HP BIOS unlock tool

[quidep]

Re: HP BIOS unlock tool

Hello all,

sorry to bother you again.

Yesterday I tried it again:
- soldered the original chip back: laptop worked, I could boot W10 from the SSD
- desoltered again and connected again to CH341A I could finally read out the content without any problems, so now I have a dump
- created an unlocked bin file, programmed it to the new chip and soldered onto the mainboard: same problem, the LEDs of the caps lock and num lk buttons blink several times, the fan goes on, then the laptop "restarts" again and again. I tried holding several buttons on power on, no luck.
- unfortunately I managed to break off a pin of the original chip, so cannot try to reprogram it anymore
- the new chip has the IDs:
ID(9F): EF7018, ID(90): EF17, ID(AB): 17, ID(15): 6060, the original one ID(9F): EF4018, ID(90): EF17, ID(AB): 17, ID(15): 6060 but both were recognized by CH341A Programmer as Winbond W25Q128FV. Could that be the problem?

Could you please check, whether my dump and the unlocked file looks OK for you?

[quidep]

Re: HP BIOS unlock tool

The end of the story: I bought a pre-programmed BIOS chip on e**y, the seller sent me 2 pre-programmed chips (main and spare) and also as an alternative, the main chip with the unlocked file from my last post. I tried at first this one and it worked!

So no idea, what was exactly my problem, maybe there were more than one, but finally it worked

Thank you for all support and for the unlock tool!

[vjkomix]

Re: HP BIOS unlock tool

i did try use thi, it will generate file,but still have bios locked admin pw
someone explain or help?? need these files unlocked

[Bonzas]

Re: HP BIOS unlock tool

i did try use thi, it will generate file,but still have bios locked admin pw
someone explain or help?? need these files unlocked

If your file not working, try this. But you need insert DMI manually if this file work.

[vjkomix]

Re: HP BIOS unlock tool

If your file not working, try this. But you need insert DMI manually if this file work.

i would like to keep original bios file just unlocked

[Bonzas]

Re: HP BIOS unlock tool

i only failed when unlock G5 & G6 series, result almost no display after flash with file generated from unlock tool.

[IT-Guy]

Re: HP BIOS unlock tool

Dear community,
I want to share my experience with HP 1030 G2 "passworded" notebook.

First of all THANKS RethoricalCheese for this excellent tool!
Thanks to other supporters here, helping others to get their (i hope) hardware back.

Abbreviations:
NB1 = "passworded" notebook.
NB2 = working notebook, but slightly another modell (without SureView).

BIOS Chip: 25Q128JVPQ



As RethoricalCheese suggested, I have tried to use Raspberry Pi as flasher with software FlashRom. RasPi already have flashrom, but older version (in stable), i had to build a newest version from git to get chip identifiyed.
You also have to modify /boot/config.txt and uncomment/add dtparam=spi=on and reboot

As the chip is WSON8 packaged, SOIC8 clip would not work, so i decided to build a "probe" to not leave any soldering traces on the mainboard. Ordered pogo pins and built quick&dirty probe:





Be sure to not connect to MXIC chip, i't not bios

Then i tried to read a chip. It was pain in the a..
Sometimes it said "No EEPROM/flash device found."
Sometimes it said:
Multiple flash chip definitions match the detected chip(s): "MX25L6405", "MX25L6405D", "MX25L6406E/MX25L6408E", "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F"

First, read the whole topic. There are instructions from RethoricalCheese, follow them: https://www.badcaps.net/forum/showpo...4&postcount=27

In my case, I disconnected battery, connected PSU, went to bios asking me for a password, switched NB with power button, disconnected PSU, placed a "probe" and connected 3,3V to RasPi (pin 17).

Even after i triple checked all connections and made sure all pogo pins are on their pads (chip was also detected correct) I got strange behavior,
also described by someone in topic: all reads produced garbage, md5sum did'nt match:





Then i looked here: https://www.flashrom.org/RaspberryPi and saw a hint about a decoupling capacitor. Looked into linked doc, it says max. capacity is 10uF.
Found in my arduino set such a capacitor and soldered it between GND and 3,3V (minus to GND).
And WOW, it worked like a charm!





Now transfer a good readout to your computer (file must have extention .bin (!), no spaces/umlauts/cyrillics in full path), drop it on tool's .exe and look for your dump with "_unlocked" suffix.
Transfer it back to RasPi and flash back to chip.
And then read again and check md5sum





Always have original, verified dump!!!

