ThinkPad x395 attempt at password removal

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • siddiq
    Senior Member
    • Dec 2011
    • 121
    • Ghana

    #1

    ThinkPad x395 attempt at password removal

    Did some experimenting to try supervisor password removal ... initially laptop has supervisor password and no computrace. I erase IT8186VG controller, it self-reprograms upon booting with serial number errors and supervisor password is gone but to my surprise computrace automatically activates ... I program a clean bios file downloaded and cut from website and upon booting, self-healing activates and upon checking setup, password still gone but computrace remains activated ... I write back backups of both Bios and EC and things are back to normal, that is supervisor password is back and computrace is off... I also noticed that removing UL5 (MX25L80) from the motherboard stops Bios self-healing so that's probably where backup is stored. So long story short, I'm back to square one ... anybody had success unlocking? I think the whole secret lies in the EC firmware ... still can't wrap my head around what's causing the computrace to activate ...
  • volinakis
    Badcaps Legend
    • Jan 2021
    • 2666
    • N/A

    #2
    Re: ThinkPad x395 attempt at password removal

    Originally posted by siddiq
    Did some experimenting to try supervisor password removal ... initially laptop has supervisor password and no computrace. I erase IT8186VG controller, it self-reprograms upon booting with serial number errors and supervisor password is gone but to my surprise computrace automatically activates ... I program a clean bios file downloaded and cut from website and upon booting, self-healing activates and upon checking setup, password still gone but computrace remains activated ... I write back backups of both Bios and EC and things are back to normal, that is supervisor password is back and computrace is off... I also noticed that removing UL5 (MX25L80) from the motherboard stops Bios self-healing so that's probably where backup is stored. So long story short, I'm back to square one ... anybody had success unlocking? I think the whole secret lies in the EC firmware ... still can't wrap my head around what's causing the computrace to activate ...
    What programmer did you use to erase IT8186VG?
    ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
    https://www.badcaps.net/donate/
    ----------------------------------------------------------------------------------------------------------------------------------------------------------------------

    Comment

    • siddiq
      Senior Member
      • Dec 2011
      • 121
      • Ghana

      #3
      Re: ThinkPad x395 attempt at password removal

      Svod 3

      Comment

      • volinakis
        Badcaps Legend
        • Jan 2021
        • 2666
        • N/A

        #4
        Re: ThinkPad x395 attempt at password removal

        I also have a X395 with password, I did try to unlock it with RT809H but no luck. I set up lines as in schematics, I used a 24pins FFC cable but I get "failed to enter the ISP status". UL5 is linked with ethernet controller, I erased it and nothing happened, no bios recovery, all DMI data shows in bios, so...
        Maybe someone with more experience take a look and tell me what I did wrong or if RT809H is able to read IT8186VG. 24pins FFC cable I used is B-type - reverse contact.Thank you.
        Attached Files
        ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
        https://www.badcaps.net/donate/
        ----------------------------------------------------------------------------------------------------------------------------------------------------------------------

        Comment

        • volinakis
          Badcaps Legend
          • Jan 2021
          • 2666
          • N/A

          #5
          Re: ThinkPad x395 attempt at password removal

          Originally posted by siddiq
          Svod 3
          your X395 is with Ryzen? if it is I found a solution to full unlock, by patching bios - mine has a 25q128fw 1.8V.
          ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
          https://www.badcaps.net/donate/
          ----------------------------------------------------------------------------------------------------------------------------------------------------------------------

          Comment

          • dimah77
            Senior Member
            • Sep 2016
            • 147
            • ALGERIA

            #6
            Re: ThinkPad x395 attempt at password removal

            Originally posted by volinakis
            your X395 is with Ryzen? if it is I found a solution to full unlock, by patching bios - mine has a 25q128fw 1.8V.
            can you share this patching solution bro ?

