HP Zbook 17 G6 password

[tezza192]

Would someone be so kind as to remove the password from my attached bios?

Many thanks

[tezza192]

Re: HP Zbook 17 G6

Anybody help with this?

[black0hackers]

Re: HP Zbook 17 G6

post 32Mb bios file

[RethoricalCheese]

Re: HP Zbook 17 G6

Only 16MB is needed. Hold on

[tezza192]

Re: HP Zbook 17 G6

Thanks

[black0hackers]

Re: HP Zbook 17 G6

Only 16MB is needed. Hold on

really?

[RethoricalCheese]

Re: HP Zbook 17 G6

really?

Yes, unlocked succesfully. Took 2 tries but atleast I can improve my unlocker now. Still some minor improvements to make so it would be as safe to use as possible, unlike previous version.

[tezza192]

Re: HP Zbook 17 G6

Yes, unlocked succesfully. Took 2 tries but atleast I can improve my unlocker now. Still some minor improvements to make so it would be as safe to use as possible, unlike previous version.

Can confirm all working perfect, thanks for the PM chat to sort this 👍 😀 👌

[ShikaUsstan]

Re: HP Zbook 17 G6

I am having a similar need to OP. Could someone help me out with my boot password as well? I also have a Zbook 17 G6

Thank you in advance!

[shabi]

Re: HP Zbook 17 G6

I am having a similar need to OP. Could someone help me out with my boot password as well? I also have a Zbook 17 G6

Thank you in advance!

send both bios files

[Vesko356]

Re: HP Zbook 17 G6

send both bios files

Unlocking can be done without it, so it doesn't need to upload the second file.
look up at the beginning of the topic.

I am having a similar need to OP. Could someone help me out with my boot password as well? I also have a Zbook 17 G6

Thank you in advance!

I've sent you the file to test.

[ShikaUsstan]

Re: HP Zbook 17 G6

So I have tried the HPunlocker from @RethoricalCheese and @Vesko356 file that he sent me. I did see the screen that Vesko had mentioned after flashing his altered file so I know that it is writing to the chip. However, I am still boot password blocked. If it will help I will spend some time later today dismantling the laptop to get the bios file.

[RethoricalCheese]

Re: HP Zbook 17 G6

What do you mean by boot password?

Can you access bios?

[Vesko356]

Re: HP Zbook 17 G6

So I have tried the HPunlocker from @RethoricalCheese and @Vesko356 file that he sent me. I did see the screen that Vesko had mentioned after flashing his altered file so I know that it is writing to the chip. However, I am still boot password blocked. If it will help I will spend some time later today dismantling the laptop to get the bios file.

I've sent you the instructions as a PM, but here I see that you are writing about the use of the HPUnlocker, and this was not mentioned until now! Which file was used with it? And what exactly files are used now for testing? You also didn't say can you enter the BIOS or not (F10 key)?

[ShikaUsstan]

Re: HP Zbook 17 G6

I cannot access the bios. I have a PowerOn Authentication password lock. The file I uploaded here was directly from the chip. I used HPUnlocker on a copy of that file and Vesko's file separately. The 2 were not combined, however I did flash them both and tried them at different times.

To get a read on the bios chip I will need to desolder it and it is going to take some time...

[ShikaUsstan]

Re: HP Zbook 17 G6

I was able to score a fresh EC dump from another person and after flashing that the bios still has that PowerOn Lock so the information must be on the bios chip and not the ec chip.

[Vesko356]

Re: HP Zbook 17 G6

I was able to score a fresh EC dump from another person and after flashing that the bios still has that PowerOn Lock so the information must be on the bios chip and not the ec chip.

Using the HPUnlocker on the G6 model is absolutely useless, so you only complicated the situation I'm afraid. After all the mess you've created, it's best to stop. If you continue with this pointless experiments, a bigger mess can happen. In this case, it is best to upload both files here so that they can be edited with R92_010900 bios version.
From now on ask first, and then act, the opposite as you can see does not lead to good results.

[bobpeace]

Re: RCUnlocker

Hello:

I am attempting to remove the admin password (I set and forgot) on my HP Zbook G6 17. My zbook g6 has a 16mb EC chip next to a 32mb BIOS chip . This thread seems to be the most appropriate.



Chips:
32mb bios: mx25L25673gz4i-08g
16mb EC: 25b127DSig
Tools: RT809F programmer and Springloaded 8pin Wson6x8 probe
Method: on board with cmos battery removed. Probe used for both chips.

Steps completed:
+Dumped and verified each chip twice w/o errors. SHA256 comparison of first and second dump. Same.
+Installed RcUnlocker version from RhetoricalCheese's 8/30/2021 post and hpunlocker from post of his.
+RCunlocker on both EC and hpunlocker on BIOS dump.
+Compared results using BeyondCompare. RCUnlocker blanked out two lengthy sections beginning with "NVRAM" HpUnlocker blanked a short section after "U.s.e.r.C.r.e.d"...


