[TOOL] Lenovo (H20) Bios Unlocker and Locker

Can you try the method I said with all the NVMe drives disconnected? No NVMe, no battery, no CMOS. plug charger and let it run for a minute. If it doesn’t turn on automatically press power button.

  1. Format a FAT32 usb drive with a partition of no more than 128MB, using diskpart, and copy bios file onto the formatted drive. You could name the drive Crisis_Recovery.
    2. unplug both batteries
    3. Press power button for 1 minute
    4. Plug in the cmos battery alone.
    5. Hold down Fn+R (with one hand)
    6. Plug the power cable back in (do not connect the main battery)
    7. Wait for flashing light activity from usb stick (this means crisis recovery has been activated)
    8. Let go off Fn+R and let the recovery process complete.

    I wrote a guide for my notebook here: https://forums.lenovo.com/t5/Gaming-Lapt…?page=1#4178802

    Edit: Not every USB drive is suitable for this kind of recovery. Generally, you want an older generation USB2 drive of maximum 8GB. Also, be sure to plug it into the USB 2.0 slot, not USB 3.0.



This laptop (at least my model 15ACH6H) doesn’t turn on without the battery plugged in. It does however with no batteries just the charger, which is the way I managed to recover from bricked bios.

Yes, that’s what I mean. Use just the charger. Don’t plug in the battery until recovery is done. My notebook never goes into recovery mode when the battery is connected. Instead, I get a red light when I press Fn+R when the battery is connected. Also, he could try another ram after clearing cmos.



No, I mean the laptop will not turn on to do the recovery withouth the battery. Battery has to be plugged in.

Gotcha! I suppose these things are implemented different ways now.



Yes. However, Ziraaa and I have the same bios, and GKCN49WW must have a different recovery method, as the Fn+R isn’t seem to be working for me either with this version. It was working for me when I was messing around with the GKCN34WW version, and bricked, I could just use the Fn+R method to recover. This time it doesn’t work. However as I said before, unplugging both the battery and the CMOS battery, and plugging just the charger manages to clear the CMOS and boot the device. Not sure why isn’t it working for Ziraaa. Maybe without the NVMe or with the spare RAM that doesn’t have modified SPD should work.



Not worked, thank you.



Not wroked again.

Is there any other suggestion before spi flash?



For SPI Flashing, you’ll need the BIOS region extracted from the bios.fd, otherwise you can’t flash it. it has to be 16MB.

Hello,

@AARCH64_EL3 may I ask if I can get the source code very please?

Maya

Dump first before reflashing, for a proper reflash, you have to copy some region of the dumped bios in the fresh one, otherwise you loose serial number and other laptop specific stuff.

Zitat von AARCH64_EL3 im Beitrag #213

Dump first before reflashing, for a proper reflash, you have to copy some region of the dumped bios in the fresh one, otherwise you loose serial number and other laptop specific stuff.



For extracting bios file from .fd file, I’ve searched for "IFLASH_BIOSIMG" in .fd file on a hex editor. I copied the content starting from the next offset of IFLASH_BIOSIMG until 1000000th block (from offset 0017D050 to 0117D040) to a new .bin file. This gives me a file which is 16.777.216 bytes, I think it is the correct size for a bios file. Am I doing it the right way?

But I don’t know which parts I need to copy from dumped bios file to this fresh bios file.

Hey, did you perhaps try all the usb ports? For me some works some doesn’t. Give it a go if haven’t already.

If you don’t want to share the code it’s okay I understand but please tell me if that’s so, so I don’t wait pointlessly for it please, @AARCH64_EL3

Maya

Sorry @SadMaya , I missed your last message, I already posted the code some time ago, replying to someone.
If is not there anymore, let me know and will upload again if I have on my current SSD,

keep in mind that I don’t check WinRaid every day, so I could take a day or two.
If you don’t want to wait, the code is not obfuscated, so reversing it is pretty easy, or even better you could create you own version… xD

It’s okay, thank you very much for responding,
I do see the message where the person asked you for the code but I don’t see any file attached for some reason, may I ask if you could upload it again please?

hey guys sorry to interrupt (not sure if this belongs here or in the old thread i dont want to bump the topic)
so far everything works as intended but does anyone know the key combo to unlock the advanced menu? have you managed to find it after reversing the bios firmware? so basically i want to re-lock the bios and then open it naturally this time using the keycombo
im having some slight issues with the unlocker when i run this script in ubuntu liveCD [https://github.com/T-vK/MobilePassThrough] the terminal just hangs even after i reset the bios and re-run it (back then when i used this program it loads just fine even after tweaking bios anyone getting this as well)
windows boots up perfectly managed to enable kernel DMA protection and get my radeon Vram to 1gb and system works much more smoothly than before even with hyper-v mode enabled i dont get any lag or crashes whatsoever during my 40 day uptime

>got any problems while using the unlocker
dunno if this is a bug in the bios firmware but no matter which setting i select on UMA settings my integrated graphics still has 1gb of vram instead of 2gb (messing with this also causes the IOMMU settings to revert and you will need to toggle it again in the bios)
the TPM setting also revert automatically when i select discreet tpm trying to fix [PCR7 binding not possible] not sure if this affects passthrough
my system also crashed that one time without BSOD after i reset the bios to default to disable the iGPU while benchmarking the dGPU (dunno why this happened)
screen also blacked itself when the iGPU reached more than 0.5gb of Vram this only happened once when i opened lots of youtube tabs and windows to see if the vram tweak worked (nowadays the igpu sits at 0.6gb when idle with lots of edge tabs it seems that the system got used to it)

heres an old screenshot of vbox and vmware working in tandem while testing both GPUs after using the unlocker (hyper-v was off during that time firmware reverted to EUCN31WW)
Edit: forgot to add stuff and fixed grammar

iommu working.PNG.jpg



You don’t need to unlock the bios to change the UMA Frame Buffer and the Virtualization settings.