LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

[VetKifayat]

hey, i tried flashing one of these bins here but it didnt work, ill attach my original bin here please help me remove the bios password.

[peste]

hey, i tried flashing one of these bins here but it didnt work, ill attach my original bin here please help me remove the bios password.

post S/N, full name and model, motherboard model, TYPE,etc.

[VetKifayat]

post S/N, full name and model, motherboard model, TYPE,etc.

i got a x380 yoga Type: 20LJ-S0JK0A with S/N MP-1L34LQ | 19/07

the motherboard is DTZS1 LA-F421P (2017-10-26)

thank you so much for the help!

[Xargon1975]

Hello everyone,

I'm pleased to share that I've successfully recovered my Lenovo T480.
As I mentioned earlier, I used an older version of the firmware, and everything worked as expected.
One important detail was to patiently wait for the system to boot, with the patched firmware, it took over 15 minutes, but eventually it started up and I was able to unlock it.

Many thanks to everyone for your support.

[ike.aparicio]

Hi there. I'm stuck. I got a T480 (Type 20L6-S4XG00, I can't find the S/N, the one I see on the laptop is PF-1LEYQQ but it doesn't show on Lenovo's website).

I'm using https://github.com/nofeletru/UsbAsp-flash/releases 2.1.2 and trying to patch a winbond 25Q128JVSQ 1849, using the option for the SPI winbond W25Q128JV but after flashing the patched bios the screen stays black and there is a chime. Searching online I found that there is a Lenovo app to interpret it and doing just that I get the code 0285 with the message "TCG-compliant functionality-related error (might be the TPM initialization failure)". After this I flashed the original bios back and my laptop worked again.

I'm not sure what I'm doing wrong. Here is a list of things that I figure are related:

- CMOS battery still connected
- Storage still connected
- Linux OS installed on storage

From the original post (But honestly, I don't get it):

> When booting the patched BIOS you might have to:
> - Hold the anti-tamper switch down the whole time (use tape)
> - Remove the hard disk or replace it with a locked one

That's pretty much it.

[Stefan Steff]

Hi there. I'm stuck. I got a T480 (Type 20L6-S4XG00, I can't find the S/N, the one I see on the laptop is PF-1LEYQQ but it doesn't show on Lenovo's website).

I'm using https://github.com/nofeletru/UsbAsp-flash/releases 2.1.2 and trying to patch a winbond 25Q128JVSQ 1849, using the option for the SPI winbond W25Q128JV but after flashing the patched bios the screen stays black and there is a chime. Searching online I found that there is a Lenovo app to interpret it and doing just that I get the code 0285 with the message "TCG-compliant functionality-related error (might be the TPM initialization failure)". After this I flashed the original bios back and my laptop worked again.

I'm not sure what I'm doing wrong. Here is a list of things that I figure are related:

- CMOS battery still connected
- Storage still connected
- Linux OS installed on storage

From the original post (But honestly, I don't get it):

> When booting the patched BIOS you might have to:
> - Hold the anti-tamper switch down the whole time (use tape)
> - Remove the hard disk or replace it with a locked one

That's pretty much it.

1.- Write this patched dump and follow the instructions.
2.- Write back your original dump.
3. - If you don't have original backup write the ME_Clean version.
4.- Go to https://pcsupport.lenovo.com/us/en/p...4xg00/pf1leyqq and download the latest bios for your laptop.

[Csanád Balogh]

Hi,

I'm looking for some assitance. I used the T495Main_PATCHED file to knock out the admin password.
The notebook entered the menu asking if i really wanted to delete it, i pressed the spaces multiple times, and it restarted.
After that only a blank screen showed everytime it got restarted, so I went to write the flash again now the original that was on the notebook.
But now for some reason there was continously too much voltage on the writer, so I had removed the chip, and used the elevated 1.8v board on the CHA341-A-PRO instead of the clips.
When I tried to write it again, I had multiple cannot read sector errors and probably killed the chip, so i purchased the only avalible replacement that I could get my hands on: MX25U12835FM2I-10G
Today I wrote the old dump, to the new chip and soldered it to the board, when I first turned it on the screen had the backlight glowing, and it turned off after around 10 seconds.
I tried going into the BIOS, and I succeded once, cause I heard the beeping sound that it is supposed to make. But I couldnt make it any further than this.
I was measuring 1.8v on most lines and 300mv on a few lines, I tried removing the SSD, the extra RAM, externals monitors, but I couldnt get an image.
Now after a few restarts I measured 1.8v to all lines from the ground, except to VCC, which is probably the issue, but at this point I have no idea on how to fix it.
I also bought multiple chips in case I killed it again, so that won't be an issue, if needed.
I see that you guys recommended to reinstall the BIOS, but I don't think I can do that without a screen.

Any adivce or tips on how to fix it are appreciated!

[ike.aparicio]

1.- Write this patched dump and follow the instructions.
2.- Write back your original dump.
3. - If you don't have original backup write the ME_Clean version.
4.- Go to https://pcsupport.lenovo.com/us/en/p...4xg00/pf1leyqq and download the latest bios for your laptop.

Thanks. You don't know how grateful I am. Following your instructions made all the difference.

I just wanted to add, for the sake of documentation, that my laptop restarted two times before even the screen turned on, let alone access the BIOS.

[ike.aparicio]

1.- Write this patched dump and follow the instructions.
2.- Write back your original dump.
3. - If you don't have original backup write the ME_Clean version.
4.- Go to https://pcsupport.lenovo.com/us/en/p...4xg00/pf1leyqq and download the latest bios for your laptop.

