Thinkpads Forum

Posted: **Wed Apr 13, 2016 1:37 pm**

Hi folks,
You may have remember some attempts to install classic X220 keyboard into X230 - they were not quite successful.

Recently I stumbled upon a story of removing lenovo battery authentity check, which as it turned out was implemented in the Embedded Controller firmware. The author published a toolset required to reproduce his work. Someone used these tools to try make X220 keyboard work in X230 - and reported partial success - got working Delete, PgUp, PgDn, Wback, Wfwd and Menu. However, PrtSc, ScrLk, Pause, Insert and Home were still malfunctioning.
I continued his research and found another table which is related to keyboard mappings:

Code: Select all

0x000219E8: FF 00 7F 00 7F 00 FF 00 FF 00 FF 00 FF 00 FF 00
0x000219F8: FF 00 8A 00 FF 00 D3 00 A2 00 A0 00 48 00 41 80

Each byte of this table is a bitmask, which enables handling of corresponding cells in keyboard matrix.
To make new mapping work, I modified this mask table as follows:

Code: Select all

0x000219E8: FF 00 7F 00 7F 00 FF 00 FF 00 FF 00 FF 00 FF 00
0x000219F8: FF 00 8B 00 FF 00 D3 00 E3 00 A6 00 48 00 41 80

After I flashed modified EC image, all keys are working.
Now all that left is Fn keys (and, probably, CapsLock led). I'll post here once we get progress with that.

A guide on how to patch and flash EC firmware on Reddit - thanks to theamdman

WARNING

X220/X230 keyboard pinouts are slightly different, so first thing you need to do is to isolate pins #25 and #29 (grab a schematic to see where they are [Page 63]). The reason for it is that in X230 keyboard these pins are separated, but in X220 one they are connected all together, shorting VCC5M_KBD (pin #25) to ground through the keyboard cable. I disassembled the keyboard and covered #25, #27 and #29 with a piece of scotch tape (#27 is redundant since it's connected directly to ground on the motherboard).

nitrocaster wrote:You need to disassemble the keyboard.
I got a cheapass chinese keyboard (don't buy these) and took some pictures that can help to understand the process: http://imgur.com/a/YLW83

MOD edit: there are two layers of gold-contacts. The tape goes on the right-hand side of the layer closest to the keyboard-metal.
Check again: http://i.imgur.com/Lx41VMw.jpg

Ignoring this thing will cause keyboard overheating and damage.

Posted: **Thu Apr 14, 2016 1:33 am**

This is actually an amazing achievement.

Posted: **Thu Apr 14, 2016 5:19 am**

Full, step-by-step instructions for patching your firmware: README

This README file is part of the project that creates a bootable USB stick to update your firmware (Essentially automating the same process that zmatt described in his blog posts about hacking his battery)

I also recommend reading the thinkwiki page that extensively documents the hardware steps for keyboard replacement

Posted: **Thu Apr 14, 2016 11:25 am**

Now if only this method could be replicated to remove the wlan whitelist....

Posted: **Thu Apr 14, 2016 2:14 pm**

For X230T it has already been done: https://www.bios-mods.com/forum/Thread- ... ware-Flash
The X230 BIOS can't be too far off.

Posted: **Thu Apr 14, 2016 2:55 pm**

RealBlackStuff wrote:For X230T it has already been done: https://www.bios-mods.com/forum/Thread- ... ware-Flash
The X230 BIOS can't be too far off.

Modified bioses exist for the X230 as well, but that method involves hardware flashing, while the modified EC can be software flashed. The difference is that the EC is in the .FL2 file, the bios (and the whitelist) in the .FL1 file which, if I understood correctly, uses crc and encryption.

Posted: **Thu Apr 14, 2016 6:24 pm**

harryK wrote:The difference is that the EC is in the .FL2 file, the bios (and the whitelist) in the .FL1 file which, if I understood correctly, uses crc and encryption.

As far as I can see, BIOS comes without encryption.

Posted: **Fri Apr 15, 2016 8:02 am**

nitrocaster wrote:
harryK wrote:The difference is that the EC is in the .FL2 file, the bios (and the whitelist) in the .FL1 file which, if I understood correctly, uses crc and encryption.
As far as I can see, BIOS comes without encryption.

True. But apparently (software) flashing a BIOS with a modified .FL1 results in a "SecureFlash Error" on X230 and subsequent models :-/
https://www.bios-mods.com/forum/Thread- ... val?page=2

Posted: **Sat Apr 16, 2016 5:08 am**

Will this modification be possible to perform on a T430s, or is the EC firmware different?

Posted: **Sat Apr 16, 2016 7:41 am**

Frobe70 wrote:Will this modification be possible to perform on a T430s, or is the EC firmware different?

It has the same EC and similar firmware, so - yes, should be possible.

Posted: **Sat Apr 16, 2016 8:51 am**

dr_st wrote:This is actually an amazing achievement.

