LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

[Polar Bear]

Hello,

A friend of mine approached me with request for help to recover access to a few electronic devices left after tragic death of his son. One of the devices is a Lenovo T480s laptop with UEFI Supervisor laptop. I did my research on internet for possible methods and couple of them lead to BadCaps forum.

Laptop: Lenovo T480s
MB: ET481 NS-B471 Rev: 1.0 2017-10-30
Type: 20L7-002CUS
S/N: PC-0WWFM7 18/08
BIOS IC: 25Q128JVSQ

Method #1: Lenovo autopatcher
Video: https://www.youtube.com/watch?v=s9XlN2Hl0ag
lenovo_autopatcher_0.2
The BIOS has been read and stored 3 times in a files, CRC is the same for each file. The BIOS was processed by lenovo_autopatcher_0.2 successfully. The result bin file was written into the BIOS chip. At next laptop's boot a procedure to disable TPM was completed successfully. Then original BIOS was written/restored into BIOS chip. Following boot of the laptop still asks for password input.

The procedure was completed/repeated a few times (with connected/disconnected batteries) with exactly same result.

Method #2: Supervisor password decryption
Video: https://www.youtube.com/watch?v=IhRw7ePhLKs
Followed the video in attempt to decript Supervisor's password. Using UEFItool was found padding value (00700000h) and BIOS file was scanned for an offset (0003FC20h). Looking at 0073FC20h in BIOS file the password has 168 bites and bytes values way beyond keyboard scan codes. It is considered that this attempt/method is not applicable to Lenovo T480s.

Keyboard scancodes: https://aeb.win.tue.nl/linux/kbd/scancodes-1.html

Method #3: JLPC ADC shorting to GND
Video: https://www.youtube.com/watch?v=D-PFVJpBcTY
URL: https://www.badcaps.net/forum/troubl...-ec-pwd-bypass

Followed the video, in many attepts to GND any pin 4,6,8,10 (ADC0:3) on JLPC pads and only once I was offered to press F1 go get into BIOS settings, for some unexplicable reason keyboard refused to respond on key presses. All following attempts was unsuccessful so far (to catch a right timing to corrupt data exchange and get into BIOS settings).

Please suggest how Supervisor password can be remove.
Your help is greatly appreciated.

[peste]

post merged...next time look for a thread with the name and model, motherboard model of the laptop, and post there, if you can't find it, then make a new thread..

[abrnb]

Hi,
when i try to autopatch a file the fill generated and immediately deleted, pls assist me for this problem, Thanks

[Polar Bear]

Hello Knucklegrumble,

per your suggestion I would like to report unsuccessful case with Lenovo T480s. I followed your procedure and everything was going according plan except that after restoring original BIOS and reboot laptop asks for a password.

I've made a post for my case with a details. I would appreciate if you take a look at it.

Thank you for your work and help

Polar Bear

[Polar Bear]

Just bought a CH341A programmer for Thinkpad T480s, IC chip is 25Q128JVSQ,

I used the AsProgrammer 2.1.0 .13 Version, But I cannot find this chip model in CH341A chip list, there are only 25Q128BV and 25Q128FV.
Can someone help how to handle this IC 25Q128JVSQ?

Thanks very much.

Hi,

you can use any of 25Q128BV or 25Q128FV they share same chip ID as your IC 25Q128JVSQ (see page 21).

Or you can add your chip into list of supported chips yourself. Just edit file chiplist.xml,

find line

<W25Q128FV id="EF4018" page="256" size="16777216"/>

add after it

<W25Q128JV id="EF4018" page="256" size="16777216"/>

save the file.

Now try identify chip in AsProgrammer and you will see your chip in the list.

Note: you can download more recent AsProgrammer 3.7 or AsProgrammer 2.1.2

Polar Bear

[CesrDroid]

Can someone help me? When I use the autopatcher, the computer starts beeping and does not start the BIOS.

I just saw that I uploaded the file, but it's 6MB. The original BIOS is 16MB, but when I run the autopatcher, it doesn't work and the siren is activated.

[Maxpower3]

I just saw that I uploaded the file, but it's 6MB. The original BIOS is 16MB, but when I run the autopatcher, it doesn't work and the siren is activated.

serial number, type etc ... respect rules please

[Maxpower3]

Method #1: Lenovo autopatcher

Method #2: Supervisor password decryption

Method #3: JLPC ADC shorting to GND

method 1 should work
Method 2 doesn't work. Password is in EC. Can't decrypt. It's not registered in the BIOS.
Method 3: You must use a USB keyboard because the shunt disables the keyboard. Watch the other videos to understand, the timing of the shunt is important
f1 is pressed before the shunt.

