LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Knucklegrumble
    Senior Member
    • Jun 2020
    • 78
    • US

    #1

    LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

    lenovo_autopatcher_0.2.zip Hello everyone!

    In the past several weeks I've learned a lot from this forum and its community especially from all the folks who contributed to THIS thread

    With some trial and error I was able to reliably patch BIOS dumps for SVP-locked Lenovo machines up to the 8th generation using the info, tools, and files provided on this forum. After some practice and positive feedback from users I helped I've noticed that, once learned, the process is fairly straightforward, so I've developed a small python script to automate it and allow everyone to patch their own binaries without having to ask for help and wait.

    This is my way to give back to the community. Also I am lazy... lol.

    DISCLAIMER
    1. THIS SCRIPT IS FREE AND IS INTENDED FOR EDUCATIONAL PURPOSES ONLY.
      You CAN download it, modify it, redistribute it, etc. I only ask that you DON'T sell it or try to make a profit from it, and that you please credit the authors for the time and work they put into it.
    2. I TAKE NO CREDIT FOR CREATING THE DXE DRIVERS OR ANY OF THE FILES THAT MAKE UP THE PATCH ITSELF.
      I've only developed the python script that automates the process and puts it all together.
    3. I TAKE NO RESPONSIBILITY FOR ANY DAMAGE YOU DO TO YOUR MACHINE, YOUR PETS, YOUR HOUSE, YOUR LIFE, AND THE SPACE-TIME CONTINUUM
      Making this kind of modifications is risky and might leave you with an unusable/broken machine.
      The script is not perfect by any means, and while I haven't bricked any hardware (yet) I can't promise that won't happen to you.
      USE IT AT YOUR OWN RISK.


    With that out of the way, using it is pretty simple and it should work on both Windows and Linux as long as you have Python installed https://www.python.org/downloads/.
    Just download the zip file and extract it. You'll get a folder named "lenovo_autopatcher" with the following content:



    IMPORTANT: Before applying the patch make sure you verify that your original image is not corrupted by dumping 1 or 2 additional images from your bios chip and comparing them. The original dump is THE ONLY WAY to recover your machine if something goes wrong!

    From command line use either autopatch.cmd (Windows) or autopatch.sh (Linux) as follows:

    autopatch <your_bios_image.ext>

    THAT'S IT!

    The command will generate either your_bios_image_PATCHED.ext or your_bios_image_PATCHED_CLEAN.ext depending on the type of BIOS you are patching. The original dump will be left unchanged.

    autopatch -h will output the help info for the command
    autopatch --howto will output the following instructions on how to use the patched image:

    [ HOW TO USE THE PATCH ]
    STEP 1: Flash and replace current BIOS with the generated patch file
    STEP 2: Boot the machine
    STEP 3: Press ENTER/F1/etc. to enter BIOS settings
    STEP 4: Enter any character when asked for Supervisor Password
    STEP 5: Press enter when it shows Hardware ID
    STEP 6: Press space bar 2x when asked
    STEP 7: Turn off machine
    STEP 8: Restore original BIOS
    STEP 9: Reset BIOS settings to factory default

    [ NOTES ]
    When booting the patched BIOS you might have to:
    - Hold the anti-tamper switch down the whole time (use tape)
    - Remove the hard disk or replace it with a locked one

    Finally, I would be grateful if you could report any bugs, errors, problems, or general feedback in this thread so that I can make improvements to the script.



    Thank you, and enjoy!

    Download -> https://www.badcaps.net/filedata/fetch?id=3166264
    Attached Files
    Last edited by SMDFlea; 03-16-2022, 12:16 PM.
  • Maxpower3
    Bad Veteran
    • Feb 2018
    • 1153
    • France

    #2
    Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

    thanks, good job, i will look at this. Doesn't that correct the checksum?

