bout the x230 keyboard, what works, what doesn’t

update: Basically what it says here, http://www.thinkwiki.org/wiki/Install_Classic_Keyboard_on_xx30_Series_ThinkPads

but with the spanish keyboards and some non working keys are different. I still choose to use the old keyboard because those keys are not used with VIM.

Before giving up, I used an external X220 style spanish keyboard with the X230 and it works without any modifications. some keys are not correctly mapped. I’ll put how to deal with those ones by software by now.

I needed a keyboard I could find comfortable with and I don’t have 250 euros for a second hand x220 computer so this will have to do it.

The official Lenoo BIOS checks something on the keyboard. I could turn on the computer with an english layout x220 keyboard but then it didn’t even show anything on the screen. With the spanish x220 keyboard it didn’t complain.

All the Fn keys are like in the X230 and the numeric keypad doesn’t work. The Supr, home, end, pgup, pgdown don’t work as expected. in general it works but it has issues that should be resolved using the embedded controller or using coreboot. I haven’t tried yet because the english/usa layour keyboards gave me problems.

So far it seems nothing security related has to be done and this could be easier that whitelisting wifi cards (but changing the bios for coreboot).

about the x230 keyboard – pre end

I won’t be able to work on this project. I still have some pinout to publish but no code will be published because I fear the bad uses it could have besides just using another keyboard and countermeasures would have to be made before, and I am not in the mood to work on those things.

I will publish just the electric pinout and keycodes so that if someone just wants to do the keyboard part and has the technical skills can do it without dismantling their keyboards but I won’t do further advancements in the code or explain how to code for that part of the BIOS.

I would like someone else to do it since I can’t and I would like to use a propper keyboard but I don’t know how to do it safely so it won’t be me.

If someone else want to do it I could help on the countermeasures but only if the person really waits for the countermeasures to be ready and has the technical skills to do it. It won’t be soon anyway and the x230 is getting old so maybe there isn’t a point for doing it after all.

I wouldn’t like it to be installed in an airport checking in a foreign country and not being able to detect it easily for example.

The quick and dirty solution is to use an external USB keyboard and plug it to an internal USB connector. The drawback of this is that it cannot be used if the USB subsystem doesn’t work (kernel developers).

Well anyway, what I’ve done so far won’t have to be done by anyone else and at least it can be usefull for repairs and keyboard mods on the Novena and similar open source laptops because the X220 keyboard rocks.

Lenovo x230 keyboard and bios pause

This will be fun. I will test the keyboards with a multimeter and several things will be posted but this might not end well for the x230. I am even thinking on buying a second hand x220 to hack a x230.

I’ve seen many things about UEFI, SMM and bizarre hacks and they make me feel nostalgic and happy at the same time. I don’t particularly care about security and I think it is a waste of time like solving puzzles but I like solving puzzles.

I can not even follow the ultra detailed posts by Dmytro Oleksiuk now but I am enjoying them and since I have not the required knodledge to continue this at a decent speed and it is interesting, I will learn.

http://blog.cr4.sh/2015/07/building-reliable-smm-backdoor-for-uefi.html

PD: I could just go to coreboot sources and start from there but I am enjoying this.

Lenovo X230 and Lenovo X220 keyboard bios hack part 3

I Downloaded G2ET95WW, G2ET96WW and G2ET94WW Lenovo Bioses for the x230.They all have changes on the BIOS but no changes on the Embedded Controller firmware.

They’ve two important files $01D3000.FL1 and $01D3000.FL2 (and several files from 306a4.HSH to 306a9.HSH

I’ve no idea what they do yet. I’ve seen that the file $01D3000.FL2 is the same for all of them so the code for the embedded controller has to be there. It seems it is there with other stuff so I downloaded a BIOS unpacker to see if I was lucky.

I downloaded Phoenix Bios Editor 2.2.1.3 but it was not able to open the file. It said “Invalid ROM lenght!

There are many underground bios related pages on the web but the most friendly site is bios-mods. So I choose that one to begin with.

Then I realized that what others at bios-mods were using was Phonenixtool 1.90 for Lenovos so I downloaded Andy’s Phoenixtool256 and this one was able to generate a SLIC.LOG and create a folder named DUMP with lots of files.

Maybe the extractor didn’t even touch the embedded controller but now I’ve to look what do I have.

Refs:
http://support.lenovo.com/us/en/downloads/ds029187

https://www.bios-mods.com/tools/index.php?dir=Phoenix+Bios+Editor+v2.2.13%2F&download=PhoenixBiosEditor2.2.13.zip

https://www.bios-mods.com/tools/index.php?dir=Andy+P+%28MDL%29+Phoenix-Insyde-EFI+SLIC+Tool%2F&download=Phoenixtool256.zip

I found those two threads at bios-mods interesting:
https://www.bios-mods.com/forum/Thread-Solved-REQUEST-Lenovo-X230-wlan-whitelist-removal

https://www.bios-mods.com/forum/Thread-TUTORIAL-Lenovo-X230-Tablet-BIOS-Whitelist-Removal-Hardware-Flash

UPDATE: My reasoning might have been wrong.
If what coreboot said regarding the bios placement is true the .FL2 file might have nothing to do with the Embedded Controller after all. I’ll check it later. I have no time until this afternoon.

