Git Product home page Git Product logo

yoga-bios-unlock's Introduction

yoga-bios-unlock

Based on FlyGoat's work to unlock the BIOS advanced menu documented here, I wrote that tool to unlock my yoga laptop without using a proprietary software which is only available on Windows.

I'd like to thank FlyGoat a lot for giving me the right direction on how to translate his guide into low-level functions provided by glibc (see also FlyGoats gist).

This tool will unlock the advanced menu in your Lenovo Yoga Slim 7 14ARE05.

To unlock the advanced menu it's necessary to change the data field on port 0x73 at index 0xf7. Port 0x72 is the index port that defines which value at 0x73 will be accessed.

                            \/
     | 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
  ---+------------------------------------------------
  00 | 21 bc 21 63 00 00 5a a5 18 70 f6 7c 00 f5 19 00
  10 | 80 00 a6 20 00 44 00 02 00 00 94 80 89 00 e0 49
  20 | 00 0d 04 30 21 00 24 00 00 10 00 04 00 00 04 ec
  30 | 55 55 55 55 ff 07 00 20 29 00 8c 00 0a a8 00 08
  40 | f4 00 00 00 01 20 01 01 08 00 00 00 10 11 00 00
  50 | 00 00 80 00 00 00 41 00 00 00 00 00 ff 07 00 00
  60 | 00 00 00 00 00 10 00 20 02 00 00 00 00 00 00 00
  70 | 00 00 00 00 08 01 08 00 00 00 00 00 86 22 00 00
  80 | c0 0c 00 80 09 52 00 00 00 00 00 00 00 00 00 00
  90 | 00 00 00 00 08 00 00 80 00 00 04 40 00 80 00 00
  a0 | 00 00 00 00 00 00 00 00 20 40 00 00 20 00 01 00
  b0 | 00 00 08 20 00 00 40 00 00 00 00 00 00 42 00 00
  c0 | 02 02 00 00 00 40 00 00 00 00 80 80 00 00 00 40
  d0 | 00 40 14 00 02 00 82 00 00 00 00 80 81 08 00 80
  e0 | 00 02 00 01 00 00 00 00 00 00 00 00 00 00 01 00
> f0 | 29 a4 a7 a7 00 00 00 77 e0 00 24 04 00 10 10 00
                            /\

Disclaimer

This tool may eat your cat, burn your house or do anything else beside the expected task. So use it at your own risk and be aware that you're playing around with your BIOS which may end in a bricked device.

Compatibility

| Version  | Missing features    |
| -------- | ------------------- |
| DMCN27WW |                     |
| DMCN29WW |                     |
| DMCN32WW |                     |
| DMCN34WW | no XFR enhancements |
| DMCN35WW | no XFR enhancements |
| DMCN36WW | no XFR enhancements |
| DMCN38WW | no XFR enhancements |
| DMCN39WW | no XFR enhancements |
| DMCN41WW | no XFR enhancements |
| DMCN44WW | no XFR enhancements |

If you're aware of any further differences in BIOS version please raise a ticket or open a pull request.

BIOS downgrade

Boot into BIOS and go to Configuration tab. There is an option called BIOS Back Flash which is disabled by default.

The product page of lenovo's Yoga Slim 7 provides the latest BIOS version. Thanks to lenovo they do not obfuscate their download links therefore it's quiet easy to estimate former versions and download them.

Former BIOS versions are available at lenovo servers (Readme and installation instructions are also available):

Known Issues

If you hit the following issue please disable secure boot first and try again:

Can't set I/O privilege level (Operation not permitted)

Usage

BIOS versions greater or equal to DMCN34WW are supported but hiding some menus. Using DMCN32WW is recommended.

Build from source

git clone https://github.com/esno/yoga-bios-unlock.git
cd ./yoga-bios-unlock
make

Add new bios/board versions

New supported bios and board versions can be added by appending the version string either to bios-versions.txt or to board-versions.txt. Afterwards the headers needs to be regenerated with

make headers

Verify current value of data port

# ./yoga-bios-unlock --read
Run in read mode
Be aware that readmode temporarily changes value of port 0x72 to index 0xf7
WARNING: use at your own risk!
Agree? (y/n) y
Port 0x72 is 0xf4 and will be set to 0xf7
Port 0x73 is 0x00 and would be set to 0x77

Unlock your BIOS

# ./yoga-bios-unlock --unlock
Run in unlock mode
WARNING: use at your own risk!
Agree? (y/n) y
Port 0x72 is 0xf4 and will be set to 0xf7

Lock your BIOS

# ./yoga-bios-unlock --lock
Run in lock mode
WARNING: use at your own risk!
Agree? (y/n) y
Port 0x72 is 0xf4 and will be set to 0xf7

Ignore platform check results

If you know that you're on Lenovo Yoga Slim 7 (14ARE05) but either board version might differ or BIOS version is currently not supported by this tool you can enforce an unlock. If you do please open a ticket/PR to notify me that your current BIOS version/board version works well.

