Lenovo Thinkpad Ec Pwd Bypass

[kachito]

Hello everyone, first time posting here (if i did something wrong let me now)

I have a T14s Gen2 with MEC1503, was anybody able to finally unlock it?

Thank you in advance

[thecheekymonkey]

Maxpower3


Strange issue after performing the EC password Bypass.

ive performed your process on a lenovo thinkpad t14 gen1 (amd)

i figured out the correct points for the GND wire.

first time i managed to gain access to the bios as your process states. instead of asking for the password it error`d and gave me access.

i blanked both passwords and cleared the security chip. ctrl - alt - delete out.

now it still asks for the password if i want to access the BIOS but it accepts blank and lets me access BIOS setting but now i cannot disable the password. i can no longer clear the security chip. i cannot change uefi settings, infact most options i cannot change. they are greyed out, i can access there submenu but cannot change anything. i cannot reset defaults. apart from gaining access to the bios menu i pretty much cannot change 99% of the settings.

is this normal? i have tried the method again a number of times to gain access to the bios and even though it shows the error every time i perform the GND it when i press F1 to access the bios it still asks for the password, it still accepts Blank password and still lets me into bios but all relevant things are greyed out, i can only access the sub menu but chance to change is not possible.

hope you can help?

many thanks

[thecheekymonkey]

Maxpower3


Strange issue after performing the EC password Bypass.

ive performed your process on a lenovo thinkpad t14 gen1 (amd)

i figured out the correct points for the GND wire.

first time i managed to gain access to the bios as your process states. instead of asking for the password it error`d and gave me access.

i blanked both passwords and cleared the security chip. ctrl - alt - delete out.

now it still asks for the password if i want to access the BIOS but it accepts blank and lets me access BIOS setting but now i cannot disable the password. i can no longer clear the security chip. i cannot change uefi settings, infact most options i cannot change. they are greyed out, i can access there submenu but cannot change anything. i cannot reset defaults. apart from gaining access to the bios menu i pretty much cannot change 99% of the settings.

is this normal? i have tried the method again a number of times to gain access to the bios and even though it shows the error every time i perform the GND it when i press F1 to access the bios it still asks for the password, it still accepts Blank password and still lets me into bios but all relevant things are greyed out, i can only access the sub menu but chance to change is not possible.

hope you can help?

many thanks

Maxpower3

EDIT: FIXED IT

ok so ive managed to fix it. not really sure what happened to cause it as i did everything as per your basic instructions but the password still kept being asked for,, even though it was empty and upon entering a blak password it let me into the bios but would not actually let me change nearly everything. basically let me view the bios settings but not change.

i kept trying the ec bypass method and could guarantee it would error and let me press F1 to enter but would always ask me to enter the password (blank) and then not let me change anything.

so i persisted with the GND bypass method. I changed my timings,

i started with power on , wait 2 seconds, GND to USB for 2 Seconds, remove, wait until FnLock and F1 light came on and went out, then GND for 2 seconds, wait 2 seconds, then remove. This probably isnt the exact method but eventually i managed to get back into the BIOS without it asking me for the password. THIS time when i went to security settings and changed the apssword to blank it actually stated that configuration has changed. It NEVER said this the very first time i did this. I Blanked both passwords and both time it stated that the configuration had changed, i then ctrl=alt=delete and it restarted. this time the password has 100% gone. and i can change all settings and save them. ive even updated bios to the latest all working 100%

many thanks MaxPower3 . took me 3 or 4 days to figure stuff out and grab the schematics, board view etc etc and find out what i needed to do. enjoyed the learning.

p.s. This was a Lenovo Thinkpad T14 Gen1 (AMD) with board nm-c801

[Atreide]

Hi guys,

First of all thanks for you work Maxpower3
I need to remove Supervisor Password on x13 gen 1 amd
I want to confirm before doing it the correct location to be used for the hack. (picture attached)
Also I want to now if there is an other location available for the hack to avoid scratching the motherboard and welding.