“X230 has 2 flash chips of 8M and 4M. They’re concatenated to one virtual flash chip of 12M which is itself subdivided in roughly in 3 parts:
http://www.coreboot.org/Board:lenovo/x230
Descriptor (12K)
ME firmware (5M-12K)
System flash (7M)”

I guess I’ll have to look at the embedded controller datasheet and the x230 schematics first. Well, it is going to be slow. At least I am enjoying the quest but I would prefer to have the keyboard working.

Coreboot doesn’t even list this embedded controller yet. I’ll update the page once I have more info but I already have a bit more here about it than in the coreboot web page.
http://www.coreboot.org/Embedded_controller

MAC addresses and the Normerell conspiracy

Some companies try to generate random MAC addresses on uboot without even having an official oui address space. Then most of the times they find the entropy is very low.

Usually a board device ID can be used in those cases (the flash or eeprom serial number). And in the worst cases some companies (specially Chinese ones, I found several) use MAC address-es belonging to Normerell, a French company that went backrupt and didn’t give back their address space.


echo 00:00:11:`od /dev/urandom -w3 -tx1 -An | head -n 1 | sed -e 's/ //' -e 's/ /:/g'`

http://www.usinenouvelle.com/article/informatiquela-pme-normande-veut-livrer-les-micro-ordinateurs-de-la-posteadd-x-normerel-parie-sur-les-micros-a-valeur-ajouteesur-un-creneau-de-marche-dispute-add-x-normerel-tire-son-epingle-du-jeu.N70890

http://www.telecompaper.com/news/addx-normerel-goes-into-liquidation–84923

The official MAC address ranges can be looked at here:

http://standards-oui.ieee.org/oui.txt

What most people seem to forget (or don’t know) is that you can use perfectly legal private MAC address ranges and even U-boot comes with a simple generator for them.

https://en.wikipedia.org/wiki/MAC_address

“Universally administered and locally administered addresses are distinguished by setting the second-least-significant bit of the most significant byte of the address. This bit is also referred to as the U/L bit, short for Universal/Local, which identifies how the address is administered. If the bit is 0, the address is universally administered. If it is 1, the address is locally administered. In the example address 06-00-00-00-00-00 the most significant byte is 06 (hex), the binary form of which is 00000110, where the second-least-significant bit is 1. Therefore, it is a locally administered address.”

private mac address
Practical uses:

~/U-Boot/tools $ cat gen_eth_addr.c
/* (C) Copyright 2001
* Murray Jensen
GPLv2 bla bla bla...
*/
#include "stdio.h"
#include "stdlib.h"
#include "unistd.h"
#include "time.h"

int
main(int argc, char *argv[])
{
unsigned long ethaddr_low, ethaddr_high;

srandom(time(0) | getpid());

/*
* setting the 2nd LSB in the most significant byte of
* the address makes it a locally administered ethernet
* address
*/
ethaddr_high = (random() & 0xfeff) | 0x0200;
ethaddr_low = random();

printf("%02lx:%02lx:%02lx:%02lx:%02lx:%02lx\n",
ethaddr_high >> 8, ethaddr_high & 0xff,
ethaddr_low >> 24, (ethaddr_low >> 16) & 0xff,
(ethaddr_low >> 8) & 0xff, ethaddr_low & 0xff);

return (0);
}

Still people make the same mistakes again and again…
The Uboot community was always against it but even big companies like Marvel choose to do it their way (getting pseudo aleatory numbers from undocumented registers).

http://lists.denx.de/pipermail/u-boot/2011-August/099819.html

http://git.marvell.com/?p=u-boot-kw.git;a=summary

mkdir mi_marvell

git clone git://git.marvell.com/u-boot-kw.git/

mi_marvell/u-boot-kw/drivers/net $ vim kirkwood_egiga.c

while (!eth_getenv_enetaddr(s, dev->enetaddr)) {
/* Generate Ramdom MAC addresses if not set */
sprintf(buf, “00:50:43:%02x:%02x:%02x”,
get_random_hex(), get_random_hex(),
get_random_hex());
setenv(s, buf);

commit 4efb77d41f9c5d93f0f92dda60e742
023fa03c72
Author: Prafulla Wadaskar
Date: Sat Jun 20 11:01:53 2009 +0200

mi_marvell/u-boot-kw/cpu/arm926ejs/kirkwood/cpu.c

soc reg offsets KW_REG_UNDOC_0x1470 and KW_REG_UNDOC_0x1478 are reserved regs and
* Does not have names at this moment (no errata available)


/*
* Generates Ramdom hex number reading some time varient system registers
* and using md5 algorithm
*/
unsigned char get_random_hex(void)
{
int i;
u32 inbuf[BUFLEN];
u8 outbuf[BUFLEN];

