please patch this ThinkPad S1 Yoga 12

[sonsy]

Re: please patch this ThinkPad S1 Yoga 12

Edit: SOLUTION FIND

DON'T USE FILE WITH PDF

JUST REPLACE 0x200 to 022F on your original EC Dump

no lost UUID ,serial and others numbers

can you be more precise please? Am I reading only the 4MB chip, and am I replacing only the values I see in the image with "00"? Thanks!

[Maxpower3]

Re: please patch this ThinkPad S1 Yoga 12

need read kbc 9022 and change values (JUST REPLACE 0x200 to 022F on your original EC Dump)

[adil12]

lenovo yoga 12 bios locked help please

hello,

can you please help unlock my yoga 12 bios dump attached.
Thank you

[spuree11]

Re: LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal

Hi,
I have a ZIPS3 LA A342P For Lenovo ThinkPad Yoga 12 Laptop with a locked bios, can somebody patch it?

[Maxpower3]

Re: please patch this ThinkPad S1 Yoga 12

read EC ,solution here
https://www.badcaps.net/forum/showpo...4&postcount=19

[SiO2]

Re: please patch this ThinkPad S1 Yoga 12

First of all, thank you so much for figuring this out and sharing the solution!
I used your technique to read and clear the UEFI password of my Yoga 12.

Now for the remaining problem: Even though I can now enter the UEFI by just pressing enter (empty password), I cannot change any settings. I guess this is because the "lock UEFI BIOS settings" option is set to enable. Probably this prevents me from making any changes.

Any thought on how this can be resolved?

EDIT: Nevermind. I repeated all steps from scratch and now it works

[Alassane]

Re: Bios yoga12

Sorry for the delay

Thanks in advance

thanks very much

[TJJones94]

Re: please patch this ThinkPad S1 Yoga 12

need read kbc 9022 and change values (JUST REPLACE 0x200 to 022F on your original EC Dump)

where can I get this chip reprogrammer from?

[Maxpower3]

News

Patch possible on yoga 12
Pach by bios, no need to reprogram EC (Kb9022Q)

- Just read the two bios files (8+4MB)
and join them with utility provided.


Use Uefi Tools to modify your BIOS

Extract as is LenovoPasswordCP E4F272DA-237F-454C-8868-FCF096CF1C6C
Search AA382865-12B0-44E5-A731-6DEF4DF34CE7 LenovoPromptService
Replace as is LenovoPromptService by LenovoPasswordCP
LenovoPasswordCP must appear twice after
Split your file, select 8 for first file

Cleaning can help but not necessary
Password CP and Prompt may appear several times in relation to the bios templates, so all of them will need to be replaced

The patch allows you to access setup
- Load by default for the first time and restart
- Enter setup and go security
- type a blank password twice and save.
- Turn off, restore your original bios.

If you don't restore, the password will never be asked again!!
Tested here : https://youtu.be/f43JuDzA3yU

Booting may take time with different melodies, be patient!!
This patch also works on other models
https://www.badcaps.net/forum/troubl...10#post1873410
I'll leave you tested,
No Prompt, No Password
--------------------------------------------------------------------------------------------
For clear EC KB9022Q as previously cited
Just replace 0x200 to 022F on your original EC Dump
no lost UUID ,serial and others numbers

--------------------------------------------------------------------------------------------

Can someone help me create a patcher with python
because the autopatcher does not extract, just replaces.
I don't understand anything about python

[Davidscheiber28]

STUFF

I tried this but for some reason I cannot get the laptop to boot with the modified image
What am I doing wrong, Is there a trick to getting it to boot with the modified BIOS?
I tried also the auto patcher linked here https://www.badcaps.net/forum/troubl...age169?t=87588
but could not get it to boot.
I attached the original BIOS file reads, read and flashed with a CH341A.

[Maxpower3]

I tried this but for some reason I cannot get the laptop to boot with the modified image
What am I doing wrong, Is there a trick to getting it to boot with the modified BIOS?
I tried also the auto patcher linked here https://www.badcaps.net/forum/troubl...age169?t=87588
but could not get it to boot.
I attached the original BIOS file reads, read and flashed with a CH341A.

try only 64,32 it's same

[Davidscheiber28]

try only 64,32 it's same

I flashed the 8 MB W25Q64FV chip with the file "64 try test.bin" but still was not able to get a boot after trying for a while. The CPU fan spins for 3-5 seconds before stopping, CPU gets warm no video on display.
I also tried with and without the CMOS battery and also pressing the button on the motherboard.
I have only the display, charger and power button&sata board connected not sure if that matters but it would boot previously like this.
I had noticed the 4 MB part of the image was the same for the stock and modified so I only verified the dump matches before reinstalling. (I also verified the 8 MB chip after flashing)
Maybe I am doing something wrong in programming? Not sure.

[Maxpower3]

I flashed the 8 MB W25Q64FV chip with the file "64 try test.bin" but still was not able to get a boot after trying for a while. The CPU fan spins for 3-5 seconds before stopping, CPU gets warm no video on display.
I also tried with and without the CMOS battery and also pressing the button on the motherboard.
I have only the display, charger and power button&sata board connected not sure if that matters but it would boot previously like this.
I had noticed the 4 MB part of the image was the same for the stock and modified so I only verified the dump matches before reinstalling. (I also verified the 8 MB chip after flashing)
Maybe I am doing something wrong in programming? Not sure.

If you put the original back, does it work again? So the programming is good

[Davidscheiber28]

If you put the original back, does it work again? So the programming is good

This is very strange, I programmed the original BIOS back to the 8M chip and the board still does not boot, I even tried swapping the flash chips off a similar dead board (shorted PCH) and still got no boot.
I verified with an older board the LCD is still working also.
I have been comparing this board to the dead one to see if I knocked off a component but I don't see any knocked off. There are some resistors in different positions but I believe those are the straps for the ram as the dead board only had 4GB of ram if I recall and the locked one has 8GB.
Any idea what might have happened?
Maybe I somehow killed the SIO? I'm assuming the power rails are all present since the CPU has power right? I would think that would be last in the sequence.
I also wonder about the ram solder balls but I would think I would get a beep code if one of the ram chips became disconnected.
I must have screwed something up but I have know idea what I did .