A Wi-Fi Whitelist Free ThinkPad T440p

§01Things you will need

• ThinkPad T440p
• a Raspberry Pi 4 with Raspbian installed
• a Linux laptop or PC
• IC Test Clip SOIC 8 Pin
• 6x Jumper Wire

§02Setting up your Raspberry Pi programmer

Before enabling the SPI interface, it is good practice to update the Raspbian software. sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot We will need to enable the Raspberry Pi SPI interface. This can be done by typing into the terminal sudo raspi-config, and selecting P4 SPI under the Interfacing Options.

Fig. 1

§03Setting up your second computer

First, We will need to download flashrom, UEFIPatch, thinkpad-uefi-sign, python 3, and the Patch files. On your Linux computer install flashrom and python3 from your distro's repositories.

To install UEFIPatch: download UEFIPatch from the GitHub repo and unpack it. Remove both text file in the unpack folder to avoid any confusion.

Afterward, clone the thinkpad-uefi-sign GitHub repositories to the unpack UEFIPatch folder.

Finally, Download the patch file and move it to the unpack UEFIPatch folder. In the patch file, comment out any feature and device we don't want to be applied by placing hash character at the beginning of the line. Save and exit the file.

§04ThinkPad T440p Disassembly

Fig. 2

Fig. 3

Fig. 4

Fig. 5

§05Dumping the BIOS

⚠ DISCLAIMER ⚠: Only hook your test clip to your BIOS chip WHEN THE BATTERY IS REMOVED, LAPTOP UNPLUGGED, AND RASPBERRY PI POWER OFF! You might possibly fry the BIOS chip. I am not responsible for any lost data, bricked devices, or any other hardware or software faults that come from performing this modification.

First, find the BIOS chip close to the bottom of the motherboard.

Fig. 6

Next, align the test clip so that the dimple on the BIOS chip and red wire meet, and clip it onto the BIOS chip. Ensure that the test clip is on properly and that the laptop battery and charger is removed prior to turning on the Raspberry Pi.

Fig. 7

Fig. 8

Fig. 9

Turn on the Raspberry Pi and SSH into it. See whether flashrom can detect your chip by running sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 in the terminal.

pi@raspberrypi:~ $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512
flashrom v1.2 on Linux 5.10.63-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
No EEPROM/flash device found.
Note: flashrom can never write if the flash chip isn't found automatically.

If you see No EEPROM/flash device found. turn off the Raspberry Pi and verify your test clip connections and pins.

pi@raspberrypi:~ $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512
flashrom v1.2 on Linux 5.10.63-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop ... OK.
Found Winbond flash chip "W25Q32.V" (4096 kB, SPI) on linux_spi.
Reading flash ... done.

If you see Found Winbond flash chip "W25Q32.V" you can continue to the next step.

Run the command: sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -r bios1.img to create a BIOS images.

When flashrom has finished reading the chip, run the command sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -r bios2.img and create a duplicated file.

After creating the two BIOS image, verify that the file match by running diff bios1.img bios2.img.

ubuntu@ubuntu:~ $ diff bios1.img bios2.img
Binary files bios1.img and bios2.img differ

If this return Files are different, You will need to turn off the Raspberry Pi and re-seat the test clip on the BIOS chip and try again.

ubuntu@ubuntu:~ $ diff bios1.img bios2.img
ubuntu@ubuntu:~ $ 

If this return empty, you can continue to the next step.

Afterward, backup and store one of the BIOS image for safe keeping in case something might goes wrong. Transfer the other BIOS image to your second Linux computer.

§06Patching the BIOS image

Now to patch the BIOS image and remove the Wi-Fi whitelist. You will have to move the BIOS image to the UEFIPatch folder and run the command:

./UEFIPatch bios2.img xx40_xx50_patches_v7.txt -o bios_patched.img

§07Signing the patched BIOS image

To sign the BIOS image, verify that python3 is installed and pycryptodome package is installed:

sudo apt-get python3 python3-pip

pip3 install pycryptodome

Now run the command: thinkpad-uefi-sign/sign.py bios_patched.img -o bios_patched.img to sign the image.

Verify that the image is sign by running the command: thinkpad-uefi-sign/verify.py bios_patched.img and it should say "SIGNATURES CORRECT!".

§08Flashing the patched BIOS

Transfer over the patch BIOS image to your Raspberry Pi and run the command:

sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -w bios_patched.img

Wait for flashrom to finish, turn off the Raspberry Pi and remove the test clip from the BIOS chip.

⚠ WARNING ⚠ Turn off the Raspberry Pi FIRST and then remove the test clip. You might damage your laptop if this is not done properly.

§09Thinkpad T440p Reassembly

You can now reassemble the laptop by sliding the bottom cover back on the laptop, screwing the two top screw near the battery, slide in the battery, and power the laptop.

Finally, we can see the fruit of our labour by verifying that the laptop boots into the OS and connect to Wi-Fi.

§10References:

• Wolfgang
• Pinout
• Tom van Veen
• Tyler Cipriani