[Request] Unlocking Lenovo Legion 5i BIOS

@dglt - You also don’t need to add/remove power anymore, since you know what method works that is all you need to do now.
This may be when you change the setting you changed about XTU, this changed something on EC/KBC FW, and that may be the issue. This is on other chip, sometimes you can’t even read/write this chip without doing via KB ribbon cable.
Do you see any other SOIC8 chips? If yes, show me image or give me their ID’s, so I can look up and tell you if you need 1.8V adapter to dump them, or you can look them up. Then dump once you know and let me check

No, if you cannot see burned traces, or lifted trace, or blown part, there is no way to see what is wrong/damaged (if anything)

FPT makes two dumps because that is what the batch file you used creates. YOu may make MANY different sizes of dumps, of different regions of the BIOS with this tool.
What you dumped in this case is all from same chip, one is FD+ME+BIOS region and one is BIOS region only.

If something is getting very hot, that is often a bad part, or some part connected to it via traces is bad (which you cannot find unless you are a specialist at this kind of work)
Nothing should get overly hot, especially with just being plugged in. Sounds like something is bad, either blown out, or voltage protection circuit tripped, or there is a short internally somewhere.
“Hazy” chip, that could be blown out, hard to say

Please zip (max compress while zipping too), all those images for me, thanks


there are a couple i didnt see before that look like they could be soic8, i do know that whenever i updated/changed bios versions the bios and ec were programmed separately one after another. is it possible to have bios on an SOIC8 chip and then have the EC on a WSON? because i see both types.


in the pictures from my previous post i tried to include closeups of any chip i thought might be bios/ec related. and i actually have a 1.8v adapter for the programmer


i figured something was wrong but at the same time i dont understand how something like this could happen from using that modded bios or enabling XTU interface.


i think you underestimate my level of stubbornness . joking aside though im not a professional but i know i can do whats needed, if i can find the problematic component i can order another and i have no concerns about soldering which i’ve done plenty of times in the past.

you tell me if this sounds like a valid plan, or please do suggest another way if it’s not right.

1. add power
2. starting at the hot chip, i would work my way through each component seeing where the power stops being passed through to the other side almost like you would do with any fuse.
3. document on images where the power path is and where it starts/stops
4. if something sticks out as broken, order/replace it


ok, i’ll do that now and add the compressed archive to this post.

thanks again for helping me work through this, it really is appreciated and not that i think you only do this for $$ but i think it’s only right for you to be compensated for your time/knowledge and i’d be more than happy to increase the amount i previously offered if you can continue helping me get this laptop up and running.

EDIT: maximum compression archive of pictures from front/back of motherboard
https://drive.google.com/file/d/1gYF97Yl…iew?usp=sharing


EDIT#2:

CHIP TYPE/MARKINGS:

- "hazed" wson 8pin : "4508NH" search shows its a sinopower MOSFET
- chip next to "hazed" chip (wson 8p) "4513NH" . search shows its a sinopower MOSFET
- wson 8p labeled "PK5E4BA" is another MOSFET

- the only other similar size SOIC8 chip i can see on the board is marked "AH2007" , im attaching to this post a close up of said chip.

EDIT #3:
i managed to dump data from the only other SOIC8 chip labeled "AH2007" using colibri since AsProgrammer 1.4.1 wouldnt detect it.
link to AH2007 chip dump : https://share.unixfy.net/ah2007-chip-dump.bin

AH2007.png

@dglt - Ask dud2002 why ME FW does not match in original BIOS you sent him and mod BIOS he sent back to you.
Maybe he sent you someone else mod BIOS ** See below ? But, even if so, it should have been OK. Main reason I noticed and ask this, ME FW region should not have been touched in his mod but it has a LOT of differences
I am comparing and talking these two dumps only, ME FW region only
original-bios-dump-from-chip = MD5 >> FA3B0309A4EB49B41B2FD9286F71236A
modded-version-of-original = MD5 >> 05C8C2DA80213929FE7CD3D22DDB7A06

Ahh yes, maybe this happened!! Maybe to save time, he already had mod BIOS region done or something, so sent you instead, or maybe just by mistake?
I see NVRAM also does not match, at all, and this also would not differ in the way I’m seeing, even if he modified some stuff there (which is not required for BIOS mods, but sometimes we do)

Never mind, I see what happened! What you sent me is just NOT the original BIOS you sent him to mod, you must have sent him some other file instead, and got confused on which you sent him, when you sent the files to me.
Please try to find and confirm which file exactly you sent him to modify, check your PM’s over there and find the link you sent him and download it, then send me this

Now, to your reply above

Yes, sometimes BIOS and EC would be on different chip types, sometimes even EC/KBC FW is on QFP type chip

