Lenovo Thinkpad Ec Pwd Bypass

[Maxpower3]

The short method won't work for this model it uses espi and not lad.

https://www.badcaps.net/forum/troubl...02#post3558002

[boy80]

Hello

I have looked through the last 46 pages, does anyone know where the lpc is on a t450s? I downloaded boardview and it seems i can see lpc-ad3 on a test point on the bottom of the board. any help would be appreciated

[volinakis]

Hello

I have looked through the last 46 pages, does anyone know where the lpc is on a t450s? I downloaded boardview and it seems i can see lpc-ad3 on a test point on the bottom of the board. any help would be appreciated

LPC debug port, J5 - pins 10-12

[Udemzy]

The contract must be executed for 1 or 2 seconds while pressing F1. The contact must not remain .
The timings vary depending on the EC.

Otherwise, try it as soon as the backlight is on and adjust the time.

!!!!Never restart with shunt on.!!!!!!!
Read the posts about timing here.It'll give you an idea, or watch my videos.

Thanks for further explanation, which point should one short on the 3 scrape part and can this work for T14s Gen 4?

[WhatTheDuck]

Hello Community,

i read nearly every comment in this thread, but i wasnt succesful after several hundreds tries. Could someone confirm i m doing it correct.

Specs:
Lenovo T14s
MB: GT4A3/GX3A2 NM-C891
Chip: MEC1663-BA0

Procedure:
I have a cable grounded on one of the screw holes and make contact to the PIN10 (better described here: https://jhewitt.net/thinkpad_x13_res...visor_password)
Timing varies, but most of the time:
Start: short before or after the backlights go on, also tried short before the logo
End: varies between brief shorts, just 1-2 second to long shorts until the lenovo logo dissapears


Results: The lenovo logo is longer visible when i keep shorting. When i stop the short before the lenovo logo is visible for 2,5 seconds, i dont get any errors. When i stop after 3 seconds the error always show:
BIOS self healing + other messages like:


I read several times that i should short it briefly. But in the video with the same board and chip, he short it very long and dont get the bios self healing message.
https://www.youtube.com/watch?v=kaRdq-tnJdU


Any help is appreciated

Quack Quack

[Maxpower3]

Hello Community,

i read nearly every comment in this thread, but i wasnt succesful after several hundreds tries. Could someone confirm i m doing it correct.

Specs:
Lenovo T14s
MB: GT4A3/GX3A2 NM-C891
Chip: MEC1663-BA0

Procedure:
I have a cable grounded on one of the screw holes and make contact to the PIN10 (better described here: https://jhewitt.net/thinkpad_x13_res...visor_password)
Timing varies, but most of the time:
Start: short before or after the backlights go on, also tried short before the logo
End: varies between brief shorts, just 1-2 second to long shorts until the lenovo logo dissapears


Results: The lenovo logo is longer visible when i keep shorting. When i stop the short before the lenovo logo is visible for 2,5 seconds, i dont get any errors. When i stop after 3 seconds the error always show:
BIOS self healing + other messages like:


I read several times that i should short it briefly. But in the video with the same board and chip, he short it very long and dont get the bios self healing message.
https://www.youtube.com/watch?v=kaRdq-tnJdU


Any help is appreciated

Quack Quack

Too many errors, too long. The logo freezes when you do the short, that's normal. Try different timings and start as soon as the backlight comes on.

[kicker12]

Hey!
Anyone tried on P1 Gen 3???
EC is NUVTON NPCX897K : I have tried many times on the "debug connector" where the LPC lines reaches BUT seems to have NO effect at all... :-(((

[ErParucca]

recent finding: I dumped both 32MB chips on the X13 Gen 2 Intel before applying a supervisor password and after. The "bottom" (touchpad's side) chips' content didn't change but the "top" (hinges' side) did change.
Suspicion (haven't been able to verify yet): dumping the 2 chips from a supervisor protected machine on file and restoring them on a non-protected machine will make the BIOS store and activate the supervisor password on the EC chip (made that mistake but not sure destination motherboard was password-free and have to try again after being certain the password is cleared).
If anyone wants to have a look, here are the two files before adding a password and after.

