HP EliteBook **70 Series BIOS Password Reset [Util Test]

Discussion in 'BIOS Mods' started by Mazzif, Sep 12, 2014.

  1. Mazzif

    Mazzif Elitebook Pwner

    Oct 18, 2013
    268
    313
    10
    #1 Mazzif, Sep 12, 2014
    Last edited: Dec 8, 2017
    Greetings, (Modified my original post to collect all my data in one spot). There is no 'utility', but I have outlined a 'process' that works pretty bullet proof. Some models require disassemble for the bottom half of the chassis to expose the chip on board (mostly **70 series). I like to cut out the plastic here (I used a pair of dykes to clip the plastic) instead and save time.

    Verified on these Models
    430 G2
    650 G1
    8470P
    8470W
    8570P
    2170P
    2570P
    9470M
    6570B
    810 G1
    840 G1
    840 G2
    1040 G2
    Z Book 15

    Very little information on pinouts and parts and whatnot so figured Id share some of my experience and notes.

    Using a Raspberry Pi 2 Model B v1.2 (you can use a 3, its cheaper: https://www.amazon.com/dp/B01CD5VC92)
    Use Pomona SOIC clips, they are a little more expensive but work much better in my experience. (16Pinhttps://www.amazon.com/dp/B00GRKFKJI 8Pin https://www.amazon.com/dp/B00HHH65T4)
    Use 20cm F/F Wire connector (This is the kit I ordered, has other pieces as well:https://www.amazon.com/dp/B06Y2JHGGV) (I have also used 10cm, and 40cm without issue)

    I disassembled the bottom half of the 8570p chassis to expose the motherboard and BIOS chip. This required the removal of approximately 16 screws, and 3 micro connectors. I examined the chip and pulled it’s spec sheet (http://bit.ly/2zuP1sH) . I verified it was within the +3v power range required for this type of flashing. It was. I attached the 16pin SOIC clip and attempted a read. Success. I had a good 16MB BIOS dump. I opened the file within the EUFI tool and located the VSS_Store data area. I extracted this data as dirty_VSS_Store.bin as I have done in the past.

    I then pulled a clean ROM image from the internet. I did not do any copy and pasting of the clean/dirty VSS_Store as I have done previously because the ‘clean’ dump did not have the ‘VSS_store’ data section. I went ahead and flashed this image anyway as the file size was exactly the same as my dump. It took upwards of 10 minutes to complete this read/erase/write and verify process with the 16MB ROM image.

    After the process was complete, I powered on the notebook. It POSTED, but displayed the ‘Manufacturing Mode 1 of 10’ error and then the white “Product Informing Missing” screen, showing that system information data was missing. Some will boot to a 'recovery mode' and automatically restore data. Some will reboot several times and require pressing F9/Enter to get to boot menu to boot USB.

    I created a Windows10 PE bootable USB (http://bit.ly/2zvum7M) with the HP WinDMIFit toolset. Booting to WindowsPE and navigating to the WinDMIFit directory on the USB, then running the utility, I was able to reprogram the motherboard manually, using the information off the bottom of the notebook (Serial Number, SKU etc). I committed the changes and the software reported success.

    I rebooted the laptop and pressed F10 to enter the BIOS. No warning, errors or messages. No password!

    I have standardized my color selection. Makes no difference if you are using an 8pin or 16pin SOIC Clip, just wire up as to your Pi as indicated by color.

    Formatting messes up the pinouts, so see attached images
    PINOUTS:

    17 on the PI - 3.3V (WHITE)
    19 on the PI - MOSI (GREEN)
    21 on the PI - MISO (BLUE)
    23 on the PI - SCLK (YELLO)
    24 on the PI - CS (RED)
    25 on the PI - GROUND (BLACK)


    *********PADDING BIOS FILE FROM DUMP)***********************************
    Open your 16MB BIOS Dump in HxD Hex Editor. Search (Ctrl+F) for $VSS. In my 8570p BIOS example, it starts at Dec Offset 15597640.

    Open Padding.pad file in HxD. Select all (Ctrl+A) and copy (Ctrl+C). Length is 126904.

    Flip back over to your BIOS tab in HxD. Press Ctrl+E to Select Block. Select Length and ensure the value matches the size of Padding.pad (126904). Make sure dec is selected.

    Now with the proper block size highlighted (Block 15597640-15724543, Length 126904), perform a Paste Write (Ctrl+B). The contents of your BIOS file will be overwritten with the contents copied from Padding.pad.

    Save your edited BIOS file.

    Using your favorite flashing kit (Im using a Rasperry Pi 2 with flashrom and a 16pin Pomona SOIC clip), flash your BIOS. Once this is done (not only will you not have a password for BIOS, but MPM will be unlocked.

    You can now use wndmifit.exe to reprogram Model, SKU, Serial Number, Etc.

    [Padding.File: https://app.box.com/s/q1w7k840ofyektif4lp2kmshrqto2jgc]

    #MPM
    #HP
    #BIOS
     

    Attached Files:

  2. innoserv

    innoserv MDL Novice

    Jun 24, 2014
    8
    0
    0
    hi bro
    any news about probook 6570B??

