HP EliteBook 650 15.6 inch G10 Bios Unlock

[Mart1]

As spider300 and Arsch wrote, after flash thanks to HpMPM I can access BIOS but when I hit at 2nd boot 'reset security settings to defaults' => asks for administrator password

I've done as rex98 says:
First boot press f10 apply factory defaults and restart
2nd boot reset security settings to defaults and exit

The exactly here '2nd boot reset security settings to defaults' where it asks for administrator password.
hoaca388 do you have an idea maybe ?

HpMPm and UserCreds were patched (Even then patching didn't chaneg a thing it seems)
Or maybe spider300 or Arsch you found the issue ?

[Ahmed BerKani]

Hi it's still me I will send you the two files to unlock pass bios hp elitebook 650 G10 SN: 5CD409F31H

[Mart1]

my BIOS version is V74 Ver. 01.01.07
For my issue above I tried what mentionned by essaadi here:
https://www.badcaps.net/forum/troubl...44#post3738044

namely:
A) Replace "aa 55 3f" with "aa 55 3c" :

After : QP.o.w.e.r.C.o.n.t.r.o.l
After : QH.P._.R.u.n.t.i.m.e.B.B.C.h.e.c.k.P.o.l.i.c.y
After : f.f.l.i.n.e.U.n.i.q.u.e.I.D.E.K.P.u.b.C.R.C
After : QH.p.C.o.m.m.o.n.S.e.t.u.p
After : m-B.u.i.l.d.I.d and Before : F.a.c.t.o.r.y.C.o.n.f.i.g


B) Replace "00 00 00 00" with "23 01 00 02" : Exactly after : H.p.M.p.m....

When I hit at 2nd boot 'reset security settings to defaults' => asks for administrator password

Also rex98 I saw you worked on ElitBook 640 G10: https://www.badcaps.net/forum/troubl...e7#post3672293 about this specifq issue on (BID V75 ).
It seems a fix in EC is needed as you said (even my laptop differs a bit from 640G10 and BIV is v74). Can you explain more about this patch in EC ?

[rex98]

my BIOS version is V74 Ver. 01.01.07
For my issue above I tried what mentionned by essaadi here:
https://www.badcaps.net/forum/troubl...44#post3738044

namely:
A) Replace "aa 55 3f" with "aa 55 3c" :

After : QP.o.w.e.r.C.o.n.t.r.o.l
After : QH.P._.R.u.n.t.i.m.e.B.B.C.h.e.c.k.P.o.l.i.c.y
After : f.f.l.i.n.e.U.n.i.q.u.e.I.D.E.K.P.u.b.C.R.C
After : QH.p.C.o.m.m.o.n.S.e.t.u.p
After : m-B.u.i.l.d.I.d and Before : F.a.c.t.o.r.y.C.o.n.f.i.g


B) Replace "00 00 00 00" with "23 01 00 02" : Exactly after : H.p.M.p.m....

When I hit at 2nd boot 'reset security settings to defaults' => asks for administrator password

Also rex98 I saw you worked on ElitBook 640 G10: https://www.badcaps.net/forum/troubl...e7#post3672293 about this specifq issue on (BID V75 ).
It seems a fix in EC is needed as you said (even my laptop differs a bit from 640G10 and BIV is v74). Can you explain more about this patch in EC ?

upload your original locked main and ec here. i'll try to fix it. BID v74 is i think only 630 G10.

[Ahmed BerKani]

Hi sir, here are my two files with photos which show the serial number as well as the motherboard number and thank you very much for your help.

[rex98]

Hi sir, here are my two files with photos which show the serial number as well as the motherboard number and thank you very much for your help.

Use my post # 130 640 AND 650 G10 Have the same bios V75. just follow my instructions there Flash Both main and EC.
https://www.badcaps.net/forum/troubl...93#post3672293

[Mart1]

You did also this post in 650G10 : https://www.badcaps.net/forum/troubl...39#post3689039
where it seems you provided clean BIOS for 630/640/650 G10 in v74 & v75 family ROM.
Here is BIOS locked 630G10 file in attachements.

I'm mostly looking for how you patched instead of the unlock result itself.
As I understood in your post above you used stock bios from customer. ME Region in configured (so UnInitialized on the contrary to every specific bios dump from laptop). That's what makes it usable on all 630/640/650 series as it hasn't been tied to motherboard yet.
I also understood that password IS NOT stored in ME region so I doubt cleaning/cleaned ME region BIOS would solve my issue that at 2nd boot 'reset security settings to defaults' => asks for administrator password.

Then there is VSS/NVRAM region where I didn't look yet.
Then what's the patch ? Is it cleaned ME region, cleaned VSS/NVRAM/ another patch in EC ?
Thanks again for you wonderful work :-D !

[rex98]

You did also this post in 650G10 : https://www.badcaps.net/forum/troubl...39#post3689039
where it seems you provided clean BIOS for 630/640/650 G10 in v74 & v75 family ROM.
Here is BIOS locked 630G10 file in attachements.

I'm mostly looking for how you patched instead of the unlock result itself.
As I understood in your post above you used stock bios from customer. ME Region in configured (so UnInitialized on the contrary to every specific bios dump from laptop). That's what makes it usable on all 630/640/650 series as it hasn't been tied to motherboard yet.
I also understood that password IS NOT stored in ME region so I doubt cleaning/cleaned ME region BIOS would solve my issue that at 2nd boot 'reset security settings to defaults' => asks for administrator password.

Then there is VSS/NVRAM region where I didn't look yet.
Then what's the patch ? Is it cleaned ME region, cleaned VSS/NVRAM/ another patch in EC ?
Thanks again for you wonderful work :-D !

have you tried the v74 in my post? https://www.badcaps.net/forum/troubl...39#post3689039
here try flash both.

[Mart1]

The one you sent doesn't work, exact same behavior: 2nd boot 'reset security settings to defaults' => asks for administrator password
As I'm aware you patched thoses VSS entries in MAIN:

• TheftRecoveryFlags
• BatteryCTNumber
• HP_MUD
• BuildID
• FactoryConfig

You also overwrite UserCred VSS entry by a clean one, and activate H.p.M.p.m by replacing the target bytes to 23 01 00 02.
You patched only NvramActiveRegn in EC as I saw.

If I dump again, EC has it's NvramActiveRegn with data again it's not filled with 0xFF anymore.
I noticed there is also an NvramActiveRegn in Main. If patched to 0xFF laptop doesn't boot.
I didn't try the one from your post yet as I would like to fix my specific BIOS if possible before flashing a 'global' one https://www.badcaps.net/forum/troubl...e3#post3689039

[Mart1]

I burned by mistake one of the chip...Marking code is 'QqFOB' and is just above BIOS chip in QFN16 package.
Do you guys have any idea what chip could it be to replace it ?
I did create a topic on stackexchange juts in case... https://electronics.stackexchange.co...own-qfn16-chip

[SMDFlea]

https://www.badcaps.net/forum/troubl...02#post1538202