Lenovo Thinkpad Ec Pwd Bypass

[cy2u5]

Okay
I couldn‘t wait anymore and wanted to try an experiment. I swapped the MC1503 from
my faulty donor board.

The result: Just 5V while charging.
Swapped to the original IC and 20V went back.

I think there is a version mismatch between UEFI and EC? I‘ll try to flash a lower UEFI version by a CH341A. I already created a dump of it successfully before.

[CraterM]

Hi guys

I got a Lenovo Thinkpad X1 Carbon 9th generation. I bought PW locked mainboard on ebay (specially bought it locked) and would like to know if there are chances to do it on that model? It is a NM-D341.

The faulty board has unfortunately a MEC1503.
As it says failed in the first post maybe there is something new?

Your help is appreciated.

Thanks a lot!
Tolga

Not yet

[CraterM]

Okay
I couldn‘t wait anymore and wanted to try an experiment. I swapped the MC1503 from
my faulty donor board.

The result: Just 5V while charging.
Swapped to the original IC and 20V went back.

I think there is a version mismatch between UEFI and EC? I‘ll try to flash a lower UEFI version by a CH341A. I already created a dump of it successfully before.

Write clean bios

[cy2u5]

Write clean bios

Thanks!

I got a BIOS file from a T*legram group. Will flash it now. Or what is meant exactly with „clean“?

[Sparo]

Hi, have you tried erasing the MEC chip? See if it programs itself back from the BIOS

[cy2u5]

That‘s a good advice! But how to perform that?
Actually I flashed another UEFI Image and it charges only at 5V. It doesn‘t turn on also.
I will flash the original image back to see if it will turn back on.

[luvbe3]

i try on Thinkpad E15 gen 4. it work well.
thanks sir.

[0x888816]

Not having much luck with my T14 Gen 1 via the jtag pad. I am occasionally getting different boot behavior though such as BIOS messages about some CRC or SVT. Other times it just gets stuck at the Lenovo banner.

[azanwaqas771]

Okay
I couldn‘t wait anymore and wanted to try an experiment. I swapped the MC1503 from
my faulty donor board.

The result: Just 5V while charging.
Swapped to the original IC and 20V went back.

I think there is a version mismatch between UEFI and EC? I‘ll try to flash a lower UEFI version by a CH341A. I already created a dump of it successfully before.

hi bro how to remove under chip gum

[cy2u5]

hi bro how to remove under chip gum

Hi bro

First unsolder all the solder and then remove the glue just with hot air (220 degrees Celsius) and a sharp surgical blade. Step by step and patiently

[anhbanxoi]

Okay
I couldn‘t wait anymore and wanted to try an experiment. I swapped the MC1503 from
my faulty donor board.

The result: Just 5V while charging.
Swapped to the original IC and 20V went back.

I think there is a version mismatch between UEFI and EC? I‘ll try to flash a lower UEFI version by a CH341A. I already created a dump of it successfully before.

Better to take the chip from the donor board. Maybe the chip you are using for another model.

[makar303]

Hello,

I have an NM-D271 board that is password-protected. I have attached the EC dump.

Could you remove the password, or tell me where the password is stored in the dump?

Thank you.

[shiyab]

Hello,

I have an NM-D271 board that is password-protected. I have attached the EC dump.

Could you remove the password, or tell me where the password is stored in the dump?

Thank you.

posted

[Sparo]

Hello,

I have an NM-D271 board that is password-protected. I have attached the EC dump.

Could you remove the password, or tell me where the password is stored in the dump?

Thank you.

Hi, The password data is located from 0x5C420 to 0x5C46F and from 0x5D420 to 0x5D46F
However, clearing only the password+checksum won't be enough. The associated data chunks also need to be cleared
Therefore, Post the Serial Number so someone can do it for you > RULES UPDATE for BIOS requests/offers *AVOID BANNING, READ BEFORE POSTING* - Badcaps

[Andreasbest]

I have a request about a locked P14s Gen1 with Intel ( i think MB is NM-D351 with MEC1663 ) so i was wondering, the bypass method works on this model or only jtag with SVOD4 is working?
Anyone has experience on this model?

[CraterM]

Working , but try more times

[Andreasbest]

Working , but try more times

You sure? Have you tried it?

[Uewel]

I would like to let you know that I have successfully carried this out on the following device:
ThinkPad X13 Yoga Gen 1
20SY-S4JC00
LBB-2 MB 19733-1
UEFI BIOS N2UET474W (1.27)
EC FW: N2UHT27W (1.10)

I have soldered a micro switch with thin isolated copper wires between R1854 (LPC_AD_CPU_P0) and GND. The resistor can be found in the area between Wifi module and CPU (see boardview).
After the Lenovo boot logo appeared I have pressed the button until error messages are shown on the screen. Then (as shown in the videos) supervisor password is disabled, enter a empty password, save changes by pressing F10. After reboot everything is fine.

Thank you so much for this easy solution which doesn't require a special programmer.

[Maxpower3]

You sure? Have you tried it?

NM-D351 MEC1503
Look EC. if MEC 16XX, OK
if MEC 15/17 Not work works

[mksdinho]

LBB2-MB 19733-1 (X13 Yoga Gen 1)

DBG1 PORT Pin 6 LPC_AD_CPU_P3

[jadymydurs]

Hello, do you have a detailed photo of the pins that need to be shorted to get rid of the svp in the x1 extreme gen1 (LPM-1 MB 17870-1, MEC1653-BA1)? I would be very grateful for your help.