hamishcoleman / thinkpad-ec

Infrastructure for examining and patching Thinkpad embedded controller firmware
GNU General Public License v2.0
1.05k stars 116 forks source link

b590 ERROR 081 - FAILED TO LOAD BIOS IMAGE FILE! sTATUS = 101 #227

Closed deeptenk2 closed 1 year ago

deeptenk2 commented 1 year ago

Hello. b590 ERROR 081 - FAILED TO LOAD BIOS IMAGE FILE! STATUS = 101 ? https://ibb.co/7zG51ns

deeptenk2 commented 1 year ago

I tried to edit the bin file through the programmer manually, but this only led to the laptop starting up and freezing on the system logo with maximum fan speed.

i replaced these lines https://github.com/hamishcoleman/thinkpad-ec/blob/master/b590.H9ET92WW.img.d/006_battery_validate.patch


p.s. Bootable ISO for EC hotpatching working correct, but i need permament paching.

leecher1337 commented 1 year ago

Hm, hard to tell, I don't have a B590 here for testing. The error 101 might indicate that the file to be patched may not even exist on the source medium. Have you tried to check with dir command if it's there? I didn't see the commandline for the flasher in the photo, but that's the first thing I would check: Does the BIOS update file exist in the image?

As EC hotpatching ISO works, the code change itself must be correct.

As you asked me via e-mail why my ISO doesn't allow permanent flashing: The reason is already explained in the project's readme: https://github.com/leecher1337/thinkpad-Lx30-ec#patch-and-reflash-firmware So the flash chip cannot be unlocked, except with some hackery that 1vyrain could do, but that would be more overhead than just flashing with original flash procedure what thinkpad-ec is supposed to do.

If you patched the image manually, did you ensure to also update the checksum of the embedded controller ( https://github.com/leecher1337/thinkpad-Lx30-ec/blob/main/fwpat/util/npce885crc.c )? Otherwise your updated firmware won't load and you can only (possibly) recover using a flash programmer, so take care!

deeptenk2 commented 1 year ago

Thanks for the answer.  Sorry, my English is bad. I did not calculate the checksum, you are right, but I do not quite understand how to do it with *.bin File created by the programmer (CH341a programmer). The file is present, but even if you replace it in the original flash driver and the flash driver under Windows by Lenovo do not see the file, I checked the path, the file is in place. Today I will check through the iso file and CD and report the result.

deeptenk2 commented 1 year ago

https://ibb.co/BqGKphW screen by ISO by DVD-Rom These are the images I got. https://ufile.io/wisi2xa7

deeptenk2 commented 1 year ago

If I send you the bin file read by the programmer https://ufile.io/xj8d2vnj, can you modify it correctly or tell me step by step how to do it?

leecher1337 commented 1 year ago

Hi,

The thinkpad-ec repository here is buggy. As mentioned in my original thread, I don't recommend using it and instead use my original repository, as the repository here doesn't seem to be tested very well. So, please use https://github.com/leecher1337/thinkpad-ec/tree/Lx30 instead.

If you diff the output of the building process, you can see that this repository uses a wrong filename when writing to the disk image causing mentioned failure that file wasn't found:

< = this repostiroy = wrong

= my repository = correct

< cp --reflink=auto b590.H9ET92WW.CAP.orig b590.H9ET92WW.CAP.tmp
< ./scripts/FL2_copyIMG to_fl2 b590.H9ET92WW.CAP.tmp b590.H9ET92WW.img
< IMG at offset 0x4001d0 size 0x20000 (EFI::Capsule::PFH_header b590.H9ET92WW.CAP.
tmp)
< mv b590.H9ET92WW.CAP.tmp b590.H9ET92WW.CAP
---
cp --reflink=auto H9ET92WW.CAP.orig H9ET92WW.CAP.tmp
./scripts/FL2_copyIMG to_fl2 H9ET92WW.CAP.tmp b590.H9ET92WW.img
IMG at offset 0x4001d0 size 0x20000 (EFI::Capsule::PFH_header H9ET92WW.CAP.tmp)
mv H9ET92WW.CAP.tmp H9ET92WW.CAP

Then you should receive a correct .iso file that you can boot and patch. If you are still having problems, I can also patch your BIOS dump, but I don't think it will be necessary.

