7 ms·

Unlocking my Lenovo laptop, part 3

168 points by edward 11y ago

otec 11y ago
Extremely interesting!
qb45 11y ago
So... you need to reverse engineer some "security" thing to put 3rd party battery in a laptop? The same Lenovo people are recommending everywhere?
- pilif 11y ago
  Considering the damage a 3rd party battery can potentially cause, I can see where Lenovo is coming from. Of course there's also the aspect of securing margins on accessories, but there's also the aspect of making sure people's machines don't go up in flames or fail in ways that might trigger expensive repairs (which Lenovo will have to pay for if the device is still in warranty)
  - deleted 11y ago
    [deleted]
  - wslh 11y ago
    We need a list of good/bad batteries then, and a label telling you to use the original batteries.
    - rincebrain 11y ago
      The problem is that, in a lot of cases, there's little QC on the third-party batteries, or even necessarily ways to validate the battery, since they're all just going to be using one of a handful of "copied" chips. Then you get into fun with who's liable if a battery explodes - many of these vendors don't really have much concrete existence, and good luck with a "warranty". Source: tried playing hard and fast with batteries a few times, including helping someone solder his own cells into a dead first-party battery.
  - rincebrain 11y ago
    Lenovo would only have to cover the repair if you had the incidental damage coverage - last I checked, they're pretty sticky about not covering things that aren't manufacturer defect unless you have it.
    - pilif 11y ago
      How would they prove that the damage was caused by a third-party battery if there was no security feature to authenticate first-party ones? People would buy third party batteries and put the original back before filing a warranty claim
      - qb45 11y ago
        Heat damage or busted overvoltage protection diode. Is there something else a broken/wrong battery can do to a laptop?
        TeMPOraL 11y ago
        It can literally burst into flames?
        qb45 11y ago
        They sometimes do, but then it's obvious that the laptop has been damaged by battery so the user would better show remnants of a genuine one before asking for warranty replacement.
        Klathmon 11y ago
        But warranty replacement is only one aspect, what happens when a social media website gets a tweet from someone saying their lenovo exploded? Something like that could significantly hurt the brand
        qb45 11y ago
  - qb45 11y ago
    Vendors shouldn't be liable for actions of users. And if they are doing this out of well-meant concern for user safety, I suppose this warning screen during bootup would suffice. I would like to know if there are some actual regulations/litigations which forced them or if it's just another money grab like this SuperFish adware.
- Joeboy 11y ago
  > The same Lenovo people are recommending everywhere? Lenovo laptops used to be awesome. I'm typing this on a T410 and I'd still recommend an old Lenovo laptop for lots of purposes. I've heard mostly bad things about their newer offerings.
  - lgieron 11y ago
    These are Thinkpads. I recently bought a non-Thinkpad Lenovo (y50-70 gaming laptop) and it's a piece of crap. The keyboard and touchpad are mediocre, fans are pretty loud under load, the numlock key has fallen off (!), and it sometimes just powers off for no reason. It costs 40% of what a comparable MacBook Pro would cost, but it is unfortuantely reflected in quality.
    - throwawayaway 11y ago
      The new lenovo thinkpads are nearly as bad. I'm an x series user, the last model with a good keyboard for programming was the x220. From the x230 onwards they have stupid chicklet keys, no visual representation of caps lock or numlock, bad trackpads, and 'modal' function keys - (visually represesented with LEDs of course). Abandoning traditional insert/delete/home/end/pgup/pgdn layout. Superfish on thinkpads, this battery thing, this bios thing: https://www.techdirt.com/articles/20150812/11395231925/lenovo-busted-stealthily-installing-crapware-via-bios-fresh-windows-installs.shtml https://www.techdirt.com/articles/20150812/11395231925/lenov... Very frustrating! Beyond a joke at this stage.
      - mindslight 11y ago
        I really don't mind the keyboard on my X230. Then again, I don't see the point of caps lock or trackpads. The layout is a bit annoying when I switch back and forth to a T61, but that's due to the difference rather than inherent superiority. If the keyboard dies, I will obviously consider replacing it with an X220 keyboard but nothing makes me want to do that preemptively. The plastic case seems a bit flimsy, but so far hasn't broken. And obviously having a shortscreen sucks, but I accepted that tradeoff for the LED backlight and better specs.