The problem is you need to be a skilled technician to find bad parts, you can’t just poke with DMM and find it. What you outlined could work, possibly, if it’s something that simple, which it’s almost always not.
And you can’t trace what goes where without schematic and or boardview, due to multi-layer PCB (usually 6-8 layer) and you can only see trace on top or bottom layer, what you think may be from one item could be an entirely different trace from something on other side of board or back side of board etc

I do not help for $$, I mean, that’s not why I help I help users when I can, because I enjoy helping, that is all
I will continue to help, but sadly it’s not looking good thus far

Mosfet could be blown, or could be that way by default, hard to say. I doubt anything blew out during a BIOS settings change, most likely the issue here is something wrong in the EC FW, which we’ll never be able to fix

Sorry, I can’t download 151MB of images, please resize those to maybe half or less of their original resolution.

Colibri/ASProgrammer will both detect the chip, detection is only about lucky perfect physical connection, all software/versions will read “something” from chip once properly connected.
That is Gigadevice GD25LQ80 - I looked at can only say this does not look corrupted in a general sense, that’s all I can do here without comparison of dump from exact model on exact same BIOS version
This is 1MB chip, you dumped with 16MB size selected, so this is invalid dump (1MB repeated 16 times ) I cut one out, but if you want proper dump on your end and don’t know how to do that, redump with 8Mbit/1MB selected
This is RTX 2070 vBIOS

If worse comes to worse, you can request BIOS/EC FW dump from paid site like Vinafix.com, and they will get for you if they do not have already.
I think you can join for free, make a thread, discuss/request etc, and then once they provide the files you have to pay $3 for one day access or maybe $5, I can’t remember
But, EC/KBC FW will only help if you can find and read/write to the chip that contains this FW. Sometimes you cannot, except via KB ribbon cable, or remove and program in programmer that can handle that kind of chip
If it is on QFP package, this is Quad Flat Package, and can be 16-64-128 connections, like WSON only worse. It’s the kind of chips you see with tons of tiny connections all around all four sides. Ideally this is programmed through cable, it should not be removed/replaced for programming


i will send him an email now and ask why, i will update post with his answer after i hear back (usually quick response)

i just checked the link i provided him with the original dump (software, not ch431a) made and i think it’s the one i already provided but maybe im mistaken. https://share.unixfy.net/90o6wt8d.rar

in order to clarify i will list the order of events in order.

1. request bios mod, began talks with dudu and he had me run the bios backup tool (FPT?).
2. ran the tool which dumped a compressed archive on the desktop, then provided dudu a link to that dump (the link i posted above in this post)
3. dudu told me the only way to unlock my bios was with an SPI programmer so i ordered one, took a couple days to arrive.
4. in those 2 days of waiting for the programmer i was testing different VBIOS using NVFLASH from models that have the 115w power limit, i backed up my original before doing anything.
5. those vbios would only work in hybrid/optimus mode. when i switched to discrete mode the laptop booted but screen remained black.
6. to recover from the black screen issue, dudu had me use the SPI programmer to dump the bios chip and send him the dump. this is that dump: https://share.unixfy.net/invalid.bin
7. he sent back this for me to flash, https://share.unixfy.net/invalid.bin after flashing it i was able to boot again, i checked and the vbios i flashed were still there so i flashed my original VBIOS using NVFLASH. at this point the laptop was fully functional, i tested both hybrid and discrete mode and everything was working 100%.
8. shortly after making sure my laptop was 100% working, he sent me the modded bios https://share.unixfy.net/invalid.bin which i flashed and was able to boot from.
9. in bios advanced settings, i enabled XTU interface and i also changed the ram multiplier from 11 (2933mhz) to 12(3200mhz) since the ram that comes pre-installed is 3200mhz ram.
10. after save/apply settings, i only got a black screen. dudu instructed me to re-flash the modded bios in order to reset the changes i made but then the SPI programmer would not detect the chip any longer and i tried many many times. this turned out to be the SPI programmer going bad.
11. although i could not write to the chip or detect it properly i was able to manually set the correct chip type and i did a dump of the chip. https://share.unixfy.net/invalid.bin
12. after many hours of not getting the programmer to work, i went and ordered another. when it arrived i flashed the modded bios back on to the chip but the laptop would not post.
13. after not being able to fix the issue and dudu does not know what is wrong, and so i come here and ask for your help which i wish i had asked for in the first place


i know, i can tell from the other threads on this forum that you help regardless of payment and thats awesome. since my problem seems to be a little more involved i just thought it would be appropriate to make sure you knew i can appreciate the time/skill involved for which you should be compensated for, especially if the help im asking for is more time consuming. this is a brand new laptop less than a month old, and it will be a long time before i’m able to afford a new one so if your able to get me up and running again then an offer of $75-$100 is money well spent. either way, thank you very much and your help, it is very much appreciated.



is there any way of obtaining these board schematics or is it very unlikely?



ok, i’ll remove some and see if i can get them compressed even further

EDIT #1:
some key images, first 2 are of the back side. the third is the bios chip on the front side of motherboard.

