121K views · Jan 22, 2017 · 44:50 · 2 HN recommenders · 3 mentions · discussed 2017–2025
Hamish Coleman describes reverse engineering the keyboard controller in a Thinkpad and reflashing it with custom firmware. He covers how Lenovo secures its firmware, and his ongoing work on the protocol between the BIOS and the vendor flash tool.
Why Hacker News points people here: HN people cite it as an approachable, hands-on introduction to hardware and firmware reverse engineering, and as the author's own account of the Thinkpad keyboard patch effort.
“Here's the presentation by the author himself at linux.conf.au”HN comment, 2025
“Here's something from Linuxconf.au and hacking Thinkpads”
Indirect introduction to reverse engineering via hacking Thinkpad keyboards
For those who might want a somewhat indirect introduction to radare... Here's something from Linuxconf.au and hacking Thinkpads: this video
“I found this video on hacking old Thinkpad keyboards onto new Thinkpad models interesting.”
Fitting old Thinkpad keyboards to new models required firmware reverse engineering
I found this video on hacking old Thinkpad keyboards onto new Thinkpad models interesting. Required a lot of reverse engineering due to how the firmware in the Thinkpad maps keys: this video
“Here's the presentation by the author himself at linux.conf.au”
Author's own presentation on the Thinkpad patch effort
That is the general nature of reverse engineering efforts, but this one has been documented enough that you don't need to blindly trust completely random executables or code from strange places. You can manually recreate the process of building a patch for the embedded controller instead of just following instructions: link . Here's the presentation by the author himself at linux.conf.au (what used to be the biggest local Linux conference for those of us in Australia and NZ): this video . This is of course not supported by Lenovo. Unlocking the BIOS is definitely more like what you described. It's the price to pay for freely playing around with processor power limits, getting AES-NI instruction set support, etc. I have not checked since 2019, so there might be a clearer way.