Indeed it is. Way above my pay grade, unfortunately....

Posted: **Sun Apr 17, 2016 11:40 pm**

subscribed. I've lazily googled this several times over the last year. I lack the skillset to figure it out but I applaud those that can! Keep up the good work.

I will build an x230 with a real keyboard when the toolset is available. Heck, I'd chip in to pay for the development. I'd wager others would, too.

Jamie

Posted: **Mon Apr 18, 2016 1:14 am**

imaradiostar wrote:subscribed. I've lazily googled this several times over the last year. I lack the skillset to figure it out but I applaud those that can! Keep up the good work.

I will build an x230 with a real keyboard when the toolset is available. Heck, I'd chip in to pay for the development. I'd wager others would, too.

Jamie

Yes, an easy software tool for modification is needed for us with more experience in handling soldering irons and mechanical tools. I paid Middleton for his BIOS modification before I had bought a T61 board to modify.

Posted: **Mon Apr 18, 2016 1:21 am**

Frobe70 wrote:
imaradiostar wrote:subscribed. I've lazily googled this several times over the last year. I lack the skillset to figure it out but I applaud those that can! Keep up the good work.

I will build an x230 with a real keyboard when the toolset is available. Heck, I'd chip in to pay for the development. I'd wager others would, too.

Jamie
Yes, an easy software tool for modification is needed for us with more experience in handling soldering irons and mechanical tools. I paid Middleton for his BIOS modification before I had bought a T61 board to modify.

Good call. I'm an electronics tech but not much of a programmer.

JT

Posted: **Mon Apr 18, 2016 6:53 am**

Frobe70 wrote:
imaradiostar wrote:subscribed. I've lazily googled this several times over the last year. I lack the skillset to figure it out but I applaud those that can! Keep up the good work.

I will build an x230 with a real keyboard when the toolset is available. Heck, I'd chip in to pay for the development. I'd wager others would, too.

Jamie
Yes, an easy software tool for modification is needed for us with more experience in handling soldering irons and mechanical tools. I paid Middleton for his BIOS modification before I had bought a T61 board to modify.

The difficult bit comes from not knowing if we have the right to distribute the EC firmware file. It should be possible to make a bootable USB image that simply flashes the firmware, but there would still be an awkward step to download the original firmware from lenovo and patch it - even if that was fairly well automated, it can start to get quite fragile.

That being said, It sure can be made simpler than it currently is

Posted: **Mon Apr 18, 2016 7:17 am**

Update on my progress:

I have found most of the missing Fn key combo tables and patched them too - Currently, the only keys missing are Fn+F2 (Lock), Fn+F3 (Battery), Fn+F12 (Hibernate) and Fn+Space (Magnify?). Actually, the Lock function is there, but it is in the wrong spot at Fn+F3.

So, it is essentially fully working

I have updated the details on the thinkwiki page with the exact patch needed.

Posted: **Mon Apr 18, 2016 12:08 pm**

Fn+F2 and Fn+F3 can be swapped (so that Fn+F2 will do screenlock) with this patch:

Code: Select all

 00021668 B4 8E 01 00
-0002166C C0 70 C0 71
-00021670 C0 72 C7 73
+0002166C C0 70 C0 72
+00021670 C0 71 C7 73
 00021674 E4 50 E5 51

Posted: **Mon Apr 18, 2016 7:14 pm**

Just installed the keyboard, it feels awesome! Had to cut some plastic on top side to fit into X230 keyboard bezel, cut notches in the palmrest and remove bottom nub.
Ideally, X220 keyboard bezel and palmrest are required.

Posted: **Tue Apr 19, 2016 2:42 am**

It works perfectly! I only had to cut away the three small nubs at the bottom of the keyboard and it fitted perfectly. It's awesome, I had almost forgotten the feeling of the classic keyboard

Thank you hamish and nitrocaster!

http://imgur.com/a/DzeXy

Since I was at it I also patched the bios to edit the wlan whitelist. When reflashing, the EC portion went through fine and the bios portion failed with "SecureBIOS error" as expected. So, it is clear that only the first 8Mb of the firmware (the BIOS portion) are write protected.

Posted: **Tue Apr 19, 2016 2:59 am**

harryK wrote:I only had to cut away the three small nubs at the bottom of the keyboard and it fitted perfectly.

Only three? It has 5 nubs, while palmrest has 4 notches for smaller nubs. As I understand, you either cut all of them or cut the one near trackpoint buttons and adjust 4 notches in the palmrest.

Posted: **Tue Apr 19, 2016 3:13 am**

nitrocaster wrote:
harryK wrote:I only had to cut away the three small nubs at the bottom of the keyboard and it fitted perfectly.
Only three? It has 5 nubs

You're right, 5 nubs. Sorry.
I did the cutting a while ago and forgot about it because I couldn't use the keyboard with the wrong mapping, until today

I didn't touch the palmrest though, I am sure. With the five nubs removed the keyboard fits well with the X230 palmrest. it's easier if you install the keyboard first and then the palmrest.

