How I flashed Heads on my T480s [An Unofficial, Newbie Approach Guide]

Community Guides
1

Background

I was tempted to buy a privacy-built machine (T480s) from Nitrokey [1] , but I just can’t afford it, not to mention the import duty. With the base price of i7 processor and 16 GB of RAM, I can get TWO used Lenovo T480s here, which that Nitrokey’s T480s machine is based on. All they do is installing Heads to replace proprietary BIOS and deactivating Intel ME. And add Nitrokey’s Key for measured boot (which in this newbie guide, not mandatory, more on this later) since we will use Purism’s Basic Boot Mode.

What is Heads?

Heads is one of several coreboot payloads [2], which has strong and advanced security features compared to others. It basically a replacement to the proprietary BIOS on T480s with coreboot and patch the proprietary blobs (Fix thunderbolt 3 problem and deactivate Intel ME).

Prerequisites:

  1. CH341A Programmer [3] or any Generic ones (if you can take the risk of frying your SPI chip)
  2. Philip Screwdriver to open the back panel of the laptop
  3. Another machine running Linux (in this case I used Kali Linux)
  4. Anti-static mat
  5. Latex gloves (black is preferred so you look like a murderer :P)
  6. Magnifier if you have sight problem

Preparation

Before flashing Heads, make sure to disconnect all power inputs to your laptop that is going to be flashed, these includes CMOS battery, Internal Battery, and AC Input from your adapter. Here [4] is a guide as to how to disconnect the Internal Battery. For the CMOS battery, just unplug the connector socket.

Downloading Heads

We need *.rom file and tb.bin file and hashes.txt file to verify their integrity.

Flashing Heads to your T480s

First thing first, make sure you understand the wiring and orientation of the CH341A Programmer. Then we will have to locate the SPI chips which hold BIOS, ME, etc, and another one which hold a buggy Thunderbolt 3. We will use a program called flashrom in this guide, so make sure you install it on your other machine that is going to be used to flash Heads on your T480s. In this case I use other T480s running Kali Linux, please adapt the commands that are not relevant to your specific distro of choice.

  1. Install flashrom
sudo apt install flashrom
  1. Locate the BIOS and Thunderbolt Chip [5]

Look closely at those chips, there are dots in every chip, this is where your CH341A Programmer’s RED wire should be connected to

  1. We will first flash the BIOS chip. Connect the clip to it with the orientation mentioned above. If you can’t see the dots of the chip, use magnifier, and make sure the clip connected properly, then insert the CH341A programmer to your USB port of your other machine and verifying the connection:

Connecting the clip to the chip can be tricky, so we should verify it first, to see if our programmer is connected properly.

sudo flashrom --programmer ch341a_spi

A successful connection between the programmer and the “target” chip should output something like this. Notice the “W25Q128.V” is our chip name and 16384 kb (16MB) is the size which in this case refers to BIOS chip.

flashrom v1.6.0 on Linux 6.19.14+kali-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on ch341a_spi.
  1. Dump our Original BIOS from the chip and save it somewhere just in case
sudo flashrom --programmer ch341a_spi --read ~/t480s_original_bios.bin --chip W25Q128.V
  1. And do it once again and save it with a different filename, just in case it corrupted
sudo flashrom --programmer ch341a_spi --read ~/t480s_original_bios_1.bin --chip W25Q128.V

Notice the different output filename

  1. Make sure that files do not differ. We can verify them using `sha256sum` as follows:
sha256sum t480s_original_bios.bin

Output:

54d58fdf217f41d4385576bb74f45f20de233d1a9d9ea2d6f1543b86111e1062 t480s_original_bios.bin

sha256sum t480s_original_bios_1.bin

Output:

54d58fdf217f41d4385576bb74f45f20de233d1a9d9ea2d6f1543b86111e1062  t480s_original_bios_1.bin

Notice the hash are the same, meaning the file are identical, we can delete one.

  1. Now we need to verify our dump with the actual content of the chip

    sudo flashrom --programmer ch341a_spi --verify ~/t480s_original_bios.bin --chip W25Q128.V

    Here is a successful verification output:

flashrom v1.6.0 on Linux 6.19.14+kali-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on ch341a_spi.
Verifying flash... VERIFIED.

If the files differ or the chip content does not match the dump, try reconnecting your programmer to the chip again and make sure your flashrom software is up-to-date and redo everything from Step 3.

  1. If they are the same, then we can flash Heads (heads-t480s-maximized.rom) to the chip:
sudo flashrom --programmer ch341a_spi --chip W25Q128.V --write heads-t480s-maximized.rom

Here is a successful attempt. Be patient, it may take a while.

flashrom v1.6.0 on Linux 6.19.14+kali-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on ch341a_spi.
Reading old flash chip contents... done.
Updating flash chip contents... Erase/write done from 0 to ffffff
Verifying flash... VERIFIED.

If all goes well you can connect the CMOS and internal battery, press the power button and you should see the keyboard LED flash. After that, Heads will boot into its GUI.

Two reboots are sometimes needed after flashing. Force a power off by holding the power button for 10 seconds. Since the memory training data was wiped by the content of the fully flashed ROM, this is normal.

  1. If everything is okay, we will proceed to flash our second chip, which is the Thunderbolt chip, the procedure is similar to flashing the BIOS chip. Dump twice → Compare → Verify → Flash . We will not discuss this in detail to keep things simple.
sudo flashrom --programmer ch341a_spi

Output:

flashrom v1.6.0 on Linux 6.19.14+kali-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Found Winbond flash chip "W25Q80.V" (1024 kB, SPI) on ch341a_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
You can also try to follow the instructions here:
https://www.flashrom.org/contrib_howtos/how_to_mark_chip_tested.html
Thanks for your help!
No operations were specified.

sudo flashrom --programmer ch341a_spi --read ~/t480s_original_tb.bin --chip W25Q80.V

sudo flashrom --programmer ch341a_spi --read ~/t480s_original_tb_1.bin --chip W25Q80.V


sha256sum t480s_original_tb.bin
sha256sum t480s_original_tb_1.bin

sudo flashrom --programmer ch341a_spi --verify ~/t480s_original_tb.bin --chip W25Q80.V

sudo flashrom --programmer ch341a_spi --chip W25Q80.V --write t480s_tb.bin

Done.

Now you can proceed to install Qubes OS with improved firmware security. If you want, you can set up GPG to verify Heads integrity, but that is beyond the scope of this writing.

Credit goes to @tlaurion/@Insurgo for his patience answering newbie like me.

Please do consider donating to Heads project.

References:

[1] NitroPad T480s | shop.nitrokey.com

[2] Payloads — coreboot 26.06-524-g18352c02e5 documentation

[3] https://shop.3mdeb.com/product/ch341a-flash-bios-usb-programmer-kit-soic8-sop8/

[4] Lenovo ThinkPad T480s Battery Replacement - iFixit Repair Guide

[5] https://osresearch.net/images/T480s/3_chips.jpg

5 Likes