External Flashing Tools and Their Functions

Hello! Welcome back to the third module of our course.

In the previous lesson, we conducted the essential reconnaissance for our Coreboot project. You learned how to research your x230's specific hardware, confirmed its two-chip architecture, and identified the general procedure for external flashing, including the names of the required tools and the flashrom utility.

Today, we'll transition from identifying the tools to deeply understanding them. This lesson focuses on the "what" and "why" of each component in your external flashing toolkit. A solid grasp of your tools is fundamental to performing the eventual "hardware surgery" with confidence and precision.

Lesson Outline

This lesson addresses the learning outcome: Identify the tools required for external flashing (e.g., Raspberry Pi, SOIC8 clip, jumper wires) and explain the function of each.

We will break down the toolkit into its three main parts:

1. The Programmer: The Raspberry Pi, which acts as the brain of the operation.
2. The Physical Interface: The SOIC8 clip and jumper wires that connect to the BIOS chip.
3. The Control Software: The flashrom utility that orchestrates the communication.

By the end of this lesson, you will not only know what each tool is but also how it contributes to the overall system that allows us to communicate directly with the firmware chip.

Estimated time to complete: 60 minutes.

---

1. The External Flashing Toolkit: A Systems View

As we established, the x230's firmware is protected against modification from within the running operating system. External flashing is the process of bypassing these protections by creating a direct, physical, electrical connection to the BIOS chips.

This requires a small system of specialized tools working in concert.

This image shows the essential components for external flashing laid out: a CH341A programmer (an alternative to the Raspberry Pi), an SOIC8 test clip with ribbon cable, jumper wires, and a screwdriver.

At its core, the system consists of three functional blocks:

• A Programmer: A device capable of "speaking" the low-level communication protocol of the BIOS chip.
• A Physical Interface: A non-destructive way to connect the programmer to the chip's pins.
• Control Software: A program that runs on the programmer to manage the reading and writing process.

Let's examine each of these blocks in detail.

2. The Programmer: Raspberry Pi

The heart of our flashing setup is a Raspberry Pi. While you might know it as a tiny single-board computer for hobbyist projects, its key feature for our purposes is its set of General Purpose Input/Output (GPIO) pins.

These pins are a direct interface to the Pi's processor, allowing software to control the voltage on each pin (setting it high or low) and to read the voltage from them. This capability allows the Pi to emulate a dedicated hardware programmer by generating the precise electrical signals needed to communicate with other electronic components, like our BIOS chip.

Function: The Raspberry Pi's role is to act as the master device in the communication with the BIOS chip. It runs the control software (flashrom) and uses its GPIO pins to send commands and data to the chip and receive data from it.

📖 Reading (5 mins)

To see the Raspberry Pi listed as the central component, quickly review the hardware lists in the following two guides. Notice that they both center the setup around a Pi.

• Corebooting the ThinkPad X230 with Skulls - Famicoman.com (Necessary Hardware)
• Coreboot on Lenovo X230 - Community Guides (Hardware Requirements for Coreboot Flashing)

While we are using a Raspberry Pi, other devices like the CH341A programmer shown in the image above can also serve this function. The principle remains the same: a device is needed that can control electrical signals to "speak" the chip's language.

3. The Control Software: flashrom

A programmer is just hardware; it needs software to tell it what to do. This is the role of flashrom.

flashrom is a powerful, open-source command-line utility designed to detect, read, write, verify, and erase flash chips—exactly what we need to do.

Function: flashrom is the translator and controller. It translates your high-level commands (e.g., flashrom --read my_backup.bin) into the low-level signal sequences of the Serial Peripheral Interface (SPI) protocol, which is the language the BIOS chip understands. It then instructs the Raspberry Pi's operating system to manipulate the GPIO pins to generate those signals.

📖 Reading (5 mins)

You don't need to perform these steps now, but read the section "Install FlashROM on Raspberry Pi" in the Qubes OS forum guide. This will help you understand that flashrom is a piece of software that you install on the Pi's operating system (Raspbian), reinforcing the relationship between the hardware (Pi) and the software (flashrom) that controls it.

• Coreboot on Lenovo X230 - Community Guides (Procedure Overview and FlashROM Installation)

4. The Physical Interface: SOIC8 Clip & Jumper Wires

Now we have the brain (Pi) and the language (flashrom), but we need the "hands" and "nerves" to connect to the patient—the BIOS chip.

The SOIC8 Clip

The BIOS chips on the x230 motherboard use a standard form factor called SOIC-8 (Small Outline Integrated Circuit, 8-pin). The SOIC8 clip is a brilliant tool designed to solve a major problem: making a reliable electrical connection to these tiny pins without having to desolder the chip from the motherboard, which is a difficult and risky process.