Read/write takes approx. 160 sec. with standard speed (2000), you can speed up with

[FONT="Fixedsys"]flashrom -p linux_spi:dev=/dev/spidev0.0[B],spispeed=4000[/B] -r orig.rom[/FONT]

it doubles speed and works. I have not tried more, maybe it can damage chip?

Unfortunately Unlock Tool was not able to disable Power-On Power ON Authentication.
RethoricalCheese suggested to replace UserCred section from working Dump. I did so and there was something strange:
NB2 with same chip worked only WITHOUT decoupling capacitor!!!
With capacitor all dumps were different! I have no idea why.

Maybe it helps somebody)))

[IT-Guy]

Re: HP BIOS unlock tool

I have tried to replace UserCred section of passworded dump (NB1) with one from working notebook (NB2):
3559 bytes.
After power on: power-on authentication, but with credentials from NB2 (defaultuser0 and install). I know password from user "install" from NB2, but it does not match.


Questions:
1) Where is the password stored? Plain? Hashed?
2) NB2 has no power-on auth, so it must be some flag in original dump?
3) defaultuser0? Not a user from windows

can somebody help me to unlock this original bios (attached)?

Second problem: after 5-10 reads i've switched notebook on and saw this:

Now i see this screen every time, any chance to get rid of it?

Your help is very appreciated

[RethoricalCheese]

Re: HP BIOS unlock tool

You would need a totally clean UserCred section since password is not stored there. Using a clean UserCred just gets you access to bios. After getting there, you need to reset security settings to default. After that, password is fully removed.

Just find an unlocked dump in this forum and get that section from there.

[IT-Guy]

Re: HP BIOS unlock tool

How long is the UserCred section? I'm pretty new to this)
I took your 1030G2_OK.bin from 2 or 3 page and it has no Usercred section at all)
Digging in progress

[RethoricalCheese]

Re: HP BIOS unlock tool

It ends with hex AA55

[IT-Guy]

Re: HP BIOS unlock tool

You are the boss man
Took unlocked bios from peste (https://www.badcaps.net/forum/showpo...&postcount=238) and replaced intuitive till AA 55)

No password!

But "Security Device Problem" remains, reset security settings (F10->Security tab) done 3 times, it asks for clearing TPM, F1 F1 for accept, but error comes again and again.

I'll try to decript user password from windows, just curious what i entered as pass.

ME has pass to, but not critical atm.
Just this Security Device nag screen is annoying....

[Timbo01]

Re: HP BIOS unlock tool

Would this work?

Original dump of the left - file after running the unlocker tool on the right



https://drive.google.com/file/d/1Cse...ew?usp=sharing

It's from a Elitebook 830 G5 and I have attached the dump to this post

[bidox]

Re: HP BIOS unlock tool

hi
please help me to unlock this bin bios for laptop hp probook 650 g2

[KingBonecrusher]

Re: HP BIOS unlock tool

MODEL:     HP ProBook 650 G2
SERIAL:     5CG7505M0
MAC:      80:CE:62:28:CC:81
SKU:      L8U47AV
FD:       V2/3
NVAR ID:    3F
BUILD ID:    15WWCIET601#SUUG#DUUG
BOARD CT:    PFKCQ00WBA80T
FEATURE BYTE:  3Q3X476J6S6Z6b7H7M7Q7W7m7saBaEapaqauawbhdQdUdpdqfSgd.EB
UUID:
COA:      TY94N-XXXXX-9T9XV-H32GM-XXXXX
ME:       11.8.50.3425

[pronto]

Re: HP BIOS unlock tool

thanks but not working

File Type: zip hp_probook_650-g2_patched.rom.zip

not working

[Akintunde]

Re: HP BIOS unlock tool

hi
please help me to unlock this bin bios for laptop hp probook 650 g2

Try this and Report

[Timbo01]

Re: HP BIOS unlock tool

Has anyone managed to clear the HP Laptop BIOS Administrator password from a 32MB bios?

[baselse]

Re: HP BIOS unlock tool

Has anyone managed to clear the HP Laptop BIOS Administrator password from a 32MB bios?

Yes I did, but after going through the bios menu, there was a second prompt for the admin password which was not removed.
See post.

[Timbo01]

Re: HP BIOS unlock tool

Yes I did, but after going through the bios menu, there was a second prompt for the admin password which was not removed.
See post.

Looks like we are in the same boat. Your laptop layout looks just like mine! Except mine is a WSON package and yours looks to have some legs that a clip and go on?



https://drive.google.com/file/d/1qdT...ew?usp=sharing