    Comment

    • Knucklegrumble
      Senior Member
      • Jun 2020
      • 78
      • US

      #3
      Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

      Originally posted by Maxpower3
      thanks, good job, i will look at this. Doesn't that correct the checksum?
      If you mean after switching the DXE drivers, it uses UEFIReplace to inject them, so that takes care of rebuilding the binary image.

      Now since you mention the checksum... Initially to verify that the image obtained using the autopatcher was the same as the one I'd manually patch I compared them using checksum and windiff but they never came up identical so I was concerned that the one generated through the script would not work. Turns out that when I patch a file manually using UEFITool I replace the 2 DXE drivers at the same time and let the program do it's thing in one pass. UEFIReplace however can only replace one driver at the time and it rebuilds the binary after each substitution. That somehow causes a few bytes to be different. I have tried replacing one driver at the time with UEFITool, save it reopen it and replace the other one and the resulting file is identical to the one generated by the autopatcher.

      Comment

      • Maxpower3
        Bad Veteran
        • Feb 2018
        • 1153
        • France

        #4
        Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

        If bios beeps at startup, the checksum is not corrected.
        I had the problem here and followed this tutorial

        But I failed to do a correct bios.

        https://www.badcaps.net/forum/showth...=65996&page=11

        https://www.insanelymac.com/forum/to...eps-on-lenovo/

        Comment

        • Knucklegrumble
          Senior Member
          • Jun 2020
          • 78
          • US

          #5
          Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

          Originally posted by Maxpower3
          If bios beeps at startup, the checksum is not corrected.
          I had the problem here and followed this tutorial

          But I failed to do a correct bios.

          https://www.badcaps.net/forum/showth...=65996&page=11

          https://www.insanelymac.com/forum/to...eps-on-lenovo/
          Ahh I see... I do not modify the checksum of the patched bios so I am assuming it WILL beep 5x... That should not prevent it from going through the process though and reset the TPM. After that you have to reload the original bios anyway which will have the correct checksum.

          Am I missing something?

          Comment

          • Maxpower3
            Bad Veteran
            • Feb 2018
            • 1153
            • France

            #6
            Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

            some machine does not work if not corrected, I think so


            you have tried a lot of models already?

            Comment


            • odenirandnl
              odenirandnl commented
              Editing a comment
              hello maxpower good morning boss. I cannot seem to find the autopatcher file for the lenovo file posted by knuclegrumble at the begining of this thread. i think the badcaps site reconstruction has affected it. I dint know if there is any advice you can give me
          • Knucklegrumble
            Senior Member
            • Jun 2020
            • 78
            • US

            #7
            Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

            Originally posted by Maxpower3
            some machine does not work if not corrected, I think so


            you have tried a lot of models already?
            I've tried 8-10 different models between 4th gen and 8th gen. All reported working. It would be interesting to see what people report using the autopatcher.

            Unfortunately I don't have that many SVP-locked Lenovo's on hand... lol

            Comment

            • Maxpower3
              Bad Veteran
              • Feb 2018
              • 1153
              • France

              #8
              Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

              if you compare an x240 with an L470, you notice that there is a blue part in uefi tools. you need to correct checksum for work.

              no need to patch each bios, the patched files are compatible in other machines. just need to create a library

              on the last gen, it is written twice (see pics)
              Attached Files

              Comment

              • Maxpower3
                Bad Veteran
                • Feb 2018
                • 1153
                • France

                #9
                Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                Originally posted by Knucklegrumble
                I've tried 8-10 different models between 4th gen and 8th gen. All reported working. It would be interesting to see what people report using the autopatcher.

                Unfortunately I don't have that many SVP-locked Lenovo's on hand... lol

                yes I will test as soon as I have the opportunity too

                Comment

                • Knucklegrumble
                  Senior Member
                  • Jun 2020
                  • 78
                  • US

                  #10
                  Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                  Originally posted by Maxpower3
                  if you compare an x240 with an L470, you notice that there is a blue part in uefi tools. you need to correct checksum for work.

                  no need to patch each bios, the patched files are compatible in other machines. just need to create a library

                  on the last gen, it is written twice (see pics)
                  Do you mean that if you correct the checksum then the file is compatible with different machines other than the original one?