- Symmetry 11y ago
  Well, the big TrackPoint patents are going to be expiring before too long so maybe someone else will be able to make good laptops for use without the touch pad?
davidovitch 11y ago
Part 1 has been discussed on HN a week ago: https://news.ycombinator.com/item?id=11041210 https://news.ycombinator.com/item?id=11041210
pedrocr 11y ago
If you want a cheaper battery wouldn't it be simpler and safer to replace the cells in an old Lenovo battery than to buy one of these dubious copies? That way the charge electronics are all correct and you can also control that the cells are good quality. There are even places that will do that for you if you're worried about poor soldering or other issues with doing this kind of swap.
- xnzakg 11y ago
  He did mention that possibility in part 1. The reason he didn't do it is because it's hard to open the original battery without damaging the case.
- userbinator 11y ago
  The monitoring circuits in some batteries will permanently disable them if the cells are disconnected, and need a special programmer to reset them the way they came from the factory.
- tim333 11y ago
  >wouldn't it be simpler and safer to replace the cells Dunno about safe but I've bought maybe 5 unofficial replacement li ion batteries for thinkpads, 2 for the iphone and will probably get one for my macbook. It takes about 1 min - go on ebay click buy, arrives in the post. It's hard to get much simpler than that until this recent lock down stuff. I've had no problems except the cheap knock offs don't generally last quite as long as the originals did when new.
yason 11y ago
It makes me sad to think that first a group of engineers spend time writings this complex system of checksums, partially encrypted firmware images, proprietary challenge-response handshake and communications with the battery so that another hacker must spend days to allow himself to make a fix as simple as replacing the battery in his own laptop. Is this because of fear? Money? Greed? All three? How much money does Lenovo make out of Lenovo batteries to make this all this extra complexity worth its salt in the first place? Consider that maintaining all that complexity is a recurring cost: it's not just writing the authentication scheme but making sure it works for each future firmware release. I haven't let go of the 80's and I still think if you buy a car, phone, laptop, compact disc or a video disc, then it's yours because you paid for it in your own money. From that standpoint it's simply inexcusable for manufacturers to try to re-own parts of a device they've already sold to someone.
- nine_k 11y ago
  I think it's mostly about brand security. If a battery works with the laptop, it's guaranteed to be a tested compatible one. Quickly slapping up a counterfeit and selling it as a brand-name thing won't work. A battery ua a critical device, prone to fires or blasts if made improperly. One such incident would significantly tarnish the brand. Thus the over-reaction. I wish there wad an open spec for certified batteries, to allow for third-party fixes and replacements, though.
  - martinald 11y ago
    Agreed. As we've seen from. The USB typeC stuff, seriously screwing power cables and batteries is really bad. If you put a crap SD card in a laptop it might be the wrong size. If you put a bad counterfit battery in and it explodes and permanently disfigures someone you've got a PR nightmare before people have figured out the real reason.
    - Klathmon 11y ago
      Especially today when a single tweet can spark that PR nightmare and social media sites will take a title and run with it without ever doing any fact checking. If i were lenovo, i'd be doing the same exact thing, and i'm honestly surprised we don't see more of this stuff in things like cables, chargers, etc...
deadgrey19 11y ago
See also: https://news.ycombinator.com/item?id=11086158 https://news.ycombinator.com/item?id=11086158
userbinator 11y ago
