LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

[SMDFlea]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Ah okay, yeah I found it...thanks to you both AAAC and SMDFlea!!!! Now that I found it yeah you're right this one is right next the the HDMI port.

I just had to keep looking and peel back some more black film and there's another Winbond chip

Ah,thats where it was hiding

[AAAC]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Hi, I have added my dumps. Could you please help.

In the BIOS Region, in the first padding volume, in other models is where the password is stored, there's a block which is XORED and once you perform that operation again you obtain some information like the model number, Windows product key and the password at the end stored as scancodes, but in your file the password is not there, so it must be stored somewhere else.
IdeaPad 3 15ITL6

[wonderbaloon123]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Hi All Members,
First of all thank you very much for all the information shared. Its truly remarkable.
I have a Thinkpad X1 Carbon Gen3 (touch screen - 20BT) that had a supervisor password, which later I managed to brick rather ingeniously. System would start POST (fan spins up and KB lights comes up for about 3 sec and dies).Since I haven't had a back up copy of the BIOS, this is what I tried so-far
1. Downloaded a generic copy of the BIOS (size did match up with my chip- 16384KB)
2. Flashed the chip while onboard and no external power and battery disconnected (CMOS battery was still connected) - used CH341-A with default 5v setting (I later realised I should have fixed it for 3.3V, but the chip is still readable, so possibly not fried yet. I will fix the voltage any further attempts)
3. Tried booting. No joy. Tried with different BIOS dump, still same result

All steps as explained in Page1 was followed to that point. Autopatcher ran and generated the new file just fine. Checksum for the file matched against a copy read from the chip after flashing. So a bit lost what I have done wrong.

As it stands, when I power up (external with or without battery), I get the power button led lighting up 4 times (first blink very quick and then 3 subsequent blinks- much like a 1->3 sequence. Or it could be counted as 4 blinks too)
Since the BIOS chip is still responding, I am thinking of trying another flash after getting the voltage sorted. But any suggestions please? Have anyone been in this place before?

Thank you. And apologies for the lengthy post.

Hi,
So, I sorted out the Ch341 voltage and took a BIOS dump from another working X1 Carbon Gen3 (20BS). It has SVP, but does boot and load the OS.
Used this BIOS to flash the bricked laptop. This time, I took the whole motherboard out and disconnected CMOS while flashing. Still no luck. On power up, all I get is a quick fan spin and the same 4 LED blinks on the power button (that repeats for the eternity as long as the power lead is connected). Resetting the laptop hasn't helped either.

I am totally lost at this point. Any suggestions or leads please?
Thank you.

[margin292]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Hey everyone, just wanted to pass along some potential time savings tips for those working on a Lenovo P50/51.

First off, this saved me from having just throw away a perfectly good main board and buy another...thank you so much to everyone who has contributed!!!

Alright so this blog and this datasheet (pg. 5) helped me once I found the BIOS chip.

Here is a screenshot of where the BIOS chip is located. You don't have to remove the main board from the chassis, nor do you have to remove the fan assembly as pictured...but you do have to separate the bottom chassis from the screen assembly, if that makes sense.



If the picture is no longer hosted, as AAAC said earlier:

@margin292
BIOS chip is located near the uProcessor and/or the RAM slots.

For me it was right next to the RAM slots.

Hope this helps someone save a little bit of headache.

Cheers

[rednax]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Excellent! I'm a bit nervous. May I ask:
- if you used the 'black' CH341A did you modify it to 3.3v?
- What software did you use with the programmer?
Which chip is the bios chip that needs to be modified. According to this post there's two similar ones:
https://www.reddit.com/r/Lenovo/comm...security_chip/

I'm very grateful for your assistance.

1. I did not modify my CH341A.
2. AsProgrammer
3. U49, the one near RAM.

[wonderbaloon123]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Hi,
So, I sorted out the Ch341 voltage and took a BIOS dump from another working X1 Carbon Gen3 (20BS). It has SVP, but does boot and load the OS.
Used this BIOS to flash the bricked laptop. This time, I took the whole motherboard out and disconnected CMOS while flashing. Still no luck. On power up, all I get is a quick fan spin and the same 4 LED blinks on the power button (that repeats for the eternity as long as the power lead is connected). Resetting the laptop hasn't helped either.

