LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

[abrnb]

Hi,
when i try to autopatch a file the fill generated and immediately deleted, pls assist me for this problem, Thanks

[Polar Bear]

Hello,

A friend of mine approached me with request for help to recover access to a few electronic devices left after tragic death of his son. One of the devices is a Lenovo T480s laptop with UEFI Supervisor laptop. I did my research on internet for possible methods and couple of them lead to BadCaps forum.

Laptop: Lenovo T480s
MB: ET481 NS-B471 Rev: 1.0 2017-10-30
Type: 20L7-002CUS
S/N: PC-0WWFM7 18/08
BIOS IC: 25Q128JVSQ

Method #1: Lenovo autopatcher
Video: https://www.youtube.com/watch?v=s9XlN2Hl0ag
lenovo_autopatcher_0.2
The BIOS has been read and stored 3 times in a files, CRC is the same for each file. The BIOS was processed by lenovo_autopatcher_0.2 successfully. The result bin file was written into the BIOS chip. At next laptop's boot a procedure to disable TPM was completed successfully. Then original BIOS was written/restored into BIOS chip. Following boot of the laptop still asks for password input.

The procedure was completed/repeated a few times (with connected/disconnected batteries) with exactly same result.

Method #2: Supervisor password decryption
Video: https://www.youtube.com/watch?v=IhRw7ePhLKs
Followed the video in attempt to decript Supervisor's password. Using UEFItool was found padding value (00700000h) and BIOS file was scanned for an offset (0003FC20h). Looking at 0073FC20h in BIOS file the password has 168 bites and bytes values way beyond keyboard scan codes. It is considered that this attempt/method is not applicable to Lenovo T480s.

Keyboard scancodes: https://aeb.win.tue.nl/linux/kbd/scancodes-1.html

Method #3: JLPC ADC shorting to GND
Video: https://www.youtube.com/watch?v=D-PFVJpBcTY
URL: https://www.badcaps.net/forum/troubl...-ec-pwd-bypass

Followed the video, in many attepts to GND any pin 4,6,8,10 (ADC0:3) on JLPC pads and only once I was offered to press F1 go get into BIOS settings, for some unexplicable reason keyboard refused to respond on key presses. All following attempts was unsuccessful so far (to catch a right timing to corrupt data exchange and get into BIOS settings).

Please suggest how Supervisor password can be remove.
Your help is greatly appreciated.

[volinakis]

The conclusion of his research for this thesis is :

that he doesn't do anything well, and yet, it works.

when he will discover your method he will realize he waste his time researching and writing his thesis. Imagine: after reading his thesis in front of colleagues and professors, the dumb of the class rises 2 fingers and says: I know a faster and better way!
On a serious note, I bet you didn't discover your method by accident, you searched a way to interrupt communication between UEFI and EC and you found it.

[Maxpower3]

now we wait from him to document your method of bypassing SVP

The conclusion of his research for this thesis is :

that he doesn't do anything well, and yet, it works.

[volinakis]

impressive, well done, great job

now we wait from him to document your method of bypassing SVP. I think in 2028!

[Maxpower3]

impressive, well done, great job

[SVTV]

EC MEC1503 no solution

Only programmer

[ali0robot]

AMD or Intel ?? intel not work
L14 L15 complicated model
look at the other posts in
https://www.badcaps.net/forum/troubl...-ec-pwd-bypass

it's intel, ok I will try second solution. thank you

[Maxpower3]

Hi Maxpower3
I have Lenovo L15 with part number GL4A0/GL5A0 NM-C631 and I followed your guidance for NPCE68APA0DX by make a short connection pin 1 or 128 with ground for two second when I can see Lenovo logo but problem is that laptop stuck in Lenovo logo. what am I doing wrong?

AMD or Intel ?? intel not work
L14 L15 complicated model
look at the other posts in
https://www.badcaps.net/forum/troubl...-ec-pwd-bypass

[ali0robot]

Hi Maxpower3
I have Lenovo L15 with part number GL4A0/GL5A0 NM-C631 and I followed your guidance for NPCE68APA0DX by make a short connection pin 1 or 128 with ground for two second when I can see Lenovo logo but problem is that laptop stuck in Lenovo logo. what am I doing wrong?

[sonsuzbilgisayar]

Hi have a lenovo e595 with a supervisor password lock. I have tried the auto patcher from bios dump but my bios comes out to 32mb not 16 and wont fit on the flash.

can anyone help?

Laptop serial number is PF-2233EX

type : 20NF-0006UK

This system does not work for 32Mbytes. This system is only valid for 16MB. I have done it many times.

[Maxpower3]

I'm sorry. This my model and original bios
Serial Number R9-10W8WV
Type Number 20UN-0001JP

EC MEC1503 no solution

[nguyenhuuducntu]

Type the laptop serial number, full name and model, motherboard model, etc.
post the contents of the original bios chip even if it is corrupted..

read the forum rules..https://www.badcaps.net/forum/troubl...before-posting

I'm sorry. This my model and original bios
Serial Number R9-10W8WV
Type Number 20UN-0001JP

[SMDFlea]

hi everyone, my laptop Lenovo Thinkpad X1 Nano Gen 1 Bios screen is stuck at 100%, I found some dumps and flashed the bios, it works but the SuperVisor password is stuck. Can someone help me? This is the dump I used, not the original dump of the machine

Type the laptop serial number, full name and model, motherboard model, etc.
post the contents of the original bios chip even if it is corrupted..

read the forum rules..https://www.badcaps.net/forum/troubl...before-posting

[nguyenhuuducntu]

hi everyone, my laptop Lenovo Thinkpad X1 Nano Gen 1 Bios screen is stuck at 100%, I found some dumps and flashed the bios, it works but the SuperVisor password is stuck. Can someone help me? This is the dump I used, not the original dump of the machine

[fobblengt]

Hello,

I have a laptop with supervisor password set which I don't remember. I tried the autopatcher (both versions), but it seems it doesn't work with my model. The keyboard status LEDs light up, turn off again, then nothing, and after about 20 seconds I get multiple beeping tones.

ThinkPad X1 Extreme (v1)
Type: 20MF-000TGE
S/N: R9-0RVL8E

Can you help me remove the password?

I managed to solve this by myself. Using the BIOS from https://www.badcaps.net/forum/troubl...15#post3579915 worked with the autopatcher.

[jhonssssss]

I have a Lenovo T490S, can you help me REMOVE THE SUPERVISOR PASSWORD? Type: 20NY-S34L00 S/N PC-1FV4Q1 20/03 Thank you in advance

[CesrDroid]

Can someone help me? When I use the autopatcher, the computer starts beeping and does not start the BIOS.

[fobblengt]

Hello,

I have a laptop with supervisor password set which I don't remember. I tried the autopatcher (both versions), but it seems it doesn't work with my model. The keyboard status LEDs light up, turn off again, then nothing, and after about 20 seconds I get multiple beeping tones.

ThinkPad X1 Extreme (v1)
Type: 20MF-000TGE
S/N: R9-0RVL8E

Can you help me remove the password?

[patrykstw]

Hello I have Yoga 11e 20 LN S06E00 SN R9-0V7ZYP and i cant remove password with autopatcher beacause after flash im getting black screen. If someone could help me with password delete on this bios i would be grateful