, 2005 6:20 am
Location: Israel

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#6 Post by dr_st » Wed Sep 11, 2019 4:02 am

In any case, it's not a big deal, since no one needs to be updating BIOS on such old systems anyways. However, it's an important warning for people against accidental upgrades.

What happens if you accidentally upgraded, though? I believe there are methods to force downgrade Thinkpad BIOS even from versions that are designed to prevent it.
Thinkpad 25 (20K7), X1 Carbon (20HQ), Yoga 14 (20FY), T430s (IPS FHD + Classic Keyboard), X220 4291-4BG
X61 7673-V2V, T60 2007-QPG, T42 2373-F7G, X32 (IPS Screen), A31p w/ Ultrabay Numpad, A21m 2628-GXU

TinkerMan
Sophomore Member
Posts: 212
Joined: Sun Jun 24, 2018 4:02 am
Location: Paris, France

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#7 Post by TinkerMan » Fri Sep 13, 2019 7:02 am

so what models are concerned about this ?
W530, 3630QM, 32GB, K2000M
P1, XEON 2176, 32GB ECC, P2000, IPS
X230, 3320M, 16GB, HD4000, IPS
T601F X9000, 8GB, X3100, UXGA FlexView 1600x1200
T61 14" 4:3, T9500, 8GB, NVS140M
T60 14" 4:3, T7600, 3GB, GMA950
P71, 7700HQ, 16GB, P600, IPS
X201, 520M, 8GB, SSD, W10
R61i, T430s, T43p

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 21170
Joined: Mon Sep 18, 2006 5:17 am
Location: Dublin, Éire
Contact:

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#8 Post by RealBlackStuff » Fri Sep 13, 2019 7:29 am

Guess you did not read the Lenovo link in the first post...
Lovely day for a Guinness! (the Real Black Stuff). And pigs CAN fly!
Check out The Boardroom for Parts, Mods and Other Services.

TinkerMan
Sophomore Member
Posts: 212
Joined: Sun Jun 24, 2018 4:02 am
Location: Paris, France

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#9 Post by TinkerMan » Sun Sep 15, 2019 3:37 am

RealBlackStuff wrote:
Fri Sep 13, 2019 7:29 am
Guess you did not read the Lenovo link in the first post...
i did, but I didnt understand one yota, the info on the link says something about allowing newer thinkpads to use the old 7 key row, but the comments here talk about a new bios blocking this action, hence my confusion.
W530, 3630QM, 32GB, K2000M
P1, XEON 2176, 32GB ECC, P2000, IPS
X230, 3320M, 16GB, HD4000, IPS
T601F X9000, 8GB, X3100, UXGA FlexView 1600x1200
T61 14" 4:3, T9500, 8GB, NVS140M
T60 14" 4:3, T7600, 3GB, GMA950
P71, 7700HQ, 16GB, P600, IPS
X201, 520M, 8GB, SSD, W10
R61i, T430s, T43p

thelash
Posts: 41
Joined: Sat Aug 06, 2016 11:34 pm
Location: Eltham, New Zealand

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#10 Post by thelash » Tue Sep 17, 2019 2:28 am

I have been using lenovo vantage for system updates on my T430, and - yes a bit naive - installed t430 BIOS 2.82 (G1ETC2WW) EC 1.14 (G1HT36WW), the first locked bios in hamishcoleman's article. Intending to install the 7 row keyboard one day, I find that Lenovo don't want me too. How is that going to hurt them? So, finding under 'security' in my bios that 'prevent rollback' or something like that is disabled, I downloaded an earlier bios from Lenovo.com and it flashed without a hitch. Seemed too simple - wonder how long before Lenovo blocks rollbacks in their earnest quest to save us from ourselves?
T430 ips, T440p.

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 21170
Joined: Mon Sep 18, 2006 5:17 am
Location: Dublin, Éire
Contact:

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#11 Post by RealBlackStuff » Tue Sep 17, 2019 4:41 am

As long as you don't (unnecessarily) update your BIOS (and don't get misled/waylaid by unwanted Micro$haft/Vantage/System updates), you will be spared from that Lenono evil.
Lovely day for a Guinness! (the Real Black Stuff). And pigs CAN fly!
Check out The Boardroom for Parts, Mods and Other Services.

czubaka
Posts: 2
Joined: Mon Dec 23, 2019 5:26 pm
Location: Cracov, PL

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#12 Post by czubaka » Mon Dec 23, 2019 5:36 pm

Hello,

I know that this post is a bit old now but I've just faced a problem with updating my t430s... its about step 6 in Hamish guide

If it will always download the original file from Lenovo does it mean... it will be this locked newest bios ?
If yes so how can I change this 6th step to make it work with 2.75 img file that I've downloaded manually ? (it's the latest unlocked bios for t430s) I will be grateful for help because I am kinda noob with linux :/
Using the name chosen in the previous step, make the fully patched image for this laptop (this will download the original file from Lenovo and patch it):

make patched.x230.img

moofish2842
Posts: 15
Joined: Tue Sep 17, 2019 2:57 pm
Location: La Verkin, Utah

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#13 Post by moofish2842 » Wed Dec 25, 2019 3:19 pm

The reason this works is that, to my understanding, the current BIOS is what blocks the flash, not what you are updating to. Thus, if you are not on the newest version that blocks flashing, then flashing the newest modified version can’t be blocked because it is handled by the non-blocking BIOS. Sorry if that was a bad explanation, but basically you can go ahead and flash this update, however you will have to roll back in order to perform the modified flash again e.g. reverting to a modern keyboard.
W541 - i7-4940mx, 8gb RAM, Quadro k2100m
T530 - i7-3632qm, 8gb RAM, NVS 5400M; motherboard upgrade from t520.
T430 - i5-3320m, 4gb
T430s - i7-3520m, 8gb
Helix 1st Gen - i5-3337u 4gb
Other experience with X230t and t540p
I am 15 years old

czubaka
Posts: 2
Joined: Mon Dec 23, 2019 5:26 pm
Location: Cracov, PL

Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods

#14 Post by czubaka » Thu Dec 26, 2019 6:12 pm

Hm I'm not sure... I'have t430s with 2.75 bios (and EC 1.14) when I run this "make" command I think it will try to download the newest bios (2.82 with EC 1.15 that is locked) so I think I should modify this make file and force it to use img file with 2.75 bios that I downloaded before instead of trying to download the newest verrsion...

But I don't know how :/

BTW
I'm using FHD kit and it works perfectly. My T430s has got wonderful 1900x1050 IPS screen :D

Post Reply
  • Similar Topics
    Replies
    Views
    Last post

Return to “Thinkpad - General HARDWARE/SOFTWARE questions”

Who is online

Users browsing this forum: No registered users and 8 guests