LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

[bear_2007]

Does this it have a model number ? .Does it start if you flash the old bios back

After the patcher, it stopped starting at all, I tried the saved lamps, it doesn't work...

[SMDFlea]

Dump original

Post the laptop serial number and your EC backup

[bear_2007]

Я одразу прочитав дамп BIOS, а EC — лише після того, як перепробував many options BIOS з форумів. I immediately read the BIOS dump, and the EC only after trying many BIOS options from the forums.

[bear_2007]

Я одразу прочитав дамп BIOS, а EC — лише після того, як перепробував many options BIOS з форумів. I immediately read the BIOS dump, and the EC only after trying many BIOS options from the forums.

still svod 4 reads EC, but doesn't want to wipe

[mariusdumi]

Test this patched file.

Thanks for sharing.
I tried the file you shared,
I wrote it and verified it was written correctly.

It has the same problem as above: it beeps 5 times twice, the fans spin for a few seconds, and then shuts down. No signal.

rewriting my original, it goes back to how it was before with the password.

[floppy1]

Your model can be unlock if you provide 2kb file EEPROM container from MEC1663
No main BIOS patch available for your model

ok, thanks

[mouse1972]

Hello friends! I used autopatcher, rewrote the patched file in the bios, but as a result, when I press the power button, it blinks 3 times. Then nothing happens. Can someone help?
Laptop Lenovo P50
Type 20EQ
Serial MJ-04TPLT

[Stefan Steff]

Hello friends! I used autopatcher, rewrote the patched file in the bios, but as a result, when I press the power button, it blinks 3 times. Then nothing happens. Can someone help?
Laptop Lenovo P50
Type 20EQ
Serial MJ-04TPLT

Try with this attached content.

STEP 1: Flash and replace current BIOS with the P50_Bios_2_PATCHED.bin file
STEP 2: Boot the machine
STEP 3: Press ENTER/F1/etc. to enter BIOS settings
STEP 4: Enter any character when asked for Supervisor Password
STEP 5: Press enter when it shows Hardware ID
STEP 6: Press space bar 2x when asked
STEP 7: Turn off machine
STEP 8: Restore original P50_Bios_1.bin BIOS content
STEP 9: Reset BIOS settings to factory default

Good luck!

[ofluffy]

This has bricked my T470s, great. Now the power button and keyboard flicker and it won't come on fully at all.

[ofluffy]

Flashing both chips back to their original states doesn't even fix it, it no longer boots at all after trying the PXE driver injector method...

[Stefan Steff]

Flashing both chips back to their original states doesn't even fix it, it no longer boots at all after trying the PXE driver injector method...

Please provide a serial number and model number.
Let's try to fix your laptop

[ofluffy]

Please provide a serial number and model number.
Let's try to fix your laptop

It's a 2017 T470s

I think the original serial number stickers were replaced, all I can find is:
Type 20HG-S14D00 and S/N PC-OPTLL4 17/09

[Stefan Steff]

It's a 2017 T470s

I think the original serial number stickers were replaced, all I can find is:
Type 20HG-S14D00 and S/N PC-OPTLL4 17/09

OK, that's good. (PC0PTLL4 with "zero" after letter C.
The 25Q80 chip is your PD controller SPI so must be untouched and write it back as is.
Write the content from the attachment and tell me if it works or not.
It's tested by me on several T470s laptops.

[ofluffy]

OK, that's good. (PC0PTLL4 with "zero" after letter C.
The 25Q80 chip is your PD controller SPI so must be untouched and write it back as is.
Write the content from the attachment and tell me if it works or not.
It's tested by me on several T470s laptops.

I flashed it just now, it still does the same thing. The keyboard and power button light up briefly then it shuts off. This happens once when power is plugged in, then it is unresponsive until unplugged and plugged back in once more.

[Stefan Steff]

I flashed it just now, it still does the same thing. The keyboard and power button light up briefly then it shuts off. This happens once when power is plugged in, then it is unresponsive until unplugged and plugged back in once more.

OK.
I see some differences between your PD Controller backup and what I have saved on my PC.
So here is mine to try.

[ofluffy]

OK.
I see some differences between your PD Controller backup and what I have saved on my PC.
So here is mine to try.

Flashed that to the pd chip, same result... Not sure what on earth is going on. This all started after trying to use the auto patcher...

