LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

[mactouch]

PASSWORD REMOVE THINKPAD P15 GEN 1
SN : PF-245326

[SMDFlea]

Maybe the EC bypass will work https://www.badcaps.net/forum/troubl...e4#post3257023

[Xargon1975]

Hello,

I have conducted multiple tests and arrived at the following conclusion, please correct me if I'm mistaken.
After patching the original BIOS on my T480 using Lenovo AutoPatcher, the system emits a melody and fails to initialize the display (black screen).
Reverting to the original BIOS dump allows the laptop to power on, but it remains locked.
Further investigation suggests a CRC32 checksum error in the modified BIOS. After correcting the checksum, the melody no longer occurs, but the system still fails to boot (persistent black screen followed by an automatic shutdown).
Could this issue be related to the TPM module?
What is the correct approach to resolve this?

Many thanks

[yuyuyak]

@Xargon1975
See my post, I spent 3-4 days and many hours to come to that successful solution. Especially if you have a newer bios. T480 pretty popular, bet you can find a dump somewhere, it's only to remove SVP and then you go back to your original bios. Be careful though and get the right one.

[Xargon1975]

@Xargon1975
See my post, I spent 3-4 days and many hours to come to that successful solution. Especially if you have a newer bios. T480 pretty popular, bet you can find a dump somewhere, it's only to remove SVP and then you go back to your original bios. Be careful though and get the right one.

Thank you very much, I'll try to find a BIOS that matches my computer, hope I can do it. I've been trying to unlock it for two weeks now.

[mick_ros]

Hi and thanks for the possibility, to fix a bios.
I got a t580 on my desk and after a lot of reading - sadly at first not about the ch341a and his 5 volt issue, instead i was able to read the bios and 3 dumps of the original file.
I used the software ch341a programmer. I used the software and the autopatcher within windos10 and the patch was succesful but not the writing back to the soic. Later i found out (thanks to your documentation), that the voltage at the data pins is to big and unstable. So i bought the raspberry pico RP2-B2 and pulled the source from pico-serprog, compiled it and can now use the pico to read / write the soic.

The patching with the script was successful and after the flashing and verification, the t580 did 4 reboots with a black screen. As suggested, i taped the 2 tamper buttons.
After the 4 reboots, i got the splashscreen to interupt the start process and tried to enter the bios, which gives me a black screen. Caps Lock / Num Lock is not reacting.
After a cold start, i tried again to enter the bios. This time, i got the "Entering Bios....." Message. The 5 dots cycled one time and in the second try, only 3 dots showing up.
So i disconnected the ssd did a cold start, this time, the "Entering Bios....." Message came back with 5 dots and now it's in this state.

Does anyone has an idea how to continue ?

Product 20LAS1PJ00
SN R90VRFEE

Regards

Mick

[SMDFlea]

flash the original bios back, see what happens

[lrservicios]

Hi all !!

I have a Lenovo X12 detachable laptop with supervisor password, i have svod3 programmer but i read in this forum i can make a short in some EC pins to erase this password, any idea wich pins i need to short or if anyone has tool to erase password from EC reading BIN ??

LENOVO ThinkPad X12 Detachable Gen 1 TYPE NUMBER: 20UV-S2Q100

Thank you in advance

[SMDFlea]

Hi all !!

I have a Lenovo X12 detachable laptop with supervisor password, i have svod3 programmer but i read in this forum i can make a short in some EC pins to erase this password, any idea wich pins i need to short or if anyone has tool to erase password from EC reading BIN ??

LENOVO ThinkPad X12 Detachable Gen 1 TYPE NUMBER: 20UV-S2Q100

Thank you in advance

Post your bios backup and Type the laptop serial number https://www.badcaps.net/forum/troubl...before-posting

[lrservicios]

Post your bios backup and Type the laptop serial number https://www.badcaps.net/forum/troubl...before-posting

Thanks for your response and effort but i suspect this model the password is stored in EC not in the BIOS, i have read that shorting some pins can clear password in EC but i dont know wich pins i need to short in this model, also i read about a floppy disk 1.44 with some LENOVO thinkpad low level utilities can clear this password

[Muhammedshafikc]

S/N R9-0N9053
45 SECONDS LATE DISPLAY

[peste]

S/N R9-0N9053
45 SECONDS LATE DISPLAY

post full name and model, motherboard model, etc.