The option of replacing the cells in a genuine battery may be worth considering as an alternative to modifying the EC firmware, the advantage being is that you can choose your own high quality Li-Ion cells versus whatever you might happen to get in a replacement battery. I suppose the whole "safety culture" around lithium cells in laptops has yet to change, but high-quality 18650 cells have been available on the open market for several years now, with all the accompanying products that use them (torches, vapes, power banks, etc.) The general public handling bare lion cells has increased significantly, whereas the amount of incidents related to cells catching fire etc. doesn't seem to have increased correspondingly. The majority seem to be from lipo "pouch cells" which are definitely far more fragile and less resistant to abuse. (They're also higher density = more energy to cause excitement when things go wrong, this is the type that's been causing the hoverboard fires.) 18650s are more robust and it's hard to cause a fire unless they're seriously abused (e.g. severe overcharge or physical damage.) Given that you can buy empty power banks and add your own cells like this... http://www.aliexpress.com/item/1Pc-6-X-18650-Battery-Case-Usb-Charger-20000mAh-Power-Bank-Battery-Case-Box-Shell-With/1928848788.html http://www.aliexpress.com/item/1Pc-6-X-18650-Battery-Case-Us... ...it's odd that I haven't found similar battery cases for laptops. (Or maybe they do exist and I'm just using the wrong keywords. If they do, please say so; that seems like a great product to have.)
- Anechoic 11y ago
  The general public handling bare lion cells has increased significantly, whereas the amount of incidents related to cells catching fire etc. doesn't seem to have increased correspondingly. This may in part be due to certification and testing methodologies [0] for battery packs. The issue is that not all cells/battery packs go through this testing, so unless the batteries have been appropriately certified, there are restrictions on the handling and transportation of these batteries (for example non UN 38.3-rated cells are not allowed on planes [1]). CE manufacturers test and certify the batteries in their products ([2], [3], [4] for example) which is why Amazon can ship them by air and passengers can carry them on planes. The issue is that 3rd party batteries may be uncertified and possibly unsafe. Lenovo doesn't want to take responsibility for an uncertified battery in one of their laptops downing an airliner [5] so they disallow the use of batteries they haven't certified. I doubt this is a nefarious scheme and more about potential liability. (at my company we use lithium-ion battery packs for our field equipment and had to become very familiar with these issues when IATA promulgated their lithium/lithium-ion battery pack shipping rules a couple of years ago. [0] http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_D4B2D17039E706213B36C1B309D41DCF8B4A0200/filename/UN_Test_Manual_Lithium_Battery_Requirements.pdf http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_D4B2D17039E70621... [1] http://www.iata.org/whatwedo/cargo/dgr/Documents/lithium-battery-guidance-document-2016-en.pdf http://www.iata.org/whatwedo/cargo/dgr/Documents/lithium-bat... [2] https://www.lenovo.com/lenovo/us/en/Lenovo_Battery_DoC_Letter.pdf https://www.lenovo.com/lenovo/us/en/Lenovo_Battery_DoC_Lette... [3] https://www.apple.com/legal/more-resources/docs/apple-product-information-sheet.pdf https://www.apple.com/legal/more-resources/docs/apple-produc... [4] http://www.dell.com/downloads/global/corporate/environ/comply/dell_battery_declaration_january_2013.pdf http://www.dell.com/downloads/global/corporate/environ/compl... [5] http://news.yahoo.com/fires-involving-lithium-batteries-planes-191455142--finance.html http://news.yahoo.com/fires-involving-lithium-batteries-plan...
jhallenworld 11y ago
Well this is very interesting- I had no idea there was a BMC-like embedded controller for laptops. There is a standard way to update the BMC firmware: "ipmitool hpm upgrade". Also sometimes the server will have a JTAG header or even a socket for the flash chip.
craig131 11y ago
Nice article, that was a really enjoyable read. But one of the things that stuck out to me was: > The last four bytes of the EC firmware image clearly appeared to be a checksum, and there were some other locations that consistently varied as well. I guessed (correctly) that if I programmed an image with the wrong checksums the EC would fail to boot and I would have a brick on my hands, so trial and error was not a very good option. I was under the impression that the checksum is validated before flashing? Isn't that the primary purpose of checksums in ROM images?
- fpgaminer 11y ago
  It's not possible to verify the checksum before flashing in this scheme. The EC is the only device that can calculate the checksum (1), and its RAM is probably smaller than its Flash. So there isn't enough RAM to receive the entire update, checksum, and then flash. It needs to stream to flash. So the checksum is either checked after flashing, after which it's too late to go back, or it's checked by the EC during boot, which is again too late. There are better ways of doing this, but based on the article it seems the EC didn't implement them. (1) We know this because the checksums are calculated on the decrypted image, and only the EC has the keys to decrypt the image.

