[Need Help] Bricked ThinkPad T480 BIOS

OK, you really got a bricked update here. You lost structure in the second static uefi colume in the bios region- left update bios region, right your bricked bios.

51.jpg



Which version were you updatng to and which version were you updating from? EC firmware is first padding in bios region, separate file in lenovo updates (*.fl2). Version is N24HT36W, according to Lenovos bios update page this would be bios 1.36 or bios 1.37. Comparing the static bios volumes up- down shows they’re identical for bios 1.36 (W) to the bricked area, looking for the not- updated part it’s version 1.19, you find a hint for N24ET44W in the lower part.

So either you replace EC firmware and bios static volumes with old or new versions. EC firmware is normally copied from bios padding into the separate controller chip, but since the firmware you got by Sweet Kitten has an even older EC- firmwar and starts, it possibly won’t matter.

Rename the attached files to unb.zip.001 unb.zip.002 unb.zip.003, the zip will contain 2 files- one everything back to old version (1.19) and one version everyting to the newer version (1.36).

unb.001.zip (6 MB)

unb.002.zip (6 MB)

unb.003.zip (4.92 MB)



Thanks @Sweet_Kitten , that didn’t work though. I get the same result as with the bricked one (same beep pattern etc.)


I don’t know @lfb6 - it’s a company laptop, so the update happened automatically.

But: Both of your images seem to work! The errors are gone, except for the "Check Date…" one. But when I press F1 for the settings, I get prompted for a password, which i assume is supposed to be the BIOS password?

It was not there before, so I’m not sure what to enter here. Is this related to the new image or is this some other guard that is not happy about the change? Is there a way to get rid of it or find out what it is?



Thank you guys so much!

Zitat von quasdunk im Beitrag #11

I don’t know @lfb6 - it’s a company laptop, so the update happened automatically.



I found out myself as written already in #10.

Yes, both images were expected to work. As explained, I just repaired the static parts of the bios region, and transfered your NVRAM settings, complete EFI- volume. That should’ve put back your system to the state before the update.

But you tried a ‘foreign’ bios in between (without transfering your machine specific settings first), and you got an error about the security settings:

Some newer business machines store such passwords outside bios, too, so that it should be harder to overcome. The foreign dump you tried worked in the original thread, or it’s not mentioned that it contained a password? Maybe that is kinda interference between those 2 bioses? ‘Foreign’ one had a supervisor password which got stored into the security chip and is still there? I don’t know!

There are lots of pages regarding Lenovo bios passwords, for example that page, seems it covers several generations, CMOS battery is quite old, ‘shortcut security chip’ seems for newer machines. Be aware: Resetting the TPM/ security chip might destroy your data. If you for example use BitLocker resetting the TPM will make your data unaccessible if you don’t have the recovery key.

I read the information that the swap of the ME region to updated version helped someone, but it did not do you any good.
Here is a BIOS in which I tried to remove erros only: BIOS.bin. Unfortunately, I can’t offer anything more.


Are you kitten kidding me? You pointed me to a (sort of) working firmware, that’s way more than I had hoped for and it did help a lot! So thanks a ton for your effort!!! @Sweet_Kitten


Sorry @lfb6 I guess that was a little too technical for me so it flew over my haead.


Sweet Kitten had linked to the source - it doesn’t mention anything about a password.


In case the security chip is the other one on the board with 8 pins and a firmeware of 1048576 Bytes - I’ve got that backed up. Maybe I’ll try to flash that back.


Alright, that about matches what I found, too. The approach looks quite ‘adventurous’, but might give it a shot if everything else fails. I don’t really care about the data on the hard drive, since it’s basically just the operating system to manage all the cloud services and network drives. So there is no sensitive data there. But thanks for the heads up, and also thank you so much for bearing with me! I’ll let you know how it worked out!

So, I actually got it working

A user over at badcaps.net, where Sweet Kitten linked the first image from, has build a LENOVO BIOS AUTO-PATCHER for Supervisor Password Removal.

So I downloaded that tool and pretty much followed the instructions lined out in the thread using the unbricked_old.bin that @lfb6 had uploaded. So basically:

1. Run the tool on the unbricked image
2. Flash that image to the chip
3. Boot up and follow instructions ← this gets rid of the supervisor password
4. Flash the original unbricked image to the chip again
5. Factory reset BIOS (which is now accessible without a password!)

It does look a bit shady though, ngl, so I’m not sure yet what to think of it and if it didn’t introduce some unwanted guests or something.

But: It did work. After that, the machine did boot normally without any errors or warnings. Bonus: BitLocker was still in place and accepted my old password, so I was able to recover everything and everything is working as if nothing ever happened!

Thanks so much to both of you, @lfb6 and @Sweet_Kitten !

Thanks for the feedback! Saw some commercial offers that did use a method like this (probably same), but didn’t find this ‘auto patcher’ on badcaps.

i don’t know the tool, but would introduce some malware to the bios that affects the windows boot and injects some paylod, alredy happen in some gigabyte an or asus motherboards.
i would not use windows any more in that machine for securety reasons

Well, you don’t know the tool, but suggest that the (HP specific) tool plants malware in the bios for ASUS and Gigabyte boards.

Would you mind adding a little more substance to these claims like some references for example?

Did you used clip for flashing or did you desoldered chip from the motherboard?

Hey Stefan,

I just used a CH341A clip, didn’t need to desolder anything

Thanks for reply, i got the same problem as you had, which programmer tool you used?

Take a look at my original post, I documented everything I did.

I used flashrom (flashrom.org) to read from and write to the chip. Other than that, see my reply above on how I got the BIOS working again (or rather how lfb6 and sweet kitten did :smiley: ).

I’ll try to help if you have any questions, but it’s been a long time and I forgot most of the stuff :smiley: Laptop is still working like a charm though :+1:

Right now, keyboard lights up for a second, and then nothing. The CPU fan spins couple of times and that’s it. I tried flashing couple of .bin files (also dump from Sweet Kitten) with CH341A Black programmer with a clip and NeoProgrammer and AsProgrammer (both latest versions). Charging works, i can see orange light and later it becomes white.
And yeah, laptop worked before normally, all this happened because i wanted to remove supervisor password, and because of that now the laptop is dead. I found the original BIOS dump files on the external hard drive that i saved before, and turns out it is encrypted.

1 Like

How come the original BIOS dump files are encrypted?

I don’t know, it simply doesn’t look similar to other bios dumps…

:worried:

You could post a link to it and the mods, perhaps modders experienced or acquainted with this one can take a look and figure something out. Since you have a programmer you’re not as restricted as other people.

In addition make a fresh dump of the SPI and let’s see what’s actualy stored there

Turns out, motherboard are shorted somewhere, that’s the reason why it can’t boot up.

same problem