deeptenk2 commented 1 year ago

I checked, the result is the same. Both under Windows and under dos. The file sizes are also different. I still ask you to make me a working .img and .bin for the programmer. Thank you in advance. https://ibb.co/0mvz92T

deep@deep-virtual-machine:~/thinkpad-ec-Lx30$ make patched.b590.img Generated dependancies from descriptions Downloading b590,b490 BIOS ?.? (H9ET92WW) EC 1.02 (H9EC09WW) 2022-12-01 09:14:54 URL:https://download.lenovo.com/pccbbs/mobiles/h9et92ww.exe [4525327/4525327] -> "h9et92ww.exe.orig" [1] scripts/checksum --mv_on_fail h9et92ww.exe.orig h9et92ww.exe mvinnoextract h9et92ww.exe.orig -I H9ET92WW.CAP | grep -i H9ET92WW.CAP | cut -d'"' -f2` H9ET92WW.CAP.orig ./scripts/FL2_copyIMG from_fl2 H9ET92WW.CAP.orig b590.H9ET92WW.img.orig IMG at offset 0x4001d0 size 0x20000 (EFI::Capsule::PFH_header H9ET92WW.CAP.orig) ./scripts/hexpatch.pl --rm_on_fail --fail_on_missing --report b590.H9ET92WW.img.report b590.H9ET92WW.img b590.H9ET92WW.img.d/006_battery_validate.patch Attempting to patch b590.H9ET92WW.img Applying b590.H9ET92WW.img.d/006_battery_validate.patch -4178,14 +4178,14 mkdir nuvoton-tools wget -O nuvoton-tools/npce885crc.c https://raw.githubusercontent.com/leecher1337/thinkpad-Lx30-ec/main/fwpat/util/npce885crc.c --2022-12-01 09:14:55-- https://raw.githubusercontent.com/leecher1337/thinkpad-Lx30-ec/main/fwpat/util/npce885crc.c Распознаётся raw.githubusercontent.com (raw.githubusercontent.com)… 185.199.109.133, 185.199.110.133, 185.199.111.133, ... Подключение к raw.githubusercontent.com (raw.githubusercontent.com)|185.199.109.133|:443... соединение установлено. HTTP-запрос отправлен. Ожидание ответа… 200 OK Длина: 3276 (3,2K) [text/plain] Сохранение в: ‘nuvoton-tools/npce885crc.c’

nuvoton-tools/npce8 100%[===================>] 3,20K --.-KB/s за 0,1s

2022-12-01 09:14:56 (27,6 KB/s) - ‘nuvoton-tools/npce885crc.c’ сохранён [3276/3276]

gcc -o nuvoton-tools/npce885crc nuvoton-tools/npce885crc.c fatal: не найден git репозиторий (или один из родительских каталогов): .git ./nuvoton-tools/npce885crc -o 0x8000 -u b590.H9ET92WW.img NUVOTON Insyde firmware CRC calculator v1.00 (c) leecher@dose.0wnz.at 02/2022