/*
* in case of 88F6281/88F6192 A0,
* Bit7 need to reset to generate random values in KW_REG_UNDOC_0x1470
* Soc reg offsets KW_REG_UNDOC_0x1470 and KW_REG_UNDOC_0x1478 are reserved regs and
* Does not have names at this moment (no errata available)
*/
writel(readl(KW_REG_UNDOC_0x1478) & ~(1 << 7), KW_REG_UNDOC_0x1478);
for (i = 0; i < BUFLEN; i++) {
inbuf[i] = readl(KW_REG_UNDOC_0x1470);
}
md5((u8 *) inbuf, (BUFLEN * sizeof(u32)), outbuf);
return outbuf[outbuf[7] % 0x0f];
}

Lenovo X220 and Lenovo X230 keyboard connector candidates – part 3

cucumber eyesI got an schematic in English/Chinese and it says the connector on the motherboard is a JAE-CONN40A-1-U1GP

but I have not found any other reference to it and it seems it cannot be bought alone (without a motherboard on ebay or similar)

If this schematic turns out to be true a lot of info can be obtained from it.

https://web.archive.org/web/20150804115952/http://plan9.stanleylieber.com/hardware/thinkpad/x230/x230.schematics.pdf

The internal name for the Lenovo x230 seems to be Dasher-2 and Winstron developed the schematics. They somehow got leaked.  I still wish I had a connector to map the keyboard table/keys without breaking it but I’ll manage somehow. With all the info available many things seem possible now.

Well, the internal name of the Lenovo x220 is Dasher-1 and the schematic is here:
https://web.archive.org/web/20150804174718/http://kythuatphancung.vn/uploads/download/097d8_Dasher-1.pdf

It seems the x230 uses an 8051 and a x220 uses an H8S/2113 (page61) so it won’t be super easy to extract keyboard code tables from their embedded controller update blobs but I continue in my quest.

I had to share this. Searching for dasher-2 I found the next paper and anyone familiarized with Víktor Pelevin will find it amusing. Please give me another cucumber: https://www.lsuagcenter.com/NR/rdonlyres/9BD67509-BDB8-4E77-9A6F-E96F0A783DC5/81387/B844StakedCucumberProduction.pdf
…”In fall 1983, ‘Dasher II’ cucumber was planted in a randomized complete block ”

Lenovo X220 and Lenovo X230 keyboard connector candidates part2

I still don’t know which connector do they use. I made a list of the connectors they could have used but didn’t use.
A guy took those photos (he connected it to the T60 but by USB not using the connector)
https://picasaweb.google.com/117436154327433424940/ThinkPadUSBKeyboardWithTrackPoint

Jae 0.50mm Board to Board Connector products
http://jae-connector.com/en/pdf/2008-31-32-WR.pdf

but those pages are nowhere to be found on that PDF.
AA01A…………………………………………… 0.50mm (.020″) pag 29
IL-312……………………………………………..0.50mm (.020″) pag 30
WR…………………………………………………0.50mm (.020″) pag 31 – 32
WB3 ……………………………………………….0.50mm (.020 “) pag 33

http://jae-connector.com/en/catalog_en.cfm#BoardtoBoardConnectorProducts

AA01A is no longer on sale and it is similar but it not that one:
(this one has metalic borders and a strange ending)
http://jae-connectors.com/en/pdf/MB-0197-2E_AA01A.pdf
http://www.digikey.com/product-detail/en/AA01A-P030VA1-ROL100/670-2166-ND/2044074
The old thinkpad T60 used the JAE AA01B-P040VA1

IL-312 connector looks similar but the borders are different.
http://media.digikey.com/pdf/Data%20Sheets/JAE%20PDFs/IL-312-AxxP-VF-A1.pdf

The WR connector looks very similar but I got samples and saw they’re not the same.
http://jae-connector.com/en/pdf/2008-31-32-WR.pdf

Ok the WB3 is very different so it is not this one.
http://jae-connector.com/en/pdf/2008-33-WB3.pdf

So maybe it is not made by JAE (or, the worst case, it is but it is a private connector)

Molex makes this and it is very similar but it is not the same.
Molex slimstack connector: http://www.mouser.com/pdfdocs/Molex_SlimStack.PDF
( 55650-XX88 )
http://www.farnell.com/datasheets/1859117.pdf
http://www.farnell.com/cad/155168.pdf
http://au.element14.com/molex/54363-0578/receptacle-50way/dp/1507966?CMP=i-55c5-00001621

They’re not Panasonic AXK5F-6F connectors.

They’re not Morethanall connectors (and some look very similar)
http://www.morethanall.com/products/search
http://www.morethanall.com/products/index/btype_id/1/type_id/13/id/9
http://www.morethanall.com/products/index/btype_id/1/type_id/13/id/1897
http://www.morethanall.com/products/index/btype_id/1/type_id/13

UPDATE: I’ll try the molex ones. Update2: I still haven’t tried the molex ones but I made another post here