T480 advanced BIOS and KB matrix EC cracking - Some progress!

[H-Atkinson]

I have been able to get some more info from the TP community at reddit. I made a post over there enlisting the help of anyone with info on Leokim's T480 EC crack, or any other method of achieving the same result, to let me know. A used PMed me (and requested I not name them) and provided me a step-by-step process for how the EC mod worked, but unfortunately didn't have access to what software was used, or any of Leokim's BIOS/Firmwares that he modified. The steps are as follows:

-Open bottom case, disconnect all power including CMOS
-Locate JTAG 2 connector under where WWAN card goes
-solder a lead to each pad of JTAG 2
-Solder "3 100kohm resistors to the pads above JTAG 2" (no info/photos beyond this, Im a bit confused)
-use SVOD3 in MEC mode to read firmware of MEC1653 (thinkengine) and back it up
-modify firmware (presumably somehow enabling advanced menus and adding/altering the KB matrix if what Leokim did is feasible through this method), and then reflash to MEC1653
-Disconnect SVOD3, boot and verify installation
-Traces and resistors may be left in place when machine is used again

This is copy-pasted from the message unless its in parenthesis. I dont have a SVOD3, or a rework station to effect these mods. If anyone does, and perhaps a sacrificial T480 mobo, and of course willing to try experimenting, do let me know if you get anywhere.

Its worth noting that this misses Leokim's mentions of encrypting and encrypting the firmware, but he may have just meant modifying the matrix in saying this. Unsure.

Also, if anyone knows a cheaper alternative to SVOD3 let me know, they dont exactly seem readily available unless you are willing to pay and arm and a leg for them, and accept some sketchy shipping terms from eastern Europe (as a former Moscow resident I dont entirely trust some of these ebay listings for them).

[keithsketchley]

T480 certainly inferior keyboard to small x41, key feel worse, no protection for Caps Lock key (x41 key had depressed surface on right end next to A key).

Having a large caps Lock key is foolish as it is little used, but at least x41's was depressed on inboard half.

[tresho]

"T480 certainly inferior keyboard " Seems to be the case with my T480. I am currently working to install keyboard #3. I have worn out several keyboards on other Thinkpads through the years, but this is a record for me.

[echow2001]

a bit late but jtag pinout guide here

[RealBlackStuff]

If unlocking a T480-BIOS is still on your to-do list, check this out.

BUT BE WARNED!!!

The webpage looks like it is a not-very-good translation from Chinese into English and some of it looks like gibberish and/or makes no sense (at least to me).

Worst example of their pidgin-English:

Open with binary editor {1 bin. Find 4ce 42, replace 4ce 42 with 4ce 53, then 4ce 42 with 4ce 53, then 4ce 53, and then 4CD 53

Should really be: (as seen here: https://web.archive.org/web/20210429085 ... ylake.html)

Open file {1.bin} in a Hex editor and replace 4C 4E 56 42 42 53 45 43 FB with 4C 4E 56 42 42 53 45 43 FF