ALLservice Service Forum
support board, PC repair, unlocking solutions
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Unlocking ibm thinkpad t450 bios - Lesson learned

 
Post new topic   Reply to topic    Service Forum Forum Index -> IBM/Lenovo ThinkPad Password Help Center (EN)
View previous topic :: View next topic  
Author Message
fzvisu
Nou Venit


Joined: 10 Dec 2018
Posts: 1
PostPosted: Mon Dec 10, 2018 3:05 pm    Post subject: Unlocking ibm thinkpad t450 bios - Lesson learned Reply with quote
tl;dr version

1) Be really careful when manipulating the clips on a motherboard with smd chips near the eeprom. The clips can broke the motherboard without you knowing it
2 ) Take a photo before and after each manipulation (Extremelly valuable later)
3 ) Don't give up easily
4 ) allservice.ro is good, Victor is a great guy, really appreciate his service and helps

So let's start (Sorry for my english)

This is my attempt to unlock the thinkpad t450 bios locked with a SVP password.
it's the first time i'm doing this kind of stuff so no prior experience before this.

So after reading various websites and tutorials on internet, i ordered a [] programmer and a soic8 clips from aliexpress .
The chips of theT450 is W25Q128FV.

3 weeks later, it's time to extract the eeprom firmware and send it to allservice.ro

So I removed the main battery, unplugged the cmos battery, put the clips on the eeprom (W25Q128FV by the way), and plugged the programmer to usb.



Putting the clips on the chip is not a trivial procedure. I tried many many times before it's ok. Having a big and shaking hands didn't help.

I used the flashrom program on ubuntu to read the data :

Code:
Command as root : flashrom --programmer ch341a_spi -r originalbios.bin


It's all goods, flashrom detected the model and extracted successfully the 16M firmware.

So i sent the firmware with addition informations (mac, some number ,..) to allservice and asked them if they can unlock the model. Victor responded quickly it's ok and ask me to give him 1 hour to regenerate the patched the bios with his magic stuff.

One hour later, allservice sent me an email with a link to the patched bios and a detailed procedure steps to follow.

So for me it's just a matter of rewriting the bios and follow the procudre and i'm done.

Returning to home, i downloaded the patched bios and began to plug all the devices.

With flashrom again, it's time to write

Code:
Command as root : flashrom --programmer ch341a_spi -w patchesbios.bin




The last step after programming the bios is to plug the adapter and start the computer.

So i plugged the AC adapter, and press the power button. The computer won't start (no beep either) . The power button just blink four times and keep repeating it.

I tried to rewrite the bios, reread it and compared the checksum, it's all good but the computer won't start. I tried this many times.

I tell it to Victor, and he told me to try to rewrite the original bios.

So i rewrote the original bios (after trying to plug many times the clips again) but the computer won't start.

At this time, i'm ready to give up. And i asked Victor if he can do me an half refund.

And his response strike me !! He told me to retry again and with his own words :

" I will rebuild the BIOS from scratch and send to you a new dump.
As soon as you test and the laptop starts, I will patch it again.

Also in many cases, you may need only to replace the chip that is just a few bucks, these chips are easy to get damaged. There is no need to abandon the work"

So one hour later, i received his reconstructed bios, i uploaded it to the chip but the computer won't start.

I tried many times but no good.

At this time, i want to resign and throw the computer to trash but i remembered Victor response to keep trying and to not give up easily.

I always take a picture before and after each manipulation when disassembling something. It'is useful to help me remembering screws placement etc..

So i analyse all of the pictures and then i discovered something strange.

I've broken with the clips a mini smd diode near the eeprom on the motherboard.





I told Victor this and he told me to use a normal 1N4148 diode. I used a big magnifying glass to be able see the damage.

So after struggling to solder the diode (i don't have a special tools for smd soldering)
, i'm finally able to boot the computer and to follow the unlocking procedure.





So i sent the Hardware to ID, and he responded me an email with a key and a procedure to follow. The last step of this procedure is to reflash the original bios back.

And guys !! when trying to rewrite the original, i broken again the motherboard with the clips. This time it's a really tiny resistor that i don't know the value.

Time to give up seriously !! But the again the Victor's response above keeps popping in my head to keep trying.

So i search some diagram on the internet and found that the value of the resistor on the pin 1 is between 2k and 10k. So i soldered a normal 4,7K diod (value choosen randomly, i dont'care anymore here).

After struggling to solder the resistor, i started the computer and then guys .... it works !!! And the computer display a successfully unlocked Bios !! wow !!!









i put some hot glue to solidify and isolate correctly the resistor and the diode.

I installed a linux system and now i have a laptop that boots in under 4s !!




Some lessons learned :


- Always take a picture before and after each manipulation
- Be really careful when manipulating clips on the motherboard (may be soldering some wire on the eeprom is more safe afterward)
- Do no give up easily
- And finally , Allservice.ro is really good , Thank you Victor and all of your team.


Thanks for reading, i hope you find it useful.

Last edited by fzvisu on Fri Dec 14, 2018 12:20 pm; edited 1 time in total
Back to top
View user's profile Send private message
victor
S.F. Boss


Joined: 07 Mar 2004
Posts: 2581
Location: Staff
PostPosted: Mon Dec 10, 2018 3:26 pm    Post subject: Reply with quote
Great write-up, fzvisu.
Is always good to see a Linux Thinkpad too Very Happy

My only advice is to not buy clips or anything cheap from aliexpress or chinese copy&paste sites. Do yourself a favor and order a good Pomona 5250 clip from farnell.com and buy a real programmer not a cheapo CH that in 75% of cases will ef up a SPI QUAD chip and will put 5V on a 1.8v-2.7v lines screwing up the TTL gates and damaging the motherboard when used in-system.

Our SPEG prog is also a good choice that we made specially for in-system programming, no impedance issues, correct TTL thresholds. Do it right with the good tools.
_________________
Victor Voinea
ALLservice HQ, Romania.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Service Forum Forum Index -> IBM/Lenovo ThinkPad Password Help Center (EN) All times are GMT + 2 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



Powered by phpBB © 2001, 2005 phpBB Group