Searching at offset 8000 CRC Start address=0048800A Assumed load address: 00488000 CRC indexing offset = A Calculated CRC = A2, file CRC = 75 --> CRC differs! Updating CRC...OK! cp --reflink=auto H9ET92WW.CAP.orig H9ET92WW.CAP.tmp ./scripts/FL2_copyIMG to_fl2 H9ET92WW.CAP.tmp b590.H9ET92WW.img IMG at offset 0x4001d0 size 0x20000 (EFI::Capsule::PFH_header H9ET92WW.CAP.tmp) mv H9ET92WW.CAP.tmp H9ET92WW.CAP Downloading l430,l530 BIOS 2.54 (G3ET94WW) EC 1.14 (G3HT40WW) 2022-12-01 09:15:03 URL:https://download.lenovo.com/pccbbs/mobiles/g3uj13us.iso [25538560/25538560] -> "g3uj13us.iso.orig" [1] scripts/checksum --mv_on_fail g3uj13us.iso.orig g3uj13us.iso Downloading b590,b490 BIOS ?.? (H9ET75WW) EC 1.01 (H9EC08WW) 2022-12-01 09:15:15 URL:https://download.lenovo.com/pccbbs/mobiles/h9et75ww.zip [49576764/49576764] -> "h9et75ww.zip.orig" [1] scripts/checksum --mv_on_fail h9et75ww.zip.orig h9et75ww.zip mkdir -p h9et92ww.exe.orig.extract.tmp unzip -o h9et75ww.zip.orig DOS/* -x *.cap *.IMC *.BAT -d h9et92ww.exe.orig.extract.tmp/ Archive: h9et75ww.zip.orig creating: h9et92ww.exe.orig.extract.tmp/DOS/ inflating: h9et92ww.exe.orig.extract.tmp/DOS/Bios.EXE
inflating: h9et92ww.exe.orig.extract.tmp/DOS/chkGPIO.EXE
inflating: h9et92ww.exe.orig.extract.tmp/DOS/CMPBIOS.EXE
inflating: h9et92ww.exe.orig.extract.tmp/DOS/DosFlash.exe
inflating: h9et92ww.exe.orig.extract.tmp/DOS/EC.EXE
inflating: h9et92ww.exe.orig.extract.tmp/DOS/ECIO.EXE
inflating: h9et92ww.exe.orig.extract.tmp/DOS/EEP_INIT.COM
extracting: h9et92ww.exe.orig.extract.tmp/DOS/ERROR.LOG
inflating: h9et92ww.exe.orig.extract.tmp/DOS/FIND.EXE
inflating: h9et92ww.exe.orig.extract.tmp/DOS/fparts.txt
inflating: h9et92ww.exe.orig.extract.tmp/DOS/fpt.exe
inflating: h9et92ww.exe.orig.extract.tmp/DOS/GPIO.EXE
extracting: h9et92ww.exe.orig.extract.tmp/DOS/GPIO.INI
inflating: h9et92ww.exe.orig.extract.tmp/DOS/SMBIOS.EXE
mattrib -i h9et92ww.exe.tmp@@71680 -r -/ ::FLASH/ mdeltree -i h9et92ww.exe.tmp@@71680 FLASH/ mmd -i h9et92ww.exe.tmp@@71680 FLASH mcopy -o -s -m -i h9et92ww.exe.tmp@@71680 h9et92ww.exe.orig.extract.tmp/DOS/* ::/FLASH/ mcopy -t -m -o -i h9et92ww.exe.tmp@@71680 H9ET92WW.CAP.tmp ::/FLASH/H9ET92WW.CAP mcopy -t -m -o -i h9et92ww.exe.tmp@@71680 h9et92ww.exe.report.tmp ::report.txt mcopy -t -m -o -i h9et92ww.exe.tmp@@71680 h9et92ww.exe.bat.tmp ::AUTOEXEC.BAT file is read only, overwrite anyway (y/n) ? y cp h9et92ww.exe patched.b590.iso cp h9et92ww.exe.report patched.b590.iso.report

Your build has completed with the following details:

Built ISO: 9182a061ae2f238eaebf5130a45dfcbdca9229f8 patched.b590.iso Based on code from: b590,b490 BIOS ?.? (H9ET92WW) EC 1.02 (H9EC09WW) Buildinfo: (20221201) patched.b590.img Built FL2: 1647da4d2edb03e61a764cbe9614f506113814f0 H9ET92WW.CAP

Patches applied: b590.H9ET92WW.img.d/006_battery_validate.patch

./scripts/geteltorito -o patched.b590.img.tmp patched.b590.iso Booting catalog starts at sector: 20 Manufacturer of CD: NERO BURNING ROM Image architecture: x86 Boot media type is: harddisk El Torito image starts at sector 27 and has 49152 sector(s) of 512 Bytes

Image has been written to file "patched.b590.img.tmp". ./scripts/fix_mbr patched.b590.img.tmp

Your build has completed with the following details:

Built ISO: 9182a061ae2f238eaebf5130a45dfcbdca9229f8 patched.b590.iso Based on code from: b590,b490 BIOS ?.? (H9ET92WW) EC 1.02 (H9EC09WW) Buildinfo: (20221201) patched.b590.img Built FL2: 1647da4d2edb03e61a764cbe9614f506113814f0 H9ET92WW.CAP

Patches applied: b590.H9ET92WW.img.d/006_battery_validate.patch `

deeptenk2 commented 1 year ago

Guys, where are you?

leecher1337 commented 1 year ago

You can simply patch your dump with;

./patchui.sh patchdump B590 "bat" ~/b590.bin

using thinkpad-Lx30-ec.

So here is your patched dump file, in case you didn't already patch it yourself: http://dose.0wnz.at/b590.zip

It's interesting that the Thinkpad Firmware update program doesn't like the - now hopefully correctly - patched image, but as I saw in your previous mail, it issues a different status code (14) now on patching (so not the original 101 which just meant file not found due to the error I pointed out). Unfortunately I cannot test it without having such a machine myself in order to find out what the new error code means, could be anything, I guess... So you say that you get the same status code with WinFlash and with DOS flash?

Maybe using the flash programmer with patched dump is still the easiest solution, as I cannot find a list of WinFlash error codes.

deeptenk2 commented 1 year ago

Thanks, I'll try the dump tomorrow. For me, flashing through a real programmer is the easiest solution. I will inform you about the result. My friend and I have been waiting for your reply.

deeptenk2 commented 1 year ago

I flashed http://dose.0wnz.at/b590.zip with a programmer. Everything is great! Huge thanks and respect!