Posted: **Fri Apr 22, 2016 2:34 am**

imaradiostar wrote:
Frobe70 wrote:
Yes, an easy software tool for modification is needed for us with more experience in handling soldering irons and mechanical tools. I paid Middleton for his BIOS modification before I had bought a T61 board to modify.
Good call. I'm an electronics tech but not much of a programmer.

JT

I've been trying to think of ways to make this process simpler - but one of my stumbling blocks is that I cannot distribute the copyrighted firmware file, so I still need to distribute a patch file - and cannot just have a "click on this to fix" all-in-one tool. I can cut out all the mucking about with downloading and compiling the mec_tools though.

I have rolled all the patches into one - including the checksums and encryption, which ends up with a >550 line patch file. I have a tool to apply this binary patch, but it needs perl to use. Then there is still the flash tool to run.

I'm happy to try and make it more accessible for people, but I'm looking for some advice on how much complexity you want to handle..

Posted: **Fri Apr 22, 2016 8:12 am**

I ported mec-tools to Windows and uploaded a binary release - see here (requires VC140 runtime).

Posted: **Fri Apr 22, 2016 8:34 pm**

nitrocaster wrote:
Frobe70 wrote:Will this modification be possible to perform on a T430s, or is the EC firmware different?
It has the same EC and similar firmware, so - yes, should be possible.

I've just downloaded the t430s g7uj18us.iso bios update, extracted the EC firmware and had a look - all the same keyboard tables are there, and it looks totally patchable

Posted: **Sat Apr 23, 2016 4:13 pm**

hamish wrote:
nitrocaster wrote: It has the same EC and similar firmware, so - yes, should be possible.
I've just downloaded the t430s g7uj18us.iso bios update, extracted the EC firmware and had a look - all the same keyboard tables are there, and it looks totally patchable

That is very exciting news! Just want to thank you guys for working on this. It this patch works for the T430 it will be a game changer!

Posted: **Sat Apr 23, 2016 4:22 pm**

Botticelli wrote:It this patch works for the T430 it will be a game changer!

It has the same EC, sure it will work.

Posted: **Sat Apr 23, 2016 8:38 pm**

Botticelli wrote:
hamish wrote:
I've just downloaded the t430s g7uj18us.iso bios update, extracted the EC firmware and had a look - all the same keyboard tables are there, and it looks totally patchable
That is very exciting news! Just want to thank you guys for working on this. It this patch works for the T430 it will be a game changer!

I have created a trial patch for t430 - If you have the ability to try it: https://gist.github.com/hamishcoleman/c ... 43f3160d48

For reference, the system I am using to create patches is at https://github.com/hamishcoleman/thinkpad-ec

Posted: **Sun Apr 24, 2016 12:36 am**

Wow, great work! As someone who's been desperately searching for an upgrade path from the X220 tablet for years, this is just the ray of hope I needed

Do you think this method could generalise to newer Thinkpads than the xx30 generation, or is the way they handle keyboards too different? (I'm thinking of software/connector differences more than the shape of the keyboard assembly; in a pinch, I imagine there's plenty you can do to plastic given access to a machine shop...)

Posted: **Sun Apr 24, 2016 1:40 am**

4bpp wrote:Wow, great work! As someone who's been desperately searching for an upgrade path from the X220 tablet for years, this is just the ray of hope I needed

Do you think this method could generalise to newer Thinkpads than the xx30 generation, or is the way they handle keyboards too different? (I'm thinking of software/connector differences more than the shape of the keyboard assembly; in a pinch, I imagine there's plenty you can do to plastic given access to a machine shop...)

I've looked at the firmware for three of the xx30 generation laptops, and I was able to find the right keyboard data in all three cases, so I am hoping that it just as straight-forward to apply the same process to others in that generation.

See http://www.thinkwiki.org/wiki/Install_C ... r_Firmware for the current list of firmware I have looked at

Posted: **Sun Apr 24, 2016 2:18 am**

hamish wrote:I've looked at the firmware for three of the xx30 generation laptops, and I was able to find the right keyboard data in all three cases, so I am hoping that it just as straight-forward to apply the same process to others in that generation.

See http://www.thinkwiki.org/wiki/Install_C ... r_Firmware for the current list of firmware I have looked at

Sorry, I meant the generations that are still newer (xx40~xx60, or perhaps even the Yoga 260 for an actual digitiser machine). Did you have any chance at all to look at the firmware of those?

(Also, in the xx30 series, does the X230 tablet have the same firmware as the X230? (I wouldn't expect them to be too different, at least...))

Thinkpads Forum

Installing classic keyboard into X230 with EC firmware mod

Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod

Re: Installing classic keyboard into X230 with EC firmware mod