LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

[asukabeh]

post your bios with serial number

okay, this is the code W25Q128BV and I have included the bios too, thank you for answering

[SMDFlea]

The laptop serial number, as required by the rules https://www.badcaps.net/forum/troubl...before-posting

[joger182]

Hi! I have superadmin pass. on bios. Can you help me?

lenovo p52
sn:pf-1838a0
EP520 NM-B562 Rev.1.0

I'm added 25Q80BL and MX25L25673G files to zip
Do I need to add more info?
For now I only have 3 flashes on power button when I connect power to laptop...

[Maxpower3]

Hi! I have superadmin pass. on bios. Can you help me?

lenovo p52
sn:pf-1838a0
EP520 NM-B562 Rev.1.0

Patch not work
see https://www.badcaps.net/forum/troubl...04#post3337104
or read EC

For now I only have 3 flashes on power button when I connect power to laptop...

Bad reading maybe it worked before

[Danny159]

Many thanks to Knucklegrumble and Maxpower3 for their efforts and of course to everyone who helps and teaches us.
Thank you very much!

[Andromedus_81]

Hello
Is it possible to clear the password to the bios using the auto patcher on the Lenovo ThinkPad E595 AMD Prosessor?
Type 20nf-s0th0q
s/n 2bf5q1

[Ahmed Izzeldin]

Hi ....its 2024 ...i have a lenovo x1 carbon gen 8 locked with Supervisor Password lock i am new to all this ....so how can i unlock it ....(dump my Bios , patch it and install the new patched bios) ? thanks in advance

[danito]

Hello
Is it possible to clear the password to the bios using the auto patcher on the Lenovo ThinkPad E595 AMD Prosessor?
Type 20nf-s0th0q
s/n 2bf5q1

Try

[Andromedus_81]

Thank You danito, but laptop is still dead. Nothing on the screen plus caps lock is on and fan is spinning too.

[Maxpower3]

Thank You danito, but laptop is still dead. Nothing on the screen plus caps lock is on and fan is spinning too.

hash mismatch, opened image may refuse to boot

retry mod

L0589601_PATCHED.rar


EDIT: SOLVED

[meyertechguy]

Hey this patch is working perfectly for removing the bios so, I was wondering if I could use this to remove the computrace?
I did try but when I try to patch the file CMD opens and closes right away and shows no sign of completing the process.
Can you help me in this matter please. Thanks

[poppay]

Hi guys i need patched bios for P50s

[SMDFlea]

RULES UPDATE for BIOS requests/offers AVOID BANNING, READ BEFORE POSTING
https://www.badcaps.net/forum/troubl...before-posting

You MUST:

• Provide the full machine model number, serial number (or Service tag, SNID) and the board model number (see https://www.badcaps.net/forum/showthread.php?t=88758 ) ,The serial number, make, full model number, motherboard model and revision (except QR codes) must be written/typed at your request as per the rules. Not as a picture, part of the file name and so on.

[jayakumar]

Hi guys i need patched bios for P50s

Try

[Andromedus_81]

Lenovo T495s 20QK
The first try didn't worked out and the bios beeped 5x times (wrong checksum). UEFITool revealed the wrong hash:

FfsParser::checkProtectedRanges: Phoenix protected range [BB0000h:F30000h] hash mismatch, opened image may refuse to boot
RelativeOffset: 00BB0000h Size: 380000h
Hash: 894F0EC4AAE777028ADC60150B10ECE724FC165E6530129DD6B56E45623192E6

With the help of HxD i calculated the SHA256 of above range and replaced the old hash with the new one (search the old hash and replace it with the calculated one with help of HxD). A boot with manipulated checksum and patched BIOS binary worked. Supervisor password was removed. Thank you very much!

Donation incomming (:

EDIT:

Output of patcher:

Using UEFIReplace to inject 2 DXE drivers...
[1/2] BootOption (GUID e0746c42-d3f9-4f8b-b211-1410957b9ff5)
[2/2] LenovoTranslateService (GUID 826bcf56-bac4-43f4-8ea1-8cdf0a121abd)

Looking for volumes to patch...
[1/1] NVRAM_EfiSystemNvDataFvGuid (checksum 2609h):
Found volume at offset 710000h (checksum 91f8h)
Volume checksum does not match... Skipping.​

Can anyone help how to generate the sha256 code and how to find the range in the HxD program please. Thank You

[Maxpower3]

how to generate the sha256 code and how to find the range in the HxD

[Andromedus_81]

Maxpower3 thank you.

[hach]

Hello,

My laptop is also blocked because I forgot my supervisor password.
It's an AMD P14s gen4 (serial PF54NMJB), I have another copy of exactly the same laptop.

My questions:
- I'm not sure how to dump/flash the bios, is it really a CH341A programmer that should be used?
- is it possible to read the bios of the laptop I know the password for and flash it on my other laptop? (they're exactly the same model).
- if not, what should I do?

Thanks for your help

[hoaca388]

Hello,

My laptop is also blocked because I forgot my supervisor password.
It's an AMD P14s gen4 (serial PF54NMJB), I have another copy of exactly the same laptop.

My questions:
- I'm not sure how to dump/flash the bios, is it really a CH341A programmer that should be used?
- is it possible to read the bios of the laptop I know the password for and flash it on my other laptop? (they're exactly the same model).
- if not, what should I do?

Thanks for your help

To flash the bios you need a programmer, not necessarily CH341A.
We do not recommend this because each device has its own DMI and Windown key.

[hach]

Thanks for your feedback, I ordered a CH341A programmer.

Concerning copying the bios from another laptop, I don't have an OEM windows key but serial numbers could be copied....

Would the following procedure work?
- dump the bios on my working laptop
- change the bios password
- dump the bios again
- do a diff to identify the area where the password is stored
- => modify this zone on the blocked laptop
I'm wondering whether there might be checksum or other issues, and if so, whether the autopatcher method might not be simpler.

[Maxpower3]

Thanks for your feedback, I ordered a CH341A programmer.

Concerning copying the bios from another laptop, I don't have an OEM windows key but serial numbers could be copied....

Would the following procedure work?
- dump the bios on my working laptop
- change the bios password
- dump the bios again
- do a diff to identify the area where the password is stored
- => modify this zone on the blocked laptop
I'm wondering whether there might be checksum or other issues, and if so, whether the autopatcher method might not be simpler.

password is stored in EC
not possible unlock via bios dump for this generation

[hach]

password is stored in EC
not possible unlock via bios dump for this generation

(edited, sorry I misread the thread)

if my understanding is correct, this means that for this model I need to work on dumping/flashing the EC and not the bios, i.e. with a program other than CH341A.
Can you confirm this?
If so, how do I dump the EC on this model?