Take a look at our
ThinkPads.com HOME PAGE
For those who might want to contribute to the blog, start here: Editors Alley Topic
Then contact Bill with a Private Message

x230 2.77 bios with 1vyrain softmod questions

X230-X280, X390 Series
Post Reply
Message
Author
nogolem
Posts: 7
Joined: Mon Nov 25, 2019 2:19 pm
Location: Paris, France

x230 2.77 bios with 1vyrain softmod questions

#1 Post by nogolem » Fri Jan 17, 2020 4:40 pm

'Hi there and happy New year to everyone!
I've been a longtime user of classic thinkpads in the past because of my former job...
One that was running win98 and a x41 pen tablet with a special flavor of winXP.
i recently went back to thinkpad life by acquiring a refurbished X230 in a quiet good condition and win 10 family copy and its official serial label sticker + a 12 monthes warranty.
I must say i'm not a huge fan of win 10 neither am I a fan of Vpro cpus features...
So I permanently disabled security AT/AMT and security chip in the sadly recently flashed bios (2.77, Sept 2019) as well as disabling cortana and internal microphone driver since I noticed it was still active even with the hard switch activated mike mute and it's orange led...
theoretically it should only be activated with plugin in an external microphone/earphone set on the ext jack....
deactivated webcam in the bios as well....

Since I've been loving Linux since Slackware 1.1 in 14 floppies, I decided to make a dualboot laptop with a copy of kali linux on the Msata 240GB encrypted SSD configured in bios as first boot device, installed grub on it letting me the possibility of 2nd choice booting on WIN10 installed on the main SSD drive in order to have it running for games with an EGPU.

I discovered on wolfgang's channel that even with deactivating so called "security features" in the bios did not preserve user from beeing spied by intel's Vpro cpu features...
So I got interested in seeking info about alternative bioses to flash ...
I quickly understood that it is not an easy process since you have to tear open the laptop in order to bridge 2 chips and flash them from another computer...

But a few days ago I discovered the 1vyrain softmod exploit.
which could help soft downgrading the "locked bios", and eventually flash in an alternate bios promising of getting rid of whitelist wifi cards, Vpro features for good and so on....

I wanted to know if anybody could have tried this method and what he does think about it with an X230 2.77 bios laptop....
since it is a very recent technique....

Thank you for any information about the process....
I hope you'll pardon my bad english since I'm french...
Long life to thinkpads.com

thank you very much
the one who helps me would be offered a few pints at the pub nextdoor in Montmartre Paris, France if he/she plans a journey in Paris, city of love.

thx a lot and Peace !

JPOESQ
**SENIOR** Member
**SENIOR** Member
Posts: 259
Joined: Sun May 16, 2004 2:26 pm
Location: San Francisco, CA
Contact:

Re: x230 2.77 bios with 1vyrain softmod questions

#2 Post by JPOESQ » Fri Jan 17, 2020 8:37 pm

It worked fine on my T530. I haven’t tried it on my X230 but it should work as well according to the instructions.
John P. O'Banion, JD, PE, BSEE
Registered Patent Attorney
http://www.intellectual.com

X220 (McDonnell bios), X230 (1vyrain bios), T530 (1vyrain bios), X1 Carbon 5th Signature Edition

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23812
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: x230 2.77 bios with 1vyrain softmod questions

#3 Post by RealBlackStuff » Sat Jan 18, 2020 2:19 am

Ivyprep brings your BIOS down to V2.60
1vyrain will up it to the best possible version, with the whole shebang unlocked.
Don't know about disabling VPro, other than swapping CPU.
There are only very few X230 without VPro, check it out in this PSREF list: https://psref.lenovo.com/syspool/Sys/PD ... d_X230.pdf
Lovely day for a Guinness! (The Real Black Stuff)
Lenovo: X240, X250, T440p, T480, M900 Tiny.

PS: the old Boardroom website is still available on the Wayback Machine
.

nogolem
Posts: 7
Joined: Mon Nov 25, 2019 2:19 pm
Location: Paris, France

Re: x230 2.77 bios with 1vyrain softmod questions

#4 Post by nogolem » Sat Jan 18, 2020 1:11 pm

Thank you very much indeed you both for your fast answers...
With the Bios 2.77 you have the possibility to "permanently" (so say intel) disable security chip and AMT features... but i've read somewhere on reddit it would only superficially disable "a few features" of the Vpro system...but without any real example and/or evidence.

