Lenovo L15 Gen 2 (Ryzen) Password removal w/ Vertyanov Successor

[Atomsk]

Hi all. Thanks for taking the time to read. Here's the situation. I have several of this model, most locked. Recently purchased a Vertyanov Successor and was able to successfully read and write to the Nuvoton EC. However, erasing then writing did not remove the password. I was expecting to user the lenovoUone tool. I have an unlocked bios saved and was able to write that file. The Bios was no longer locked but the SN info etc was of course wrong. (proof of concept for me at least)
I was hoping that if an unlocked version of my Bios was made for me, I could use that to compare and learn where to edit the password, assuming that is the was the way forward. If the solution is building a new bios and flashing the ec, could I have an unedited one and one with my SN added.

Anyway, here is the pertinent info:

Lenovo Thinkpad L15 Gen2
Board NM-D391
SN - PF-34YBPD
EC- NPCE68BPA0DX

Thanks

[peste]

Re: Lenovo L15 Gen 2 (Ryzen) Password removal w/ Vertyanov Successor

Hi all. Thanks for taking the time to read. Here's the situation. I have several of this model, most locked. Recently purchased a Vertyanov Successor and was able to successfully read and write to the Nuvoton EC. However, erasing then writing did not remove the password. I was expecting to user the lenovoUone tool. I have an unlocked bios saved and was able to write that file. The Bios was no longer locked but the SN info etc was of course wrong. (proof of concept for me at least)
I was hoping that if an unlocked version of my Bios was made for me, I could use that to compare and learn where to edit the password, assuming that is the was the way forward. If the solution is building a new bios and flashing the ec, could I have an unedited one and one with my SN added.

Anyway, here is the pertinent info:

Lenovo Thinkpad L15 Gen2
Board NM-D391
SN - PF-34YBPD
EC- NPCE68BPA0DX

Thanks

to understand that the password for this type of laptop is in the EC bios?..
try this..

[Atomsk]

Re: Lenovo L15 Gen 2 (Ryzen) Password removal w/ Vertyanov Successor

Hey Peste, thanks for the file but that wasn't quite what I was looking for. That Bios was locked as well. Was it supposed to be unlocked? I'm assuming that the password is physically stored in the EC. I was hoping to look at my locked and unlocked bios and learn something. If I could get this unlocked, that would be a start.

Thanks

[volinakis]

Re: Lenovo L15 Gen 2 (Ryzen) Password removal w/ Vertyanov Successor

Hi all. Thanks for taking the time to read. Here's the situation. I have several of this model, most locked. Recently purchased a Vertyanov Successor and was able to successfully read and write to the Nuvoton EC. However, erasing then writing did not remove the password. I was expecting to user the lenovoUone tool. I have an unlocked bios saved and was able to write that file. The Bios was no longer locked but the SN info etc was of course wrong. (proof of concept for me at least)
I was hoping that if an unlocked version of my Bios was made for me, I could use that to compare and learn where to edit the password, assuming that is the was the way forward. If the solution is building a new bios and flashing the ec, could I have an unedited one and one with my SN added.

Anyway, here is the pertinent info:

Lenovo Thinkpad L15 Gen2
Board NM-D391
SN - PF-34YBPD
EC- NPCE68BPA0DX

Thanks

why don't you compare locked vs unlocked EC file? Post also unlocked file to compare them.

[Atomsk]

Re: Lenovo L15 Gen 2 (Ryzen) Password removal w/ Vertyanov Successor

I meant to say that the unlocked file was from a gen1 and I was able to unlock a different gen1 using that method. I do not have an unlocked L15 Gen2. In this thread: https://www.badcaps.net/forum/showthread.php?t=112184
the block the password was stored in was found and could be erased. I'm hoping to find those addresses for this model.

[Maxpower3]

https://www.badcaps.net/forum/troubl...96#post3166296

[skazide]

thanks maxpower3 , it only still one msg . no i dont have the original cause i did mistake with saving 256 not 384 kb and a guy provide me with this one from exract lenovo bios

[Maxpower3]

cool, things are better
you have access to the setup now.
post a photo of the numbers in the setup

Rfid don't know yet but we will find

Message: 0188: Invalid RFID Serialization Information Area. Solution: The EEPROM checksum is not correct (block # 0 and 1).

The system board should be replaced

[skazide]

ok bro

[Maxpower3]

you still have the file in 256??

[skazide]

this is the file bro

[Maxpower3]

too bad the good part is missing

[skazide]

if this prob is asset tag can this do the work ??

[Maxpower3]

I don't think so, it's not necessary.
the problem is in UUID and Mac address

you can dump eeprom with lenovo utility and post me the blocks in pictures

[Maxpower3]

one of the dumps is shifted, I need to read block 3,
I'm going to give your information, I kept that of the donor

[Maxpower3]

here is a block after password (block6/7), I don't know this function 0x5C600 and 0x5D600.


I made a file with your mac address and changed UUID.
you can try, I don't really believe it

please before writing, look at the thread and post identical photos with yours
https://www.badcaps.net/forum/troubl...31#post3157831

or try initialise eeprom with utility (4) and rewrite your serial and others informations

[skazide]

😁😁 THE LAST one is better

[Maxpower3]

post picture serial setup please

[Maxpower3]

if 2 times RFID + product name, we are in the right place

[skazide]

it is not asset tag , im thinking to just let it like that

[Maxpower3]

put back the one from before and do an initialization with utility to rewrite the checksum

[Maxpower3]

Initialise configuration aéra
should be enough to clean block with uuid and mac address and product name

[skazide]

ini untility i never used is this a programe software

[Maxpower3]

make yourself a key like this and then we will activate the ini functions
https://www.badcaps.net/forum/troubl...78#post1848078

[skazide]

i did give pc to client . he just need to tap esc , i just come to say thanks a lot before i forget

[Atomsk]

Thanks Maxpower3, those were it. Bios unlocked! For everyone else..
DMI information and password writes 2 times on file
Dmi start from 0x5C120 and 0x5D120
Password 0x5C420 to 0x5C56F and 0x5D420 to 0x5D56F

[Maxpower3]

[wuyaping]

Initialise configuration aéra
should be enough to clean block with uuid and mac address and product name

Hi! Can you share this .EFI file with me?（This associative maintenance utility you have is not quite the same as the one I have）😀

[jozlar]

PLEASE UNLOCK BIOS

THINKPAD L15 GEN 2

SERIAL: PF-3MSSHS

TYPE : 20X4-S2VJ00

FACTORY ID : JVHFC1

[Vesko356]

Do NOT post in all caps please!

[Maxpower3]

Visitor message from jozlar

jozlar posted a Visitor Message for Maxpower3

Yesterday, 01:05 PM

please help me l15 gen 2 unlock

Thanks Maxpower3, those were it. Bios unlocked! For everyone else..
DMI information and password writes 2 times on file
Dmi start from 0x5C120 and 0x5D120
Password 0x5C420 to 0x5C56F and 0x5D420 to 0x5D56F

[jozlar]

Visitor message from jozlar

jozlar posted a Visitor Message for Maxpower3

Yesterday, 01:05 PM

please help me l15 gen 2 unlock

I can't understand these addresses, I'm using hex editor, is another editor needed?