Lenovo Thinkpad Ec Pwd Bypass

[nabilgo]

how to unlock lenovo t14 gen 4 amd ??

[zomi]

Whats the security chip on the board ?

[judamex]

Any update for
NM - E972 Rev: 1. 0 14 gen 4 with MEC1723-cbo
not have a password on bios, only have coputrace y have only a vertyanov 3

[Usering]

Hello everyone , Is it true that KBC Nuvoton npcx998 like Thinkpad is programmed for new hp devices, and does this person do this? As shown in the picture on the hp g11 device

[zomi]

I believe it is true they are unlocking, as you know they are locally services at moment only.
I think maybe in new year we will see and offering from maybe lbe extractor people.. at a price though.
And fair play to them...
nice to see things advancing.

[Mahesa09]

[QUOTE=Maxpower3;n3519150][QUOTE=zDarkStarz;n3518890]
Update:

This method works with Thinkpad P50 - MEC 1653L. The issue I had before is caused by the resistors (R488, R489, R490, R491) did not populate, so I have been shorting the wrong side.
Do it on the other side works.

thanks for feedback

max, Does this method work for Lenovo E14 G2?

[Mahesa09]

Hello everyone.

Here is the bypass solution for several Lenovo ECs.
This has worked on many ECs.
Only works if password is contained in EC

I succeeded on many models
https://www.badcaps.net/forum/troubl...86#post3217086
https://www.youtube.com/channel/UCeF...t_adKcguvynjeA

I shorten the LPC bus, with the LAD0:3 and Gnd.

you can use the dedicated ports where you connect directly to the track.
(Be careful, resistors may be missing on the path)
look at the diagrams

example x390 npce388


The communication being cut off, corrupted,
it cannot read information contained in EC and therefore continues.
then simply clean by rewriting after access.

Don't save with F10, just clean Pwd with enter twice.
If the serial, uuid etc. information is corrupted, you are saving the wrong information
Like the old way with sda/scl.

The method is delicate, there is always a risk of bricking or try failed.
ITE and Nuvoton is easy, Mec16 is more delicate (many try necessary).
Timing is important
watch videos to understand

works on Mec1633 / Mec1653 / Mec1663 / IT8186VG / IT5261VG / NPCE68B / NCPE288/388 and surely others

but my tests failed with the Mec1503
The LPC bus is no longer used, it has been replaced by eSPI

Attached some connection diagrams for tested models

Edit
-----------------------
EC PWD eeprom location

NCPE68B
Dmi start from 0x5C120 and 0x5D120
Pwd 0x5C420 - 0x5C56F and 0x5D420 - 0x5D56F replace with 00

NCPE288/388
Dmi start from 0x30000
Pwd
0x36000 - 0x3604F
0x36080 - 0x360CF
0x36100 - 0x3614F
0x36180 - 0x361CF
0x36200 - 0x3624F
0x36280 - 0x362CF
0x36300 - 0x3634F
0x36380 - 0x363CF
0x36400 - 0x3644F
0x36480 - 0x364CF
0x36500 - 0x3654F
0x36580 - 0x365CF
0x36600 - 0x3664F
0x36680 - 0x366CF
replace with 00

Mec1663 Dmi start from 0x00
Pwd 0x300 - 0x34F replace with FF

search for this shape

good info, this method works to lenovo e14 gen 2.
thanks you Maxpower3

[Usering]

The person ************************* who unlocked the ThinkPad Mec1503 , Mec1723 , NPCX997 and HP G11 posted this picture on his Facebook page of a new chip EC Nuvoton NPCX499H in the HP family and maybe even the new generation ThinkPad with an Ultra processor.

[Usering]

Do they have another way of programming io or do they have a different programmer that is not available in the market? Or what? Thanks to those who gave us information on this topic , I am very interested in this matter.

[zomi]

.Hardware method migrated to software patch.
thats my guess

[zomi]

https://github.com/skysafe/reblog/bl...word/README.md

[adamgouadma]

anyupdate about this model for remove password P15 Gen 1 NM-C651

[zomi]

https://www.badcaps.net/forum/troubl...46#post3257646


EPSI 101

p15 g1

[azanwaqas771]

anyupdate about this model for remove password P15 Gen 1 NM-C651

no anyupadte

[azanwaqas771]

https://www.badcaps.net/forum/troubl...46#post3257646


EPSI 101

p15 g1

not working with this method

[adamgouadma]

no anyupadte

Thank you, you are right, there is nothing

[adamgouadma]

Is there a way to read EC

[zomi]

Yes, ufpi supports it

[narsil]

Lenovo ThinkPad E16 gen 1
Is there a solution for the password?

[Maxpower3]

Lenovo ThinkPad E16 gen 1
Any help to solve it?

if LPC try 7/8/9/10
https://www.badcaps.net/forum/troubl...66#post3510066

or Espi not try