LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

[mariusdumi]

Test this second version if you still need , let me know.

Hi, this file boots the PC.

I follow this procedure, but I get stuck at step 5.
When the hardware ID appears, whatever I do is invalid password.

I can't proceed.

STEP 1: Flash and replace current BIOS with the P50_Bios_2_PATCHED.bin file
STEP 2: Boot the machine
STEP 3: Press ENTER/F1/etc. to enter BIOS settings
STEP 4: Enter any character when asked for Supervisor Password
STEP 5: Press enter when it shows Hardware ID
STEP 6: Press space bar 2x when asked
STEP 7: Turn off machine
STEP 8: Restore original P50_Bios_1.bin BIOS content
STEP 9: Reset BIOS settings to factory default


I tried restoring my original file, but the password isn't removed.

The HARDWARE ID changes with every boot.

[moadb]

Any idea if this will work on a P14s G5?

[Stefan Steff]

I ordered the one you sent, however I've noticed something. Underneath the black "tape" around the motherboard, I found a messed up chip. There is one wider chip near the Ethernet port that is cracked and has exposed copper coils! I looked into it some, if this is shorting out I think it may be causing my issue. I'd like to have the programmer anyway, but this might be the real issue with my laptop. I hadn't considered hardware damage because it was powering on fine before, but I believe I may have jolted it slightly which caused a short in the chip. I think removing it entirely should stop the short, it would just prevent the RJ45 from functioning. Thank you for your help! I'll come back here if it's not that chip and still doesn't boot.

OK.
Rewriting the EC chip must be the last try if any else isn't working .
A very good hardware check before it's also a good idea...
Good Luck!

[ofluffy]

I think RT809H is the best price/value in this category...in fact every programmer has good and bad things but to use it once or twice a year then RT809H is a good choice.
In US you find a lot of RT809H programmers on Amazon or eBay. (ex. https://a.co/d/eUE6vcB)
Look for RT809H not for RT809F !

I ordered the one you sent, however I've noticed something. Underneath the black "tape" around the motherboard, I found a messed up chip. There is one wider chip near the Ethernet port that is cracked and has exposed copper coils! I looked into it some, if this is shorting out I think it may be causing my issue. I'd like to have the programmer anyway, but this might be the real issue with my laptop. I hadn't considered hardware damage because it was powering on fine before, but I believe I may have jolted it slightly which caused a short in the chip. I think removing it entirely should stop the short, it would just prevent the RJ45 from functioning. Thank you for your help! I'll come back here if it's not that chip and still doesn't boot.

[mouse1972]

brother please helpme,please send patch t470p ,i have problem bios password

Try this.

[Sidqi Januar Riadi]

Test this second version if you still need , let me know.

brother please helpme,please send patch t470p ,i have problem bios password
s/n:R90VGF3G

[Karol]

Thanks for sharing.
I tried the file you shared,
I wrote it and verified it was written correctly.

It has the same problem as above: it beeps 5 times twice, the fans spin for a few seconds, and then shuts down. No signal.

rewriting my original, it goes back to how it was before with the password.

Test this second version if you still need , let me know.

[mouse1972]

Try with this attached content.

STEP 1: Flash and replace current BIOS with the P50_Bios_2_PATCHED.bin file
STEP 2: Boot the machine
STEP 3: Press ENTER/F1/etc. to enter BIOS settings
STEP 4: Enter any character when asked for Supervisor Password
STEP 5: Press enter when it shows Hardware ID
STEP 6: Press space bar 2x when asked
STEP 7: Turn off machine
STEP 8: Restore original P50_Bios_1.bin BIOS content
STEP 9: Reset BIOS settings to factory default

Good luck!

This file didn't help. My P50 is still dead.😂

[Stefan Steff]

Can you send a link to a decent one? I don't have a JTAG programmer. I have heard of it though, but I usually avoid it and use UART with my raspberry pis, since I've only ever used it for serial debugging/console.

I think RT809H is the best price/value in this category...in fact every programmer has good and bad things but to use it once or twice a year then RT809H is a good choice.
In US you find a lot of RT809H programmers on Amazon or eBay. (ex. https://a.co/d/eUE6vcB)
Look for RT809H not for RT809F !

[ofluffy]

It's very tricky to use clips...must be careful and check the reading/writing at least 2 or 3 times to be sure it's done correctly...
As a last try ... here is the EC content.

I hope you can and know how to use JTAG to read/write the MEC1653. (You find plenty of examples here on badcaps how to prepare the MB and use the JTAG to read/write MEC chips...
An example: https://www.badcaps.net/forum/troubl...lock#post74632)

I don't know about the MEC1653 but the MEC1633 has an internal 2Kb EEPROM in witch is the password stored so if this is true for MEC1653 then rewriting the EC content may help to bring your laptop back to life.(without clearing the password...)
Also, I don't use CH341a (I use SVOD4 and before SVOD I used JTAG programming with RT809H) so I don't know if it supports JTAG programming...
In conclusion, what I would do:
1.- Write the 25Q80 with the original backup content
2.- Write the 25Q128 with Thinkpad T470s-Type 20HG.bin
3.- Write the MEC1653 with T470s_MEC1653.bin via JTAG (attached)

If it's starts then patch the Thinkpad T470s-Type 20HG.bin file and follow the instructions.
Write back your saved BIOS backup file or write back the Thinkpad T470s-Type 20HG.bin and make a BIOS update.
Good Luck!

