The Thinkpad in question, with a Linux shell open on its screen, showing that the device mode has been successfully enabled

ThinkPad X1 Carbon Turned USB Device Through Relentless Digging

March 1, 2024 by Arya Voronova 15 Comments

In what’s perhaps one of the most impressive laptop reverse engineering posts in recent memory, [Andrey Konovalov] brings us an incredibly detailed story of how he’s discovered and successfully enabled a USB device controller in a ThinkPad X1 Carbon equipped with a 6th gen Intel CPU.

If you ever wanted to peek at the dirty secrets of a somewhat modern-day Intel CPU-based system, this write-up spares you no detail, and spans dozens of abstraction layers — from Linux drivers and modifying NVRAM to custom USB cable building and BIOS chip flashing, digging deep into undocumented PCH registers for the dessert.

All [Andrey] wanted was to avoid tinkering with an extra Raspberry Pi. While using a PCIe connected device controller, he’s found a reference to intel_xhci_usb_sw-role-switch in Linux sysfs, and dove into a rabbit hole, where he discovered that the IP core used for the laptop’s USB ports has a ‘device’ mode that can be enabled. A dig through ACPI tables confirmed this, but also highlighted that the device is disabled in BIOS. What’s more, it turned out to be locked away behind a hidden menu. Experiments in unlocking that menu ensued, in particular when it comes to bypassing Intel Boot Guard, a mechanism that checks BIOS image signatures before boot.

Continue reading “ThinkPad X1 Carbon Turned USB Device Through Relentless Digging” →

Deep Dive Into A Prison Laptop

February 26, 2024 by Maya Posch 30 Comments

The phenomenon of prison electronics is by now relatively well-documented, with striking transparent radios, televisions, and kin easy to recognize. Yet what about prison laptops? As it turns out, these are a thing as well, and [Zephray Wenting] got one from eBay to investigate, as documented over at Twitter (ThreadReader single page). Much like their audiovisual brethren, these laptops lack basic features in the name of prison security, which in the case of this laptop means for example no USB ports. Even the spacebar stabilizer rod is missing. Weaponized keyboards are apparently a thing in corrections facilities.

The Justice Tech Solutions Securebook 5. (Credit: Zephray Wenting)

Called the Justice Tech Solutions Securebook 5, it has been superseded by the Securebook 6. Inside this earlier unit, you’ll find an Intel N3450 with 4 GB LPDDR3, with SATA for storage and a special dock connector. Some laptops come with WiFi hardware installed, others are unpopulated. It appears that these Securebooks by default have a BIOS password that cannot be erased, even by removing it from the NVRAM (‘CMOS’), as it’ll return on the next boot due to an automatic BIOS reset. This was temporarily bypassed through a hacky external SPI Flash adapter, but the reward for all this trouble was a BIOS setup screen with just the ‘Security’ tab.

It’s now been sleuthed out that the default password is N%(dU32p as reported by Hackaday’s own [Adam Fabio] on Twitter. It turns out the password was available on a (now private) YouTube video. [Techknight] on Twitter has delved into EFI BIOS hacking. He has an alternate BIOS image that does provide access to the full BIOS setup utility. With BIOS access not being necessary to boot the system, the question that [Zephray] went ahead with was how to boot it into an OS since the original HDD or SSD had been removed prior to being sold. The bad news here is that it turned out that the system has a HDD whitelist (which [Sark] found a way to bypass). The good news is that someone has probed the system before, with the storage device being reported as ‘China SATA3 240GB SSD’.

Rather than mess with this, it was attempted to boot from USB, by tapping into the USB lines for the touchpad, which turned out to allow booting into a live image of Ubuntu without fuss. As an ongoing project, it’ll be interesting to see what more functionality can be wrung out of this piece of prison kit, all hopefully from the right side of the prison bars.

Thanks to [livelaughliang] for the tip.

Revive A Sony Vaio P-Series With KiCad’s Background Bitmaps

November 20, 2023 by Arya Voronova 31 Comments

You might remember that KiCad 7 came out this February, with a multitude of wonderful features. One of them was particularly exciting to see, and the KiCad newsletter even had an animated GIF to properly demo it – a feature called “Background Bitmaps”, which is the ability to add existing board images into your board editor, both front and back, and switch between them as you design the board. With it, you can draw traces, recreate the outline and place connectors over these images, giving you a way to quickly to reproduce everything on an existing PCB! I’ve seen some friends of mine use this feature, and recently, I’ve had a project come up that’s a perfect excuse for me to try it.

Back in 2020, I managed to get a Sony Vaio P from a flea market, for about 20€. It’s a beloved tiny laptop from 2009, now a collectors item, and we’ve covered a few hacks with it! The price was this wonderful only because it was not fit for regular flea market customers – it was in bad condition, with the original DC jack lost and replaced by some Molex-like power connector, no hard drive, and no battery in sight.

In short, something worth selling to a known tinkerer like me, but not particularly interesting otherwise. Nevertheless, about half a year later, when I fed it the desired 10.5 V from a lab PSU and gave the power button a few chances, it eventually booted up and shown me the BIOS menu on the screen! I’ve disassembled and reassembled it a few times, replaced the DC jack with an original one from a different Vaio ultrabook I happened to have parts from, and decided to try to bring it back to original condition.

