A method has been identified to bypass supervisor passwords on Lenovo ThinkPad laptops equipped with Intel 4th- to 8th-generation processors. The process utilizes a CH341A programmer, which costs approximately $10, to interact with the EEPROM and SPI flash memory on the motherboard.
The procedure involves extracting the BIOS using the programmer and a utility called NeoProgrammer. By applying an auto-patching workflow, users can flash a modified BIOS back to the chip. This allows the removal of security data stored in the Embedded Controller, effectively unlocking the device.
The exploit leverages a vulnerability in the Lenovo firmware verification and driver architecture. Specifically, the EmulatedEepromDxe driver provided by the manufacturer allows for read and write access to the EEPROM, where the supervisor password is stored. This enables the password to be overwritten.
This technique was developed through the work of several individuals, including Victor Voinea, a user named Knucklegrumble, and researcher Mark Juvan, who analyzed the exploit for his master's thesis at Radboud University Nijmegen. The method is now documented for public use.
