[Request] Lenovo P16 G2 unlock/mod

BIOS/UEFI Modding BIOS Modding Requests
1

Lenovo P16 G2. Downgraded to factory BIOS.

I want to make the following modifications:

  1. Unlock advanced menu
  2. Clean whitelist for modem
  3. Enable ACPI S3 Sleep State
  4. Enable undervolt/remove overclocking lock

I was able to extract bios file, using innoextractor.
Extracted Setup P32 image, where all above settings are present.
Checked offsets using irfextractor.

Tried editing BIOS using ru.efi. Got “Write variable failed: 0x00000008” error when attempted to edit any hex value. Seems like direct BIOS modifications are locked, even though I’ve disabled Secure Boot, TPM 2.0 and everything else on the Security tab in BIOS.

So, I decided to modify the “pure” bios image that was downloaded from the official site, instead.

Now, here are some issues that I’m not able to overcome myself:

1 issue. Setup P32 image was extracted into two .txt files by irfextractor:
Section_PE32_image_Setup_Setup_body.efi.0.0.en-US.ifr.txt,
Section_PE32_image_Setup_Setup_body.efi.1.0.en-US.ifr.txt

I opened Section_PE32_image_Setup_Setup_body.efi with HxD, but not sure which values should be changed. Fore example, I found S3 state mentioned in 0.0.txt:

OneOf Prompt: “ACPI S3 Support”, Help: “Enable ACPI S3 support”, QuestionFlags: 0x10, QuestionId: 0x3D, VarStoreId: 0x1, VarOffset: 0xE, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x1, Step: 0x0

But, I don’t have any clue where is this located in the .efi body of Setup section. Should be 000000E0, I suppose. Right? https://i.imgur.com/riNAYvo.png

2 issue. I’m not sure if t would be possible to flash the modded BIOS using the unpacked official installer. Do I need to somehow sign or verify modified .fl1 image before flashing it into the laptop?

Is there any good tutorial available on how to mod the BIOS on the latest intel based, Phoenix BIOS Thinkpads?

2

This is the BIOS update tool link - https://download.lenovo.com/pccbbs/mobiles/n3tuj01w.exe
01w is the initial version, which is installed on my machine. 02w is what’s available on the official drivers page.

3

Even when SecureBoot was disabled in BIOS, I couldn’t edit variables with ru.efi.
Now, I also deleted stored keys from BIOS, tried editing one random value and it worked.
Of cause, I reverted it back to the default value and saved afterwards.
Now, what I can’t figure out by myself is which value will enable the advanced menu in BIOS.
Iэму exported Setup P32 image with UEFITool, converted entries to txt with IRFExtractor but that’s it. I see 6 entries with “Advanced menu” but unable to understand which VarStore/VarValue I should use in ru.efi GUI.

                               Form Sets

Offset: Title:

0x8F454 Intel Advanced Menu (0x1CEB from string package 0x0)
0xBECE4 Platform Information Menu (0x1CCC from string package 0x0)

0x8F458 Form Set: Intel Advanced Menu [E14F04FA-8706-4353-92F2-9C2424746F9F], ClassGuid0 [E58809F8-FBC1-48E2-883A-A30FDC4B441E] {0E A7 FA 04 4F E1 06 87 53 43 92 F2 9C 24 24 74 6F 9F EB 1C EC 1C 01 F8 09 88 E5 C1 FB E2 48 88 3A A3 0F DC 4B 44 1E}
0x8F47F Guid: [0F0B1735-87A0-4193-B266-538C38AF48CE] {5F 15 35 17 0B 0F A0 87 93 41 B2 66 53 8C 38 AF 48 CE 03 02 00}
0x8F494 Guid: [0F0B1735-87A0-4193-B266-538C38AF48CE] {5F 15 35 17 0B 0F A0 87 93 41 B2 66 53 8C 38 AF 48 CE 04 00 00}
0x8F4A9 Default Store: Standard Default, DefaultId: 0x0 {5C 06 06 1D 00 00}
0x8F4AF Default Store: Manufacture Default, DefaultId: 0x1 {5C 06 07 1D 01 00}

0x8F7E9 Form: Intel Advanced Menu, FormId: 0x1001 {01 86 01 10 EB 1C}
0x8F7EF Text: Statement.Prompt: Platform Variable Revision, TextTwo: N/A {03 08 7F 14 E6 07 80 14}
0x8F7F7 Text: Statement.Prompt: ME Setup Variable Revision, TextTwo: N/A {03 08 7D 14 E6 07 7E 14}
0x8F7FF Text: Statement.Prompt: CPU Setup Variable Revision, TextTwo: N/A {03 08 81 14 E6 07 82 14}
0x8F807 Text: Statement.Prompt: SA Setup Variable Revision, TextTwo: N/A {03 08 83 14 E6 07 84 14}
0x8F80F Text: Statement.Prompt: PCH Setup Variable Revision, TextTwo: N/A {03 08 85 14 E6 07 86 14}
0x8F817 Text: Statement.Prompt: SI Setup Variable Revision, TextTwo: N/A {03 08 87 14 E6 07 88 14}
0x8F81F One Of: Firmware Configuration, VarStoreInfo (VarOffset/VarName): 0xA, VarStore: 0x1, QuestionId: 0x1, Size: 1, Min: 0x0, Max 0x2, Step: 0x0 {05 91 1D 07 1E 07 01 00 01 00 0A 00 10 10 00 02 00}
0x8F830 One Of Option: Ignore Policy Update, Value (8 bit): 0x0 {09 07 1F 07 00 00 00}
0x8F837 One Of Option: Production, Value (8 bit): 0x1 {09 07 20 07 00 00 01}
0x8F83E One Of Option: Test, Value (8 bit): 0x2 (default) {09 07 21 07 10 00 02}
0x8F845 End One Of {29 02}

Entries 4 to 6 are related to DMI Advanced Menu, which is probably not what I’m looking for.

Can anybody help me with figuring this out? Thanks in advance.

4

There is no such in this bios.

5

How can you be so sure? Those excerpts above are from this BIOS.
I didn’t take that “ACPI S3 support” string out of nowhere.

6

any progress?