P.S. Checking the BIOS the UEFI BIOS Version is N24ET79W (1.54) and the Embedded Controller Version is N24HT37W (1.22). Checking Lenovo's site for the latest BIOS it seams these are the ones, kinda, https://download.lenovo.com/pccbbs/m.../n24uj41w.html I updated my firmware using `fwupd` (https://github.com/fwupd/fwupd) which uses `LVFS` (Linux Vendor Firmware Service, https://fwupd.org/). The firmware I'm using is https://fwupd.org/lvfs/devices/com.l...XW.firmware

[DoCNC]

Hello guys...

I want to unlock my T480 with supervisor Password..
Just a general question for dumping.. I use the CH341A Programmer.. Did you use the clamp or desolder the whole chip?
Kind regards..

[Iippy9]

(T480) I need help! I rewrite my chip with patched file but laptop no longer working, it gets charged but not opening, i have old chip file but chip is not detected by programmer, how i can solve this problem?

[DoCNC]

What kind of Programmer are you using?

[empm_repmex]

hi everyone.
I got this thinkpad which has SVP, I´ve tried using both the autopatch and autopatch 0.2.
using the autopatch (don´t know which version it is, could´n find it reading the file) it makes of a 16MB backup file a 32MB output bin, using the 0.2 version it makes a 16MB output bin which I tested but the laptop after pressing F1 got stuck on a black screen, I´ve tried a file provided by markus1741 on post # 692 but the same after pressing F1 it got stuck on a black screen, I tried cutting in half the 32MB bin & flashing and testing each part at a time but the laptop won´t turn on.
Can someone help me please?

Lenovo Thinkpad X1 Yoga 1st gen
Type: 20FR-S37300
S/N: R9-0MNW6T
Motherboard: 14282-2M

I did attached both the backup and the one I patched with 0.2 version. thanks in advance.

[ike.aparicio]

Hello guys...

I want to unlock my T480 with supervisor Password..
Just a general question for dumping.. I use the CH341A Programmer.. Did you use the clamp or desolder the whole chip?
Kind regards..

I use the clamp. I can't solder for the life of me.

[DoCNC]

Yeah.. I tried yesterday using the clamp..
works nice..
I did 4 dumps in series and compare all the 4 dumps using sha256sum, all 4 have the same checksum.. - neat..

so I tried the autopatcher..
after a few tries, setting permissions etc the patcher tell me something like „invalid dump“..

what I'm doing in the wrong way?

im using xubuntu 22.04 - up to date
python version is 3.12.something..

maybe the autopatcher can't handle special characters or longer filenames?

[DoCNC]

Yeah.. I tried yesterday using the clamp..
works nice..
I did 4 dumps in series and compare all the 4 dumps using sha256sum, all 4 have the same checksum.. - neat..

so I tried the autopatcher..
after a few tries, setting permissions etc the patcher tell me something like „invalid dump“..

what I'm doing in the wrong way?

im using xubuntu 22.04 - up to date
python version is 3.12.something..

maybe the autopatcher can't handle special characters or longer filenames?

Eeeerm... I cant edit my Post?

Problem is solved... There were a missing libary..
In case someone get the same fallstone, try: sudo apt install libqt5core5t64 libqt5gui5t64 libqt5widgets5t64

Bios file successfully patched... But not flashed yet.. I will try this later, after a new Bios dump with a detached chip... Just for getting sure... I dont really trust that clip for dumping...

[rubtov]

Hey, any can help ? (need dump without supervisor pass)

model = T14s gen1/x13,
serial_number = PC1L73DS
chip = MX25L25673G (32MB)

[DoCNC]

[…]Lenovo T480.
[…]
One important detail was to patiently wait for the system to boot, with the patched firmware, it took over 15 minutes, but eventually it started up and I was able to unlock it.

Did your T480 plays a „melody“ at startup?

mine does…

is this a normal behavior?
I erased the chip, write the patched file into it, flashrom verifies successfully…
Instert RAM into the machine plug the charger (battery still disconnected)
tamper switch taped down.. start the t480…
This guy just plays a melody, screen stays blank, nothing more happens…

so I switched it off, remove the charger & RAM and verify the chip content again (of course with the file I flashed before)
verification failed…
so I did all again…
erase, flash & verify, verify again, plug all together (just RAM & charger) boot up…
yes, melody, blank screen, nothing more…

if I press fn + ESC the melody plays 3 times.. nothing else…

detached ram and charger, verify again… again failed…

need help please..

[yuyuyak]

@DoCNC,
See these posts:
https://www.badcaps.net/forum/troubl...31#post3619031
https://www.badcaps.net/forum/troubl...26#post3619126
https://www.badcaps.net/forum/troubl...28#post3634528
https://www.badcaps.net/forum/troubl...05#post3636905
https://www.badcaps.net/forum/troubl...05#post3639905

Hmm, those don't work as expected. These numbered posts in this thread:
3762
3763
3753 - the link referred to in 3763
3777
3779
3784

[DoCNC]

yuyuyak
if I read (and understand) it in the right way, it is in summary
1. patch an older bios version
2. flash the older patched versions on the chip
3. boot up & follow the instructions
4. flash the original dump back to the chip
5. have fun and be happy

does the t580 dump who is shared here work for the t480?
or should I use the dump posted at post #3786?