                  Comment

                  • Maxpower3
                    Bad Veteran
                    • Feb 2018
                    • 1153
                    • France

                    #11
                    Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                    Originally posted by Knucklegrumble
                    Do you mean that if you correct the checksum then the file is compatible with different machines other than the original one?

                    the patched file is compatible with other pc "same model of course", with or without checksum
                    https://www.badcaps.net/forum/showthread.php?t=81573
                    Last edited by Maxpower3; 08-13-2020, 02:09 PM.

                    Comment

                    • Knucklegrumble
                      Senior Member
                      • Jun 2020
                      • 78
                      • US

                      #12
                      Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                      What's "List NOK with Patch files"?

                      Comment

                      • Maxpower3
                        Bad Veteran
                        • Feb 2018
                        • 1153
                        • France

                        #13
                        Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                        some model that doesn't work with just patched files.
                        It's been a long time since I looked at this, I don't remember very well

                        Comment

                        • Knucklegrumble
                          Senior Member
                          • Jun 2020
                          • 78
                          • US

                          #14
                          Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                          Originally posted by Maxpower3
                          some model that doesn't work with just patched files.
                          It's been a long time since I looked at this, I don't remember very well
                          Right. The autopatcher has 2 steps. On the first pass it injects the patched DXE drivers. If the bios is from an older gen it ends there and its work is done. If it's a newer generation on the second pass it replaces parts of the NVRAM with clean ones and then it's done. I've patched some of the ones you have listed in NOK and they all reported working.

                          Comment

                          • Maxpower3
                            Bad Veteran
                            • Feb 2018
                            • 1153
                            • France

                            #15
                            Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                            ok my error is the NVRAM and not the checksum then

                            Comment

                            • Knucklegrumble
                              Senior Member
                              • Jun 2020
                              • 78
                              • US

                              #16
                              Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                              Originally posted by Maxpower3
                              ok my error is the NVRAM and not the checksum then
                              Yeah that's the part that took me the longest to figure out... I had to piece together a lot of posts on several threads and compare a lot of original and patched files to figure out what I was missing. Those parts cannot be patched with UEFITool and are only visible with UEFITool NE. They need to be modified with an hex editor. The script does it for you.

                              Comment

                              • Maxpower3
                                Bad Veteran
                                • Feb 2018
                                • 1153
                                • France

                                #17
                                Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                                Yes ok I saw the 2 VSS2 and FTW. Why patched EVSA, it is identical to orignal?

                                Comment

                                • RethoricalCheese
                                  Badcaps Legend
                                  • Mar 2013
                                  • 1514
                                  • Estonia

                                  #18
                                  Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                                  Nice. Just unlocked about 30 Lenovos before you published this. Got to wait for the next batch to try this out. No need to copy from raspberry to work pc to patch files anymore.

                                  Comment

                                  • Knucklegrumble
                                    Senior Member
                                    • Jun 2020
                                    • 78
                                    • US

                                    #19
                                    Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                                    Originally posted by Maxpower3
                                    Yes ok I saw the 2 VSS2 and FTW. Why patched EVSA, it is identical to orignal?
                                    The EVSA was tricky...

                                    Without patching that the laptop plays a little musical tone after boot and the screen stays black...
                                    Attached Files
                                    Last edited by Knucklegrumble; 08-13-2020, 03:19 PM.

                                    Comment

                                    • Knucklegrumble
                                      Senior Member
                                      • Jun 2020
                                      • 78
                                      • US

                                      #20
                                      Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

                                      Originally posted by RethoricalCheese
                                      Nice. Just unlocked about 30 Lenovos before you published this. Got to wait for the next batch to try this out. No need to copy from raspberry to work pc to patch files anymore.
                                      Well I hope it works for you. Please report the results.

