Recently, I bought a broken Lenovo Thinkpad W550s off of Craigslist for around $50. It would boot sporatically, only when I changed the amount of RAM in the machine. Strange issue. I got it to boot, then updated the BIOS. Once I got the machine booting consistently, I realized that there was also a supervisor password on the BIOS!
https://www.badcaps.net/forum/showthread.php?t=87588
I did this on Ubuntu with python and flashrom installed.
I connected the SOIC8 chip clip to the BIOS chip on the W550s, then plugged the CH341a USB EEPROM flasher in to my reading machine.CH341a flasher connect from my Thinkpad 11e to my W550s BIOS chip
In the Ubuntu terminal emulator, I used flashrom to pull 2 copies of the BIOS off of the N25Q128..3E chip. I then compared the 2 images using md5sum in order to see if there were any inconsistencies between the files.
I had some initial issues with the BIOS images. They were consistently the same, but when read with a hex editor (okteta), they shown only zeros. I readjusted my my clip on the chip, and then ran the flashrom commands again and it worked.
Then I used the autopatch python script to patch the BIOS file
Let’s follow those instructions
Flash the patched BIOS file to our chip
I’ve entered gone in to the supervisor prompt, typed in some random letters for a password, and pressed “enter” on my keyboard. I’m met with this screen:
 |
| What a supervisor password entry screen looks like |
I used the autopatcher tool here on badcaps.net compiled by Knucklegrumble to patch my BIOS and remove the supervisor password
https://www.badcaps.net/forum/showthread.php?t=87588
I did this on Ubuntu with python and flashrom installed.
I connected the SOIC8 chip clip to the BIOS chip on the W550s, then plugged the CH341a USB EEPROM flasher in to my reading machine.CH341a flasher connect from my Thinkpad 11e to my W550s BIOS chip
 |
| Lenovo on Lenovo violence |
In the Ubuntu terminal emulator, I used flashrom to pull 2 copies of the BIOS off of the N25Q128..3E chip. I then compared the 2 images using md5sum in order to see if there were any inconsistencies between the files.
sudo flashrom -p ch341a_spi -c N25Q128..3E -r W550s_1.binsudo flashrom -p ch341a_spi -c N25Q128..3E -r W550s_2.binmd5sum W550s_*.bin
I had some initial issues with the BIOS images. They were consistently the same, but when read with a hex editor (okteta), they shown only zeros. I readjusted my my clip on the chip, and then ran the flashrom commands again and it worked.
Then I used the autopatch python script to patch the BIOS file
sudo chown martin:martin W550s_1.bin./autopatch N25Q128..3E -r W550s_1.bin./autopatch --howto[ HOW TO USE THE PATCH ]STEP 1: Flash and replace current BIOS with the generated patch fileSTEP 2: Boot the machineSTEP 3: Press ENTER/F1/etc. to enter BIOS settingsSTEP 4: Enter any character when asked for Supervisor PasswordSTEP 5: Press enter when it shows Hardware IDSTEP 6: Press space bar 2x when askedSTEP 7: Turn off machineSTEP 8: Restore original BIOSSTEP 9: Reset BIOS settings to factory default
Let’s follow those instructions
Flash the patched BIOS file to our chip
sudo flashrom -p ch341a_spi -c N25Q128..3E -w W550s_1_PATCHED.bin
I’ve entered gone in to the supervisor prompt, typed in some random letters for a password, and pressed “enter” on my keyboard. I’m met with this screen:
*Picture of the screen*
I followed the remaining instructions, but forgot to take any pictures!
What’s left after all these steps is a completely unlocked Lenovo Thinkpad W550s.
Big thank you to Knucklegrumble on Badcaps.net for creating this very easy to use tool!
What’s left after all these steps is a completely unlocked Lenovo Thinkpad W550s.
Big thank you to Knucklegrumble on Badcaps.net for creating this very easy to use tool!
Comments
Post a Comment