Lenovo Thinkpad Ec Pwd Bypass

[black0hackers]

i have try on T14 G2 with mec1503 but not done

[Patrik Vilja]

Intresting..

So, to be able todo the eez on 17xx mcu, the decoupling cap is needed..?

Am im thinking right...?


Someone?

[Patrik Vilja]

[kitor]

What are you trying to do? What decoupling caps? Where did you get 5v and 1.8v?

For LPC you short data pin(s) to ground, not up...

[Patrik Vilja]

My mec1723 has no lpc, it has espi.. somewhat digitalized protocol, compared to lpc, thats more analog...
i belive Therese error checking on espi, and not lpc...
(Confirm?)

What Im thinking tho, if you remove the bat and cmos bat, hold powerbutton 20 sec, the mcu starts an bios restore, event svp data, defualts all settings.. after that, comp boots, and you get an error message, smt bout reading back conf info..

As i beliveit here, the SVP, Bios password, area thats usualy not writeable is open..


If ppl with 15 and 17 gen mec try and bug there..?
If its only reading conf, back to mec, svp, settings and so on, this makes it easier and less prone to read wrong data, so you not corrupt and destroy your bios...

Mening, you wont be able to corrupt mec bios, only config and settings.. (cmos-rst)
and could maybe this also work with undervoltage glitching..?
and UV, writes mostly 0. And OV(Overvoltage) 1..?
its bettet to be an 0 then an 1 that starts everything, id say.. :p


Question..

Does mec16xx read from flash Every boot, and what does it read? (Svp pass
Is that info stored on external efi chip, or stored inside the mec mcu?


Or does 15 to 17 mec controllers read the bios conf and data same, or only the change in LPC or ESPI?

[didouche1200]

i have thinkpad t14s moterboard nm-c891 with password please help me

[Maxpower3]

i have thinkpad t14s moterboard nm-c891 with password please help me

try one wire (lad0-3) with Gnd
wait for the backlight,before logo.wait 1-2 sec with contact ,release and press f1 to enter setup
errors can occur
EC can be corrupted if you save wrong info

Clear supervisor password with twice blank
and manager with twice blank password
Clear security chip too
After just Ctrl alt del and try
if Mec need many tries

[milanTT]

Hi all,
Maxpower very much thanks for this simple method, today I was able to remove system management password combined with predesktop authentication with help of one microswitch on Thinkpad T490 NM-B901 MEC1633

[khaledmosa99]

Try

thank you sair work like charm with pad num 3 many thanks to you and maxpower

[imranromi]

thank you sair work like charm with pad num 3 many thanks to you and maxpower

Can you tell which Ec chip use your board?

[imranromi]

thank you sair work like charm with pad num 3 many thanks to you and maxpower

Can you tell which Ec chip use your board?

[khaledmosa99]

Can you tell which Ec chip use your board?

Yes sure NPCX897KA0BX

[miansh621]

Yes sure NPCX897KA0BX

Can u mention which points you use

[didouche1200]

thanks work for me

[didouche1200]

Where can I find lpc line in thinkpad t14s gen 2 nm-d361

[CraterM]

Where can I find lpc line in thinkpad t14s gen 2 nm-d361

In the galaxy. Only search!

[bigboots]

Has anyone tried this on a T14 Gen 3?

[nistel]

I have some progress with T490 and MEC1663. Shorted LPC_AD0 to ground and sometimes i manage to get EAIA error 0187 and i got into BIOS with only 2 tabs - Config and Date/Time. Tried many many times with AD1,AD2,AD3

Am i missing something?

[Maxpower3]

I have some progress with T490 and MEC1663. Shorted LPC_AD0 to ground and sometimes i manage to get EAIA error 0187 and i got into BIOS with only 2 tabs - Config and Date/Time. Tried many many times with AD1,AD2,AD3

Am i missing something?

This happens to me too,
change the timing and start earlier just before backlight and stays short for less time.

Mec16 is difficult
many many tries

[azanwaqas771]

hi any one can onlock P15 Gen 1 NM-C651