[TUTORIAL] Lenovo X230 Tablet BIOS Whitelist Removal (Hardware Flash)

Hi all, this is my first thread and English is not my first language - so please be gentle.

As experienced by all Lenovo Laptop user around the world, our options in hardware upgrades are pretty much limited to Lenovo approved parts only (especially on WLAN/WWAN card) due to embedded "Whitelist FRU" in BIOS. Some BIOS EEPROM software programmer successfully solved the problem by coding the BIOS ROM to bypass whitelist check or change Hardware PID/VID list in the ROM and flash it normally. Unfortunately on recent Lenovo Laptops (X230, X240, T430, etc) such approach no longer works as Lenovo has some protection mechanism to prevent unauthorized BIOS ROM Image from being flashed into their laptops.

But, resistance is futile, Lenovo! We can still do this in hard way...I mean the hardware way

I attempt to install Intel newest WLAN card, the Half-Size Mini PCI-E Intel Dual Band Wireless-AC7260+Bluetooth 4.0. Lenovo X230 Tablet of course doesn't accept this card, eventhough we get the card from Lenovo approved parts ; since X230T Original BIOS doesn't list Lenovo's Intel AC7260 FRU.

As frustrated Lenovo owner already knew

The dreaded part blacklist from Lenovo.

To get it done I have my tools ready:

1. Atten 8586 Solder Station (PID Controlled Solder Iron & Hot Air)
2. Multicore Ersin 0.46mm Leaded Solder Wire (Sn62/Pb36/Ag2)
3. MG Chemicals RA Type Rosin Flux (ROMI Class) in Bonkote SMD flux brush
4. Multicore Loctite 3.5mm and 0.8mm solder wick
5. Isopropyl Alcohol
6. Kimwipes Science lint free tissue
7. SMD antistatic tweezer, antistatic brush, LED third hand holder, etc.


The Tool Setup

8. Minipro TL866CS USB Universal EEPROM Programmer ~ I get it new @ USD 39 from some Chinese supplier.
9. SOIC/SOP 8 to DIP adapter.


Cheap Chinese Minipro TL866CS EEPROM Programmer

First of all, I need to have a modded BIOS ROM Image from someone (as I don't have any expertise on that) to bypass the whitelist check. I got my ROM from one of famous guru here (sovem). I sent him 2 ROM backup images from my current 2.57 BIOS (using Universal BIOS Backup and FPT Backup). These 2 images have different size, 12MB and 7MB. I don't know exactly which one he need so I sent both of them anyway. And regardless of how new I am here on the forum, he replied me with 4MB modded BIOS ready to be flashed the day after (thanks man!).

I decided to buy a new blank chip at first to be flashed into so I can keep my original BIOS chip untouched for recovery in catastrophic event. From other guide laying out in the internet, we can recognize our BIOS chip using FPT Backup Tools (which I found out to be unreliable later on).



The FPT Backup tools read 2 of my EEPROM (Main BIOS and Embedded controller BIOS) as Macronix MX25L3205D and Macronix MX25L6405D. The one need to be flashed is the Main BIOS, so I bought 3 MX25L3205D chips (@ USD 0.5 each) from China.

I disassemble my laptop using Lenovo Hardware Maintenance PDF manual as guide (which can be found in Lenovo Support Page). The board was covered in black sticky cover tape, so it's kinda difficult to locate my BIOS chip. But I got lucky from the first tape tear anyway. Both of these BIOS chips is located near the Express Card slot as shown in the picture.



But after I look more closely to it, I realized that I got the wrong blank chip. I bought MX25L3205D but the chip on the board was MX25L3206E. So I lookup into Macronix document and found out that the one on Lenovo board is a new one as the one I bought (which the FPT Backup Tool read) is being discontinued. Though both chips mainly share the same command sets, but the older one support dual I/O command, ACC write protection pin, and so on - so it's not cross compatible (trust me, I tried and it is NOT compatible). Even Macronix have special migration document about it.