Enforce unlock your BIOS

# ./yoga-bios-unlock --unlock --force
Run in unlock mode
Platform checks are disabled - hopefully you know what you do
WARNING: use at your own risk!
Agree? (y/n) y
Port 0x72 is 0xf4 and will be set to 0xf7

yoga-bios-unlock's People

Contributors

achim-k avatar esno avatar jrandiny avatar oleg-l avatar rebtoor avatar tehcneko avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

yoga-bios-unlock's Issues

Works on board version SDK0J40697

Just letting you know that it also works for my computer with the board version SDK0J40697 WIN as reported by /sys/class/dmi/id/board_version.

BIOS DHCN32WW

I have a Yoga Slim 7 14IIL05 (is an intel version)
Does it make it a difference that is DHCM instead of a DMCM

Make error - "redefinition of ‘bios_version_34’"

Highly appreciate your work!
On the latest version, when running make I get the following error:

/yoga-bios-unlock$ make
cc -o ./yoga-bios-unlock ./src/yoga-bios-unlock.c -O2 -Wall -Wextra -Wfloat-equal -Wshadow -Wstrict-prototypes -Wstrict-overflow=5 -Wcast-qual -Wconversion -Wunreachable-code
./src/yoga-bios-unlock.c: In function ‘is_yoga’:
./src/yoga-bios-unlock.c:66:17: error: redefinition of ‘bios_version_34’
   66 |   dmi_strings_t bios_version_34 = { .string = __BIOS_VERSION_34, .next = &bios_version_36 };
      |                 ^~~~~~~~~~~~~~~
./src/yoga-bios-unlock.c:65:17: note: previous definition of ‘bios_version_34’ was here
   65 |   dmi_strings_t bios_version_34 = { .string = __BIOS_VERSION_36, .next = &bios_version_38 };
      |                 ^~~~~~~~~~~~~~~
./src/yoga-bios-unlock.c:66:75: error: ‘bios_version_36’ undeclared (first use in this function); did you mean ‘bios_version_34’?
   66 |   dmi_strings_t bios_version_34 = { .string = __BIOS_VERSION_34, .next = &bios_version_36 };
      |                                                                           ^~~~~~~~~~~~~~~
      |                                                                           bios_version_34
./src/yoga-bios-unlock.c:66:75: note: each undeclared identifier is reported only once for each function it appears in
make: *** [Makefile:4: yoga-bios-unlock] Error 1

Can't set I/O privilege level (Operation not permitted)

Hi, I got this error message under ubuntu 20.04. It is my hw or some sw incompatibility?

sudo ./yoga-bios-unlock --read Run in read-mode Be aware that readmode temporarily changes value of port 0x72 to index 0xf7 WARNING: use at your own risk! Agree? (y/n) y Can't set I/O privilege level (Operation not permitted)

Dump bios

Good day. Do people have any bios dump that can be uploaded through the programmer?

board_version does not match (SDK0J40700 WIN )

It looks like I own one with a different board type.

$ sudo ./yoga-bios-unlock --read
Run in read-mode
Be aware that readmode temporarily changes value of port 0x72 to index 0xf7
board_version does not match (SDK0J40700 WIN  )
Wrong device, aborting!

Here are some relevant information:

Handle 0x0001, DMI type 1, 27 bytes
System Information
	Manufacturer: LENOVO
	Product Name: 82A2
	Version: Yoga Slim 7 14ARE05
	Serial Number: XXXXXXXXXX
	UUID: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	Wake-up Type: Power Switch
	SKU Number: LENOVO_MT_82A2_BU_idea_FM_Yoga Slim 7 14ARE05
	Family: Yoga Slim 7 14ARE05
BIOS Information
	Vendor: LENOVO
	Version: DMCN32WW
	Release Date: 07/14/2020
	Address: 0xE0000
	Runtime Size: 128 kB
	ROM Size: 15488 kB
	Characteristics:
		PCI is supported
		BIOS is upgradeable
		BIOS shadowing is allowed
		Boot from CD is supported
		Selectable boot is supported
		EDD is supported
		Japanese floppy for NEC 9800 1.2 MB is supported (int 13h)
		Japanese floppy for Toshiba 1.2 MB is supported (int 13h)
		5.25"/360 kB floppy services are supported (int 13h)
		5.25"/1.2 MB floppy services are supported (int 13h)
		3.5"/720 kB floppy services are supported (int 13h)
		3.5"/2.88 MB floppy services are supported (int 13h)
		8042 keyboard services are supported (int 9h)
		CGA/mono video services are supported (int 10h)
		ACPI is supported
		USB legacy is supported
		BIOS boot specification is supported
		Targeted content distribution is supported
		UEFI is supported
	BIOS Revision: 1.32
	Firmware Revision: 1.2

BIOS Language Information
	Language Description Format: Long
	Installable Languages: 4
		en|US|iso8859-1
		fr|FR|iso8859-1
		ja|JP|unicode
		zh|TW|unicode
	Currently Installed Language: en|US|iso8859-1

What do you think: should I take the risk and try altering the default BOARD_VERSION definition?