EDIT #2:
@LOST_N_BIOS heard back from dudu, he says its impossible since he used the dump i provided. i sent him links to each file in the order we traded them back and forth but i dont think he checked them. he is also telling me that the other SOIC8 chip labelled "AH2007" is the EC Firmware chip. he is a man a very few words and leaves a lot unexplained, i think there is a bit of a language barrier making things a little more difficult.

EDIT #3:


i had to pay for access but thats totally fine with me, i’m looking for where i create the request right now.

is it possible that both you and dudu are correct and that maybe that "AH2007" SOIC8 chip holds both the EC FW as well as the VBIOS?

@Lost_N_BIOS i did another dump of the AH2007 chip in the correct size i believe. i have a request in for schematics and for EC FW over at vinafix.com but no response on the EC FW yet.
https://share.unixfy.net/ah2007-dump.bin

@dglt - Yes, I already have the above linked FPT dumps from you, those are not the files I was asking about when I gave the MD5 checksums above.
Please send me files from 6-8 in one single zip, with names that specify what they are or put in folders with description etc.

The main thing I was asking about, from what you sent me, I still have same question. Unless you sent me wrong file, something he didn’t modify for you and send right back, or part of what you describe above is inbetween what you sent me originally and what you sent me as the mod he sent back to you.
original-bios-dump-from-chip = MD5 >> FA3B0309A4EB49B41B2FD9286F71236A
modded-version-of-original = MD5 >> 05C8C2DA80213929FE7CD3D22DDB7A06

I assumed for the menu unlock, the above was what you sent him, and this was BIOS in working state
Then he sent back the mod BIOS above, and this was what bricked, or bricked after you changed some setting etc.
These two files are what my ME FW questions at #23 are about, and then my further findings/thoughts.

Seems like you need to clarify with him, what file he used to send you back mod BIOS at #8, which I assume is the file I asked about above (modded-version-of-original = MD5 >> 05C8C2DA80213929FE7CD3D22DDB7A06)
I want to see the exact file he edited, that was in known working state, to create the above file. This is not a file you’ve sent me

Yes, very sorry you didn’t ask me to help you with the mod BIOS from the get-go, we possibly would not be in this situation.
However, either of the changes you mention could brick BIOS, well not so much memory one but that can cause you to be in soft-brick state where you can’t get in BIOS or clear CMOS, but re-program would fix that.
XTU change in BIOS, I do not know if this also changes something in EC/KBC FW or not, so I couldn’t comment to much on that

You can try to find schematic and or boardview in Google, sometimes you can find for free, other times at paid sites. You’ll have to search for exact model + Boardview or Schematic, and then also with model of motherboard + schematic or boardview
The site I mentioned above for trying to request a dump, can also usually get schematic and boardview files, ask for all that at once + BIOS/EC FW. Then wait until they reply/add the files to site, before you pay to join and download stuff.

I’d prefer non-cropped images, I mean, don’t crop down to any single chip, I want to be abel to see both sides of the board. Two images is fine, 2-4K would be OK for two images, put in max compressed zip.

As to the AH2007 chip, please dump that again, twice, once using 1MB and once using 512MB.
I think this is same vBIOS twice, in the 1MB cut I made, from the 16MB dump you sent, but I need to see 512kb dump first to be sure, since I’m not super familiar with Nvidia headers, footers, signature files etc.
Due to that, until I see a correct sized dump and then a 512kb dump, I can’t be sure if what I see at end of my 1MB cut is part of the vBIOS, or possibly something else.
Thanks for above dump, sorry, I didn’t see that until i already typed above. This matches what I already cut from the 16MB you sent, can you please now dump 512KB from there too

@Sylar76 - Can you look at vBIOS dump at post #25, is this just duplicated 512KB, or smaller, vBIOS, duplicated + header/signature at end, or is there other non-vBIOS related data in there?
Thanks for your time poking around for us

@Lost_N_BIOS

It’s a TU1xx bios with uefi gop duplicated twice as always.

This escalated quickly.

I’m a bit confused.

Chrome and windows won’t let me download or run uniextract161, claims it’s a virus? Could the mirror I was linked be compromised or should I just ignore the warnings?

RE: dglt. Do you need any files from me?

edit: Will try to extract from temp

edit2: Is there a way to make sure my laptop isn’t fubared along the way? Mitigate risk? I’m a bit nervous after reading the Saga of the 17 inch dead Legion.
---------------------

@Lost_N_BIOS Ok, I’m struggling with the innosetup. I’ve never felt more useless in my computer life (regular life I’m way worse, so no problem there).

