Lenovo Thinkpad Ec Pwd Bypass

[Maxpower3]

why are you looking for these keys? By the way, there is a new version of the UEFI tool.

thanks for uefitools. practice calculating hashes
No more need for hxd

[rediii]

Do you have any ideas for checking the keys?
We notice here that the automatic repair (Self Healing) is linked to the verification of the Phoenix keys.
We know how to calculate it for older AMDs with SHA256,

but I can't find Intel.
I looked on other forums too, and I found information for older models.
https://www.insanelymac.com/forum/to...eps-on-lenovo/

why are you looking for these keys? By the way, there is a new version of the UEFI tool.

[Maxpower3]

Do you have any ideas for checking the keys?
We notice here that the automatic repair (Self Healing) is linked to the verification of the Phoenix keys.
We know how to calculate it for older AMDs with SHA256,

but I can't find Intel.
I looked on other forums too, and I found information for older models.
https://www.insanelymac.com/forum/to...eps-on-lenovo/

[moshu]

I confirm Maxpower's method is working on:

Lenovo E15 G2 AMD Ryzen 5500U
GE420/520 NM-C771 Rev 1.0
EC IT8227E-256

Was not easy, but eventually did worked.

I can tell there were situations where I could bypass the password screen, got into BIOS settings, but the supervisor password could not be saved even if I could change the date and other settings, so I had to start again. Synchronization is the key to success

Thanks Maxpower for sharing!

[anhbanxoi]

Hello all,

As far as I understand, for a P15 gen2 with a ncpx997 the only method to bypass SVP is via EC reprogramming, this bypass method instead does not work since eSPI is used. Am I right?

Also, I see that on NM-491 the eSPI CS pin is exposed on pin 3 of the JESPI1 connector, has anybody tried to pull that pin up (via some resistor) during power-on?
In theory, it should prevent the EC from responding (the same could be applied to CLK but at that point you need to know somehow CPOL and CPHA via e.g. an oscilloscope)

Btw that's my first post, thank you for all the great work and information you all provide!

Cheers,

My friend did this bypass method on NPCX997 twice but it took a lot of time. At the moment you can program this chip using SVOD4/ Successor/MSLW UFPI

[blacksh4rk]

Hello all,

As far as I understand, for a P15 gen2 with a ncpx997 the only method to bypass SVP is via EC reprogramming, this bypass method instead does not work since eSPI is used. Am I right?

Also, I see that on NM-491 the eSPI CS pin is exposed on pin 3 of the JESPI1 connector, has anybody tried to pull that pin up (via some resistor) during power-on?
In theory, it should prevent the EC from responding (the same could be applied to CLK but at that point you need to know somehow CPOL and CPHA via e.g. an oscilloscope)

Btw that's my first post, thank you for all the great work and information you all provide!

Cheers,

[CrashNBurn]

Hell guys i did it! 😃

Lenovo E15 G2 AMD Ryzen 4500U
GE420/520 NM-C771 Rev 1.0
20T8-000VGE
IT8227E-256 2048-CXA S16TCB (<- the bastard is on the PCB backside covered under protective tape film)
winbond 25Q128JWSQ 2046

Needed around 30-40 tries to get it to work on Pin 7-10.

Left a little tip for the team. THX for this great forum and Maxpower3 for sharing! 💝

[64xgeo]

I cannot edit my preview message so, will post again, with some info, maybe help someone.
Tried again and, after pressed Z keys when that windows appeared, all works like a charm. Pushed enter twice, supervisor password gone, cleared security chip, restart with CTRL+ALT+DEL and all bios info are still there untouched (machine type, system unit serial, system board serial, UUID, MAC, etc...).

Now, will tell you how I managed to bypass password. First, the trick with button connected at J5, pin 10 and GND (see image) helped a lot. Very easy to control timing with it. For my unit (X1C7, FX490 NM-B861 board).

How I gained access to the bios: after power on/CTRL+ALT+DEL, I pushed button just before Lenovo image appear...let's say 0,5 sec before and keep it around 2 seconds. With button still pressed, after that 2 second I hit F1 short and then released both (button and key). When I was successful, only fan error appeared on the display. Very easy now! 😊.
For me, the hardest part was to solder the wire to the J5 pin without shorting it. The pins are very close each other, for my old eyes.
Many thanks to Maxpower3 . His method saved me from spending money on a programmer...at least for now.
Image with wire soldered:



Oh, I forget to say, I disconnected only the main battery and speakers. All other components stayed connected and I used laptop's display throughout the operation.

[64xgeo]

Forget to say thank you to Maxpowre3 for this trick and to all others "veterans" that help us here with their experience. Thank You all!

[64xgeo]

Hi everyone. Thinkpad X1 Carbon 7th gen. SN PF1SCL9C, motherboard FX490 D23 with supervisor password. Tried to remove by this method but I encountered the following problem (see photo). Enter key not work on this windows. If I press Esc, can move on other tabs, can clear chipset security, but, after ctrl+alt+del, nothing change, supervisor password is still there. I read this topic 2 times but don't saw something like this posted. To try with Z Key?...need your advice. Don't want to brick it.

[alfredposadas09]

123 delete

[Saad Haider]

I have a T14 Gen2 with MEC1503, was anybody able to finally unlock it?

Thank you in advance

[Atreide]

Hi guys,

First of all thanks for you work Maxpower3
I need to remove Supervisor Password on x13 gen 1 amd
I want to confirm before doing it the correct location to be used for the hack. (picture attached)
Also I want to now if there is an other location available for the hack to avoid scratching the motherboard and welding.