Indeed my X230, since it is an I5-3320m , comes with the Vpro "feature"...
Yep for me it is a security breach since it is possible to wake/switch on your system up and make it lan-boot any kind of code...Authorized by Intel or "malicious"
just using administration tools... tell me if 'im wrong....

No way to swap CPU on a X230 since it is soldered to the mobo (Xseries not Tseries)
:(

Did you inject any payload with 1vyrain trick ? such as coreboot/Libreboot or whatever ?

What are your suggestions in terms of alternative BIOSes to be installed on our beloved X230 ?

Does any of those opensource BIOSes have interesting tweaks appart from getting rid of wifi whitelist, such as ability to protect the system at low level against any remote attack targeted to our V([censored]) firmwares ?

I have checked the Exploit-DB and nothing falls on searching for "Intel" "CPU" string.... Except one exploit on 6th and 7th generation CPUs (Skylake/ Kaby lake)....:

https://www.exploit-db.com/

https://www.exploit-db.com/exploits/45785
Maybe I dot not know how to use this DB...

Thanks again for any information about 1vyrain and alternative BIOSes.

;-)

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#5 Post by Libre_ME » Wed Jan 29, 2020 3:53 pm

I don't know if I can be much help, but I'll give my input. I recently bought an x230/i5-2.8Gz and it had 2013 bios-firmware. I wanted to update EC before updating to Ivyrain, but could only find the Lenovo, signed, 2.77, so I installed Ivyrain and then I could get the opensouce Atheros network card to work. I shut off a few things like ME, mic, etc. It works great, but I still think that I might end up going with the Coreboot bios-firmware. As I understand it, you can actually install Coreboot firmware image via the Ivyrain tool. I'm not very tech, so I'm not sure that I'll be able to compile a Coreboot image to update the bios with, but if I can that would be great. Before attempting that I'd like to get the EC updated to v1.5, it's currently v1.1, but I'll have to find v2.75 bios-firmware first. Even with the old EC firmware this x230 is running very well with Ivyrain.

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#6 Post by Libre_ME » Wed Jan 29, 2020 6:33 pm

A correction: My x230's EC version currently is 1.10 and I'd like update it to version 1.15 If someone knows where to get bios-update 2.75 somewhere, then please let me know.

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23812
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: x230 2.77 bios with 1vyrain softmod questions

#7 Post by RealBlackStuff » Thu Jan 30, 2020 3:15 am

Lovely day for a Guinness! (The Real Black Stuff)
Lenovo: X240, X250, T440p, T480, M900 Tiny.

PS: the old Boardroom website is still available on the Wayback Machine
.

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#8 Post by Libre_ME » Fri Jan 31, 2020 6:31 pm

Thank you for the link and "scroll down" clue! Not fully comprehending the Ivyrain instruction set, I updated to Lenovo's v2.75 x230 bios-firmware, now I'm stuck with that bios-firmware until I can figure out how to modify the v2.60 firmware to roll back to it, so that I can install Ivyrain, again. Modifying the v.2.60 might just be beyond my skills, which are not very good for things like that. Meanwhile I have had to reinstall Intel network-card, so that I can use the computer to install UEFI bootable Debian, to build the modified firmware image. I really wish that I'd have comprehended all of this better in the first place. If I succeed then it looks like I'll end up with EC v1.13, currently it's v1.14.

JPOESQ
**SENIOR** Member
**SENIOR** Member
Posts: 259
Joined: Sun May 16, 2004 2:26 pm
Location: San Francisco, CA
Contact:

Re: x230 2.77 bios with 1vyrain softmod questions

#9 Post by JPOESQ » Fri Jan 31, 2020 7:41 pm

Run ivyprep to roll back the bios. Then run 1vyrain.
John P. O'Banion, JD, PE, BSEE
Registered Patent Attorney
http://www.intellectual.com

X220 (McDonnell bios), X230 (1vyrain bios), T530 (1vyrain bios), X1 Carbon 5th Signature Edition

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#10 Post by Libre_ME » Sat Feb 01, 2020 1:29 pm