168 points by edward 11y ago

otec 11y ago

Extremely interesting!

qb45 11y ago

So... you need to reverse engineer some "security" thing to put 3rd party battery in a laptop? The same Lenovo people are recommending everywhere?

pilif 11y ago
Considering the damage a 3rd party battery can potentially cause, I can see where Lenovo is coming from. Of course there's also the aspect of securing margins on accessories, but there's also the aspect of making sure people's machines don't go up in flames or fail in ways that might trigger expensive repairs (which Lenovo will have to pay for if the device is still in warranty)
- deleted 11y ago
  [deleted]
- wslh 11y ago
  We need a list of good/bad batteries then, and a label telling you to use the original batteries.
  - rincebrain 11y ago
    The problem is that, in a lot of cases, there's little QC on the third-party batteries, or even necessarily ways to validate the battery, since they're all just going to be using one of a handful of "copied" chips. Then you get into fun with who's liable if a battery explodes - many of these vendors don't really have much concrete existence, and good luck with a "warranty". Source: tried playing hard and fast with batteries a few times, including helping someone solder his own cells into a dead first-party battery.
- rincebrain 11y ago
  Lenovo would only have to cover the repair if you had the incidental damage coverage - last I checked, they're pretty sticky about not covering things that aren't manufacturer defect unless you have it.
  - pilif 11y ago
    How would they prove that the damage was caused by a third-party battery if there was no security feature to authenticate first-party ones? People would buy third party batteries and put the original back before filing a warranty claim
    - qb45 11y ago
      Heat damage or busted overvoltage protection diode. Is there something else a broken/wrong battery can do to a laptop?
      - TeMPOraL 11y ago
        It can literally burst into flames?
        qb45 11y ago
        They sometimes do, but then it's obvious that the laptop has been damaged by battery so the user would better show remnants of a genuine one before asking for warranty replacement.
        Klathmon 11y ago
        But warranty replacement is only one aspect, what happens when a social media website gets a tweet from someone saying their lenovo exploded? Something like that could significantly hurt the brand
        qb45 11y ago
- qb45 11y ago
  Vendors shouldn't be liable for actions of users. And if they are doing this out of well-meant concern for user safety, I suppose this warning screen during bootup would suffice. I would like to know if there are some actual regulations/litigations which forced them or if it's just another money grab like this SuperFish adware.
Joeboy 11y ago
> The same Lenovo people are recommending everywhere? Lenovo laptops used to be awesome. I'm typing this on a T410 and I'd still recommend an old Lenovo laptop for lots of purposes. I've heard mostly bad things about their newer offerings.
- lgieron 11y ago
  These are Thinkpads. I recently bought a non-Thinkpad Lenovo (y50-70 gaming laptop) and it's a piece of crap. The keyboard and touchpad are mediocre, fans are pretty loud under load, the numlock key has fallen off (!), and it sometimes just powers off for no reason. It costs 40% of what a comparable MacBook Pro would cost, but it is unfortuantely reflected in quality.
  - throwawayaway 11y ago
    The new lenovo thinkpads are nearly as bad. I'm an x series user, the last model with a good keyboard for programming was the x220. From the x230 onwards they have stupid chicklet keys, no visual representation of caps lock or numlock, bad trackpads, and 'modal' function keys - (visually represesented with LEDs of course). Abandoning traditional insert/delete/home/end/pgup/pgdn layout. Superfish on thinkpads, this battery thing, this bios thing: https://www.techdirt.com/articles/20150812/11395231925/lenovo-busted-stealthily-installing-crapware-via-bios-fresh-windows-installs.shtml https://www.techdirt.com/articles/20150812/11395231925/lenov... Very frustrating! Beyond a joke at this stage.
    - mindslight 11y ago
      I really don't mind the keyboard on my X230. Then again, I don't see the point of caps lock or trackpads. The layout is a bit annoying when I switch back and forth to a T61, but that's due to the difference rather than inherent superiority. If the keyboard dies, I will obviously consider replacing it with an X220 keyboard but nothing makes me want to do that preemptively. The plastic case seems a bit flimsy, but so far hasn't broken. And obviously having a shortscreen sucks, but I accepted that tradeoff for the LED backlight and better specs.
Symmetry 11y ago
Well, the big TrackPoint patents are going to be expiring before too long so maybe someone else will be able to make good laptops for use without the touch pad?