Thanks for your help.

[thecheekymonkey]

Maxpower3


Strange issue after performing the EC password Bypass.

ive performed your process on a lenovo thinkpad t14 gen1 (amd)

i figured out the correct points for the GND wire.

first time i managed to gain access to the bios as your process states. instead of asking for the password it error`d and gave me access.

i blanked both passwords and cleared the security chip. ctrl - alt - delete out.

now it still asks for the password if i want to access the BIOS but it accepts blank and lets me access BIOS setting but now i cannot disable the password. i can no longer clear the security chip. i cannot change uefi settings, infact most options i cannot change. they are greyed out, i can access there submenu but cannot change anything. i cannot reset defaults. apart from gaining access to the bios menu i pretty much cannot change 99% of the settings.

is this normal? i have tried the method again a number of times to gain access to the bios and even though it shows the error every time i perform the GND it when i press F1 to access the bios it still asks for the password, it still accepts Blank password and still lets me into bios but all relevant things are greyed out, i can only access the sub menu but chance to change is not possible.

hope you can help?

many thanks

Maxpower3

EDIT: FIXED IT

ok so ive managed to fix it. not really sure what happened to cause it as i did everything as per your basic instructions but the password still kept being asked for,, even though it was empty and upon entering a blak password it let me into the bios but would not actually let me change nearly everything. basically let me view the bios settings but not change.

i kept trying the ec bypass method and could guarantee it would error and let me press F1 to enter but would always ask me to enter the password (blank) and then not let me change anything.

so i persisted with the GND bypass method. I changed my timings,

i started with power on , wait 2 seconds, GND to USB for 2 Seconds, remove, wait until FnLock and F1 light came on and went out, then GND for 2 seconds, wait 2 seconds, then remove. This probably isnt the exact method but eventually i managed to get back into the BIOS without it asking me for the password. THIS time when i went to security settings and changed the apssword to blank it actually stated that configuration has changed. It NEVER said this the very first time i did this. I Blanked both passwords and both time it stated that the configuration had changed, i then ctrl=alt=delete and it restarted. this time the password has 100% gone. and i can change all settings and save them. ive even updated bios to the latest all working 100%

many thanks MaxPower3 . took me 3 or 4 days to figure stuff out and grab the schematics, board view etc etc and find out what i needed to do. enjoyed the learning.

p.s. This was a Lenovo Thinkpad T14 Gen1 (AMD) with board nm-c801

[thecheekymonkey]

Maxpower3


Strange issue after performing the EC password Bypass.

ive performed your process on a lenovo thinkpad t14 gen1 (amd)

i figured out the correct points for the GND wire.

first time i managed to gain access to the bios as your process states. instead of asking for the password it error`d and gave me access.

i blanked both passwords and cleared the security chip. ctrl - alt - delete out.

now it still asks for the password if i want to access the BIOS but it accepts blank and lets me access BIOS setting but now i cannot disable the password. i can no longer clear the security chip. i cannot change uefi settings, infact most options i cannot change. they are greyed out, i can access there submenu but cannot change anything. i cannot reset defaults. apart from gaining access to the bios menu i pretty much cannot change 99% of the settings.

is this normal? i have tried the method again a number of times to gain access to the bios and even though it shows the error every time i perform the GND it when i press F1 to access the bios it still asks for the password, it still accepts Blank password and still lets me into bios but all relevant things are greyed out, i can only access the sub menu but chance to change is not possible.

hope you can help?

many thanks

[kachito]

Hello everyone, first time posting here (if i did something wrong let me now)

I have a T14s Gen2 with MEC1503, was anybody able to finally unlock it?

Thank you in advance

[theBread]

Hi ^^

I'm trying this bypass (after succeeding on an L580 and X390 Yoga, thanks for that ) on an E14 Gen2 (NM-D011, should be the same as the E15) by shorting ESPI_IO1 (pin 9 of the IT8227) to ground, but several issues occur along the way:

• Upon boot I get

  0183: Bad CRC of Security Settings in EFI variable.

• Upon reseting the Supervisor password in the BIOS I get

  Failed to save storage: LenovoSecurityConfig. Status: Time out.

• An EATA error occurs if the reboot after the BIOS succeeds (sometimes fails as well, display stays black)
• Shorting to EC pin 7 (ESPI_IO3) (while still using the same timing that works with ESPI_IO1) does not succeed at all altough described as working on another E14 Gen2 (AMD tho).

Result: The bypass only works for me to get into the BIOS, not to actually fix anything.
My question is: Do I have to reflash the BIOS or EC at this point?
I remember that I had that CRC error when bypassing the Nuvoton chip of my X390 Yoga, but I sadly do not remember the fix.
Also, what does the LenovoSecurityConfig mean anything?

I do not own a Vertyanov programmer, only a CH341a, so programming the EC might get a bit painful and/or expensive ^^'

[volinakis]

Which method did you use?

read posts, method is described by MaxPower3 in 1st post.

[volinakis]

anyone has tried mawpower solution with E14 gen 3 AMD ryzen !!

it doesn't work, use SVOD4 to read NPC997

[Geromen]

Congratulations for you! Maybe you have some advice for T14 Gen 1 with AMD Ryzen pro GT4A1 NM-C801 Rev1.0?

I think is the same process. Just look at the images and try.