Christian killerbees19

coreboot @ Lenovo ThinkPad X230

This is only the little brother of another Gist: coreboot @ Lenovo ThinkPad T440p

Known problems

CMOS option backlight broken. (CB#647)

External links

doc.coreboot.org: Mainboard-specific documentation
libreboot.org: Install Libreboot on Lenovo ThinkPad X230/X230T
wiki.chucknemeth.com: Flashing my Lenovo x230 with Coreboot

Source: StackOverflow

1. Run `defrag` in the guest (Windows only)

2. Nullify free space:

With a Linux Guest run this:

sudo dd if=/dev/zero | pv | sudo dd of=/bigemptyfile bs=4096k
sudo rm -rf /bigemptyfile

coreboot @ Lenovo ThinkPad T440p

Replace original BIOS/UEFI with open-source alternative coreboot and strip down Intel ME.

This is my very first experience with SPI chips and external flashing 🥳

These are my personal notes, just in case I need them again…

Hardware

Notebook: Lenovo ThinkPad T440p (20AN/20AW; without dGPU / only iGPU)
Top chip: Winbond 25Q32FVSIQ (4 MiB; accessible through "big door")

Less Cheatsheet

less {filename}

Navigation
`SPACE`	forward one window
`b`	backward one window
`d`	forward half window

FAQ on the xz-utils backdoor

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that gives developers lossless compression. This package is commonly used for compressing release tarballs, software packages, kernel images, and initramfs images. It is very widely distributed, statistically your average Linux or macOS system will have it installed for

	#!/bin/bash
	###
	# cs@fnx.li (2025-03-19)
	# https://gist.github.com/90f21ebb14024c40ba46c16a0325a10d
	###

	set -euf -o pipefail

	function errexit
	{

	import sys, os, stat, errno, operator, time, datetime, requests
	from fuse import FUSE, Operations, LoggingMixIn, FuseOSError
	from mastodon import Mastodon
	from cachetools import TTLCache, cachedmethod
	from mastodon.return_types import MediaAttachment, Account, Status

	class PathItem:
	def __init__(self, path_type, mtime=None, size=0, symlink_target=None, read_fn=None, listdir_fn=None):
	self.path_type = path_type
	self.mtime = mtime or time.time()

	From self[at]sungpae.com Mon Nov 8 16:59:48 2021
	Date: Mon, 8 Nov 2021 16:59:48 -0600
	From: Sung Pae <self[at]sungpae.com>
	To: security@docker.com
	Subject: Permissive forwarding rule leads to unintentional exposure of
	containers to external hosts
	Message-ID: <YYmr4l1isfH9VQCn@SHANGRILA>
	MIME-Version: 1.0
	Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="QR1yLfEBO/zgxYVA"

	# It's may out of the day.
	# Source: https://forum.xda-developers.com/showpost.php?p=73608658&postcount=28

	# Debug Options
	persist.dbg.ims_volte_enable=1
	persist.dbg.volte_avail_ovr=1
	persist.dbg.vt_avail_ovr=1
	persist.dbg.wfc_avail_ovr=1

	# Radio Options

	zfs list -t snapshot -H -o name \| grep "201509[0-9].*" \| xargs -n1 echo
	# zfs list -t snapshot -H -o name \| grep "201509[0-9].*" \| xargs -n1 zfs destroy