davidovitch 11y ago

Part 1 has been discussed on HN a week ago: https://news.ycombinator.com/item?id=11041210 https://news.ycombinator.com/item?id=11041210

pedrocr 11y ago

If you want a cheaper battery wouldn't it be simpler and safer to replace the cells in an old Lenovo battery than to buy one of these dubious copies? That way the charge electronics are all correct and you can also control that the cells are good quality. There are even places that will do that for you if you're worried about poor soldering or other issues with doing this kind of swap.

xnzakg 11y ago
He did mention that possibility in part 1. The reason he didn't do it is because it's hard to open the original battery without damaging the case.
userbinator 11y ago
The monitoring circuits in some batteries will permanently disable them if the cells are disconnected, and need a special programmer to reset them the way they came from the factory.
tim333 11y ago
>wouldn't it be simpler and safer to replace the cells Dunno about safe but I've bought maybe 5 unofficial replacement li ion batteries for thinkpads, 2 for the iphone and will probably get one for my macbook. It takes about 1 min - go on ebay click buy, arrives in the post. It's hard to get much simpler than that until this recent lock down stuff. I've had no problems except the cheap knock offs don't generally last quite as long as the originals did when new.

yason 11y ago

It makes me sad to think that first a group of engineers spend time writings this complex system of checksums, partially encrypted firmware images, proprietary challenge-response handshake and communications with the battery so that another hacker must spend days to allow himself to make a fix as simple as replacing the battery in his own laptop. Is this because of fear? Money? Greed? All three? How much money does Lenovo make out of Lenovo batteries to make this all this extra complexity worth its salt in the first place? Consider that maintaining all that complexity is a recurring cost: it's not just writing the authentication scheme but making sure it works for each future firmware release. I haven't let go of the 80's and I still think if you buy a car, phone, laptop, compact disc or a video disc, then it's yours because you paid for it in your own money. From that standpoint it's simply inexcusable for manufacturers to try to re-own parts of a device they've already sold to someone.

nine_k 11y ago
I think it's mostly about brand security. If a battery works with the laptop, it's guaranteed to be a tested compatible one. Quickly slapping up a counterfeit and selling it as a brand-name thing won't work. A battery ua a critical device, prone to fires or blasts if made improperly. One such incident would significantly tarnish the brand. Thus the over-reaction. I wish there wad an open spec for certified batteries, to allow for third-party fixes and replacements, though.
- martinald 11y ago
  Agreed. As we've seen from. The USB typeC stuff, seriously screwing power cables and batteries is really bad. If you put a crap SD card in a laptop it might be the wrong size. If you put a bad counterfit battery in and it explodes and permanently disfigures someone you've got a PR nightmare before people have figured out the real reason.
  - Klathmon 11y ago
    Especially today when a single tweet can spark that PR nightmare and social media sites will take a title and run with it without ever doing any fact checking. If i were lenovo, i'd be doing the same exact thing, and i'm honestly surprised we don't see more of this stuff in things like cables, chargers, etc...

deadgrey19 11y ago

See also: https://news.ycombinator.com/item?id=11086158 https://news.ycombinator.com/item?id=11086158

userbinator 11y ago

The option of replacing the cells in a genuine battery may be worth considering as an alternative to modifying the EC firmware, the advantage being is that you can choose your own high quality Li-Ion cells versus whatever you might happen to get in a replacement battery. I suppose the whole "safety culture" around lithium cells in laptops has yet to change, but high-quality 18650 cells have been available on the open market for several years now, with all the accompanying products that use them (torches, vapes, power banks, etc.) The general public handling bare lion cells has increased significantly, whereas the amount of incidents related to cells catching fire etc. doesn't seem to have increased correspondingly. The majority seem to be from lipo "pouch cells" which are definitely far more fragile and less resistant to abuse. (They're also higher density = more energy to cause excitement when things go wrong, this is the type that's been causing the hoverboard fires.) 18650s are more robust and it's hard to cause a fire unless they're seriously abused (e.g. severe overcharge or physical damage.) Given that you can buy empty power banks and add your own cells like this... http://www.aliexpress.com/item/1Pc-6-X-18650-Battery-Case-Usb-Charger-20000mAh-Power-Bank-Battery-Case-Box-Shell-With/1928848788.html http://www.aliexpress.com/item/1Pc-6-X-18650-Battery-Case-Us... ...it's odd that I haven't found similar battery cases for laptops. (Or maybe they do exist and I'm just using the wrong keywords. If they do, please say so; that seems like a great product to have.)