I’ve opened the bios exe in inno setup compiler, gotten a lot of strange characters and checked my temp folder. Can’t see anything there.

@Sylar76 - Thanks man!

@gentlemantroll - Do you still need link to uniextrat161, I can upload for you, or you can ignore (this link is OK, it’s from the creator of the tool - https://www.legroom.net/files/software/a…iextract161.exe) - You only need this if you plan to extract or make edits yourself
I did not make the BIOS that created the fiasco you see above, so you should not worry However, please read what he did/changed in BIOS, so you don’t make the same mistake he did
If you use XTU now, I suggest you reset it to default and then uninstall, since you can make all changes there in BIOS anyway. If you do not use XTU now, then do not mess with XTU stuff in BIOS, ignore it

On INNOExtract, you run the exe from CMD Prompt at that folders location, and then files are extracted to a new folder right there in the Inno folder. Example below of extraction on this BIOS

InnoExtract.png



Anyway, none of this is useful to you for BIOS unlocking. Please see post #5 as mentioned and do that stuff, then we can see if you can flash in mod BIOS on this model without flash programmer.

Ok, thanks @lost_n_bios you’re a superhero!

Will continue my quest for glory, bios and low voltage later today. May all the low voltage belong to the people!

Also avocados should be cheaper and not finance crime in Mexico.

@gentlemantroll - You’re welcome, and thank you too!
That’s too funny about the avocados, I’ve seen a show or bit on a show about that on TV too, crazy!!

@Lost_N_BIOS Ok, I’m still fucking this up somehow. My ambition now is just undervolting. Advanced bios is waaaay out of my league at this point.

When I run innoextract I get this error: https://ibb.co/4Z52yYv (image link, didn’t get the img-tag to work)
Hms.

@gentlemantroll - To use img tags, you need to put direct image URL in there (such as this one for your image https://i.ibb.co/BVSGDrW/error-innoextract.png), not URL to the “View image” page, that’s probably the mistake you made
Or, you can also do advanced reply here >> on right, then in there you will see attach function on right, you can auto insert and it will put clickable thumbnail, or you can put full size image if it’s not huge - Upload, the click insert, also explained here
Are you trying to extract the Insyde EXE or the Lenovo one >> not unpacked with z7ip or Uniextract first? It looks like maybe you’re trying the Insyde one? You can only use Inno with the exe direct from Lenovo to get the Insyde EXE

But, as mentioned, none of this extracting is going to help you with unlocking BIOS. Stock files such as your trying to get are not used here

if undervolting is the only goal, for all EFCN**WW bios versions from 32 to 39 have the undervolt bit in RU you’d go to “CpuSetup”, then change “0xDA” (named “overclocking lock”) from 01 to 00 >> save/exit >> undervolt from xtu or throttlestop

@dglt - Yes, if that is all he wants, and not unlocked BIOS menu, then change change can be made like you mentioned, if that is what unlocks XTU/Throttlestop to allow undervolting.

If @gentlemantroll want’s unlocked BIOS menu, he just needs to go to post #5 and do that, so we can get started

i think he’s just having trouble extracting the bios. you mentioned the innoextract method, for me i just ran the update .exe file >> choose extract only >> extract wherever.

in regards to my issue, i think the best way to go would be to attempt to warranty it first. i have the normal warranty and the extra accidental coverage so i’ll try one of them (and likely fail), and if that doesnt work out i will replace what i beleive to be the damaged chips and go from there. thanks for your help anyways


EDIT: never mind, i just read post 5

@dglt - Yes, I keep telling him that NONE of that is needed for me to help him unlock BIOS, but I am not sure if he’s not getting what I’m saying, or trying to go ahead anyway for other reasons?
Sorry I couldn’t help you fix your system!!! Just tell them bad “AUTO” BIOS update caused by windows updates, not that you updated BIOS manually, then they can’t deny you based on BIOS update failure since it’s Microsoft’s fault


i think the major obstacle is removing the liquid metal residue from the heatsink, then they could also deny the claim if the "void if removed" sticker is removed and it is even though those stickers are not suppose to even be legal here in the states.

if i cant argue my way to warranty coverage then i’ll have to solder/replace the bad component/s myself. right now it’s nothing more than $1600 paper weight so i have nothing to lose at this point

Yes, that kind of sticker is not legal, if that’s mentioned, show them the law and ask them if they would like to speak to your lawyer
They may not remove the heatsink at all, especially if you just say bad BIOS flash, they may just reflash it and send it back. They’d notice the EC FW issue too and reflash that right then as well.

thats what im hoping for but i really think it’s a hardware issue so it’s probably gonna come off since the mosfet i suspect is blown is on the back of the motherboard. i’ll clean the heatsink plates as best as possible and apply a healthy over application of noctua nt-h2 and that should cover everything up well enough until they start putting things back together and clean it off but it’s too late by then.