Help disabling BIOS WWAN whitelist on a Lenovo X380 Yoga 20LJS0MP00

[LncAhG]

My Lenovo X380 Yoga:

Model: 20LJS0MP00
SN: MP1ME1R9
BIOS: 1.41
BOard: LA-F421P

does not accept my WWAN cards Sierra 7305 or 7455. I get the dreadful "1802 unauthorised card..." message.

I have spent hours searching for a patch and stumbled across
https://github.com/digmorepaka/think...rmware-patches
I have tried the xx70_xx80_patches_v7.txt file (using UEFIpatch) and some patches could be applied but not
those of the whitelist section.

I even extracted the LenovoWmaPolicyDxe_LenovoWmaPolicyDxe part of the BIOS and fired up ghidra. I found
the 1802 message but not the place from where it's referenced so I am stuck now.

I have attached the BIOS dump (obtained from the unsoldered Chip) in case s.o. can help me.

Thanks in advance!

[Maxpower3]

My Lenovo X380 Yoga:

Model: 20LJS0MP00
SN: MP1ME1R9
BIOS: 1.41
BOard: LA-F421P

does not accept my WWAN cards Sierra 7305 or 7455. I get the dreadful "1802 unauthorised card..." message.

I have spent hours searching for a patch and stumbled across
https://github.com/digmorepaka/think...rmware-patches
I have tried the xx70_xx80_patches_v7.txt file (using UEFIpatch) and some patches could be applied but not
those of the whitelist section.

I even extracted the LenovoWmaPolicyDxe_LenovoWmaPolicyDxe part of the BIOS and fired up ghidra. I found
the 1802 message but not the place from where it's referenced so I am stuck now.

I have attached the BIOS dump (obtained from the unsoldered Chip) in case s.o. can help me.

Thanks in advance!

https://www.badcaps.net/forum/troubl...55#post3576855

you need to change your jumps here. compare files to find


use only efi file (pe32 body) to disassemble and make your modifications on the FFS

[LncAhG]

Thanks, but thats exactly the file I analysed in ghidra. I even found now the function which references
the 1802 message (after enforcing a disassembly on that region). It leads to a result comparable to
your pic.
However, this function is called 4 times, but only from another function which also never is being called.
I must admit that I've never been an x86 assembler guy (ask me 68k or MSP stuff and we're fine ;-)).
I might be able to patch the return codes or remove the "while true" loop in the end and do try-and-error...
The problem is, I have to solder and desolder the chip each time since using some clip adapter and accessing
the chip in-circuit proved to be error-prone.

[LncAhG]

use only efi file (pe32 body) to disassemble and make your modifications on the FFS

The function which checks vid and pid and so on does more than simply compre them.
For a match, it apparently also calls some kind of initialisation code, depending on the device found.
And this does more checks that can lead to a failure which in turn emits the 1802 message.

The whitelist contains (among others):

00001f60   02 00 00 00     uint32_t  2h                      category
00001f64   99 11 79 90     uint32_t  9079 1199h              vendev_id
00001f68   99 11 78 90     uint32_t  9078 1199h              subsys_id
00001f6c   00 00 00 00     uint32_t  0h                      unk

Which is a EM7455. I inserted such a device but the 1802 remains...