Lenovo ThinkBook 13s G2 ITL Bios

[DigitalDrifta]

Hi,

Wonder if someone could assist with my issue. I set my bios password a couple years ago and I can't remember it. I tried going through the guides but lost in the Hex editing of DMI Would really appreciate if someone could assist in clearing the password for me.

Lenovo ThinkBook 13s G2 ITL
Serial: PW03Z1CD
MTM: 20V900AXUK
Bios Version: F9CN51WW

Regards,
Steve

[Maxpower3]

Third time is the lucky charm hopefully. Dump with NeoProgrammer... Thanks!

try

[doctormasry]

try and report

[DigitalDrifta]

Hi, I tested the above but SctWinFlash64 didn't like it. I opened the bin you posted with a hex editor and can't find my serial in it? Was it generated from my dump and which tool did you use? Thanks!

hardware1 Looks like you've done this laptop model before, any advice?

[danito]

Hi,

Wonder if someone could assist with my issue. I set my bios password a couple years ago and I can't remember it. I tried going through the guides but lost in the Hex editing of DMI Would really appreciate if someone could assist in clearing the password for me.

Lenovo ThinkBook 13s G2 ITL
Serial: PW03Z1CD
MTM: 20V900AXUK
Bios Version: F9CN51WW

Regards,
Steve

It is 22mb. It should be 8mb or 16mb or 32mb ....
post the original bios of the laptop even if it is corrupted

[DigitalDrifta]

Thanks for the info danito . I dumped it with SctWinFlash64 from within Windows. Should I purchase a CH341A or T48 or could it be dumped via any other software?

[danito]

Thanks for the info danito . I dumped it with SctWinFlash64 from within Windows. Should I purchase a CH341A or T48 or could it be dumped via any other software?

yes

[volinakis]

Hi, I tested the above but SctWinFlash64 didn't like it. I opened the bin you posted with a hex editor and can't find my serial in it? Was it generated from my dump and which tool did you use? Thanks!

hardware1 Looks like you've done this laptop model before, any advice?

you have to read full content of bios chipset with a programmer. You only have bios region extracted with some bios backup tool.

[DigitalDrifta]

Thanks, I've ordered a CH431A and will post when I have a proper bios dump. Apologies, I thought I could use the Lenovo Bios tool to dump it

[DigitalDrifta]

After great difficulty I've managed to get a dump via CH431A and a PCBite! Hopefully it's are good! Would really appreaciate some assistance :-) Thanks in advance!

[Maxpower3]

Hi,

I set my bios password a couple years ago and I can't remember it.
Would really appreciate if someone could assist in clearing the password for me.

retry with SctWinFlash64

After great difficulty I've managed to get a dump via CH431A and a PCBite!

bad file

[DigitalDrifta]

What about the most recent post with the NEW dump? That bad as well?

[DigitalDrifta]

I'll have to dump it again via CH431A. I dumped it 3 times with SctWinFlash64 and they all matched the attached bios in the first post, also I'll have to reconstruct the laptop again to be able to use SctWinFlash64.

[Maxpower3]

What about the most recent post with the NEW dump? That bad as well?

[DigitalDrifta]

I'm guessing one or more Pogo pins weren't making any contact 🤔

[DigitalDrifta]

Third time is the lucky charm hopefully. Dump with NeoProgrammer... Thanks!

[Maxpower3]

Third time is the lucky charm hopefully. Dump with NeoProgrammer... Thanks!

try

[DigitalDrifta]

Thanks Maxpower3, I'll give it a go and then reassemble the laptop (not looking forward to that 😁 ). I've learnt a lot since joining this forum and would love to know how you found that particular offset 01046D5E? And how changing that one byte from 3F to 3C removes the password? I've tried some of the automated tools, but not seem to work. Thanks again for your efforts!

[DigitalDrifta]

That worked! Thank you so much Maxpower3! You\re amazing 🤯

In my hopes to continue learning, could you please teach a man to fish explain how you got to that offset or point me to a guide that explains this magic 😂

Thanks again, really appreciate it!

[Maxpower3]

That worked! Thank you so much Maxpower3! You\re amazing 🤯

In my hopes to continue learning, could you please teach a man to fish explain how you got to that offset or point me to a guide that explains this magic 😂

Thanks again, really appreciate it!

[DigitalDrifta]

Thanks, read through all those posts, and if my understanding is correct the solution is to invalidate the SaDatabase variable? Does changing the length of the stored password from 3F (63) to 3C (60) do that?