[PMDev]

May I ask if this can also remove the power-on password? I mean I have a Lenovo ThinkPad T14 gen1 with AMD Ryzen 5 pro and with a power-on password. Can you please tell me how to remove it?

[PMDev]

May I ask if this can also remove the power-on password? I mean I have a Lenovo ThinkPad T14 gen1 with AMD Ryzen 5 pro and with a power-on password. Can you please tell me how to remove it?

Model is: ThinkPad T14 Gen1 with AMD Ryzen CPU, SN: PF-19L6K8, Motherboard: GT4A1 NM-C801 Rev.1.0, BIOS: winbond 250128JWSQ2033

[foxwdn]

[B]
A bit desperate, I tried something else, not really knowing what I was doing:

1. Downloaded the BIOS file shared by Stefan Steff on this thread (4th post) :
   https://www.badcaps.net/forum/troubl...20l8-bios-dump
2. Booted the PC with that BIOS file — it struggled a bit, rebooted once or twice, then asked for the Supervisor Password
3. Exported the BIOS from the chip again and compared it to the original Stefan Steff file — it had changed
4. Ran the autopatcher on this new BIOS file, then flashed the patched version to the chip
5. Followed the patch usage procedure:
     - Boot the machine
     - Press ENTER/F1/etc. to enter BIOS
     - Type any character for the Supervisor Password
     - Press Enter when the Hardware ID shows
     - Press Space twice when asked
     - Power off
6. Finally, I reflashed Stefan Steff's BIOS file — and voilà: no more Supervisor Password, and the PC works perfectly.

Don't ask me why I followed this exact process — I'm not sure myself — but it worked for me.

Hope it helps someone!

Thank you so much for the heads-up, basically copied your procedure, worked like a charm.
T480S, my board is20L8-S20Y00 (can't find it anywhere, weird).
BIOS chip is WINBOND 25Q128JVSQ (same one).
My story:
Got the board with older bios version 1.11 and probably didn't notice it was locked, so I proceeded, quite foolishly, with a BIOS update straight to 1.60 and was greeted with a supervisor password.
First thing I tried was reading and patching the already updated 1.60 bios image. This left me with no backlight, black screen and an annoying error beep code/melody, just as other people reported. And no, waiting didn't help.
After a bit of searching, found your post and decided to try it, and it worked!
I used flashrom and a CH341A programmer, soldered the chip on the adapter board (the clip is awful, basically impossible to get a good grip), backed up the flash with

flashrom -p ch341a_spi --progress -r orig_bios.bin

, downloaded same 1.27 bios dump from Stefan Steff, flashed it with

flashrom -p ch341a_spi --progress -w Stefans-bios.bin

(flashrom does erase and verify automatically), and booted up, which took the board about 5 tries.
Then I downloaded a patcher from Knucklegrumble, read the chip again and patched the resulting dump, then flashed it. The machine rebooted 5 times again, but this time the patch worked and I was able to successfully go through with it. Updated it afterwards with fwupdmgr, all good.
The only thing I'm not sure about if it's really necessary to boot the board with an old bios and then patch it, but wouldn't hurt to try, I guess.
TLDR: seems like the patcher only works on old BIOS versions, flash some old one before patching.
My guess it Lenovo did something with at some point in time which made the patch no longer functional on newer bios versions, which explains why so many people struggle with a black screen and beep codes on startup.
Sorry if something's wrong with the post, not good with forums, just wanted to share to possibly save someone from a headache.

[yuyuyak]

Thank you so much for the heads-up, basically copied your procedure, worked like a charm.
T480S, my board is20L8-S20Y00 (can't find it anywhere, weird).
BIOS chip is WINBOND 25Q128JVSQ (same one).
My story:
Got the board with older bios version 1.11 and probably didn't notice it was locked, so I proceeded, quite foolishly, with a BIOS update straight to 1.60 and was greeted with a supervisor password.
First thing I tried was reading and patching the already updated 1.60 bios image. This left me with no backlight, black screen and an annoying error beep code/melody, just as other people reported. And no, waiting didn't help.
After a bit of searching, found your post and decided to try it, and it worked!
I used flashrom and a CH341A programmer, soldered the chip on the adapter board (the clip is awful, basically impossible to get a good grip), backed up the flash with