[Stefan Steff]

Flashed that to the pd chip, same result... Not sure what on earth is going on. This all started after trying to use the auto patcher...

Do you use clips to flash the chips or you desolder them ?
Check for missing or damaged components near the BIOS chip.
If programming different versions of BIOS did not result in different behavior most likely you have a hardware issue...

[ofluffy]

Do you use clips to flash the chips or you desolder them ?
Check for missing or damaged components near the BIOS chip.
If programming different versions of BIOS did not result in different behavior most likely you have a hardware issue...

Yes I used SOIC8 clip with CH341a programmer. Didn't happen until I went through the bios unlock process listed on the lenovo autopatcher. It showed the usual PXE driver screen, turned off, I flashed the original like it said to, then it wouldn't turn on. I'll inspect the board.

After looking, I don't see any damaged connections or missing pieces, or any significant activity on thermal camera. However, I did just notice that once powered on, the fan continues to spin and stop, over and over like it's continuously trying and failing to boot. I've attached pictures of the rom chips, maybe I missed something.

[Stefan Steff]

Yes I used SOIC8 clip with CH341a programmer. Didn't happen until I went through the bios unlock process listed on the lenovo autopatcher. It showed the usual PXE driver screen, turned off, I flashed the original like it said to, then it wouldn't turn on. I'll inspect the board.

After looking, I don't see any damaged connections or missing pieces, or any significant activity on thermal camera. However, I did just notice that once powered on, the fan continues to spin and stop, over and over like it's continuously trying and failing to boot. I've attached pictures of the rom chips, maybe I missed something.

It's very tricky to use clips...must be careful and check the reading/writing at least 2 or 3 times to be sure it's done correctly...
As a last try ... here is the EC content.

I hope you can and know how to use JTAG to read/write the MEC1653. (You find plenty of examples here on badcaps how to prepare the MB and use the JTAG to read/write MEC chips...
An example: https://www.badcaps.net/forum/troubl...lock#post74632)

I don't know about the MEC1653 but the MEC1633 has an internal 2Kb EEPROM in witch is the password stored so if this is true for MEC1653 then rewriting the EC content may help to bring your laptop back to life.(without clearing the password...)
Also, I don't use CH341a (I use SVOD4 and before SVOD I used JTAG programming with RT809H) so I don't know if it supports JTAG programming...
In conclusion, what I would do:
1.- Write the 25Q80 with the original backup content
2.- Write the 25Q128 with Thinkpad T470s-Type 20HG.bin
3.- Write the MEC1653 with T470s_MEC1653.bin via JTAG (attached)

If it's starts then patch the Thinkpad T470s-Type 20HG.bin file and follow the instructions.
Write back your saved BIOS backup file or write back the Thinkpad T470s-Type 20HG.bin and make a BIOS update.
Good Luck!

[ofluffy]

It's very tricky to use clips...must be careful and check the reading/writing at least 2 or 3 times to be sure it's done correctly...
As a last try ... here is the EC content.

I hope you can and know how to use JTAG to read/write the MEC1653. (You find plenty of examples here on badcaps how to prepare the MB and use the JTAG to read/write MEC chips...
An example: https://www.badcaps.net/forum/troubl...lock#post74632)

I don't know about the MEC1653 but the MEC1633 has an internal 2Kb EEPROM in witch is the password stored so if this is true for MEC1653 then rewriting the EC content may help to bring your laptop back to life.(without clearing the password...)
Also, I don't use CH341a (I use SVOD4 and before SVOD I used JTAG programming with RT809H) so I don't know if it supports JTAG programming...
In conclusion, what I would do:
1.- Write the 25Q80 with the original backup content
2.- Write the 25Q128 with Thinkpad T470s-Type 20HG.bin
3.- Write the MEC1653 with T470s_MEC1653.bin via JTAG (attached)

If it's starts then patch the Thinkpad T470s-Type 20HG.bin file and follow the instructions.
Write back your saved BIOS backup file or write back the Thinkpad T470s-Type 20HG.bin and make a BIOS update.
Good Luck!

Can you send a link to a decent one? I don't have a JTAG programmer. I have heard of it though, but I usually avoid it and use UART with my raspberry pis, since I've only ever used it for serial debugging/console.