Thanks, I did just that! Before doing it though I updated the bios firmware to Lenovo's signed 2.77, to get EC v1.15, then rolled it back to v2.76 powering off before the EC was downgraded to v1.14. I did the same powering off before Ivyprep could downgrade the EC to v2.6's EC v1.13, then I installed Ivyrain again and since Ivyrain doesn't touch the EC portion of the bios it retained EC v1.15 However, now there is not an option to turn off the the systems microphone in the new bios settings. I had the microphone disable option with Ivyrain bios and EC v1.10

JPOESQ
**SENIOR** Member
**SENIOR** Member
Posts: 259
Joined: Sun May 16, 2004 2:26 pm
Location: San Francisco, CA
Contact:

Re: x230 2.77 bios with 1vyrain softmod questions

#11 Post by JPOESQ » Sat Feb 01, 2020 6:27 pm

As I understand it, the EC version will not downlevel. That has to be done externally.
John P. O'Banion, JD, PE, BSEE
Registered Patent Attorney
http://www.intellectual.com

X220 (McDonnell bios), X230 (1vyrain bios), T530 (1vyrain bios), X1 Carbon 5th Signature Edition

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#12 Post by Libre_ME » Sat Feb 01, 2020 11:00 pm

You're absolutely correct! Ivyprep does not touch the EC either.

As for this bios mod and vulnerabilities, I've been fighting attacks to my system all day long today and I'm giving up on Ivyrain. I'll try Coreboot next. For now it's back to my very slow Librebooted machines.

JPOESQ
**SENIOR** Member
**SENIOR** Member
Posts: 259
Joined: Sun May 16, 2004 2:26 pm
Location: San Francisco, CA
Contact:

Re: x230 2.77 bios with 1vyrain softmod questions

#13 Post by JPOESQ » Sun Feb 02, 2020 10:42 am

What vulnerabilities have you found in the 1vyrain bios? Is there a problem that makes those bios unsafe?
John P. O'Banion, JD, PE, BSEE
Registered Patent Attorney
http://www.intellectual.com

X220 (McDonnell bios), X230 (1vyrain bios), T530 (1vyrain bios), X1 Carbon 5th Signature Edition

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#14 Post by Libre_ME » Sun Feb 02, 2020 3:32 pm

Many things went wrong during the 12 hours or so that I gave myself to trying to make Ivyrain work on the x230. for one, with the network card kill-switch in the off position while booting, the wifi light was on and instead of honoring my boot order the thing would try to connect to lan, even with "wake on lan" turned off. Then i tried installing Debian. I could install, but the system would not let me update it for hours of trying. That's never happened before! When booting to a usb-drive, loaded with Tails OS, the normal black background was always grey. That's never happened before either. I was also hoping that I could do a secure erase procedure in the x230, via Gparted loaded usb-drive, with Ivyrain firmware. No it's just like any other Phoenix bios firmware in that regard. I was more than just disappointed, I was absolutely stunned at the nightmare of problems with the Ivyrain firmware. I'm wring this from the x230, via OEM Lenovo firmware, v2.76/EC v1.15

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#15 Post by Libre_ME » Sun Feb 02, 2020 6:26 pm

After writing the above negative comments about Ivyrain I decided to try again. so far, no problems at all. However, I have not replaced the Intel network card with the Atheros card yet. I'll try to run it for a few days anyway before commenting again. I'm still not getting the mic disable feature in the bios menu, like I did the first flash. This makes flash number 4 of ivyrain on this x230.

JPOESQ
**SENIOR** Member
**SENIOR** Member
Posts: 259
Joined: Sun May 16, 2004 2:26 pm
Location: San Francisco, CA
Contact:

Re: x230 2.77 bios with 1vyrain softmod questions

#16 Post by JPOESQ » Sun Feb 02, 2020 6:50 pm

That’s bad news. I just tried my Tails build on the T530 and the background is black. It’s grey on my X220 with custom bios and grey on my X1 with Lenovo bios. Odd.
John P. O'Banion, JD, PE, BSEE
Registered Patent Attorney
http://www.intellectual.com

X220 (McDonnell bios), X230 (1vyrain bios), T530 (1vyrain bios), X1 Carbon 5th Signature Edition

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#17 Post by Libre_ME » Mon Feb 10, 2020 7:21 pm

I've been using the Ivyrain bios firmware, problem free, for the last 8-days. Nevertheless, I need to go to Coreboot because a smart card adapter , for M.2 sata ssd, requires Coreboot to boot straight from the card, the way that I want it to anyhow.

