Lenovo Thinkpad Ec Pwd Bypass

[santoslao]

this is no proof for me, sry. i doubt it. i once went to the trouble of unlocking a locked t15 g2 by replacing the mec1503.

Yes, I heard that changing the MEC1503 works, can you tell me where you bought it? Has it already come programed?

[anhbanxoi]

this is no proof for me, sry. i doubt it. i once went to the trouble of unlocking a locked t15 g2 by replacing the mec1503.

Base on datasheet there is 2KB ROM inside which is used to store password and other informations like serial number, model, .... You can use lenovo tool to dump this rom content but cannot reach the part that store password.

[system_fans]

Thank you for sharing, you are a tech gurus

[rediii]

Yes, I heard that changing the MEC1503 works, can you tell me where you bought it? Has it already come programed?

i harvested one from a dead board.

[rediii]

Base on datasheet there is 2KB ROM inside which is used to store password and other informations like serial number, model, .... You can use lenovo tool to dump this rom content but cannot reach the part that store password.

exactly that's the point.

[kouider]

I have found on one Russian Website that they are able to read the chip, but only if desoldered if i understood that correctly
https://mslw.com/bb/showthread.php?t...c1503#pid97749

[kouider]

they are also able to read NPCX797 and NPCX997 chip:

https://mslw.com/bb/showthread.php?t...cx797#pid94250

[anhbanxoi]

Yes, I heard that changing the MEC1503 works, can you tell me where you bought it? Has it already come programed?

MEC1503 you can buy it on aliexpress. Just replace it and rewrite serial number, product id with Lenovo tool.

[Usering]

Share experience
1)
very Risk method lpc on espi board
killed 2 laptop cpu short
nm-d362 io mec1503
nm-981 io npcx997
I would have made a little money, now I would have paid over $500 for the board on aliexpress .

2)
regarding changing the chip, you must be a professional because the chip is glued from the inside with a black substance that can spoil the welding place and also the source of purchasing the chip.

[Kind_Drop]

Have you tested this method on P53s 20N6 Serial number PF292CDY? I can't find the schematics for this motherboard, and it seems different from the P53.

[rediii]

Have you tested this method on P53s 20N6 Serial number PF292CDY? I can't find the schematics for this motherboard, and it seems different from the P53.

same like these:

T490, T590, P43s - NM-B901

[Needthinkpad]

I'm not familiar with by passing bios password but I've a x13 gen 1 intel and it is locked, but I don't know what you doing in the video or what I need to do. I've only understood that it's necessary to to stick a screwdriver in it.

[jagadish]

1 wire to ground on one of the points following 1 or 128/127/126 of your choice
at startup as indicated in previous posts

EC : NPCE68AP
L14/L15 gen1 GL40-GL5A0 NM-C631

of course, check that the diagram matches




Who has now used this technique and is satisfied with it here ??
just to give some feedback

sir I am satisfied with this unique technique thanks lot maxpower I tried on NM-D422 T14 Gen2 Amd IT5679VG

[jagadish]

hach
santoslao
Hello.
Both of you must find schematics and search for words "LAD" and "eSPI"
If you found "LAD" is possible
If you found "eSPI" is not possible.

DEAR Andreasbest I found "ESPI' in NM-D422 it work fine and it is possible , 100% work 😊

[Andreasbest]

DEAR Andreasbest I found "ESPI' in NM-D422 it work fine and it is possible , 100% work 😊

Yes because it's LAD too.

If you found only eSPI it won't work

[rediii]

DEAR Andreasbest I found "ESPI' in NM-D422 it work fine and it is possible , 100% work 😊

shorting espi doesn't work, andreasbest is right... mec1503 and mec1723 will never be supported i guess (jtag interface). the jtag interface is software locked.

[Usering]

DEAR Andreasbest I found "ESPI' in NM-D422 it work fine and it is possible , 100% work 😊

LAD working
eSPI don't working (After several attempts, the processor shorted died )

[Andreasbest]

shorting espi doesn't work, andreasbest is right... mec1503 and mec1723 will never be supported i guess (jtag interface). the jtag interface is software locked.

One day we will manage to remove pass from MEC1503 too, for example right now we know there is 2kb rom on it that writes all data (serial, model, bios pw) everytime the laptop posts. One day someone will manage find a workaround on it too.

[rediii]

LAD working
eSPI don't working (After several attempts, the processor shorted died )

this is strange, too. i tried it like 100 times and nothing died (t15 gen 2).

[rediii]

One day we will manage to remove pass from MEC1503 too, for example right now we know there is 2kb rom on it that writes all data (serial, model, bios pw) everytime the laptop posts. One day someone will manage find a workaround on it too.

the data won't be rewritten with every post, that's wrong. the 2 kb eeprom information is not stored in the bios but only in the mec.