[REQUEST] Help to remove BIOS PowerOn Password from HP Zbook Studio G3

Hi Guys i have a HP Zbook Studio G3 with PowerOn BIOS Password and cannot remove it that have a BIOS CHIP 25q128fvsq i use a ch341a to read the chip and take a Backup of that with ch341A Programmer 1.29 (Selection_999(773).png image), read the content OK but if use the Verify button send a message that Don’t Match

With with ch341A Programmer 1.30 the same message, of mismatch in the verify (Selection_999(776).png image)

The Full MB data are: HP ZBook Studio G3 Mobile Workstation LA-C401P APW5U Rev: 1A


That is a normal situation or in effect the Reading are Wrong?

Some on can help me to know what need to modify from the Bin file or if exist another method to do it?

The Backups are in the rar files attached, are Winrar 5 version of the Files

as comment the Verification failure dont make sense for me so i run it again over Linux OS and now see
Backups]$ sudo flashrom --programmer ch341a_spi -r 25q128fvsq-Zbook-Studio-G3_Linux.bin
flashrom v1.0 on Linux 5.1.16-200.fc29.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on ch341a_spi.
Reading flash… done.
Backups]$

and make the Verification
Backups]$ sudo flashrom --programmer ch341a_spi -v 25q128fvsq-Zbook-Studio-G3_Linux.bin
flashrom v1.0 on Linux 5.1.16-200.fc29.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on ch341a_spi.
Verifying flash… VERIFIED.
Backups]$ 

So now i have a message o Verified as i’m expect
the other binary shows failed
Backups]$ sudo flashrom --programmer ch341a_spi -v ‘25q128fvsq-Zbook-Studio-G3_(ch341A Programmer 1.30).bin’

flashrom v1.0 on Linux 5.1.16-200.fc29.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on ch341a_spi.
Verifying flash… FAILED at 0x00801844! Expected=0x29, Found=0x28, failed byte count from 0x00000000-0x00ffffff: 0x1e1ef4
[fcatarino@SparkyII Backups]$ sudo flashrom --programmer ch341a_spi -v '25q128fvsq-Zbook-Studio-G3_(ch341A Programmer 1.29).bin’
flashrom v1.0 on Linux 5.1.16-200.fc29.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on ch341a_spi.
Verifying flash… FAILED at 0x008008e8! Expected=0xcb, Found=0x0b, failed byte count from 0x00000000-0x00ffffff: 0x210c24
Backups]$ 


i read the another chip too 5q80dvsig, because dont know if needed to make the unlocking

Backups]$ sudo flashrom --programmer ch341a_spi -r 5q80dvsig-Zbook-Studio-G3_Linux.bin
flashrom v1.0 on Linux 5.1.16-200.fc29.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q80.V” (1024 kB, SPI) on ch341a_spi.
Reading flash… done.

Backups]$ sudo flashrom --programmer ch341a_spi -v 5q80dvsig-Zbook-Studio-G3_Linux.bin
flashrom v1.0 on Linux 5.1.16-200.fc29.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q80.V” (1024 kB, SPI) on ch341a_spi.
Verifying flash… VERIFIED.
Backups]$



Best Regards, Franco

Selection_999(772).png

Bioes.part1.rar (5 MB)

Selection_999(773).png

BiosLinux.part1.rar (5 MB)

BiosLinux.part2.rar (2.72 MB)

Try to use CH341A Programmer 1.34 or CH341Programmer 1.38

Hmm, I just came to tag you about this @DeathBringer - He sent me PM, but I don’t know about this.

For W25Q128FV you need to use 1.18 version CH341A software (for valid read only), or use ASProgrammer 1.41, otherwise other versions always fail (at read sometimes, but write always).
For write to this chip, only Colibri (included below) or ASProgrammer 1.41 has been confirmed working here by others - Have not tested 1.38 but 1.34 fails

I thought he got valid dumps with flashrom? But I didn’t check. Looks like verified at first result above?