HP 15s-fq2230nd bios

**peste** · 11-08-2025, 04:36 AM

Originally posted by rev3rse

Hi guys,

I am actually repairing a laptop. Ofc it's locked.
And I posted for help .... like an idiot on a Dell thread. Why ? Because I've put the laptop on a shelve ... and forgot about it for months. I tought it's a DELL not an HP until i've seen the screen.

I used all this time the WRONG tools. All dell ... I tried BadCaps patcher, and the patcher from github that combines all tools together (DellBiosTools 2.5) ...

Usually I manage to fix these problems. I've read the rules and I must say that I tried everything. I tried replacing blocks using UEFITool ... but I am sick of soldering / unsoldering the BIOS from the board --- onto the adapter (for programming in my Rutronix Baghero programmer).
I have multiple dumps, all match (to be sure).

So ... I don't knot what to do next. maybe try to replace blocks with uefitool until I "shotgun" the result ?

This thing is making me pull my hair out. If someone could help with something that's "unknown" or not public to me I would be grateful.

Model: 15s-fq2230nd
Prod Id: 39Z84FA#ABH
Serial Number: 5CD1201WF0

The dump is attached (and I am quite sure it's fine. Dumped several time and fc the files.)

Thank You for your time !
Popte.

you have everything you need at post #5...087FD
https://www.badcaps.net/forum/troubl...ighlight=087FD

**rev3rse** · 11-08-2025, 09:42 AM

Peste, Thank You. I already tried the bios from the website ... I already had 087FD.bin (but ofc I didn't have DMI). I had no serial number ... not mac I think ... and no storage was working.
Thank you so much for clarifying how to transfer those.

I opened HxD - opened both files - and I went to the offsetts you mentioned in post 5 (with Edit-> Select Block) - and copy / paste write both sections into the bios from the website.
Getting the chip off now - and flashing again.

Thank You for helping me. Really apreciated.

I will let you know how it goes by editing this post after I desolder (for the 20th time) the chip - flash it - and put it back.

Popte.

EDIT: OK, I did that. I am sure that I copy / pasted only that area. The laptop starts - complains about a wrong checksum - restarts. Then it is saying that "Manufacture programming mode is in unlock mode" . And when trying to enter BIOS - still asks for a password. Is the password saved in the same DMI area offset 801000 - 8020FF ? What did I do wrong ?

**rev3rse** · 11-08-2025, 11:38 AM

YES. Thank You Peste for your help.

I did the following: I flashed a CLEAN and unaltered 087FD.bin (from the website, not DMI data, not WINKEY nothing. Clean.)
Sure that the laptop didn't work, no SSH ... no DMI ... but I went into bios and set up a password: "1234"
I dumped the flash again -and compared the 087FD.bin with the one that I dumped ONLY with password.
I pasted the difference in the ORIGINAL DUMP with the locked bios . I had NO errors and I can enter the bios with password "1234".

So to sum up :

The offset space for PASSWORD is: 802020 -> 80203F

if you replace that space with:

47 CA 8C AF B8 E0 EC EB AB 31 C1 7B CA 8E 89 C9 02 04 30 CF 5E 85 16 A1 60 BD AF 27 99 5B 6B 14

The password is 1234.

Thank you again for pointing me to the right direction !

Have a GREAT week-end !
Popte.

**rev3rse** · 11-08-2025, 02:02 PM

Here's a short code that will DECRYPT your BIOS password (works for my model).
DUMP the BIOS - and copy / paste the blob contained at address space: 802020 -> 80203F , then execute. You should get the password in clear text.

from Crypto.Cipher import AES
import binascii

# Your blob (32 bytes = IV + ciphertext)
blob = binascii.unhexlify("BF6FFE139B4788F23CB30531F71A84E7EEA327E0D31881EE4D6B740FCBE7F3A6")

# HP BIOS static AES key
key = binascii.unhexlify("A41D273F5E9B12C68F03D74A91B5E20C")

# Split IV and ciphertext
iv = blob[:16]
ciphertext = blob[16:]

# Decrypt
plain = AES.new(key, AES.MODE_CBC, iv).decrypt(ciphertext)

# Print password (strip NULs)
print(plain.split(b'\x00')[0].decode())
# Output: 12345678

Help this helps someone.

If you don't want to go through any trouble, just replace the blobs with:

47 CA 8C AF B8 E0 EC EB AB 31 C1 7B CA 8E 89 C9 1F 8B 8A 5D 0E 9F 6C 0F 7A 5E 1A 8E 0C 7B 5F 1A - > password is "abc"
BF 6F FE 13 9B 47 88 F2 3C B3 05 31 F7 1A 84 E7 EE A3 27 E0 D3 18 81 EE 4D 6B 74 0F CB E7 F3 A6 -> password is "12345678"
47 CA 8C AF B8 E0 EC EB AB 31 C1 7B CA 8E 89 C9 02 04 30 CF 5E 85 16 A1 60 BD AF 27 99 5B 6B 14 -> password is "1234"

Popte.

**m1ch43lzm** · 11-08-2025, 05:47 PM

Thanks for figuring out the password encoding

, I would have done this (this works for HP consumer laptops with AMI BIOS):

1. Search for AMITSESetup/HPAmiTse, you'll find BF 6F FE 13 9B 47 88 F2 3C B3 05 31 F7 1A 84 E7 EE A3 27 E0 D3 18 81 EE 4D 6B 74 0F CB E7 F3 A6 (your BIOS setup password, the boot/user password is 00 00 00... in your case, no password)
2. Search in hex for the value you obtained in step 1
3. Replace all instances with 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00. including from 802000-80203F (at the end of the DMI area), password is gone

**m1ch43lzm** · 11-08-2025, 08:21 PM

Tested with Python 3.13.5 and pycryptodome 3.23.0, your example doesn't work

Code:

C:\bios>hppasss2.py
Traceback (most recent call last):
  File "C:\bios\hppasss2.py", line 18, in <module>
    print(plain.split(b'\x00')[0].decode())
          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xce in position 3: invalid continuation byte

HP 15s-fq2230nd bios

HP 15s-fq2230nd bios

Comment

Comment

Comment

Comment

Comment

Comment

Related Topics