flashrom -p ch341a_spi --progress -r orig_bios.bin

, downloaded same 1.27 bios dump from Stefan Steff, flashed it with

flashrom -p ch341a_spi --progress -w Stefans-bios.bin

(flashrom does erase and verify automatically), and booted up, which took the board about 5 tries.
Then I downloaded a patcher from Knucklegrumble, read the chip again and patched the resulting dump, then flashed it. The machine rebooted 5 times again, but this time the patch worked and I was able to successfully go through with it. Updated it afterwards with fwupdmgr, all good.
The only thing I'm not sure about if it's really necessary to boot the board with an old bios and then patch it, but wouldn't hurt to try, I guess.
TLDR: seems like the patcher only works on old BIOS versions, flash some old one before patching.
My guess it Lenovo did something with at some point in time which made the patch no longer functional on newer bios versions, which explains why so many people struggle with a black screen and beep codes on startup.
Sorry if something's wrong with the post, not good with forums, just wanted to share to possibly save someone from a headache.

I agree with you 100%, it's equally possible Lenovo did it inadvertently or intentionally, but whatever the case, it's what solved my problem too. I did the same as you, immediately on receipt of laptop I updated to the newest bios, like the old days. Those days are gone, I won't do that anymore. I got a good dump and patched it, it wouldn't work, 4 days, countless hours I spent on it. Then I downloaded an older bios, patched it and in one try, it removed the SVP. Then I put MY bios back on, all good.
So if you're getting the black screen, nothing happening thing, it's likely your problem too, find an older bios, patch and use it as the fixer, then you can put your known correct bios back on.

[MR KUJO]

hi pls help me to unlock ThinkPad Edge E595

SN: PF2FYWSC

SL10R25255

[MR KUJO]

hi pls help me to unlock ThinkPad Edge E595

SN: PF2FYWSC

SL10R25255

PLS THIS IS THE LOCK BIOS FILE

[Xargon1975]

I agree with you 100%, it's equally possible Lenovo did it inadvertently or intentionally, but whatever the case, it's what solved my problem too. I did the same as you, immediately on receipt of laptop I updated to the newest bios, like the old days. Those days are gone, I won't do that anymore. I got a good dump and patched it, it wouldn't work, 4 days, countless hours I spent on it. Then I downloaded an older bios, patched it and in one try, it removed the SVP. Then I put MY bios back on, all good.
So if you're getting the black screen, nothing happening thing, it's likely your problem too, find an older bios, patch and use it as the fixer, then you can put your known correct bios back on.

"Hi, I'm reading your post and you've given me a bit of hope.
Can someone share a BIOS for the T480 with a version earlier than 1.52, which is the one I currently have installed?"
My T480.
Type: 20L6-SDR213
Serial No: PF-14H8HB

[LatinMcG]

"Hi, I'm reading your post and you've given me a bit of hope.
Can someone share a BIOS for the T480 with a version earlier than 1.52, which is the one I currently have installed?"
My T480.
Type: 20L6-SDR213
Serial No: PF-14H8HB

try this one.
i believe its version

N27UJ16W

1.24 (N27ET38W)

or
1.06 (N27ET20W)

[yuyuyak]

Just about any hexedit type program will search for hex or ascii code for you, you'll find the version in there. Here's my 1.65 info embedded in the bios. The LENOVO just before is the only place, at least up until that point, where LENOVO appears in all caps in my bios, might be a good thing to look for if you're not sure of the bios version string you are searching for:

002365E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 DC 01 00 D4 00 02 00 00 00 CC 00 00 00 01 00 00 00 4C 45 ..................................LE
00236604 4E 4F 56 4F 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF NOVO................................
00236628 FF FF FF FF FF FF FF FF FF FF A0 9A FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 4E 31 55 45 54 39 31 .............................N1UET91
0023664C 57 20 28 31 2E 36 35 20 29 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF W (1.65 )...........................
00236670 FF FF FF FF 86 F1 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 30 37 2F 33 30 2F 32 30 32 34 00 FF ........................07/30/2024..
00236694 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 60 65 ..................................`e
002366B8 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 80 9A 09 7D 00 00 00 00 00 00 00 00 00 00 00 00 .......................}............
002366DC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 BE 4E 31 55 45 54 39 ..............................N1UET9
00236700 31 57 20 28 31 2E 36 35 20 29 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 1W (1.65 )..........................

Heh, (1. works well too. 😀
Just checked LatinMcG's bios, it's different. But the LENOVO all caps search is close to this ascii string N27HT23W. You can find many T480 bios dumps with badcaps search.

[gereonb]

Cheers. This lenovo-autopatcher worked great for Yoga 12. It does use the allservice.ru DXE but cleared the TPM/password.