[Tool] Lenovo (H2O) Bios Unlocker and Locker

BIOS/UEFI Modding BIOS Modding Guides and Problems
1

USE AT YOUR OWN RISK,I won’t be responsible for any damage.

THIS DOES NOT WORK ON 2022 MODEL

.

Update: All new Version and tool will be released on my GH page, this include a new Tool that work also on 2022 model, and the newer bios, but is not a Permanent unlock, setting are saved but the gui relock after a reboot

Check https://github.com/SmokelessCPUv2/SmokelessRuntimeEFIPatcher#lenovo-bios-unlock

should work on every bios with the "!cE" variable as described below, most likely AMD ryzen Ideapad, Yoga, and legion are supported, but check to be sure
Edit: Tested and Worked also on Intel One
Tested on:

Legion 5 15arh05h CPU: 4800H GPU:1650ti Bios: EUCN31WW, User:@AARCH64_EL3
Legion Y540-15IRH CPU: i5 9300h GPU:RTX 2060 BIOS:bhcn26ww
Legion 5-15ACH6 82JW Bios: HHCN23WW
Ideapad Gaming 3-15ARH05- 82EY Bios version FCCN16WW
Legion Y700 15-ISK, BIOS: CDCN54WW.
Legion 5i Pro 2021 with firmware H1CN33WW.
GKCN49WW on a 16ACHg6
Legion 15IRH 21ww and 26ww
Legion 5 pro 16ACH6H bios version GKCN49WW
AMD Legion 7 2021


Known not Working Bios (I will not try to make a soft-unlock for these):
* H1CN45WW is not supported, use H1CN44WW


I need a SPI Flasher?:
No

My bios Is supported by this:
To check if your bios is Unlockable by this: search for "cE!" unicode text in UEFI tool, if at lest 2 result are found (one on DebugPageDxe and the other on H20FormBrowserDXE), you can give a shot:

How run it:
it a simple EFI app, copy in a fat32 USB as EFI/boot/bootx64.efi, and boot from this USB, or use the new Windows app.
UPDATE:
Windows App released, run once it unlock, run again it relock, use at you own risk. (Run as Administrator)
The windows App might return "The system could not find the environment option that was entered" even if The variable is successfully created, Just reboot to check, I could Implement a more robust check logic, but I’m lazy
Tools Used and Resource:
* UefiTool
* 010 Editor
* QEMU
* UEFI Spec 2.9
* Ghidra

Ps: I don’t know how many of these unlocked settings are effectively working, I didn’t wanted to brick my laptop changing stuff like PSTATE or DRAM timing.

Unlocker_Windows.zip (8.23 KB)

3 Likes
2

Good job. Why didn’t you release it even earlier?

3



Because I didn’t had the necessity, I did it for personal purpose, today I received a Notification from my old post, and decided to release it

Let me know, if you try and works.

4

has this been tested on EUCN33WW i shared my bios file on the attachments yesterday i don’t wanna risk breaking my system

EDIT: it works holey moley thanks man i wanna donate someday but unfortunately i don’t use paypal
after a bit of digging around i found the IOMMU option and the setting to turn off tpm entirely to avoid win11
anyone know where is the option to increase iGPU vram i don’t wanna mess my screw up by accident
most of the dangerous settings in the bios are switched to auto i have no idea what those do

5



Glad to see that helped, if you provide me with the exact model of the laptop, I’ll add it to the know tested list

6

Confirmed working on Legion 5-15ACH6 - Type 82JW Bios version – HHCN23WW. https://psref.lenovo.com/Detail/Legion/L…H6?M=82JW0012US
I would assume this means it will also work on any other laptops running HHCN23WW, which is most of the 2021 lineup, I think.

You might want to stick a link to this in here – [REQUEST] Unlock advanced menu on 2021 Lenovo Legion 5 PRO AMD – I think there were talks of a bounty for whoever managed to unlock the advanced menus and I’m guessing this may work on a few of the devices in there.

7

Worked on Lenovo ideapad Gaming 3-15ARH05 - Type 82EY Bios version – FCCN16WW

8

It is Working, in many more lapton that I tought, that’s amazing

9

Maybe even on any Lenovo with the white-colored new BIOS interface. Such has a form browser type you reverse engineered.

10

Thanks for your effort and sharing!


Please do write some tutorial or guide about reverse engineering part if your time allows, much appreciate!

1 Like
11

This is amazing!!! This worked on Lenovo Y700 15-ISK, BIOS: CDCN54WW. I tried looking in UEFITool and did find cE! variable on 2 locations but not as you mentioned. However, I gave it a try and it flippin’ worked! Thank you so much!

12

Nice , but here is no overclocking settings in advanced bios((

13

Unlock of overclocking may require to modify the BIOS.

14


If you have and AMD machine, it is under custom PSTATE, if I’m not wrong,
there should be also some option for PBO
I think that I should tell you: Think twice, before modifing anything voltage/clock related, as is something go wrong(Unstable clock, so unable to go to bios), could be a bit difficult to recovery.

15


Please do write some tutorial or guide about reverse engineering part if your time allows, much appreciate!


Ok I’ll do it , will take a bit of time, but in a couple of week should be finished

16


If you have and AMD machine,


no, my laptop Legion Y540-15IRH , specs: i5 9300h, rtx 2060.


Think twice


Yes , I know how its hard to modify BIOS. Hopefully someone will do it someday, because I won’t be able to saddle it myself.

17

UPDATE: I have released a Windows version, so no need to create a USB, Just run as admin.
Check first Post for the app.

If someone is intrested I can release also the source Code, as the exe is not obfuscated is also easy to reverse, so keeping the code private has little to no sense

18

It was also working on Legion 5i Pro 2021 with firmware H1CN33WW.

Would really be interested on the mentioned write up how you did the reverse engineering.

After updating to firmware H1CN45WW it stopped working, so I would be interested to find out what changed.

[short update]
flashed previous version H1CN44WW and unlock is working again
So it looks like they changed something in version 45 from december 27th

19


I’m working on it, but it take times, as I shold write a bit on how UEFI modules work, and common structure, I’m trying to summary Two book and a thousand page of Specification in a couple of page, so is not that easy.

Regarding H1CN45WW, is completely different, the debug page and debug setting switch seem gone on this version, I most likely that they patched. (Or maybe the old one was a Debug Build, and now there build as Release Version)

20

Great news. Just take your time.

That’s a pity. Than I’ll stick with v44.