            Comment

            • rbvndonh
              Senior Member
              • Mar 2021
              • 162
              • B

              #7
              Re: ThinkPad x395 attempt at password removal

              Originally posted by volinakis
              your X395 is with Ryzen? if it is I found a solution to full unlock, by patching bios - mine has a 25q128fw 1.8V.

              please share solution

              Comment

              • volinakis
                Badcaps Legend
                • Jan 2021
                • 2666
                • N/A

                #8
                Re: ThinkPad x395 attempt at password removal

                Originally posted by rbvndonh
                please share solution
                post your bios dump
                ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
                https://www.badcaps.net/donate/
                ----------------------------------------------------------------------------------------------------------------------------------------------------------------------

                Comment

                • soulcoder
                  New Member
                  • Feb 2021
                  • 2
                  • España

                  #9
                  Re: ThinkPad x395 attempt at password removal

                  Originally posted by volinakis
                  post your bios dump
                  Hi. i have problem with x395.

                  Originally, the bios dont boot and play melody error. I dump the bios (Orinal.bin) and flashed one new. NOw when i boot up, asked for a password. I try patch the new bios with lenovo bios auto-patcher but i get melody error....


                  can u help me?
                  Attached Files

                  Comment

                  • ytsoc
                    Senior Member
                    • May 2014
                    • 67
                    • romania

                    #10
                    Re: ThinkPad x395 attempt at password removal

                    Originally posted by volinakis
                    your X395 is with Ryzen? if it is I found a solution to full unlock, by patching bios - mine has a 25q128fw 1.8V.
                    hello,

                    i have the same: x395: ryzen +128FW can you help?
                    Attached Files

                    Comment

                    • volinakis
                      Badcaps Legend
                      • Jan 2021
                      • 2666
                      • N/A

                      #11
                      Re: ThinkPad x395 attempt at password removal

                      Originally posted by ytsoc
                      hello,

                      i have the same: x395: ryzen +128FW can you help?
                      try this and follow the steps:
                      [ HOW TO USE THE PATCH ]
                      STEP 1: Flash and replace current BIOS with the generated patch file
                      STEP 2: Boot the machine
                      STEP 3: Press ENTER/F1/etc. to enter BIOS settings
                      STEP 4: Enter any character when asked for Supervisor Password
                      STEP 5: Press enter when it shows Hardware ID
                      STEP 6: Press space bar 2x when asked
                      STEP 7: Turn off machine
                      STEP 8: Restore original BIOS
                      STEP 9: Reset BIOS settings to factory default

                      [ NOTES ]
                      When booting the patched BIOS you might have to:
                      - Hold the anti-tamper switch down the whole time (use tape)
                      - Remove the hard disk or replace it with a locked one
                      Attached Files
                      ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
                      https://www.badcaps.net/donate/
                      ----------------------------------------------------------------------------------------------------------------------------------------------------------------------

                      Comment

                      • volinakis
                        Badcaps Legend
                        • Jan 2021
                        • 2666
                        • N/A

                        #12
                        Re: ThinkPad x395 attempt at password removal

                        Originally posted by soulcoder
                        Hi. i have problem with x395.

                        Originally, the bios dont boot and play melody error. I dump the bios (Orinal.bin) and flashed one new. NOw when i boot up, asked for a password. I try patch the new bios with lenovo bios auto-patcher but i get melody error....


                        can u help me?
                        try this and follow the steps:
                        [ HOW TO USE THE PATCH ]
                        STEP 1: Flash and replace current BIOS with the generated patch file
                        STEP 2: Boot the machine
                        STEP 3: Press ENTER/F1/etc. to enter BIOS settings
                        STEP 4: Enter any character when asked for Supervisor Password
                        STEP 5: Press enter when it shows Hardware ID
                        STEP 6: Press space bar 2x when asked
                        STEP 7: Turn off machine
                        STEP 8: Restore original BIOS
                        STEP 9: Reset BIOS settings to factory default

                        [ NOTES ]
                        When booting the patched BIOS you might have to:
                        - Hold the anti-tamper switch down the whole time (use tape)
                        - Remove the hard disk or replace it with a locked one
                        Attached Files
                        ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
                        https://www.badcaps.net/donate/
                        ----------------------------------------------------------------------------------------------------------------------------------------------------------------------

                        Comment

                        • ddhlawi
                          Senior Member
                          • Feb 2017
                          • 165
                          • algerian

                          #13
                          I have X395 bios password Can one help me
                          Attached Files

                          Comment

                          • SMDFlea
                            Super Moderator
                            • Jan 2018
                            • 20477
                            • UK

                            #14
                            Originally posted by ddhlawi
                            I have X395 bios password Can one help me
                            Post the serial number...