Function: The SOIC8 clip is a non-invasive mechanical interface. It has a spring-loaded mechanism that clamps onto the body of the chip, and tiny metal contacts within the clip press against the chip's 8 pins, establishing a temporary electrical connection.

This image provides a clear view of the complete setup in action. The SOIC8 clip is attached to one of the BIOS chips on the x230 motherboard, and its ribbon cable connects to a programmer, which is powered via USB. This illustrates how the clip provides the crucial link between the programmer and the chip.

📺 Viewing (1 min)

Connection quality is paramount. A cheap clip can lead to frustrating errors. Watch this short segment where the presenter notes the flakiness of cheap clips and the benefit of a higher-quality Pomona clip.

The Jumper Wires

Function: Jumper wires are simply flexible, insulated electrical wires with connectors on each end. Their function is to create a circuit by connecting each of the 8 contacts on the SOIC8 clip to a specific GPIO pin on the Raspberry Pi. They are the "nervous system" that carries the signals between the brain and the hands.

5. The System in Action: Understanding the Connections

To truly understand the function of each tool, we need to look at the signals being passed through the jumper wires. The communication protocol, SPI, defines a specific role for each wire.

Let's break down the six essential connections you will make:

1. VCC (Voltage at the Common Collector): This is the power supply pin. The BIOS chip is an active component and needs power to operate. The Raspberry Pi provides this power, which must be 3.3 volts. Supplying the 5V also available on the Pi would permanently damage the chip and potentially the motherboard. This is a critical safety detail.
2. GND (Ground): This is the common return path for the current, establishing a reference voltage (0V) for the entire circuit. Every electronic circuit needs a ground.
3. CS (Chip Select): This is the attention signal. The Pi (the "master") lowers the voltage on this line to signal to the BIOS chip (the "slave") that it is about to be sent a command. It's like tapping the chip on the shoulder to say, "I'm talking to you now."
4. CLK (Clock): This is the metronome of the conversation. The Pi generates a steady pulse on this line to synchronize the transfer of data. On each tick of the clock, one bit of data is transferred.
5. MOSI (Master Out, Slave In): This is the data-out line from the Pi's perspective. When the Pi is writing the new Coreboot firmware to the chip, the data flows through this wire.
6. MISO (Master In, Slave Out): This is the data-in line from the Pi's perspective. When you are reading the original BIOS to create a backup, the data flows from the chip to the Pi through this wire.

📺 Viewing (5 mins)

Watching someone wire this up is the best way to understand the function of each connection. Please watch the following segment. The presenter does an excellent job of explaining the role of each wire as he connects it between the chip socket and the Raspberry Pi.

Now that you have a dynamic understanding of the wiring, study the static diagrams in the guides. Cross-reference the pin names (CS, MISO, MOSI, etc.) with the functions described above. This will solidify your understanding of how the jumper wires map the Pi's GPIO functions to the chip's pins.

📖 Reading (5 mins)

Review the pinout diagrams in these two resources. They show the same logical connections, but present them in slightly different ways.

• Corebooting the ThinkPad X230 with Skulls - Famicoman.com (Connecting the X230 and RPi)
• Coreboot on Lenovo X230 - Community Guides (Physical Setup: Connecting Raspberry Pi and Flash Clip)

---

Conclusion

In this lesson, we have dissected the external flashing toolkit and examined the precise function of each component. You now understand that this is not just a random collection of parts, but a cohesive system for direct hardware communication.

Key Takeaways:

• System Components: The flashing toolkit is a system composed of a programmer (Raspberry Pi), control software (flashrom), and a physical interface (SOIC8 clip and jumper wires).
• Component Functions:
  • The Raspberry Pi acts as the programmable "brain," generating the electrical signals via its GPIO pins.
  • flashrom is the software that translates high-level commands into the low-level SPI protocol.
  • The SOIC8 clip provides a non-invasive physical connection to the BIOS chip.
  • Jumper wires carry the specific signals between the Pi and the clip.
• SPI Signal Roles: You learned the function of the key signals: VCC (3.3V Power), GND (Ground), CS (Chip Select), CLK (Clock), MOSI (Data to Chip), and MISO (Data from Chip).

Next Up

With a firm grasp of the tools for reading and writing firmware, our next task is to prepare the content we will eventually write to the chip. In the next lesson, we will focus on a crucial piece of software in our security-focused build: the me_cleaner script. You will learn what it is, why it's important for minimizing your Trusted Computing Base (TCB), and how it works to neutralize the Intel Management Engine.