Lenovo ThinkPad L14 Gen 4 - Supervisor Password Request

[s.izadbakhsh]

Hi everyone,

I am requesting assistance with a Lenovo ThinkPad L14 Gen 4 laptop that has a BIOS Password.

I checked the motherboard, and the onboard EC chip is a Nuvoton NPCX997KAABX (ThinkShield). I do have an RT809H programmer with the specialized Keyboard Test Board interface ready for ISP flashing, but this specific new-generation Nuvoton chip is currently not supported for direct EC reading/writing in the software list.

Consequently, I have desoldered the main BIOS chip (MX25L12872FM2I-10G) and taken a verified, clean 16MB dump using a socket adapter on my RT809H.

Here are the exact specifications required by the forum rules:

• Laptop Model: ThinkPad L14 Gen 4 (21H1-003DGE)
• Serial Number: PW-06HVRL
• Motherboard Model: LG4 LT5 RPL RT UMA MB 8L 223042-1 (448.0SJ41.0011)
• Problem: BIOS Password locked.

I have attached the original 16MB BIOS dump directly to this post. Any help in patching this file to remove the password would be highly appreciated.

Thank you!

[Sparo]

Hi everyone,

I am requesting assistance with a Lenovo ThinkPad L14 Gen 4 laptop that has a BIOS Password.

I checked the motherboard, and the onboard EC chip is a Nuvoton NPCX997KAABX (ThinkShield). I do have an RT809H programmer with the specialized Keyboard Test Board interface ready for ISP flashing, but this specific new-generation Nuvoton chip is currently not supported for direct EC reading/writing in the software list.

Consequently, I have desoldered the main BIOS chip (MX25L12872FM2I-10G) and taken a verified, clean 16MB dump using a socket adapter on my RT809H.

Here are the exact specifications required by the forum rules:

• Laptop Model: ThinkPad L14 Gen 4 (21H1-003DGE)
• Serial Number: PW-06HVRL
• Motherboard Model: LG4 LT5 RPL RT UMA MB 8L 223042-1 (448.0SJ41.0011)
• Problem: BIOS Password locked.

I have attached the original 16MB BIOS dump directly to this post. Any help in patching this file to remove the password would be highly appreciated.

Thank you!

Hi, The password is in the NPCX997KAABX chip. You'll need an SVOD4 or Vertyanov programmer to read it

[s.izadbakhsh]

Hi, The password is in the NPCX997KAABX chip. You'll need an SVOD4 or Vertyanov programmer to read it

Unfortunately, I do not have access to an SVOD4 or Vertyanov programmer, and buying one for a single job isn't feasible right now. Since I have a verified, clean 16MB dump of the main BIOS chip ready, is there anyone here who can manually patch or modify this dump to trigger an EC reset on the next boot for this specific LG4 LT5 board? I would really appreciate any help with the BIOS file.

[Sparo]

Unfortunately, I do not have access to an SVOD4 or Vertyanov programmer, and buying one for a single job isn't feasible right now. Since I have a verified, clean 16MB dump of the main BIOS chip ready, is there anyone here who can manually patch or modify this dump to trigger an EC reset on the next boot for this specific LG4 LT5 board? I would really appreciate any help with the BIOS file.

The BIOS patch is only applicable to machines up to 8th generation
You have a 13th Generation Intel® Core™ i5-1335U Processor (Core™ i5-1335U)

[s.izadbakhsh]

The BIOS patch is only applicable to machines up to 8th generation
You have a 13th Generation Intel® Core™ i5-1335U Processor (Core™ i5-1335U)

Thank you for the clarification about the 13th Gen limitation. Since patching the 16MB BIOS dump is out of the question, I wanted to ask: Does the RT809H programmer have any capability (or alternative pinout/method) to read or clear this Nuvoton NPCX997KAABX chip directly? Or is it absolutely impossible to handle this specific generation of ThinkShield with the RT809H?"

[s.izadbakhsh]

Also, to add more context about the current state of the laptop: Secure Boot is turned ON in the BIOS.

Because of this, I am completely locked out of booting into any OS. Even when I take the NVME out, install Windows on it using another computer, and put it back into this ThinkPad, the system blocks it and refuses to boot. Since the Supervisor Password is locked, I cannot turn off Secure Boot or change the boot priority.

My question is: Even if removing the password from the 16MB BIOS dump is impossible for 13th Gen, is there any way to modify this BIOS dump just to force Secure Boot to OFF? If we can just disable Secure Boot via the dump, at least I can get the OS to boot.