Hesitant to flash and brick a $2k mb.... I have read the entire 19 pages of the RCunlocker thread and any thread with 'zbook in it'. Not clear to me if I have performed each step correctly.
+Question1: The password I set was a very long string. Small amount of changed bytes in Bios dump would not be sufficient to clear a password or even a hash. The only 24 bytes changed to HEX 00 or HEX FF by HpUnlocker was a name: "Keith" and a handful of single digit ascii numbers alternated with NULL bytes. Do I use both hpunlocker's output on bios chip AND rcunlocker on the EC chip or... use RCunlocker to flash EC only?
+Question2: rcunlocker post#1 says that it can be used for 32mb zbook bios dumps. However, it errors when using the 32mb bios dump: "Wrong chip...." Am I using an outdated version?
+Question3: Where can I find a safe copy of UEIFtool? I found a copy on github. However, my antivirus software was not happy with that file.

Thank you for the great tools.

[peste]

Re: RCUnlocker

Hello:

I am attempting to remove the admin password (I set and forgot) on my HP Zbook G6 17. My zbook g6 has a 16mb EC chip next to a 32mb BIOS chip . This thread seems to be the most appropriate.



Chips:
32mb bios: mx25L25673gz4i-08g
16mb EC: 25b127DSig
Tools: RT809F programmer and Springloaded 8pin Wson6x8 probe
Method: on board with cmos battery removed. Probe used for both chips.

Steps completed:
+Dumped and verified each chip twice w/o errors. SHA256 comparison of first and second dump. Same.
+Installed RcUnlocker version from RhetoricalCheese's 8/30/2021 post and hpunlocker from post of his.
+RCunlocker on both EC and hpunlocker on BIOS dump.
+Compared results using BeyondCompare. RCUnlocker blanked out two lengthy sections beginning with "NVRAM" HpUnlocker blanked a short section after "U.s.e.r.C.r.e.d"...


Hesitant to flash and brick a $2k mb.... I have read the entire 19 pages of the RCunlocker thread and any thread with 'zbook in it'. Not clear to me if I have performed each step correctly.
+Question1: The password I set was a very long string. Small amount of changed bytes in Bios dump would not be sufficient to clear a password or even a hash. The only 24 bytes changed to HEX 00 or HEX FF by HpUnlocker was a name: "Keith" and a handful of single digit ascii numbers alternated with NULL bytes. Do I use both hpunlocker's output on bios chip AND rcunlocker on the EC chip or... use RCunlocker to flash EC only?
+Question2: rcunlocker post#1 says that it can be used for 32mb zbook bios dumps. However, it errors when using the 32mb bios dump: "Wrong chip...." Am I using an outdated version?
+Question3: Where can I find a safe copy of UEIFtool? I found a copy on github. However, my antivirus software was not happy with that file.

Thank you for the great tools.

for starters make copies of both bios chips, so you don't have any problems .... use RCUnlocker on the 16 mb chip .. "wrong chip" is the chip that should not be used in this case ... for question 3 ... I think that you can use that program ... enter the antivirus settings and report false positive to their support ..

[bobpeace]

Re: RCUnlocker

for starters make copies of both bios chips, so you don't have any problems .... use RCUnlocker on the 16 mb chip .. "wrong chip" is the chip that should not be used in this case ... for question 3 ... I think that you can use that program ... enter the antivirus settings and report false positive to their support ..

Thank you for the clarification. I was successful.

For others with same difficulty with admin bios password on zbook g6 17u:

• obtained the mnfr products spec for the EC and the BIOS chip on MB to obtain the precise measurement and pin spacing.
• purchased rt809f programmer to dump data from ec/bios chips
• purchased a custom probe for my WSON bios chip with 8.4mm pin spacing. This is not the exact spacing for the EC chip, but it worked very well after precise placement.https://www.aliexpress.com/item/3295...37d218021alkdB
• setup vm on another pc as sandbox (don't trust the rt809f software)
• removed mb from zbook and removed cmos battery from mb while using anti-static protection
• used the custom probe to make a clean connection without soldering and held in place with one hand while using rt809f software with the other
• in the rt809f software, I did NOT use the chip autodetected, but selected the definition matching the part no silkscreened on the chips themselves
• made dual backups of EC and BIOS chips; verified with windows fc command
• DID not need to use the BIOS dump in my case
• dropped the 16mb EC dump on RcUnlocker.exe
• inspected the unlock EC bin file (I used Beyond Compare, any will work) and verified that the only change RcUnlocker made was the wiping of both NVRAM sections.
• wrote the unlocked bin file to the EC chip using rt809f programmer running inside sandboxed vm.
• reassembled laptop
• zbook logged in with NO bios pswd after several reboots
• immediately updated bios using HP's bios update tool in windows

I am not sure that this would even make a difference. I disconnected my anti-static strap while reading and writing the dumps. I didn't want to adulterate the dump. Just be careful not to touch the board. Those small ICs are very vulnerable.

Incidently, the UEFItool link I used to inspect the bios (not necessary to remove password) was https://github.com/LongSoft/UEFITool/tree/new_engine

I hope this helps someone. Had I known the process from the beginning, this would have take me 10 minutes. smdflea, thank you for your help!