Flashing Skulls to a Thinkpad x230t

I’ve always been quite interested in the Coreboot project, and my laptop of choice (the Lenovo Thinkpad x230t) semeed to almost be supported. When I learned about the Skulls project it seemed like a perfect match.

After a bit of research and on the advice of a few people who had gone through the process previously I picked up a CH341A USB programmer instead of the usual Raspberry Pi to do the actual flashing. It turns out however you don’t need any specialised hardware at all and the entire process can now be done in software using an exploit and the excellent 1vyrain.

Preparing your laptop

Like an idiot, many months ago I’d upgraded my BIOS version to the absolutely latest version offered by Lenovo which at the time of writing is 2.75. The exploit 1vyrain uses is only compatible with versions 2.58 and below. The official word from Lenovo is that you’re unable to downgrade your BIOS after specific versions however this is false as stated in this helpful guide.

The long winded way I got my BIOS downgraded was to write a bootable FreeDOS installation to my USB stick, using Rufus on Windows. The only files required on top of this is a compatible version of dosflash.exe and your BIOS image.

You can grab a compatible dosflash.exe by extracting the binary from the BIOS upgrade iso file using 7zip.

geteltorito -o out.img g2uj15us.iso
mount -t vfat bios.img bios/ -o loop

Inside this mounted image you can grab dosflash and copy it to the root of your FreeDOS USB stick. Lastly you want a compatible BIOS image. Initially there was no support for the x230t model, but this has been added with this pull request so you can grab the file directly from here.

Now boot up FreeDOS and flash the old BIOS image using:

dosflash.exe /sd /file X230t.FL1

Confirm you’re running a compatible BIOS version and move on to the next step.

Preparing Skulls

I’m not going to compile Skulls myself, it’s an additional step that I would rather not deal with. I downloaded the latest version and extracted the non-free top.rom file to an accessible directory on my webserver. More on this later.

Flashing Skulls

1vyrain offers a live USB image for doing all required leg work and applying the exploit. Now boot your img file in UEFI mode and follow the onscreen instructions. Eventually you’ll be able to specify your own image to flash which is where the file we prepared above comes in. Enter the path for this and flash the image and reboot when prompted.

First Boot

Your laptop was likely previously booting in UEFI mode, but the included SeaBIOS image will only boot in BIOS mode so you’re going to need to chroot into your install and install a compatible bootloader. I was in the mood for a clean install anyway so just installed grub on my Linux install.

I did plan to look into preparing a TianoCore or YaBits payload to support UEFI, but BIOS works well enough and I don’t care enough to compile my own Skulls images.

And with that, an entry from the New Years Resolution list is complete.