Lenovo x1 nano gen 1 -- bricked -- where to flash the bios/fw

[Nicola Bianchi]

Hello!

A few days ago I bricked my Lenovo x1 nano gen 1 while updating the bios/fw from linux.
No the machine power up, but it stuck in a recovery state and I can not do much.

Lenovo X1 Nano Gen 1
Type: 20UN - X021US
S/N: R9 - 10W2D9

I would like to flash a new BIOS/FW on the chip using a CH341a programmer but ... I actually don't know which "chip" on the motherboard to target 🤦♂️
So here I am to ask for help.

I opened the laptop and I found a chip that may be the target, on it I've:
Winbond 25R256JVEQ (see picture)

Is this the chip where to flash the bios?

I downloaded the bios from here:
https://fwupd.org/lvfs/devices/com.l...N2TET.firmware

I'm totally new to this topics, so be patient.
Thank you
Nicola

[SMDFlea]

25R256JVEQ should be the correct chip. Don`t flash anything to it yet. Make a backup and post it here.

[Nicola Bianchi]

Hi, thanks.
Unfortunately it looks like with my CH341a programmer and flashrom I can not read this chip 🤔
I need to understand if this is supported or not

Cheers,
Nicola

[Nicola Bianchi]

Do you have any suggestion about programmer+software that can read&write a 25R256JVEQ chip?

Thank you,
Nicola

[hardware1]

Do you have any suggestion about programmer+software that can read&write a 25R256JVEQ chip?

Thank you,
Nicola

Have you tried to choose W25Q256JV instead of W25R256JV?
Are you using NeoProgrammer software?

[Nicola Bianchi]

Have you tried to choose W25Q256JV instead of W25R256JV?
Are you using NeoProgrammer software?

I'm using "flashrom" (https://www.flashrom.org/) on a Linux OS with the CH341a programmer.
I need to check NeoProgrammer ....

Thank you.

[Nicola Bianchi]

Hi,
I managed to read something from the chip using the following:

sudo ./flashrom --programmer ch341a_spi -c W25Q256JV_Q -r backup.bin

I read it twice and I got a 32MB file but the md5sum is different between the 2.
I don't know if this is "normal" or the connection to the chip (is situ with a SOIC8 clamp) is not stable enough...

I attach the 2 extracted files.

Thanks a lot.
Cheers,
Nicola

[hobostove]

Looks like a bad connection, those dumps are basically blank. Try again. The file should zip compress to around 10-20MB. Being only 66KB is a pretty clear indicator it's mostly blank.

[SMDFlea]

Do you have any suggestion about programmer+software that can read&write a 25R256JVEQ chip?

Thank you,
Nicola

Try IMSProg https://github.com/bigbigmdm/IMSProg .You can`t use a SOP8 clip as it is. Cut the clamp off completely and then solder the wires to the copper pads or if you want to keep the clamp cut part of the insulation off and solder extra wires to the existing ones ,then solder the new wires to the pads. Keep the wires as short as possible. The other alternatives are to buy a WSON pogo adapter (you have to hold it very steady to get a good backup) or desolder the chip and use a WSON adapter board.

[Nicola Bianchi]

Yeah, I think my SOIC8 clip is not the right one.
Now I ordered a WSON8 tester which should be better.

Talk to you soon.
Nicola

[rumpumpel1]

remove the excess solder so as not to bend the pogo pins.

[Nicola Bianchi]

Hi guys!

With the right clip I managed to read the chip consistently, so here what I extracted.
binwalk shows some content, which is promising I think.

Cheers,
Nicola

[hardware1]

Hi guys!

With the right clip I managed to read the chip consistently, so here what I extracted.
binwalk shows some content, which is promising I think.

Cheers,
Nicola

Here is your new BIOS file, try it and let me know.

[Nicola Bianchi]

Here is your new BIOS file, try it and let me know.

Hi,
thank you so much!

I did a first attempt to flash the BIOS file, the tool reported back an error, but I tried to boot up the laptop anyway.
The result is that he did something different than before: "reading ME Firmware" ... but now it ended up in the same "BIOS Self Healing backup progressing ...100%" state.

I will try later to flash it again.
See attachment for details if curious.

Cheer,
Nicola

[hardware1]

Hi,
thank you so much!

I did a first attempt to flash the BIOS file, the tool reported back an error, but I tried to boot up the laptop anyway.
The result is that he did something different than before: "reading ME Firmware" ... but now it ended up in the same "BIOS Self Healing backup progressing ...100%" state.

I will try later to flash it again.
See attachment for details if curious.

Cheer,
Nicola

I don't use flashrom, but I can see failed in verifying the chip. That means the file on the chips isn't identical with the file that you already programmed.

[SMDFlea]

Try using flashrom agin, and IMSProg, if you get the same error at the same point the chip has a problem. If you get different errors in differnt places it could be you not holding the pogo adapter steady enough.

[Nicola Bianchi]

Hi guys,
I did manage to get a successful write!

Unfortunately though, the laptop is still in the same situation, stuck in the "BIOS Self Healing backup progressing ...100%" screen 🤷♂️

A couple of notes:
- I had to use W25Q256JV chip type instead of 25R256JVEQ ... maybe this in an issue?
- I used flashrom that for W25Q256JV_Q has only an untested state

.... still that the write succeeded 🤔

Cheers,
Nicola

[Nicola Bianchi]

Hi guys,
me again.

Could it be that the issue preventing the notebook to boot does not resides in the chip we are targeting?
Or it simply may be that I need to try another BIOS image?

Thank you.
Cheers
Nicola

[Nicola Bianchi]

For the records, I managed to recover my X1 Nano using the attached bios firmware using flashrom
sudo ./flashrom/builddir/flashrom --programmer ch341a_spi -c W25Q256JV_Q -w X1_Nano_Gen_1_Laptop_ThinkPad_-_Type_20UN.bin

Thank you for the support!
Cheers

[kmorin]

For the records, I managed to recover my X1 Nano using the attached bios firmware using flashrom
sudo ./flashrom/builddir/flashrom --programmer ch341a_spi -c W25Q256JV_Q -w X1_Nano_Gen_1_Laptop_ThinkPad_-_Type_20UN.bin

Thank you for the support!
Cheers

Hi Nicola! I ran into the exact same issue as you, so I have ordered a programmer and will try to flash the bios firmware you attached. I'm just curious as to where you got this firmware from...