Re: Solution to the "1802: Unauthorized network card" problem in recent thinkpad systems

[Tisheng Chen <tishengchen@yahoo.com>]

In linux, there is only 114 bytes in /dev/nvram, not
128. The correct address is not 0x6a, but 0x5c. You
can try it with "inb" and "outb".

In T30, the original value of the control byte is
0x01, which needs to be set to 0x81.

And "data &= ~0x80;" is incorrect. It should be "data
|=0x80" or "data^=0x80", I think.

Somebody did succeed with a X31. 
As I know, it should works for T30,R40,X31,R40E at
least.

Tisheng

--- Vojtech Pavlik <vojtech@suse.cz> wrote:
> On Sun, Jun 13, 2004 at 12:39:50AM -0700, Tisheng
> Chen wrote:
> 
> > In recent IBM thinkpad systems, there is a limit
> to
> > allowed MiniPCI wireless cards. When an
> unauthorized
> > card is plugged in, the system doesn't boot and
> > halt with an error message like:
> > 
> > ERROR
> > 1802: Unauthorized network card is plugged in
> > Power off and remove the miniPCI network card.
> 
> [snip]
> 
> > The other way is unbelievably simple. There is a
> byte
> > in CMOS which controls whether an "unauthorized"
> card
> > is allowed or not. That's 0x6a, actually only
> > the bit 0x80. The program to unlock the
> authorization
> > mechanism is like (asm):
> > 
> > MOV     DX,0070
> > MOV     AL,6A
> > OUT     DX,AL
> > MOV     DX,0071
> > IN      AL,DX
> > OR      AL,80
> > OUT     DX,AL
> > MOV     AX,4C00
> > INT     21
> > 
> > The program can be downloaded from:
> >   http://jcnp.pku.edu.cn/~shadow/1802/no-1802.com
> > To use this program, you need to boot to DOS.
> > 
> > The CMOS solution is safe, but I'm not sure that
> it
> > works for all recent thinkpads and all cards. The
> BIOS
> > crack sure does, however it is difficult
> > and dangerous.
> 
> Well, here is a version for Linux:
> 
>
------------------------------------------------------------
> 
> #include <stdio.h>
> #include <sys/types.h>
> #include <unistd.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> 
> int main(void)
> {
> 	int fd;
> 	unsigned char data;
> 
> 	printf("Disabling WiFi whitelist check.\n");
> 	fd = open("/dev/nvram", O_RDWR);
> 	lseek(fd, 0x6a, SEEK_SET);
> 	read(fd, &data, 1);
> 	printf("CMOS address 0x6a: %02x->", data);
> 	data &= ~0x80;
> 	printf("%02x\n", data);
> 	lseek(fd, 0x6a, SEEK_SET);
> 	write(fd, &data, 1);
> 	close(fd);
> 	printf("Done.\n");
> }
> 
>
------------------------------------------------------------
> 
> I've tried it on my ThinkPad X31, but it doesn't
> work at all. The CMOS
> has a value 0xfa at the offset 0x6a, so the most
> upper bit is already
> set.
> 
> -- 
> Vojtech Pavlik
> SuSE Labs, SuSE CR
> 




	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/