                                      Comment

                                      Related Topics

                                      Collapse

                                      • Vesko356
                                        [Guide] How to find the right HP bios version to flash
                                        by Vesko356
                                        First of all thanks to all of our members who have posted previously all methods posted here.
                                        Please leave a comment if you find something new,or have anything else to add.
                                        -----------------------------------------------------------------------------------------

                                        Find by serial number,model number or series

                                        If you know the laptop serial or model number go to HP support https://support.hp.com/us-en/drivers/laptops .
                                        Enter the serial number or model number and click submit.On the next screen you will have to enter the OS
                                        Operating system and OS version.If...
                                        08-11-2023, 03:27 AM
                                      • jbonavita
                                        ASUS TP500LA BIOS request/repair/merge?
                                        by jbonavita
                                        Hi, my laptop wont boot at all
                                        With original bios no POST, only LED lights
                                        With alternative BIOS from model TP500LN (flashed via programmer) the notebook works again
                                        Some issues
                                        A- with bios from 500LN, it won't update from bios of model 500LA (from 500LN v203 to 500LA v300)
                                        B- If updated from 500LN version 203 to 300, the battery stops being recognized

                                        Things I tried

                                        1- Update / clear ME: Took the non working bios, made a backup, and did this: https://www.badcaps.net/forum/troubl...theory/trouble...
                                        04-29-2025, 09:38 PM
                                      • zenius
                                        [REQUEST] Dell G3 3579 BIOS Password & AMI Protected Range/BIOS Guard Unlock
                                        by zenius
                                        Hello, I have an old Dell G3 3579 (ST: 2WQ7LP2-8FC8) with a newer 8FC8 BIOS password. I have successfully attached to the flash chip (W25Q128JVSQ) on the motherboard with a CH341A programmer and made several modifications using Intel FIT (e.g., allow software SPI write) without bricking. I was also able to boot to a modified GRUB shell where I attempted to edit many BIOS security related options like BIOS Guard/Lock, Flash Signature Override, ME FW Image Re-Flash, etc.

                                        Unfortunately, some of these modifications like to Intel BIOS Guard failed because it is fused into the PCH. Also,...
                                        12-08-2024, 06:13 AM
                                      • Wahaz
                                        Lenovo Thinkbook 15 G2 ITL i5 (serial number: MP2BFZEF) bios request
                                        by Wahaz
                                        Hello,

                                        I have a Lenovo Thinkbook 15 G2 ITL i5 Laptop (serial number: MP2BFZEF) that when I turn it on, the led on the power button lights up for 5 seconds, then goes out. There's no display and nothing happens.
                                        So I thought it was a Bios problem.
                                        I found 3 bios chips on the board, which I read with a bios programmer: two XMC model bios chips and a Winbond model bios chip. Each XMC model bios chip has two partitions named XM25QH128A [3.3V] and XT25F128A [3.3V]. And the Winbond model bios chip has three partitions named W25Q80BL 3.3V, W25Q80xV 3.3V and W25Q80DV 3.3V....
                                        10-30-2023, 08:42 PM
                                      • Bloodhoundje
                                        HP Pavilion Gaming Laptop 15-ec2523nd - Dimm2 slot disabled after corrupt bios repair? Advice requested.
                                        by Bloodhoundje
                                        Hi everyone,

                                        I have been doing hardware repair as a hobby for some years now and recently decided to learn about repairing laptops as a fun challenge.

                                        I managed to get my hands on a "HP Pavilion Gaming 15-ec2523nd" notebook that only shows a white power LED and doesnt respond to anything.

                                        After initial testing I concluded the bios seems to be corrupted since all voltages are normal and there are no shorts. HP has a feature for a bios restore from USB with winkey+B for this model. This did not work.

                                        I have desoldered the bios chip (GigaDevice...
                                        03-16-2024, 03:12 PM
                                      • Loading...
                                      • No more items.
                                      Working...