[Solved] Lenovo B590 with Dual Whitelist - can't find EC Chip

BIOS/UEFI Modding BIOS Modding Guides and Problems
1

Hello, I need help.

Goal: Remove Error 1802 (“Unauthorized network card”) for an Intel 7265HMW card.

This is what I have:

  • Model: Lenovo B590 (Model 20208)

  • Main BIOS Version: H5ET73WW (1.16)

  • Main BIOS Chip: Winbond W25Q64CVS
    (8MB / 64Mbit) - This is the only 8-pin chip I can find.

  • EC Controller Chip: Nuvoton NPCE885GA0DX
    (Markings: 2247BD32-072, 3023DFA)

My Diagnosis & What I’ve Done:

I know this is a Dual Whitelist problem. I ALREADY patched the Main BIOS (W25Q64), but it failed. Here are my exact steps:

  1. FPT works (BIOS Lock is OFF). I dumped the 4MB BIOS region with: fptw64.exe -d backup.bin -bios

  2. I found the LenovoWmaPolicyDxe module (by searching for “1802” Unicode).

  3. I extracted its body, patched it in HxD (74 17-> EB 17).

  4. I used UEFITool (v0.28) to “Replace Body” and “Save Image File…” to create modded.bin. (This should fix all checksums).

  5. I flashed it back with: fptw64.exe -f modded.bin -bios

  6. The flash was successful. I dumped the chip again and confirmed my EB patch is on the chip.

…BUT I STILL GET THE 1802 ERROR.

This proves the real check is in the Embedded Controller (EC) Firmware.

MY “BRICK WALL” PROBLEM:

I CANNOT FIND THE EC FLASH CHIP.

I read the Dale Nunns repair article and AI research. All sources say there MUST be a second 8-pin chip: the Winbond W25Q32FVSIG (4MB / 32Mbit).

I have searched the entire motherboard (both sides) near the Nuvoton “spider” chip and the W25Q64. I CANNOT FIND IT.

My Final Questions:

  1. Is it possible that on my specific motherboard revision, both the Main BIOS (8MB) AND the EC Firmware (4MB) are stored on the SAME 8MB W25Q64 chip?

  2. If “Yes” — how do I patch the EC part? (FPT can’t touch it, and my CH341A
    programmer will dump the whole 8MB. Where is the EC patch location inside the 8MB dump?)

  3. If “No” — can anyone please show me a photo of where the W25Q32 is hidden?

I am not ready fight again with my CH341A programmer, SOIC8 sucks! And also I don’t know what to read!

I am attaching my CPU-Z report, my original backup.bin

(from FPT), and my modded.bin (that I flashed).:sob:

I am not ready fight again with my CH341A programmer, SOIC8 sucks! And also I don’t know what to read!

I am attaching my CPU-Z report, my original backup.bin (from FPT), and my modded.bin (that I flashed).

Thank you. (AI helped me step by step, i’m sorry if i did smth wrong)


Edit by Fernando: Thread moved into the “BIOS Problems” Category and title customized/shortened

4

[SOLVED] Update after almost a year - it works!

Card: Intel AC 7265 (8086:095A, subsys 8086:9010), BIOS H5ET73WW, B590 20208.

What was wrong in my first attempt:

  • The “74 17 → EB 17” patch was wrong. Both “74 17” in LenovoWmaPolicyDxe
    are not whitelist checks (one is in a memory alloc/copy helper,
    the other in a printf format parser).
  • The EC has nothing to do with it. There is no second EC flash chip.
    The whitelist lives only in LenovoWmaPolicyDxe
    (GUID 79E0EDD7-9D1D-4F41-AE1A-F896169E5216).

How the whitelist works:

  • It is a table inside the module (RVA ~0x270), 16-byte entries:
    type (0 = WLAN PCIe, 1 = WWAN USB, 2 = Bluetooth USB),
    VID, DID, SubVID, SubDID, padding. Type 6 ends the table.
  • Bluetooth is whitelisted too (“dual whitelist”), so an Intel combo card
    also needs its BT ID (8087:0A2A) in the table.

The clean fix (no code patching):

  1. Dump BIOS region: fptw64 -bios -d bios.bin (BIOS Lock is off on this board)
  2. Extract the ORIGINAL LenovoWmaPolicyDxe PE32 body (UEFITool)
  3. Replace unused table entries with your card IDs
    (WLAN: 8086:095A/8086:xxxx, BT: 8087:0A2A). Keep your old card’s entry
    as a fallback.
  4. UEFIReplace bios.bin 79E0EDD7-9D1D-4F41-AE1A-F896169E5216 10 patched.bin
  5. fptw64 -bios -f bios.bin.patched, then dump again and compare hashes.

Result: no 1802, 802.11ac on 5 GHz, 650 Mbps link.
(BT on my noname 7265 still does not enumerate - probably pin 51 / BT disable,
not related to the whitelist.)

Done with help from an AI assistant (Claude) that did the reverse
engineering of the module. Hope this helps someone with a B590.