[bvarkino]

The contract must be executed for 1 or 2 seconds while pressing F1. The contact must not remain .
The timings vary depending on the EC.

Otherwise, try it as soon as the backlight is on and adjust the time.

!!!!Never restart with shunt on.!!!!!!!
Read the posts about timing here.It'll give you an idea, or watch my videos.

i need to scrape any of the red circled pads to expose metal to short, right? Can i damage the pad if i use a knife?

[bvarkino]

When the backlight comes up, can i ground pin 10 with pin 12 with an esd tweezer? And can i use the laptops own keyboard too to press f1?

[Maxpower3]

When the backlight comes up, can i ground pin 10 with pin 12 with an esd tweezer? And can i use the laptops own keyboard too to press f1?

A USB keyboard is better; short it for 1 or 2 seconds. Adjust the time if necessary.

[EETEH]

No need, just short the LPC_AD0:3 to ground.

I'm a little lost here, so i need to short all 4 (0:3) lines to gnd? currently i've tried shorting only LPC_AD0 with no result, only the "FAN error" a few times.

Connecting my RT809HSE to the battery clk/dat/gnd has also had no result in reading/ writing the IT5261vg-256.

[CraterM]

I'm a little lost here, so i need to short all 4 (0:3) lines to gnd? currently i've tried shorting only LPC_AD0 with no result, only the "FAN error" a few times.

Connecting my RT809HSE to the battery clk/dat/gnd has also had no result in reading/ writing the IT5261vg-256.

Only ONE to GND. Try one by one, Press power botton, wait 2 - 3 second and connect GND to AD. Use external keyboard.

[ripley]

Hi,
confirmed working with Thinkpad L590; IT8227E. There is a via with signal LPC_AD0 coming from R0901 on the bottom layer (just open backcover) under JDIMM 1 modul. Can be seen/found in boardview.
Thank you to Maxpower3 for this nice method!

[Maxpower3]

Hi,
confirmed working with Thinkpad L590; IT8227E. There is a via with signal LPC_AD0 coming from R0901 on the bottom layer (just open backcover) under JDIMM 1 modul. Can be seen/found in boardview.
Thank you to Maxpower3 for this nice method!

thanks for feedback

[blauAA]

Hi sir, Im wondering if you could tell me which one of these two video guides should I follow? so that in case the Model: T590 20N53SDU00 NM-B901 EMC1663 .

① https://www.youtube.com/watch?v=x5KvZLXA6BM for T480s （using your guide but seems not suitable）

② https://www.youtube.com/watch?v=Xw28inqitKk for P53（your YT video）

Because I cant find any guides about the T590 series （either like T490 or similar） using your method LPC Bypass. To avoid something not in control so I need help.

I guess the shorted pin point of T590 just as your map showed in another post. So perhaps you could teach my pre-procedures about T590 SVP Bypass when i say something wrong in the follows :

→ see backlight and Logo and try to short the LPC （pin 10？） for 1-2 seconds， then press F1 if see the SVP input requirement， use Ctrl+Alt+Del restart notebook

→ repeat above again until press F1 directly into the Bios setting up without SVP （that means at least shorting LPC twice？ what about maximum？ ）

→ choose security dialogs remove the SVP with pressing twice Enter button

→ after clean security chip dont make the choice save configs and restart but use Ctrl+Alt+Del to restart

[blauAA]

done with LPC pin 10！ thx a lot and wish you have a nice weekend.

[narsil]

Where is the espi point?

[Maxpower3]

https://www.badcaps.net/forum/troubl...m-d362-rev-3-0

[mksdinho]

This method doesn't work on this model (nm-d362)—the screen freezes and slows down, but it asks for the password every time. I also tried the other LPC ports
ESPI_IO0_R
ESPI_IO1_R
ESPI_IO2_R
ESPI_IO3_R

One of them had its IO chip fail while I was testing it.

[narsil]

https://www.badcaps.net/forum/troubl...m-d362-rev-3-0

Thank you