Closer look on Lenovo X230 Tablet BIOS Chip


Side to side: the older MX25L3205D vs MX25L3206E

So why the FPT Backup Tool read the wrong chip number?
Answer: Macronix use the same shared device ID for both chips along with some of their similar MX25L32xx chips. MX25L3205D being the older one is the one that FPT Backup Tool read.

I don't want to waste any more time, so I decide to bite the bullet and flash the modded ROM Image into my existing BIOS chip anyway.

1. I tape some Kapton around the BIOS chip. I did this not to protect the surrounding component from heat (as Kapton tape despite of being heat resistant and dielectric, it's not a thermal insulator), but to prevent the tiny 0402 SMD component from being blown by hot air blow whilst their tin is melting.
2. I set the hot air @ 250 deg C and raise to 320 deg C at 5-10cm distance alternately on each chip legs. While doing it I pull the chip lightly using bent SMD tweezer, and the chip came off.


Blowing hot air to the chip

3. I clean the board from the old-lousy-hard to melt lead-free leftover tin using fluxed solder wick and soldering iron.


Cleaning the lead-free solder tin from the board


BIOS Chip removed

4. I solder the chip to 8-pin SOIC/SOP to DIP adapter for direct mounting on the programmer. SOIC to DIP cable clamp proven to be unreliable. I use it at first and always result in flashing failures (even the seller warn about it before purchase).

5. I install my new Minipro TL866CS into second PC. It's easy, fast, and straightforward. Then I put my chip into the programmer and run the program.

6. First, I select the correct chip from the list.


EEPROM Chip selection

7. I open the modded ROM file from 'sovem'. (Again, thanks man!)


Open the modded ROM

8. I select Device>Program with 'Erase before' option chosen.


Programming successful

9. I flux the pad using my favourite aggressive ROMI class rosin flux for fast easy soldering using Bonkote brush


Board pad preparation

10. I set my soldering iron @ 240 deg C to solder the modded chip using my favourite leaded silver enriched solder wire. If lead-free solder wire used, temperature must probably be set at least 40-50 deg C higher to get a good enough flow and result.


Soldering the chip

11. I clean the flux using isopropanol, antistatic brush, and lint free tissue.


Cleaning the board

12. BIOS chip soldered back. I always love how easy to work with leaded solder wire and how reliable and shiny the result finish is compared to the dull lead-free one. (darn you environmentalist!)



Apparently the job isn't finished here. Intel utilize some Bluetooth switch on 7260AC+BT mini PCI-E #51 pin. I tried it on 2 PC and Bluetooth is not even showing on device manager. I read that if the board supply 3.3V on that pin, Bluetooth is off and vice versa. So I taped a tiny Kapton tape on pin #51 as shown.


Intel Dual Band 7260AC + BT 4.0 with pin #51 taped to enable Bluetooth

So I assemble my laptop with the card and the laptop turns on with 5 beeps-pause-5 beeps and finally goes to POST (phew...I thought it was dead). I went into BIOS after I learn (read) that Lenovo utilize some security measure called TPM Chip which has to be disabled to prevent the beeps goes off everytime it boots. I don't know exactly what the TPM feature is for, but apparently it's causing delayed POST and beeps when modified BIOS ROM was used.

13. Disable the TPM on the BIOS under Security tab.


Security chip disabled

We can also see how the TPM is disabled under device manager after running these commands under CMD (as administrator)
-"set devmgr_show_nonpresent_devices=1"
-"start devmgmt.msc"
Device Manager will show, enable "show hidden devices" and look up to greyed out TPM device.


TPM disabled on device manager

14. Complete!


Whooping 866.7 Mbps reward (paired with ASUS RT-AC68 Router) and Bluetooth 4.0 enabled.

My special thanks to sovem (bios-mods guru). This thread is dedicated to you as my appreciation to your work and kindness to a newbie one like me.

-kemod-