Can you send a link to a decent one? I don't have a JTAG programmer. I have heard of it though, but I usually avoid it and use UART with my raspberry pis, since I've only ever used it for serial debugging/console.

[Stefan Steff]

Yes I used SOIC8 clip with CH341a programmer. Didn't happen until I went through the bios unlock process listed on the lenovo autopatcher. It showed the usual PXE driver screen, turned off, I flashed the original like it said to, then it wouldn't turn on. I'll inspect the board.

After looking, I don't see any damaged connections or missing pieces, or any significant activity on thermal camera. However, I did just notice that once powered on, the fan continues to spin and stop, over and over like it's continuously trying and failing to boot. I've attached pictures of the rom chips, maybe I missed something.

It's very tricky to use clips...must be careful and check the reading/writing at least 2 or 3 times to be sure it's done correctly...
As a last try ... here is the EC content.

I hope you can and know how to use JTAG to read/write the MEC1653. (You find plenty of examples here on badcaps how to prepare the MB and use the JTAG to read/write MEC chips...
An example: https://www.badcaps.net/forum/troubl...lock#post74632)

I don't know about the MEC1653 but the MEC1633 has an internal 2Kb EEPROM in witch is the password stored so if this is true for MEC1653 then rewriting the EC content may help to bring your laptop back to life.(without clearing the password...)
Also, I don't use CH341a (I use SVOD4 and before SVOD I used JTAG programming with RT809H) so I don't know if it supports JTAG programming...
In conclusion, what I would do:
1.- Write the 25Q80 with the original backup content
2.- Write the 25Q128 with Thinkpad T470s-Type 20HG.bin
3.- Write the MEC1653 with T470s_MEC1653.bin via JTAG (attached)

If it's starts then patch the Thinkpad T470s-Type 20HG.bin file and follow the instructions.
Write back your saved BIOS backup file or write back the Thinkpad T470s-Type 20HG.bin and make a BIOS update.
Good Luck!

[ofluffy]

Do you use clips to flash the chips or you desolder them ?
Check for missing or damaged components near the BIOS chip.
If programming different versions of BIOS did not result in different behavior most likely you have a hardware issue...

Yes I used SOIC8 clip with CH341a programmer. Didn't happen until I went through the bios unlock process listed on the lenovo autopatcher. It showed the usual PXE driver screen, turned off, I flashed the original like it said to, then it wouldn't turn on. I'll inspect the board.

After looking, I don't see any damaged connections or missing pieces, or any significant activity on thermal camera. However, I did just notice that once powered on, the fan continues to spin and stop, over and over like it's continuously trying and failing to boot. I've attached pictures of the rom chips, maybe I missed something.

[Stefan Steff]

Flashed that to the pd chip, same result... Not sure what on earth is going on. This all started after trying to use the auto patcher...

Do you use clips to flash the chips or you desolder them ?
Check for missing or damaged components near the BIOS chip.
If programming different versions of BIOS did not result in different behavior most likely you have a hardware issue...

[ofluffy]

OK.
I see some differences between your PD Controller backup and what I have saved on my PC.
So here is mine to try.

Flashed that to the pd chip, same result... Not sure what on earth is going on. This all started after trying to use the auto patcher...

[Stefan Steff]

I flashed it just now, it still does the same thing. The keyboard and power button light up briefly then it shuts off. This happens once when power is plugged in, then it is unresponsive until unplugged and plugged back in once more.

OK.
I see some differences between your PD Controller backup and what I have saved on my PC.
So here is mine to try.

[ofluffy]

OK, that's good. (PC0PTLL4 with "zero" after letter C.
The 25Q80 chip is your PD controller SPI so must be untouched and write it back as is.
Write the content from the attachment and tell me if it works or not.
It's tested by me on several T470s laptops.

I flashed it just now, it still does the same thing. The keyboard and power button light up briefly then it shuts off. This happens once when power is plugged in, then it is unresponsive until unplugged and plugged back in once more.

[Stefan Steff]

It's a 2017 T470s

I think the original serial number stickers were replaced, all I can find is:
Type 20HG-S14D00 and S/N PC-OPTLL4 17/09

OK, that's good. (PC0PTLL4 with "zero" after letter C.
The 25Q80 chip is your PD controller SPI so must be untouched and write it back as is.
Write the content from the attachment and tell me if it works or not.
It's tested by me on several T470s laptops.

[ofluffy]

Please provide a serial number and model number.
Let's try to fix your laptop

It's a 2017 T470s

I think the original serial number stickers were replaced, all I can find is:
Type 20HG-S14D00 and S/N PC-OPTLL4 17/09

[Stefan Steff]

Flashing both chips back to their original states doesn't even fix it, it no longer boots at all after trying the PXE driver injector method...

Please provide a serial number and model number.
Let's try to fix your laptop

[ofluffy]

Flashing both chips back to their original states doesn't even fix it, it no longer boots at all after trying the PXE driver injector method...