Thanks for your help.

[Saad Haider]

I have a T14 Gen2 with MEC1503, was anybody able to finally unlock it?

Thank you in advance

[alfredposadas09]

123 delete

[64xgeo]

Hi everyone. Thinkpad X1 Carbon 7th gen. SN PF1SCL9C, motherboard FX490 D23 with supervisor password. Tried to remove by this method but I encountered the following problem (see photo). Enter key not work on this windows. If I press Esc, can move on other tabs, can clear chipset security, but, after ctrl+alt+del, nothing change, supervisor password is still there. I read this topic 2 times but don't saw something like this posted. To try with Z Key?...need your advice. Don't want to brick it.

[64xgeo]

Forget to say thank you to Maxpowre3 for this trick and to all others "veterans" that help us here with their experience. Thank You all!

[64xgeo]

I cannot edit my preview message so, will post again, with some info, maybe help someone.
Tried again and, after pressed Z keys when that windows appeared, all works like a charm. Pushed enter twice, supervisor password gone, cleared security chip, restart with CTRL+ALT+DEL and all bios info are still there untouched (machine type, system unit serial, system board serial, UUID, MAC, etc...).

Now, will tell you how I managed to bypass password. First, the trick with button connected at J5, pin 10 and GND (see image) helped a lot. Very easy to control timing with it. For my unit (X1C7, FX490 NM-B861 board).

How I gained access to the bios: after power on/CTRL+ALT+DEL, I pushed button just before Lenovo image appear...let's say 0,5 sec before and keep it around 2 seconds. With button still pressed, after that 2 second I hit F1 short and then released both (button and key). When I was successful, only fan error appeared on the display. Very easy now! 😊.
For me, the hardest part was to solder the wire to the J5 pin without shorting it. The pins are very close each other, for my old eyes.
Many thanks to Maxpower3 . His method saved me from spending money on a programmer...at least for now.
Image with wire soldered:



Oh, I forget to say, I disconnected only the main battery and speakers. All other components stayed connected and I used laptop's display throughout the operation.

[CrashNBurn]

Hell guys i did it! 😃

Lenovo E15 G2 AMD Ryzen 4500U
GE420/520 NM-C771 Rev 1.0
20T8-000VGE
IT8227E-256 2048-CXA S16TCB (<- the bastard is on the PCB backside covered under protective tape film)
winbond 25Q128JWSQ 2046

Needed around 30-40 tries to get it to work on Pin 7-10.

Left a little tip for the team. THX for this great forum and Maxpower3 for sharing! 💝

[blacksh4rk]

Hello all,

As far as I understand, for a P15 gen2 with a ncpx997 the only method to bypass SVP is via EC reprogramming, this bypass method instead does not work since eSPI is used. Am I right?

Also, I see that on NM-491 the eSPI CS pin is exposed on pin 3 of the JESPI1 connector, has anybody tried to pull that pin up (via some resistor) during power-on?
In theory, it should prevent the EC from responding (the same could be applied to CLK but at that point you need to know somehow CPOL and CPHA via e.g. an oscilloscope)

Btw that's my first post, thank you for all the great work and information you all provide!

Cheers,

[anhbanxoi]

Hello all,

As far as I understand, for a P15 gen2 with a ncpx997 the only method to bypass SVP is via EC reprogramming, this bypass method instead does not work since eSPI is used. Am I right?

Also, I see that on NM-491 the eSPI CS pin is exposed on pin 3 of the JESPI1 connector, has anybody tried to pull that pin up (via some resistor) during power-on?
In theory, it should prevent the EC from responding (the same could be applied to CLK but at that point you need to know somehow CPOL and CPHA via e.g. an oscilloscope)

Btw that's my first post, thank you for all the great work and information you all provide!

Cheers,

My friend did this bypass method on NPCX997 twice but it took a lot of time. At the moment you can program this chip using SVOD4/ Successor/MSLW UFPI