                            RULES UPDATE for BIOS requests/offers AVOID BANNING, READ BEFORE POSTING
                            https://www.badcaps.net/forum/troubl...ng?t=103570​
                            All donations to badcaps are welcome, click on this link to donate. Thanks to all supporters

                            Comment


                            • ddhlawi
                              ddhlawi commented
                              Editing a comment
                              SN : PC-1KRJZK
                          • ddhlawi
                            Senior Member
                            • Feb 2017
                            • 165
                            • algerian

                            #15
                            Hi
                            I tried auto patcher with my x395 rayzan 5 but no display and play Melody

                            Think pad X395
                            CM : FA391/FA491 NM-C181. RÉV : 1.0
                            S/N : PC-1KRJZK
                            MTM : 20NM-S1U800
                            Attached Files
                            Last edited by ddhlawi; 12-19-2023, 04:03 AM.

                            Comment

                            • volinakis
                              Badcaps Legend
                              • Jan 2021
                              • 2666
                              • N/A

                              #16
                              Originally posted by ddhlawi
                              Hi
                              I tried auto patcher with my x395 rayzan 5 but no display and play Melody

                              Think pad X395
                              CM : FA391/FA491 NM-C181. RÉV : 1.0
                              S/N : PC-1KRJZK
                              MTM : 20NM-S1U800
                              try this bios and follow steps described in autopatcher
                              Attached Files
                              ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
                              https://www.badcaps.net/donate/
                              ----------------------------------------------------------------------------------------------------------------------------------------------------------------------

                              Comment

                              • ddhlawi
                                Senior Member
                                • Feb 2017
                                • 165
                                • algerian

                                #17
                                Originally posted by volinakis

                                try this bios and follow steps described in autopatcher
                                I follow all steps ok
                                but when i programmes it originally no display .After minutes i turne off forcément.
                                Now no allumage no charge.
                                There IS 5v 3.3v 1.8v and 3.3 in thé Betton on off

                                Comment


                                • volinakis
                                  volinakis commented
                                  Editing a comment
                                  so, patched file worked and you were able to unlock it. And when you put back original file laptop doesn't turn on, right? Check soldering and if your chipset is MX25L128 change it with a winbond W25Q128.
                              • ddhlawi
                                Senior Member
                                • Feb 2017
                                • 165
                                • algerian

                                #18
                                the same problem

                                Comment

                                • Mitolamito
                                  New Member
                                  • Apr 2024
                                  • 2
                                  • Japan

                                  #19
                                  Hello everyone.
                                  I am new member Mitolamito.
                                  I would like to offer my one tip on this issue that has been stagnant for 5 months now.

                                  I am a Thinkpad X395 user with Bios Lock applied.

                                  I have been trying to unlock this ThinkPad for about 2 weeks now, but have been unable to solve the problem.

                                  The tools I used are.
                                  Lenovo auto patcher
                                  Uefi Play-ground
                                  HxD
                                  Uefitool... etc.

                                  Today I decided to edit the EC chip and give up if it doesn't work.
                                  Since I was in the middle of the last work, I removed the Cmos battery and wrote the original BIOS back to the chip.

                                  Then what do you think? Instead of the dreaded key symbol, the Entering Setup.... appeared on the screen. Fortunately, I was able to enter the BIOS.
                                  Immediately I turned off all BIOS passwords, rebooted, and successfully launched Windows 11!

                                  However, this was a complete coincidence. In fact, I had no idea what I had just done to bring about this result.

                                  More however, one thing is for sure: there is possible that you can also unlock BIOS of X395 without an EC programmer like Vertyanov.
                                  I did not use an EC programmer this time.

                                  I'm tired of typing long sentences, so I'll stop here first.
                                  In my next reply, I will itemize the main tasks I did.