I am totally lost at this point. Any suggestions or leads please?
Thank you.

Hi,

An update-
The LED blink seems to be an indication of fried MB from what I read. Since I did not use any glove/anti-static measures, there is a chance this may have happened (or the chip somehow got messed up).
So- I kept it aside and picked up the second laptop. Same model- Gen3, 20BT.
Followed the instructions from this post- https://www.badcaps.net/forum/showthread.php?t=87588

Everything went fine and now I have a TP, with a BIOS that doesnt have SVP.

Next project- I am thinking of getting a replacement chip for the first laptop and start with a clean BIOS install. See how it goes.

Thanks to all good people here for the instructions.

[rediii]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

hey guys,
i have a thinkpad t480 (20L6) here, svp-locked. the maximum number of password retries exceeded... i used the autopatcher like described, tamper button is pushed down with tape. the autopatched rom won't let the machine post just seven beeps (kind of hard to count...) and thats it, no reboot the device stays on. i flashed back the original file and the machine would post like before. the diagnostic app says code 0285 - tpm initialization error
any suggestions? thank you very much.

original bin and patched one are attached

[Markus1741]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

hey guys,
i have a thinkpad t480 (20L6) here, svp-locked. the maximum number of password retries exceeded... i used the autopatcher like described, tamper button is pushed down with tape. the autopatched rom won't let the machine post just seven beeps (kind of hard to count...) and thats it, no reboot the device stays on. i flashed back the original file and the machine would post like before. the diagnostic app says code 0285 - tpm initialization error
any suggestions? thank you very much.

original bin and patched one are attached

Try this patch ....

[rediii]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Try this patch ....

seems to work, thank you. what have you done?

[Markus1741]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

seems to work, thank you. what have you done?

Hello I think your patch was wrong compared it with md5sum and saw that they were different. I then created a new patch under Ubuntu, that's the whole secret. greetings from Bavaria

[rediii]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Hello I think your patch was wrong compared it with md5sum and saw that they were different. I then created a new patch under Ubuntu, that's the whole secret. greetings from Bavaria

very well done, but i ask myself why this happened? next step would have been to flash the mec directly. but i unlocked alot of thinkpads (even t480) with no problems so far. do you have an idea, why the checksum was wrong? greetings from germany as well , i love bavaria

[skazide]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

plz need to patch this dump

[SMDFlea]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

plz need to patch this dump

Have you tried using the Autopatcher yourself ?

[skazide]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Have you tried using the Autopatcher yourself ?

i tried 2 time bro , but now when i back the original pc didnt turn on , fan just run then stop then run ..ect

[skazide]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Have you tried using the Autopatcher yourself ?

i did change chip bios and reprogrammed the bios with autopatcher and every things go ok thanks everyone here

[HAWKAR]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Hello dears
can anyone patch this for me?

this i need to be patched

this

[hoaca388]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

this

Patched

[HAWKAR]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

why this is not working in my windows 10 also i installed pythone 3.^
i dont know why the file is not exist the patched file?

Patched

thanks for your help but i used it only some beeping and like a music then not posting to screen
so not working can you do some thing for me ?

guys i succesed
in cmd go ahead and rund the python script and the orignal bios in the same folder and it will export the patched
so you should have to install the python on windows then you can do to your self
thanks to

run cmd in patch folder in lenovo autopatcher folder

[Markus1741]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

why this is not working in my windows 10 also i installed pythone 3.^
i dont know why the file is not exist the patched file?



thanks for your help but i used it only some beeping and like a music then not posting to screen
so not working can you do some thing for me ?

guys i succesed
in cmd go ahead and rund the python script and the orignal bios in the same folder and it will export the patched
so you should have to install the python on windows then you can do to your self
thanks to

run cmd in patch folder in lenovo autopatcher folder

Try this ....

[alfredodinolfo]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

with this patch i have a prob with invalid key.

Type Number 20NK-S4RC00
Compliance ID TP00103B
MB: FA495 NM-C131 REV. 1.0
CPU RYZEN PRO YM350BC4T4MFG
help please