Hi, my name is Ivan and I am the owner of HP ProBook 4540s. More A couple years ago, I have fun with bios configuration, and set the BIOS admin password. Of course, some later I forgot thepassword, but there was no need to make configuration in bios and I continued to live with no access to bios. Nevertheless, over time I noticed, that more and more there was some cases when Ineeded virtualization and other features with was disable in bios and I decided to find out how it can be possible to restore the password.
If you found this page over the internet than it is likely you have similar problem ant trying to figure out the solution. I spend many hours doing the same with no results. However, a few days ago I solved the problem and restore access to bios. Therefore, I decided to write an article and share with my experience with you.
As I mentioned before, the goal of this blog is show, how to restore access to bios. In the end, the password will be completely reset and all unique data, including UUID, model, S/N, tracking number and others will be kept. As a result, there will be full access to modify settings in BIOS, including enabling and disabling Intel VTx. And the main achievement – experience, so you can help other people with this solution.
As there are many articles and discussion on this topic, it makes sense to say, how I did the trick and why it is better than others are. I think you probably know, that the easiest way described on the forums is to replace the BIOS chip with new one without the password. And if price in small enough (about $20), the necessity of disordering the chip makes scared, because there are dozens of small component around bios chip with high probability of causing damage during the soldering process. Instead, I decided not to use soldering, but just connect to the bios chip, read all data, remove the password and write it back.
To complete such a simple task you need HP ProPook 4540s, of course, screwdriver set, any programmer for 25xx chips (or any other device with ISP and knowledge, how to use it), test clip (you can construct your own solution to connect the chip to the programmer), other laptop to read, modify and write data, your favorite HEX editor (I suppose you have one J) and some time. I used chip programmer CH341A that supports most of 24xx/25xx EEPROM chips with CH341A programm v1.18, but any other is ok. IT IS A HIGH PROBABILITY, THAT THIS METHOD IS ACCEPTABLE FOR ANY OTHER LAPTOP FROM PROBOOK SERIES.
CH341A and test clip |
The main reference for this article is a topic on tonymacx86.com , without that post, I wouldn’t have written this. There you can find out which chip is used in your laptop and memory addresses where the bios image is stored in EEPROM to find the password.
In the next part you find how to use this solution for your laptop.
Connecting to bios chip with test clip Editing the bios EEPROM |
Steps:
- Disassemble laptop. You need to have direct access to bios chip. There are many articles in the internet how to do that, but you can go with my article [to be written] I wrote special for this case.
- When you have just the motherboard, you must find a bios chip. Usually, it is located near processor and have 8 pins in SOIC package. You can see one from ProBook 4540s below.
- On another computer install necessary drivers and run the software which provides with the programmer.
- Connect the programmer to the computer and check that programmer discovers correctly. Disconnect programmer for now.
- Next, you must connect the chip to the programmer. I used test clip, which is simple to use and really save the time. Insert programmer again into working computer and press Detect. It took me time to work, I don’t know why, but the programmer is hard to be discovered for computer. Check, that discovered chip is really yours.
- Now you must read original bios raw data into a program by pressing button Read. It took near minute to read the whole chip while there is 8MB. Just for being safe, click Check button, the program will compare if the read data are the same as on chip. Save the data into the file.
- Make copy of the file for safety and open one. I use plugin for Notepad++ that has cool possibilities, like any other. Now starts the most interesting part. You must find where the password is. Please notice, that it is not stored as plain text, but in some kind of encrypted form. Location depends of many factors, and removing wrong data may cause bricking. At the time of editing, I have bios version F.31. If you have the same, you can check addresses on the picture above first. If you have an other bios version on laptop model, then just find for hexadecimal value “aa 55 7f” (indicates the end of value) (about 60 occurs in whole document). You can find out, that there are stores all information about your computer, including name, model and many others. Your target strings on screen must be “H P _ T e m p B I O S A d m i n S c a n c o d e” and “H P _ B i o s U s e r 0 0 B I O S A d m i n i s t r a t o r” (yes, with spaces). The structure of name-values is next:66 9d c5 [.. here some other chars and text] 00 00 00 [here is value (probably, encrypted password)] aa 55 7fYou must remove value of all three fields, starting from three nulls and to the start of next value (or nulls before it). In my case, it was 14 bytes in first occurs, 48 in second and 14 in the third.
- After you complete the editing, save copy of your bin file and remember the file name. Go back to the programmer software, load modified bin file, check, that controller still connected (if not, just repeat step 5) and press Program. More careful way to flash data is to clear chip first and then rite new data, but I get an error when tried to clean the chip. Writing is a little longer than reading data, so now you have a time for coffee. After process completes, press Check again.
- On this step your bios chip stores no password. Now, you can assemble your laptop, just repeat the first step in reverse order.
- Now it is a time to test the bios. After plugging battery, laptop will power on and... there is an error about CMOS battery. You can ignore it and wait until system reboot again. Press F10 to start bios during boot animation. The password screen must not appear and you must see bios setting screen.
