A $10 CH341A Programmer Can Unlock BIOS-Locked ThinkPads

A $10 CH341A programmer is all it takes to strip a supervisor password from a BIOS-locked Lenovo ThinkPad, and the technique now has mass attention thanks to a YouTube tutorial. The method, posted three weeks ago by the channel Rebooted by Hileeq, covers ThinkPads with Intel 4th- to 8th-generation CPUs. Until now, the bypass was niche knowledge held mostly by technicians.

Rebooted by Hileeq documents repairs of cheap eBay laptops. His video walks through the full process of reading, writing, erasing and saving EEPROM and SPI flash memory using the inexpensive programmer and a second PC.

Why are these laptops locked and cheap?

Companies routinely set supervisor passwords on fleets of ThinkPads they hand to employees as an IT security measure. When those machines are disposed of, often with the storage removed and destroyed, the passwords rarely travel with them.

The result is a stream of perfectly usable hardware that sells for very little, because nobody can get into the firmware. Most of it ends up as e-waste. That is the waste stream this exploit addresses.

Who built the bypass?

The lineage of the technique runs through several contributors. Victor Voinea posted his ThinkPad supervisor removal exploit on a Romanian forum, but his method generated a random password on each run and required users to contact him for the key matching their hardware ID — and the password was not free.

In 2020, a user named Knucklegrumble posted a free bypass on the Badcaps electronics repair forum. Mark Juvan, an ethical hacker, later reverse-engineered that exploit in detail as his cybersecurity master's thesis at Radboud University Nijmegen in the Netherlands.

How does the unlock work?

The process is short once the hard work has been done for you:

• Extract the EEPROM chip from the motherboard and connect it to the CH341A programmer plugged into a second PC's USB port.
• Use NeoProgrammer, a utility for CH341A programmers, to dump the BIOS and save a copy on the second laptop.
• Let NeoProgrammer apply Knucklegrumble's auto-patching workflow to the dump.
• Flash the patched BIOS back onto the EEPROM, power on the laptop, and enter a few keystrokes that clear the password stored in the Embedded Controller (EC), a separate IC holding security data and other system tasks.
• Flash the original BIOS back into the EEPROM. The supervisor password is gone, and the laptop is usable.

Where is Lenovo's firmware weak?

Juvan states in his paper that the exploit takes advantage of a weakness in Lenovo's firmware verification and driver architecture. Lenovo itself ships the EmulatedEepromDxe driver the exploit needs, and that driver allows the EEPROM to be read and written.

The EC's supervisor password happens to be stored in a region treated as EEPROM memory. That placement puts it within reach of the same read-and-write path, so the password can be overwritten or removed.

In plain terms, the security boundary between firmware storage and password storage is not as firm as it should be.

What happens next?

The electronics repair community has already done the difficult reverse-engineering, so the remaining barrier for most people is a cheap tool and patience. The method applies only to Intel 4th- to 8th-generation ThinkPads today, but Hileeq's popular post may encourage more people to try it themselves — and it might trigger a domino effect that unlocks newer ThinkPad generations.