    THx
     
  3. Mazzif

    Mazzif Elitebook Pwner

    Oct 18, 2013
    268
    313
    10
    I have a new file to test, I need UUID and SN and an email address to send to.
     
  4. OttawaMedic

    OttawaMedic MDL Novice

    Sep 13, 2014
    1
    0
    0
    Hi Mazzif,

    this is exactly what I've been looking for. I have an EliteBook Folio 9470m. I can provide the UUID and SN, but I'm new to MDL so can't PM yet... Can I PM you through Youtube?

    Cheers
     
  5. innoserv

    innoserv MDL Novice

    Jun 24, 2014
    8
    0
    0
    hello mazzif i send you the info PM i will wait the file to test it thx
     
  6. mennom

    mennom MDL Novice

    Nov 11, 2014
    1
    0
    0

    Mazzif

    I have a 8470p locked bios so if you can send me over i can test.

    UUID: E23D73DFDC75E311BFE6B3BD9107C02D
     
  7. dgrut

    dgrut MDL Novice

    Nov 23, 2014
    5
    0
    0
    Im sorry i cant PM, Just join.

    I have HP Elitebook 2570P
    here the detail.
    S/N : CNU243B3ZV
    UUID : DDC28CC0A71CE211BFD00E89BF0C8016
    EMAIL : ayahnarda[at]gmail.com << replace [at] with @ (cannot post email address just join :rolleyes:)

    i have try your tool, use shotgun and its not working. I hope my S/N and UUID can help you to solve the problem.


    Thanks:)
     
  8. Zorro11

    Zorro11 MDL Novice

    Dec 6, 2014
    7
    0
    0
    HP 2570p- ready for test

    Hello Mazzif,

    I have HP 2570p which can't be unlocked and ready to test. I am sorry I can't PM you as just joined but here are the details:
    UID: 72ABE71F1865E211B03C09C65F06604F
    SN: CNU3049S70

    I managed to upgrade Bios to F50 using your method but password is still there...
    Thanks a lot!
     
  9. mmarek2

    mmarek2 MDL Novice

    Nov 23, 2007
    3
    0
    0
    I am sorry but I can't PM you too :(

    Here is numbers :

    HP EliteBook 8470p

    UUID : CA3DE421A319E2119AEE14121E0D60F5
    S/N : CZC2429RKQ

    Thanks a lot.
     
  10. woofer38

    woofer38 MDL Novice

    May 3, 2013
    2
    0
    0
    Hello,

    I've an HP EliteBook 9470m

    IUUID : EAF041DCE443E211A1EA95187F19D0F7



    Thank you.
     
  11. waltbylisse

    waltbylisse MDL Novice

    Feb 15, 2015
    2
    0
    0
    Sorry guys for the noob question, please where I can find the UUID and SD ?

    I have an HP ProBook 6570b
     
  12. dgrut

    dgrut MDL Novice

    Nov 23, 2014
    5
    0
    0
    on the diagnostic page.

    any progress mazzif?
     
  13. bppr

    bppr MDL Novice

    May 31, 2012
    5
    0
    0
    I'll send you via pm for 8470p
     
  14. bppr

    bppr MDL Novice

    May 31, 2012
    5
    0
    0
    Need 5 posts to send pm :D
     
  15. mikb

    mikb MDL Novice

    Jan 27, 2017
    2
    0
    0
    Did you make any ground with the Folio 9470m? I know a couple of people said they had one you could test on, I also am looking to unlock a 9470m....
     
  16. Yetti

    Yetti MDL Novice

    Jan 31, 2017
    1
    0
    0
    Hello. I need help in unlocking the HP 8470p.
    UUID: 6F86B9940075E211AB3C0FC65F06603F
    SN: CNU3079DYB
    Thank you.
     
  17. razvy79rzv

    razvy79rzv MDL Novice

    Feb 21, 2014
    2
    0
    0
    [FONT=&quot]Hi there![/FONT]
    [FONT=&quot]On a HP Elitebook 8470p i reflashed bios with an unlo[/FONT][FONT=&quot]cked one
    [/FONT]
    [FONT=&quot]I tried nbdmifit and only windows wndmifit works but:[/FONT]
    [FONT=&quot]1. how to change the UUID with the old one that I know? (I managed to change P/N and S/N with wndmifit, but it can't change the UUID)[/FONT]
    [FONT=&quot]2. is there any way to extract the "MS Digital Marker" from old bios and inject it in the new one?[/FONT]
    [FONT=&quot]3. from wndmifit what is "Feature byte" and "Build ID", are those data stored in the old bios? where i can find them?[/FONT]

    [FONT=&quot]Best regards, Razvan.[/FONT]
     
  18. LatinMcG

    LatinMcG Bios Borker

    Feb 27, 2011
    5,266
    1,422
    180
    #19 LatinMcG, Feb 11, 2017
    Last edited: Mar 7, 2017
    msdm (win 8) i just did one .. look in HP Insyde recovery thread

    with nbdmifit u can read and save to eeprom.dat file
     
  19. cz

    cz MDL Novice

    Apr 3, 2014
    2
    0
    0
    Any success on this one? Standing in the row with another 9470m...