[Sparo]

Thank you for the clarification about the 13th Gen limitation. Since patching the 16MB BIOS dump is out of the question, I wanted to ask: Does the RT809H programmer have any capability (or alternative pinout/method) to read or clear this Nuvoton NPCX997KAABX chip directly? Or is it absolutely impossible to handle this specific generation of ThinkShield with the RT809H?"

Unfortunately, The CH341A and RT809H don't support that chip, Read this thread > SVOD4 NPCX997 - Badcaps
Also, That EC backup is needed to remove the SVP password and allow access to settings like Secure Boot or others

[s.izadbakhsh]

Unfortunately, The CH341A and RT809H don't support that chip, Read this thread > SVOD4 NPCX997 - Badcaps
Also, That EC backup is needed to remove the SVP password and allow access to settings like Secure Boot or others

Understood. Thank you for the detailed information regarding the SVOD4 and the NPCX997 chip.

Just as a final alternative to get the machine working temporarily: Is it absolutely impossible to modify the NVRAM or default boot settings inside the main 16MB BIOS dump to force Secure Boot to OFF?

I don't mind if the password stays locked for now, I just need to find a way via the main BIOS dump to bypass the Secure Boot block so I can boot an operating system. Is there any trick to change just that specific setting in the 16MB file?

[Sparo]

Understood. Thank you for the detailed information regarding the SVOD4 and the NPCX997 chip.

Just as a final alternative to get the machine working temporarily: Is it absolutely impossible to modify the NVRAM or default boot settings inside the main 16MB BIOS dump to force Secure Boot to OFF?

I don't mind if the password stays locked for now, I just need to find a way via the main BIOS dump to bypass the Secure Boot block so I can boot an operating system. Is there any trick to change just that specific setting in the 16MB file?

I understand but I don't think it's possible to successfully alter those UEFI variables (SecureBoot, SetupMode, PK, etc.)
since those NVRAM variables, and the region itself, are likely checksummed/cryptographically signed on these generations

Instead, try using a clean, valid Windows installation in UEFI/GPT mode on another machine (Secure Boot requires GPT, not MBR)
When you reach the drive selection screen, delete all existing partitions and let Windows recreate them so it properly builds the ESP
And see if the resulting bootmgfw file (Microsoft-signed) is trusted by Secure Boot by default. You can try it, there's nothing to lose anyway

Or you can try using tools like this one > ValdikSS/Super-UEFIinSecureBoot-Disk: Boot any OS or .efi file without disabling UEFI Secure Boot · GitHub

[Racso_Rome]

Greetings everyone, I'm looking for a BIOS patch for an NCPX977 for a ThinkPad L14 Gen 4 with a BIOS password. I only have the model number because the stickers are no longer legible, making it difficult to read the model and serial number.
I've attached the binary file. Thanks in advance.

[SMDFlea]

Post merged.

[Sparo]

Greetings everyone, I'm looking for a BIOS patch for an NCPX977 for a ThinkPad L14 Gen 4 with a BIOS password. I only have the model number because the stickers are no longer legible, making it difficult to read the model and serial number.
I've attached the binary file. Thanks in advance.

Hi, The Serial Number is PW08SC16

[Gbolahan John o]

Please sir, help me unlock this Ec file. I have tried unlock it on my own and I'm getting bad SVP error.
Model - Lenovo L14 Gen 4
Part No - LG4 LT5 2 AMD 8L 223024-2
S/N - PW-0ESJ6G
Type Number - 21H6-S34W1N

[shiyab]

Please sir, help me unlock this Ec file. I have tried unlock it on my own and I'm getting bad SVP error.
Model - Lenovo L14 Gen 4
Part No - LG4 LT5 2 AMD 8L 223024-2
S/N - PW-0ESJ6G
Type Number - 21H6-S34W1N

hi try

[Gbolahan John o]

hi try

Thank you for your response, I tried with the Ec file you sent for me but the password is still present. The password is not removed

[valtic]

Thank you for your response, I tried with the Ec file you sent for me but the password is still present. The password is not removed

try

[Gbolahan John o]

try

Thanks you, I got bad SVP error. Then I restor the security to defaults and it work okay. Thank you

[Stefan Steff]

Thanks you, I got bad SVP error. Then I restor the security to defaults and it work okay. Thank you

I have missed the end of the message...I'm glad it's working.