Continue reading “Revive A Sony Vaio P-Series With KiCad’s Background Bitmaps” →

Beating Apple’s Secret Lid Angle Sensor Calibration With Custom Tool

September 26, 2023 by Maya Posch 35 Comments

Among the changes made by Apple to its laptops over the years, the transition from a Hall sensor-based sleep sensor to an angle sensor that determines when the lid is closed is a decidedly unpopular one. The reason for this is the need to calibrate this sensor after replacement, using a tool that Apple decided to keep for itself. That is, until recently [Stephan Steins] created a tool which he creatively called the ‘nerd.tool.1‘. This widget can perform this calibration procedure with the press of its two buttons, as demonstrated on [Louis Rossmann]’s YouTube channel.

This new angle sensor was first introduced in late 2019, with Apple’s official reason being an increased level of ‘precision’. As each sensor has to be calibrated correctly in order to measure the magnetic field and determine the associated lid angle, this means that third-party repair shops and determined MacBook owners have to transplant the chip containing the calibration data to a replacement sensor system. Until now, that is. Although the nerd.tool.1 is somewhat pricey at €169 ($179 USD), for a third-party MacBook repair shop this would seem to be a steal.

It is however unfortunate that Apple persists in such anti-repair methods, with recently [Hugh Jeffreys] also calling Apple out on this during a MacBook Pro M1/M2 teardown video. During this teardown [Hugh] came across this angle sensor issue by swapping parts between two otherwise identical MacBook Pros, indicating just how annoying this need to calibrate one tiny lid angle sensor is.

Continue reading “Beating Apple’s Secret Lid Angle Sensor Calibration With Custom Tool” →

Reverse Engineering A Classic ThinkPad Battery

July 15, 2023 by Bryan Cockfield 14 Comments

The ThinkPad 701 is an iconic laptop series from the mid-90s and is still highly sought after today because of its famous butterfly keybaord. The laptop itself is tiny even by the standards of the time, so in order to fit a full-size keyboard IBM devised a mechanism where the keyboard splits and slides over itself to hide away as the screen is closed. But, like most 30-year-old laptops, the original batteries for these computers are well past their prime. [polymatt] takes us through all of the steps needed in order to recreate a battery from this era down to the last detail.

He starts by disassembling an old battery with extensive damage from the old, leaky batteries. The first part of the recreation is to measure the battery casing so a new one can be modeled and printed. The control boards for the batteries of these computers were not too sophisticated, so [polymatt] is able to use a logic analyzer with a working unit to duplicate its behavior on an ATtiny microcontroller. With that out of the way, a new PCB is created to host the cloned chip and a new battery pack, made out of 9 NiMH cells is put together.

[polymatt] wanted this build to be as authentic as possible, so he even goes as far as replicating the label on the underside of the battery. With everything put together he has a faithful recreation of this decades-old battery for a famous retro laptop. ThinkPads are popular laptops in general, too, due to their fairly high build quality (at least for their enterprise lineups) and comprehensive driver support especially for Linux and other open-source software projects like coreboot and libreboot.

Thanks to [Roman UA] for the tip!

Continue reading “Reverse Engineering A Classic ThinkPad Battery” →

The ThinkPad You All Wish You Had, With A Brain That’s Not Ancient

July 10, 2023 by Jenny List 26 Comments

An IBM (or, later, Lenovo) ThinkPad is a popular choice in our community. They’re prized for their rugged design, longevity, and good software support. Over the many years that the line has been available, there have been a few models which have captured the attention more than others, and among those, probably the most sought-after is the ThinkPad 701c. It would be an unremarkable mid-1990s 486 laptop were it not for the party piece of that flip-out butterfly keyboard (see video, below). [Karl Buchka] has one that’s profoundly dead, and rather than use it as a novelty paperweight, he’s giving it a new lease of life with a Framework motherboard.

This is very much a work in progress, so there will be plenty more to come, but so far, he’s taken the display panel from an iPad and made it work with the Framework board, and designed an entirely new lower case for the Thinkpad. This will hold the Framework board with its USB-C ports at the edge, so in the place of its USB-based expansion modules, he’s made a custom external port replicator. Meanwhile, a Teensy handles that unique keyboard. We’re told that the design files will all eventually be put online should anyone else want to try.

We’d normally be slightly upset were someone to butcher something as unusual as a 701c, however, in thic ase we can see that it turns a broken computer into one that should see quite a bit of use. We can’t help envying him this project.

Understandably not many 701c owners have dived inside their machines, but we have previously brought you a contemporary processor upgrade. If you’ve never seen the 701c’s keyboard — or you just want to see it again — here you go:

Thanks [Ł. Juszczak] for the tip.

E-Bike Battery Tapped For Off-Grid Laptop Power

May 2, 2023 by Tom Nardi 12 Comments

If you’ve travelling via bike, you’ll know there’s a certain advantage to packing light. But what if you need to take your beefy desktop-replacement laptop with you on one of these trips? These power hungry machines can’t go far without their chargers (or a place to plug them in), which generally makes them poor traveling companions.

Luckily, [transistor-man] came up with a solution to this particular problem by reusing his e-bike’s battery pack as a mobile power source for his Lenovo laptop. The energy demands of this particular computer are too high for USB-C Power Delivery, and as such, he had to hack up a way to feed it 20 volts DC via its proprietary square power connector. His bike’s battery puts out between 30 and 42 VDC depending on charge, so at least on paper, it should work out fine. Continue reading “E-Bike Battery Tapped For Off-Grid Laptop Power” →