Hello everyone.
Here is the bypass solution for several Lenovo ECs.
This has worked on many ECs.
Only works if password is contained in EC
I succeeded on many models
https://www.badcaps.net/forum/troubl...86#post3217086
https://www.youtube.com/channel/UCeF...t_adKcguvynjeA
I shorten the LPC bus, with the LAD0:3 and Gnd.
you can use the dedicated ports where you connect directly to the track.
(Be careful, resistors may be missing on the path)
look at the diagrams
example x390 npce388
The communication being cut off, corrupted,
it cannot read information contained in EC and therefore continues.
then simply clean by rewriting after access.
Don't save with F10, just clean Pwd with enter twice.
If the serial, uuid etc. information is corrupted, you are saving the wrong information
Like the old way with sda/scl.
The method is delicate, there is always a risk of bricking or try failed.
ITE and Nuvoton is easy, Mec16 is more delicate (many try necessary).
Timing is important
watch videos to understand
works on Mec1633 / Mec1653 / Mec1663 / IT8186VG / IT5261VG / NPCE68B / NCPE288/388 and surely others
but my tests failed with the Mec1503
The LPC bus is no longer used, it has been replaced by eSPI
Attached some connection diagrams for tested models
Edit
-----------------------
EC PWD eeprom location
NCPE68B
Dmi start from 0x5C120 and 0x5D120
Pwd 0x5C420 - 0x5C56F and 0x5D420 - 0x5D56F replace with 00
NCPE288/388
Dmi start from 0x30000
Pwd
0x36000 - 0x3604F
0x36080 - 0x360CF
0x36100 - 0x3614F
0x36180 - 0x361CF
0x36200 - 0x3624F
0x36280 - 0x362CF
0x36300 - 0x3634F
0x36380 - 0x363CF
0x36400 - 0x3644F
0x36480 - 0x364CF
0x36500 - 0x3654F
0x36580 - 0x365CF
0x36600 - 0x3664F
0x36680 - 0x366CF
replace with 00
Mec1663 Dmi start from 0x00
Pwd 0x300 - 0x34F replace with FF
search for this shape
Here is the bypass solution for several Lenovo ECs.
This has worked on many ECs.
Only works if password is contained in EC
I succeeded on many models
https://www.badcaps.net/forum/troubl...86#post3217086
https://www.youtube.com/channel/UCeF...t_adKcguvynjeA
I shorten the LPC bus, with the LAD0:3 and Gnd.
you can use the dedicated ports where you connect directly to the track.
(Be careful, resistors may be missing on the path)
look at the diagrams
example x390 npce388
The communication being cut off, corrupted,
it cannot read information contained in EC and therefore continues.
then simply clean by rewriting after access.
Don't save with F10, just clean Pwd with enter twice.
If the serial, uuid etc. information is corrupted, you are saving the wrong information
Like the old way with sda/scl.
The method is delicate, there is always a risk of bricking or try failed.
ITE and Nuvoton is easy, Mec16 is more delicate (many try necessary).
Timing is important
watch videos to understand
works on Mec1633 / Mec1653 / Mec1663 / IT8186VG / IT5261VG / NPCE68B / NCPE288/388 and surely others
but my tests failed with the Mec1503
The LPC bus is no longer used, it has been replaced by eSPI
Attached some connection diagrams for tested models
Edit
-----------------------
EC PWD eeprom location
NCPE68B
Dmi start from 0x5C120 and 0x5D120
Pwd 0x5C420 - 0x5C56F and 0x5D420 - 0x5D56F replace with 00
NCPE288/388
Dmi start from 0x30000
Pwd
0x36000 - 0x3604F
0x36080 - 0x360CF
0x36100 - 0x3614F
0x36180 - 0x361CF
0x36200 - 0x3624F
0x36280 - 0x362CF
0x36300 - 0x3634F
0x36380 - 0x363CF
0x36400 - 0x3644F
0x36480 - 0x364CF
0x36500 - 0x3654F
0x36580 - 0x365CF
0x36600 - 0x3664F
0x36680 - 0x366CF
replace with 00
Mec1663 Dmi start from 0x00
Pwd 0x300 - 0x34F replace with FF
search for this shape
Comment