                                  Comment

                                  • 3mz3t
                                    Member
                                    • Sep 2023
                                    • 13
                                    • Slovakia

                                    #20
                                    volinakis I also have a t495s laptop with a supervisor password set (I know this thread is for X395, but it's the same motherboard).

                                    Can you please patch the attached bios dump for me so that I can try your method? S/N PC-1HF898

                                    Thanks.
                                    Originally posted by uvaiz

                                    yout service tag:BLLFQ72

                                    try
                                    thank you very much, i try tomorow and come with feedback.

                                    Originally posted by Bios Cracker

                                    Try and Update.
                                    Thank you very much, for your fast answer, i try tomorow and i come with feedback
                                    Attached Files

                                    Comment

                                    Related Topics

                                    Collapse

                                    • AppleLover123
                                      Lenovo Yoga X380 22LH Supervisor Password removal
                                      by AppleLover123
                                      Hey guys,

                                      have a laptop here that has a supervisor Password (dump in Attachements).
                                      Before i write the Serial NR.etc i wanted to say that strangely after flashing with 3 different Bios dumps and one from lenovos site
                                      the laptop works but everytime it wants me to type a supervisor password i never set.
                                      I thought the supervisor password is stuck in the ec bios but no it isn't either because after replacing the ec chip from one of another board it still has the supervisor password.
                                      Anyway i wanted to ask what of the two chips is the ec bios because on the left...
                                      04-17-2025, 03:42 PM
                                    • mferna14
                                      Password removal on MacBook Pro A2159
                                      by mferna14
                                      Hi friends., I am working on MacBook Pro A2159 touchbar 2019. The old logic board was liquid spilled so I ordered another logic board from AE. Received it & all worked fine till I got to the Chinese login screen where the login screen password tobe entered. I tried to reset the password but it again gave me options which I do not know about the Apple ID. I formatted the onboard SSD. & wanted to change the startup boot sequence but in order to change it, again the password is needed for that too. Is there a way to get rid of this password?? The seller has not replied back past 2 days, how...
                                      05-13-2025, 04:16 PM
                                    • Badpatch02
                                      Thinkpad X380 Yoga supervisor password removal + Intel ME removal question
                                      by Badpatch02
                                      Hi all, I'm new here, a few words about myself: CS student, interested in hardware stuff too - tinkering my whole life but with practically no experience when it comes to firmware "hacking".

                                      So I have this X380 Yoga with a supervisor password in place and before doing anything stupid I figured I'd rather ask.
                                      I plan on using the tool from this thread: https://www.badcaps.net/forum/troubl...password-remov...
                                      11-30-2024, 05:22 AM
                                    • Johnny h
                                      Asus M7600R BIOS Password request/removal
                                      by Johnny h
                                      Hello,

                                      I'm hoping someone can assist me.
                                      I have an Asus Vivobook 16x Pro OLED laptop which has a BIOS password, and I can't seem to find it.
                                      It still boots into Windows (boots from whatever SSD is installed but not from USB).

                                      The model number is M7600R and serial number is N8N0CX03H71131C.

                                      I tried AMITSESetup Decryptor but the password I got doesn't make sense (it's got a line break and special characters).
                                      I also tried to use *************** MOD EDIT ,redacted************** and it also gave me the funny password of
                                      Code:
                                      tmNx\'=QJQ
                                      ...
                                      04-10-2024, 06:13 AM
                                    • coolshrimp
                                      T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal
                                      by coolshrimp
                                      Here is all the info you should need to remove bios password from your same model or one with an MEC-Chip and also write back the config data

                                      T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

                                      See Diagram for Wiring.

                                      Use MEC-1633#ISP on your RT809h
                                      This is same Jtag pinout and method for T490S/X390
                                      (But your R/W 10K Resistor Location May In a Different Location)


                                      MEC-Chips Store Bios Password In a Secure Un-Editable Area

                                      Following steps clear that secure area to re-initialize itself to default (Blank)
                                      ...
                                      10-24-2022, 12:18 AM
                                    • Loading...
                                    • No more items.
                                    Working...