Advanced BIOS?

I read about a method here and here to achieve bios unlock that should work with other models of Lenovo notebooks. I'm yet to try it out on my Yoga Slim 7 14ARE05 but it is here for anyone who is brave enough to try it:

"1. Turn off OneKeyBattery mode in BIOS setup (this won't work with it enabled), save settings, power off
2. Type, with the laptop powered off: F1 1 Q A Z F2 2 W S X F3 3 E D C F4 4 R F V F5 5 T G B F6 6 Y H N. If you notice the pattern, it's just going down the column from F1 to the letter in the last keyboard row, from F1 to F6.
3. Boot the laptop with F2 pressed to get into BIOS as usual, you'll get into the BIOS but with a few options more unlocked."

Will this work on other Lenovo computers?

I understand that this is probably not the right place for such a question, but:

  1. do you believe that this can be performed on a similar device such as the Ideapad 5 14are05?
  2. how would one go about doing so?
    Thanks!

How to lock BIOS back

I want to take my laptop to a service center. And if they see an unlocked BIOS, then the guarantee could be lost. How can you believe him in his original state?

Asking for help

This is great work, thank you.
Do you think it would be possible to do for the 15ITL05 BIOS as well?

Bios rollback

Hi, do you think it is safe to roll back the bios to an earlier version?
From warranty service I got back the notebook with bios version 38. I want to go back to 32.

is there any update on DMCN39WW?

This version is published at 29 Sept. I will try to unlock it for disable S3 deep to solve sleep problem on linux. Should i try? or is there any files/instructions for downgrading bios version? I couldnt see it on lenovo support page.

"board version does not match" but it does

When I run the command ./yoga-bios-unlock --unlock I get:

Run in unlock mode
board version does not match
Wrong device, aborting!

cat /sys/class/dmi/id/board_version returns SDK0J40709 WIN
cat /sys/class/dmi/id/bios_version returns DMCN27WW

So everything is supported and it should work (This is also the data that shows in the bios), but the check apparently fails. I've seen in other bug reports that the result that I get usually includes the detected board version, but mine for some reason doesn't, so I assume that it failed to get the value.

I don't exactly know how the program works, but would it make sense to set those values manually and then run the program with those manual values? And if yes, how would I go about doing this?

Matching board version

I got a message saying my board version did not match, even though it should.
My board version is SDK0J40709 WIN.
I suspect the row of question marks has something to do with it.

The unlock worked fine when I used --force.

Run in read mode
Be aware that readmode temporarily changes value of port 0x72 to index 0xf7
board_version does not match (SDK0J40709 WIN   ��������������������������������)
Wrong device, aborting!

Tested on Intel Yoga 9 Pro - FYI No Success

Just noting here for anyone who comes across this in the future -- I attempted to force unlock on a Lenovo Yoga Pro 9 16IRP8 with:

BIOS_VERSION: KVCB35WW
BOARD_VERSION: SDK0T76461 WIN

and it was unsuccessful.

Laptop is not bricked, seemingly nothing changed at all; regular bios is healthy, no boot issues. I thought risking the brick was worth it.

Thanks @esno for all your hard work.

Works on DMCN35WW

Thank you for nice piece of software.
I tuned the code and checked that it works also in bios version DMCN35WW.

Fails on DMCN34WW

hey @esno thank's for this great tool!

When running ./yoga-bios-unlock --read I get this output here (same when running with sudo)

Run in read-mode
Be aware that readmode temporarily changes value of port 0x72 to index 0xf7
board_version does not match (SDK0J40709 WIN   ��������������������������������)
Wrong device, aborting!

This are my specs:

BIOS Information
        Vendor: LENOVO
        Version: DMCN34WW
        Release Date: 08/17/2020
System Information
        Manufacturer: LENOVO
        Product Name: 82A2
        Version: Yoga Slim 7 14ARE05

Why function read_pin doesn't set the original value back to 0x72?

The title is self explanatory,
I have absolutely zero knowledge about accessing Extend CMOS Index/Data Port but I am guessing(From my basic understanding) it would be better to save the original value aka index port position and after reading 0x73 set the index port back to the original?
so if other software that accesses the 0x73 and doesn't make sure it accesses correct index port doesn't end up messing something up?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.