Service Forum

[Disabled]

Hello,
I currently have a customer from out of town who has a Lenovo R61 that started to update the BIOS but canceled it at the middle of the process. Now when he turns on his laptop the screen stays black and doesn't show anything because the bios is corrupted.

I searched in Lenovo website for a the BIOS update, downloaded it, extracted the contents and found two files among others:

$01AE000.FL1 (1,321,742 bytes)
$01AE000.FL2 (2,105,344 bytes)

Analyzed both files and the one with name of $01AE000.FL2 is the BIOS update (16 Megabits/2 Megabytes + 8,192 bytes). I have done it with other brands of laptop like Acer, Dell, etc. to extract the bios update and use a programmer to flash the chip and has always worked, but IBM/Lenovo I think they may be different because of their embedded security.

Have some questions:

1) DO all the R61's within the same BIOS update have the same contents inside the SPI flash chip? why? because need to know ahead of time if I would be able to take the $01AE000.FL2 file and flash the SPI Flash chip.

2) Is there any other data besides the bios code stored in the flash chip like credencials or any other security information needed to properly boot up the laptop?

3) If this is not going to work IF there's security data or any other information stored in the firmware chip (¿?), what options do I have?

Thank you,

DRGN997

[victor]

Hello,

1. Yes, the BIOS update utility has one .fl for all R61 (well, they're different by size and video... and other few misterious things)
2. Yes, there is.
3. If the original (even damaged) code is not lost, we can do it.

Thinkpads use a TCPA subsystem and parts of the BIOS contains the core procedure for that. Each TCPA chip has a signature and if you flash the BIOS with other code it won't work, resulting the infamous 0192 POST errror. When doing a BIOS update, the TCPA part is not altered so even after a bad reflash, the signature can be retrieved.

That's why we can recover the TCPA part if the original TCPA code is not altered and we offer free support for SPEG users, just to mention. In essence you have to use SPEG to read the BIOS, even damaged as it is, and we will repair what is wrong.
_________________
Victor Voinea
ALLservice HQ, Romania.

[Disabled]

Hello Victor,
thank you for your answer. Can you provide me a list of materials to see if I have them, to build the Hardware Interface. I can just buy the SPEG software reader/write for USD$40, right? and build the interface from the diagram.

Thank you,
DRGN997

[victor]

Normally, SPEG comes with the interface in a complete kit for start.
The items can be purchased separately by licensed users only.
_________________
Victor Voinea
ALLservice HQ, Romania.

[Disabled]

Hello Victor/everyone,
a few months back I was just researching, but about a week ago I received the laptop. I need an opinion and this is what I did:

1) Dumped the chip AT26DF161 and made a backup, then downloaded the latest update from www.lenovo.com website, but to me didn't seemed to be the right files ($01AE000.FL1 and $01AE000.FL2). Seems like both files are combined into one and then the chip is flashed. So I kept searching and found that is a Phoenix BIOS, that before the update a backup file is created and fortunatelly found the backup file in the Hard Drive, that's the one that I flashed to the chip. At first it will give me 1-4-1-1 beep codes, then I checked memory and used the other slot and the beep code changed to 1-3-3-1 no matter what I did. I let it sit overnight and the next morning after power-up got this error everytime:

ERROR
System Configuration Data Write Error

Press <ESC> to continue.

at least it improved the previous condition, but I couldn't get rid of that error on every boot, so I proceeded to next step:

2) From the currupted BIOS copied the first FFFh bytes that in the backed-up BIOS were all FF's. Additionally copied the last 1FFF bytes from the first half of the chip (7E000-7FFFF) to the backed-up BIOS. Flashed the chip and put everything back again, powered-up the laptop and it didn't showed up any error, it was fixed .

BIOS Version was 7KET64WW (1.14) and the latest update 7KETC9WW (2.29-1.08.), 16 updates in between. I decided to update it to the latest BIOS, downloaded the 7KETC9WW update, ran the update and it complained that it had no battery, I just searched for the location where the files were extracted and directly used WinPhlash app. Since I didn't have a file with .ROM extension to update I used file $01AE000.FL2 file contained in the update (which at that time thought it had the full BIOS update). WRONG . After restart it didn't show anything on screen anymore.

3) I updated the chip back again with the latest file that I used and worked at that time, but this time it was the same, the laptop would turn on but doesn't show anything on-screen. Thought that maybe it was because the EC/KBC that was updated too wasn't compatible with the current BIOS, in the update notes I read that:

*** "If you update to the BIOS version 2.07-1.08 or later, you are not able to get back to the older".

4) So what I did next was to search for the most current version 7KETC9WW (2.29-1.08.) and at http://forums.mydigitallife.info found it, it had been modified just to remove hardware whitelist check, downloaded the file and then copied to it first FFFh bytes and last 1FFF bytes of first half of my original dump. Same story, programmed the chip and put everything back, the laptop doesn't show anything on screen.

On steps 3 and 4 tried to recover the BIOS with a USB stick and also with a CD-RW pressing Fn+B or Win+B keys but it didn't make a difference.

In my opinion if the EC/KBC has a FlashROM code storage, is most likely corrupted because of the file I used to update the BIOS+EC/KBC, it wasn't the right one to use. So the code used to update the EC/KBC wasn't at the offset it needed to be, I'm just guessing since it doesn't give any beeps or show any activity, the laptop would just stay on as long as is left that way. After a few minutes the fan turns on, but that's it. Any suggestions?

Sorry for the long post.

DRGN997

[victor]

We can fix it, no problemat all. We just need the original dump, the one you did back-up.
Are you a SPEG licensed user? (I always forget who's who in the forum)
_________________
Victor Voinea
ALLservice HQ, Romania.

[Disabled]

Hello Victor,
I still wanted to give it a try but didn't worked, first I used the file $01AE000.FL2 (ECP) and then decompressed the file $01AE000.FL1 (BIOS). After I flashed each file I let the laptop powered on for a couple of minutes, it didn't give any beep codes or showed anything on-screen. I even copied some data/code from .FL2 into .FL1 file, same story, no codes.
Regarding the SPEG software I'm not a licensed user, for now I'm using a Willem programmer and another one just for SPI chips.
Please let me know how much would it cost to reconstruct the BIOS/ECP and what are the probabilities that it's going to work.
I just e-mailed you two files, one from the backup created by WinPhlash (that worked on the first attempts) and another one from a dump of chip AT26DF161 before I did anything to it.

Thanks,
DRGN997