- Almost done. You can find than the most of items are grayed out. If they do then you must set password in the second tab (this option is available) and for asking for current password just leave empty string, and provide new one (but please, do not forget it again). If you restart bios, then nothing must change. Remove password in the same way, as you set it, and restart bios again. Now you have access to all settings!
- If you have an older version of bios, it is time to update. Check bios update on the HP website for your laptop. Now, your restore is complete.
Remember, if you have troubles with computer after flashing the bios, it doesn't start or show errors, please report your actions in comment and flash backup. May by someone can help you.
P.S. It is possible to read EEPROM with any compatible with ISP IC, for example Arduino or Raspberry PI, just remember, that bios chip in most cases works with 3.3 V.
P.P.S. If you find any errors, please let me know.
Can not find “H P _ T e m p B I O S A d m i n S c a n c o d e” and “H P _ B i o s U s e r 0 0 B I O S A d m i n i s t r a t o r”.
ReplyDeleteOnly "H.P..B.i.o.s.U.s.e.r.0.0", "H.P..B.i.o.s.U.s.e.r.0.1" and "H.P..B.i.o.s.U.s.e.r.0.2"
HP 4540s bios F.61 Rev.A
Thank you for this tutorial, I removed the password from my 4540s. The values were on different address but the concept is the same. My SOIC8 clip could not read the EEPROM in circuit so i had to take it out of the board and then everything worked like it should. Thank you!
ReplyDeleteHi, I've been able to reset the admin password following your instructions. The BIOS version was F42 and the 3 "admin" fields were at different addresses (around 0x006c8e00) and also they were in a different order.
ReplyDeleteNB: the BIOS language was not set to english, and the name of one of the three field was localized (I think it was the one that doesn't contain the word "Scancode").
At step 7, when you wrote "You must remove value of all three fields", it was not very clear to me what I had to do. I wondered if I had either to override the field values with zeros, or if I had to displace to end of field markers (aa 55 7f) just after the start of field markers (00 00 00), so that the fields had a zero-length. I opted for the former solution and it worked.
Last thing: I had to reset the password as explained in step 11.
Many thanks for sharing all this !
Hi, you must override the field values with F!
DeleteHi Ivan,
ReplyDeleteWill this chip programmer work ?
https://www.amazon.fr/SODIAL-CH341A-Programmer-Graveur-Tableau/dp/B01M8HE4WV/ref=pd_sbs_23_4?_encoding=UTF8&psc=1&refRID=52RQSD0X8BYJ1W58KACV
And will this clip do the job ?
ReplyDeletehttps://www.amazon.fr/gp/product/B01GBEST06/ref=ox_sc_act_title_1?smid=AOXZIQW4RHZR1&psc=1
Thank you man.
Hi Pierre,
DeleteYes, both the programmer and the clip is perfectly fine, you can use them without any doubt.
Good luck with flashing!
Thanks Ivan,
ReplyDeleteI'll report back in any case...
Success here!
Delete@nahi: I replaced the field values with zeros...
Thank you Ivan!
With F working too.. It's your choice! ;)
DeleteOK nahi ;-)
DeleteThis comment has been removed by the author.
ReplyDeleteHello Ivan, I was wondering if it is necessary to disassemble the device. On my HP 4540s I have access to chip without any disassembly.
ReplyDeleteHi Alford, IIRC I also have access to the chip without disassembling the whole laptop, but connecting a test clip to it was a pain, that why I decided to take apart the device. You definitely cold try to attach to the chip without disassembling, just remember to remove battery and power cord :)
DeleteIvan, I was asking in advance. I may not be able to do it without disassembly too. I'll have to wait for my tools to get from China. Thank you for response.
DeleteIvan, I have gone through the process of password removal. I did not disassemble my device, but I had to remove some plastic from my clip to make proper contact. I have not edited the existing bios and I have replaced it with a copy I found online. Your tutorial was of immense help to me. Thank you very much.
DeleteThis comment has been removed by the author.
ReplyDeletenotepad++ ver and download link please ??
ReplyDeletei downloaded from web but failed to open bin file in Hex mode.Please help
It is all about plugin. You can install it throught Plugin -> Plugin Manager -> find in list plugin with name HEX-Editor. After restart the new "H" icon will appear in toolbar, click it when bin file is opened.
Deletehttps://notepad-plus-plus.org/download/v7.5.6.html
ReplyDeleteNotepad ++ i downloaded from above link Ver 7.5.6
Plugin options is there in toolbar but not getting HEX plugins.
please confirm Notepad++ ver. Which ver do i need to grab?
ReplyDeleteplease revert
Why is Notepad++ relevant? You will need Notepad++ and hex editor only to edit a bin file. I plan to use latest version of the app and plugin modified to work with 64 bit version.
ReplyDeleteRegarding Notepad++ version - just grab the latest one! It makes no difference. You also can use any other Hex editor.
ReplyDeleteThis site is poorly programmed, and it kills Chrome on Linux Mint Cinnamon 19.1. Please fix it.
ReplyDelete