diff --git a/_posts/blog/2026-07-11-ideapad.markdown b/_posts/blog/2026-07-11-ideapad.markdown new file mode 100644 index 0000000..6efd9ae --- /dev/null +++ b/_posts/blog/2026-07-11-ideapad.markdown @@ -0,0 +1,143 @@ +--- +layout: post +title: "Lenovo IdeaPad 330S-15ARR Recovery" +date: 2026-07-11 13:37:42 +post_author: 지지 aka CyReVolt +--- + +One of our members was facing issues with a laptop, so we teamed up. + +## Problem + +After a suspend, the laptop no longer came up and the screen remained black. +Nothing helped; unplugging the main battery and the CMOS battery, unplugging AC +and trying to power cycle multiple times did not do the trick. + +## Analysis + +So we dumped the flash chip holding the current firmware and took a rough look. +The laptop is based on an AMD platform, and it could be parsed fine. + +We then searched for a firmware upgrade from the vendor. Our first attempt led +us to the wrong product, because there is also an IdeaPad _330-15ARR_ (mind the +missing S). + +The correct product website is this one: + + +Via "Drivers & Software" -> "Manual Update" (Select Drivers) -> "BIOS/UEFI (1)", +we ended up on the firmware download page, and picked "BIOS Update" with a size +of 7.12 MB and the name `7WCN38WW`, with the date 08 Jan 2020. +That gave us `7wcn38ww.exe`. + +## Unpacking + +From earlier experience, we knew that `innoextract 7wcn38ww.exe` would extract +it for us, and we got a directory named `app/` containg the file `BIOS.cap`. +That file is larger than the flash chip, because it is an _upgrade_ image, a +UEFI application containing the actual image. + +## Recovery + +In various forums, including the official community forum, we read that putting +the upgrade file on a USB stick and pressing Fn + R on boot would start a +recovery process. However, all we saw was the power LED blinking then, and +nothing else seemed to happen. + +## Extracting + +So we looked at the upgrade file `BIOS.cap` again. +Using `xxd`, we could quickly find the start of the raw firmware image, and +using `dd` and `truncuate`, we cut it out and truncated it to 8 MB: + +```sh +dd if=app/BIOS.cap bs=8 skip=99 of=fresh.rom +truncate -s 8M fresh.rom +``` + +Via `biodiff`, we compared it against the backup, seeing that it looks very +similar. So we gave it a try and flashed the fresh image to the laptop. + +## Almost there + +![laptop and firmware menu]({{ site.url }}/media/2026-07-11/ideapad_recovery_step1a.jpg) + +We then tried to boot again, and we were very pleased to see the Lenovo logo, +followed by the OS bootloader. But the OS failed to boot, showing a black screen +only, and no kernel output. +So we went into the firmware settings, and saw that the product name was set to +"ILLEGAL". Weird. + +![laptop and firmware menu]({{ site.url }}/media/2026-07-11/ideapad_recovery_step1b.jpg) + +An attempt to boot a fresh Linux Mint image from a USB stick worked though. So +we installed that on a new partition, rebooted, but once again, the kernel did +not get far. With extra options, the kernel stub at least dropped us two lines, +but that was it. + +## Another fix + +So we compared the firmware image that we flashed against the backup again. +And we saw that there was what looked like the product name in the backup +(left), but not in the fresh image (right): + +``` + 001e dff8 ff ff ff ff ff ff ff ff |........ | 001e dff8 ff ff ff ff ff ff ff ff |........ + 001e e000 4c 65 6e 6f 76 6f 20 69 |Lenovo i | 001e e000 ff ff ff ff ff ff ff ff |........ + 001e e008 64 65 61 70 61 64 20 33 |deapad 3 | 001e e008 ff ff ff ff ff ff ff ff |........ + 001e e010 33 30 53 2d 31 35 41 52 |30S-15AR | 001e e010 ff ff ff ff ff ff ff ff |........ + 001e e018 52 00 00 00 00 00 00 00 |R....... | 001e e018 ff ff ff ff ff ff ff ff |........ + 001e e020 00 00 00 00 00 00 00 00 |........ | 001e e020 ff ff ff ff ff ff ff ff |........ + 001e e028 00 00 00 00 00 00 00 00 |........ | 001e e028 ff ff ff ff ff ff ff ff |........ +``` + +We patched that part into the raw flash image: + +```sh +dd if=backup.rom bs=4096 skip=494 count=1 | \ + dd of=fresh.rom obs=4096 seek=494 conv=notrunc +``` + +And we finally saw the product name show up in the firmware menu, the kernel +happily booted, and the owner of the laptop is happy again. + +![laptop and firmware menu]({{ site.url }}/media/2026-07-11/ideapad_recovery_step2.jpg) + +## Recap + +Since we assumed firmware corruption, we took another look and compare the fresh +firmware image against the backup again, seeing that indeed, there were many +blocks of 64 bytes each that had been cleared: + +``` + 002f 0350 ff ff ff ff ff ff ff ff |........ | 002f 0350 ff ff ff ff ff ff ff ff |........ + 002f 0358 ff ff ff ff ff ff ff ff |........ | 002f 0358 ff ff ff ff ff ff ff ff |........ + 002f 0360 ff ff ff ff ff ff ff ff |........ | 002f 0360 ff ff ff ff ff ff ff ff |........ + 002f 0368 ff ff ff ff ff ff ff ff |........ | 002f 0368 ff ff ff ff ff ff ff ff |........ + 002f 0370 ff ff ff ff ff ff ff ff |........ | 002f 0370 ff ff ff ff ff ff ff ff |........ + 002f 0378 ff ff ff ff ff ff ff ff |........ | 002f 0378 ff ff ff ff ff ff ff ff |........ + 002f 0380 65 00 66 00 61 00 75 00 |e.f.a.u. | 002f 0380 ff ff ff ff ff ff ff ff |........ + 002f 0388 6c 00 74 00 43 00 72 00 |l.t.C.r. | 002f 0388 ff ff ff ff ff ff ff ff |........ + 002f 0390 65 00 61 00 74 00 65 00 |e.a.t.e. | 002f 0390 ff ff ff ff ff ff ff ff |........ + 002f 0398 46 00 6c 00 61 00 67 00 |F.l.a.g. | 002f 0398 ff ff ff ff ff ff ff ff |........ + 002f 03a0 00 00 01 ff aa 55 3f 00 |.....U?. | 002f 03a0 ff ff ff ff ff ff ff ff |........ + 002f 03a8 07 00 00 00 00 00 00 00 |........ | 002f 03a8 ff ff ff ff ff ff ff ff |........ + 002f 03b0 00 00 00 00 00 00 00 00 |........ | 002f 03b0 ff ff ff ff ff ff ff ff |........ + 002f 03b8 00 00 00 00 00 00 00 00 |........ | 002f 03b8 ff ff ff ff ff ff ff ff |........ + 002f 03c0 ff ff ff ff ff ff ff ff |........ | 002f 03c0 ff ff ff ff ff ff ff ff |........ + 002f 03c8 ff ff ff ff ff ff ff ff |........ | 002f 03c8 ff ff ff ff ff ff ff ff |........ + 002f 03d0 ff ff ff ff ff ff ff ff |........ | 002f 03d0 ff ff ff ff ff ff ff ff |........ + 002f 03d8 ff ff ff ff ff ff ff ff |........ | 002f 03d8 ff ff ff ff ff ff ff ff |........ + 002f 03e0 ff ff ff ff ff ff ff ff |........ | 002f 03e0 ff ff ff ff ff ff ff ff |........ + 002f 03e8 ff ff ff ff ff ff ff ff |........ | 002f 03e8 ff ff ff ff ff ff ff ff |........ +``` + +So we conclude that some race condition may have occured when the firmware tried +to handle the suspend request, but since it is closed source and we did not +intend to spend weeks and years reversing all the components that are part of +the power management, we are leaving it at this point. + +Given that the last upgrade was from 6 years ago, we assume that the vendor +would not offer a fix for this anymore, and so we hope it won't occur again, +though this has happened to many other people, looking at posts in both the +official community forum and also other places. diff --git a/media/2026-07-11/ideapad_recovery_step1a.jpg b/media/2026-07-11/ideapad_recovery_step1a.jpg new file mode 100644 index 0000000..babd40d Binary files /dev/null and b/media/2026-07-11/ideapad_recovery_step1a.jpg differ diff --git a/media/2026-07-11/ideapad_recovery_step1b.jpg b/media/2026-07-11/ideapad_recovery_step1b.jpg new file mode 100644 index 0000000..e07b300 Binary files /dev/null and b/media/2026-07-11/ideapad_recovery_step1b.jpg differ diff --git a/media/2026-07-11/ideapad_recovery_step2.jpg b/media/2026-07-11/ideapad_recovery_step2.jpg new file mode 100644 index 0000000..cfd6cae Binary files /dev/null and b/media/2026-07-11/ideapad_recovery_step2.jpg differ