Anechoic 11y ago
The general public handling bare lion cells has increased significantly, whereas the amount of incidents related to cells catching fire etc. doesn't seem to have increased correspondingly. This may in part be due to certification and testing methodologies [0] for battery packs. The issue is that not all cells/battery packs go through this testing, so unless the batteries have been appropriately certified, there are restrictions on the handling and transportation of these batteries (for example non UN 38.3-rated cells are not allowed on planes [1]). CE manufacturers test and certify the batteries in their products ([2], [3], [4] for example) which is why Amazon can ship them by air and passengers can carry them on planes. The issue is that 3rd party batteries may be uncertified and possibly unsafe. Lenovo doesn't want to take responsibility for an uncertified battery in one of their laptops downing an airliner [5] so they disallow the use of batteries they haven't certified. I doubt this is a nefarious scheme and more about potential liability. (at my company we use lithium-ion battery packs for our field equipment and had to become very familiar with these issues when IATA promulgated their lithium/lithium-ion battery pack shipping rules a couple of years ago. [0] http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_D4B2D17039E706213B36C1B309D41DCF8B4A0200/filename/UN_Test_Manual_Lithium_Battery_Requirements.pdf http://phmsa.dot.gov/pv_obj_cache/pv_obj_id_D4B2D17039E70621... [1] http://www.iata.org/whatwedo/cargo/dgr/Documents/lithium-battery-guidance-document-2016-en.pdf http://www.iata.org/whatwedo/cargo/dgr/Documents/lithium-bat... [2] https://www.lenovo.com/lenovo/us/en/Lenovo_Battery_DoC_Letter.pdf https://www.lenovo.com/lenovo/us/en/Lenovo_Battery_DoC_Lette... [3] https://www.apple.com/legal/more-resources/docs/apple-product-information-sheet.pdf https://www.apple.com/legal/more-resources/docs/apple-produc... [4] http://www.dell.com/downloads/global/corporate/environ/comply/dell_battery_declaration_january_2013.pdf http://www.dell.com/downloads/global/corporate/environ/compl... [5] http://news.yahoo.com/fires-involving-lithium-batteries-planes-191455142--finance.html http://news.yahoo.com/fires-involving-lithium-batteries-plan...

jhallenworld 11y ago

Well this is very interesting- I had no idea there was a BMC-like embedded controller for laptops. There is a standard way to update the BMC firmware: "ipmitool hpm upgrade". Also sometimes the server will have a JTAG header or even a socket for the flash chip.

craig131 11y ago

Nice article, that was a really enjoyable read. But one of the things that stuck out to me was: > The last four bytes of the EC firmware image clearly appeared to be a checksum, and there were some other locations that consistently varied as well. I guessed (correctly) that if I programmed an image with the wrong checksums the EC would fail to boot and I would have a brick on my hands, so trial and error was not a very good option. I was under the impression that the checksum is validated before flashing? Isn't that the primary purpose of checksums in ROM images?

fpgaminer 11y ago
It's not possible to verify the checksum before flashing in this scheme. The EC is the only device that can calculate the checksum (1), and its RAM is probably smaller than its Flash. So there isn't enough RAM to receive the entire update, checksum, and then flash. It needs to stream to flash. So the checksum is either checked after flashing, after which it's too late to go back, or it's checked by the EC during boot, which is again too late. There are better ways of doing this, but based on the article it seems the EC didn't implement them. (1) We know this because the checksums are calculated on the decrypted image, and only the EC has the keys to decrypt the image.