[CesrDroid]

serial number, type etc ... respect rules please

Model: ThinkPad T480
Serial Number: PF-1NSAAJ
Motherboard Model: ET480 NM-B501 - rEV. 1,0 - 2018-03.03

Issue:
I am unable to remove the BIOS supervisor password. I have tried all recommended procedures, including the Lenovo Auto‑Patcher, but I am still locked out.

What I have tried:

Used Flashrom and a CH341A SPI programmer to read and write the BIOS chip.

Worked from both Ubuntu and Windows 11 operating systems during the process.

Flashed both 8MB and 4MB dumps (attached below).

Ran the latest Lenovo Auto-Patcher script on my BIOS dumps.

Flashed the patched BIOS back to the chip.

I also tried the original BIOS dump for recovery.

Current symptoms:

With patched BIOS: The laptop does not boot and emits a continuous siren/alarm sound.

With original BIOS: The laptop boots but asks for the supervisor password (which I do not have).


Additional info:

The board label says MN-B501.


Thank you in advance for your help! Any guidance or clean/unlocked BIOS would be greatly appreciated.

[Polar Bear]

method 1 should work
Method 2 doesn't work. Password is in EC. Can't decrypt. It's not registered in the BIOS.
Method 3: You must use a USB keyboard because the shunt disables the keyboard. Watch the other videos to understand, the timing of the shunt is important
f1 is pressed before the shunt.

Tried method 1 again and again -- still after flashing original BIOS on boot a password is asked.
Tried method 3 again and again -- so far no success in right timing.

Note on method 3:
Tried to shunt after backlight on (no Lenovo logo, probably in BIOS set fastboot) with tapping F1 key - the boot process either "paused" or might give an error and reboot, or might play melody (couple of times), or password input requested. Watched YouTube videos with the procedure, I see that success shunt often happens on second-third-fourth try but in my case no luck so far.

Is there any setting in BIOS which could cause of such behavour?

Polar Bear

[abrnb]

If your CPU is i7-8650U then the patcher doesn't work...

Hi
if cpu is i5 13th, will this patcher work brother?

[Stefan Steff]

Hi
if cpu is i5 13th, will this patcher work brother?

No, it will not work.
The autopatcher works on MBs with CPU version until 8-th gen.

[abrnb]

No, it will not work.
The autopatcher works on MBs with CPU version until 8-th gen.

Hi
Thanks for you reply, is there anyway to remove supervisor password for latest gen for lenovo, if yes mean please suggest me Thanks in advance brother

[Stefan Steff]

Yes there is a hope...read here:
https://www.badcaps.net/forum/troubl...ss#post3237235

[Stachujones]

Hello i have a problem using autopatcher in ThinkPad X280, after writing patched file laptop is beeping code 010288 and no display, tried on original bios from 2020 and after update on newest bios from 2025
after writing original bios laptop is starting fine again
Laptop: ThinkPad X280
MB: NM-B521
SN: PC0YZ1FW 18/11
BIOS IC 25Q128JVSQ
Could anyone help me with removing supervisor password, thanks in advance

[danito]

Hello i have a problem using autopatcher in ThinkPad X280, after writing patched file laptop is beeping code 010288 and no display, tried on original bios from 2020 and after update on newest bios from 2025
after writing original bios laptop is starting fine again
Laptop: ThinkPad X280
MB: NM-B521
SN: PC0YZ1FW 18/11
BIOS IC 25Q128JVSQ
Could anyone help me with removing supervisor password, thanks in advance

try

[Stachujones]

try

Still the same behavior, no display and the same sound error

[Stachujones]

Done, fix ot by flashing first clean me bios, than reading it back, doing autopatch, laptop booted just fine, and lastly writing original file from laptop
Maybe this will help someone

[mohammedsf]

Hi, please help me patching this bios to remove the password..

MB: NM-B521 Rev 1.0
Machine type: 20KE
SN: PC-0YC2T3

[peste]

post merged..next time look for a thread with the name and model, motherboard model of the laptop, and post there, if you can't find it, then make a new thread..

[EB999999]

Hi all,

I'm having trouble deleting the SVP on my laptop.
EDIT:
[It's an x280 20KES2SN00; i5-8350U 8GB 01LX681
SN: PC16FNZB 19/07
IC: W25Q128JVSQ]

After flashing the patched file, I get a black screen and a musical note.
The original bin dump is uncorrupted and works after flashing it.

How can I fix the patched file so it works to remove the SVP?

Thanks for your help

[peste]

Hi all,

I'm having trouble deleting the SVP on an x280
After flashing the patched file, I get a black screen and a musical note.
The original bin dump is uncorrupted and works after flashing it.
How can I fix the patched file so it works to remove the SVP?

Thanks for your help

post S/N, full name and model, motherboard model, TYPE,etc.