Libre_ME
Posts: 42
Joined: Wed Aug 01, 2018 1:03 pm
Location: Columbus, OH

Re: x230 2.77 bios with 1vyrain softmod questions

#18 Post by Libre_ME » Fri Feb 14, 2020 9:02 pm

This evening I used the Ivyrain bios flashing tool to re-flash the bios with Coreboot. It was very easy to do. No problems at all. Now I have to figure out how to flash the 8MB chip to get rid of ME, with ME_cleaner.

ayamaros
Posts: 1
Joined: Mon Sep 28, 2020 3:33 am
Location: Jakarta, Indonesia

Re: x230 2.77 bios with 1vyrain softmod questions

#19 Post by ayamaros » Tue Oct 13, 2020 10:50 pm

I am considering of installing Coreboot on my X230. This will be my first time so I have been researching this forum and gathering as much information as I can. On the Skulls page, it was advised to run one of the latest version of the BIOS before performing Coreboot.

Like the OP, my X230 came with BIOS version 2.77 and EC version 1.15 and the seller claims that 1vyrain has been installed. The following are my questions:

1. If the seller did follow the procedure of making sure the original BIOS was version 2.60 or below prior to flashing 1vyrain, what will the final BIOS version be after the process is completed?

2. Is there a way to verify if 1vyrain has been installed apart from looking at the BIOS version?

I am trying to avoid any re-flashing of the BIOS unless it's really necessary as to minimize the risk of bricking as I am not sure of the method the previous owner took. I am aware that with EC version 1.15, I will be unable to install Hamish Coleman's Thinkpad-ec to unlock the ability to use 3rd party battery and the X220 keyboard and I am willing to sacrifice not having those options.

My ultimate goal is to have a more secure X230 from Intel's AMT and EM issues. Once this is confirm, my next question will be on finding out if ME cleaner has been run or not, which I will look and post on another post.

Thanks!

nogolem
Posts: 7
Joined: Mon Nov 25, 2019 2:19 pm
Location: Paris, France

Re: x230 2.77 bios with 1vyrain softmod questions

#20 Post by nogolem » Tue Dec 22, 2020 12:38 pm

Hey all

I went on flashing 1vyrain 2 days ago...
you can see 1vyrain has been "done" on your system if you get a bios with the advanced menu and nowhere to set date and time (time is to be set directly from the OS from now on).
no "advanced menu" on the 2.77 original lenovo BIOS.


My point is:
I used to boot from an Msata SSD (grub) and and windows is on the 2.5" SSD.

I cannot define anymore the boot disk priority in the "startup/boot" menu:
every entry is marked "empty" and no way to modify....

I can see both drives in the ATA list though....

any clue ? because since 2 days I am stuck with the system directly booting to the 2.5" SSD with windows 10.
Does this version of 1vyrain moded bios prevent you to boot an msata ssd ?
I'd really like to get back to my daily fav linux and keep my win10 for casual eGPU gaming....

Posted this question 2 days ago on the ThinkPad discord channel in the modded BIOS section but I do not get any answer....

Any help would be vastly appreciated....

;-)

nogolem
Posts: 7
Joined: Mon Nov 25, 2019 2:19 pm
Location: Paris, France

Re: x230 2.77 bios with 1vyrain softmod questions

#21 Post by nogolem » Wed Dec 23, 2020 10:46 am

Since my problem is solved, I answer to myself:

I works !
following what "digmo of the T420" wrote me:

"your efivars got reset, so you have to re-add the entry for grub. Boot up your distro with supergrubdisk2 efi and run a grub update to re-add the entry. Some distros have a update-grub or grub-update"

and since my linux had never been reinstalled, I opted to get the latest flavour of my fav, backup my personnal filez, reinstall and restore to the msata ssd....

It works so far....
thank you "digmo of the T420" on the ThinkPad discord channel !
;-)

Post Reply
  • Similar Topics
    Replies
    Views
    Last post

Return to “ThinkPad X230-X280 / X390 Series”

Who is online

Users browsing this forum: No registered users and 62 guests