Post by GrobyHello,
bought 2 HP ProBooks from an insolvency proceeding.
HP ProBook 650 G1 and G4
After the delivery I unfortunately had to find out that the bios has a PW on
both.
I have already passed through some YouTube videos and Internet pages, but
everything has so far not been able to remove them.
Maybe someone here knows how to do it!
Tried the following.
- CMOS battery removed + battery (unsuccessful)
- There are no jumpers (so no success)
- Enter PW incorrectly 3 times (supposedly a code should come to HP that can
then be decrypted) (Also no success)
- I downloaded a xx.bin file and tested it with it (key combination + USB stick
with file on it also booted but file was incorrect)
My question is there a Master.bin file for the ProBook series?
Or a tool with which you can reset the PW?
Would be really grateful for help!
I'm sure you know the details by now.
Business machines don't store the password in the CMOS 256byte RAM.
They store it in a 2K EEPROM (electrically eraseable programmable
read only memory).
It's kept separate from the BIOS image, so no matter how much
mucking about with the BIOS image you do, it doesn't "touch"
the password EEPROM.
Some laptop makers of business machines, insist the
machine be "returned to the factory to have the password reset".
They don't even trust the process to certified repair shops.
You might need a bill of sale or some other sort of proof,
when they discover you're not the business that originally
bought the machines.
I recommend phoning HP support, explaining the situation
and seeing what they recommend.
Alternately, you could contact the principals to the insolvency,
and see if you could track down the owner of the laptop, and
get the password that way.
But jamming random patterns into the 2K EEPROM, just isn't
going to work. Nobody designing "handcuffs" that way, would be
so stupid as to use a zero fill for the NULL password. The
technique might consist of taking the machine serial number,
and running it through crypto before storing it in the EEPROM,
and this would be the "null password" pattern. So when the BIOS
reads the 2KB EEPROM, not only is it checking the password, it's
also comparing the decrypted serial number, to see that it matches.
This would prevent, for example, a person making a "copy" of
an unlocked machine, and inserting that EEPROM (via soldering iron)
into the PCB.
On a more modern machine, they could even involve the TPM chip.
Many business machines will have a TPM for secure boot.
Rest assured there are details. With business machines, for
only a few bucks worth of parts, they can make a solution
worthy of Fort Knox.
There was one Eastern European gentleman, offering
to "send a kit for $50", but what are the odds that
person knows the recipe for every business machine
ever invented ? I think the gentleman popped up, when
some discussion about the handcuffs on a Toshiba
was being discussed.
Some of the crypto people are amazing. They can guess
the method, by sight inspection. Which is something
well beyond my pay scale.
For a taste of the process, try an article like this.
The information in this example is in plaintext, and
doesn't necessarily use crypto.
https://www.pentestpartners.com/security-blog/how-to-read-from-an-eeprom/
Purple UNI U24C02 2 Kbit (256 Byte) EEPROM I2C
Not that this matters, but here is a chip datasheet,
so you can see the pins on it. AFAIK, the A0/A1/A2 are
strapped to a pattern, and when addresses are presented
on the bus, the chip only responds at the "strapped address"
value. So if the chip was strapped to "010", then when
doing a read cycle, the read cycle serial address transfer
phase would have to present "010" too. Something like that.
http://ww1.microchip.com/downloads/en/DeviceDoc/21202j.pdf
They pentesters used logic probe clips to access the logic pins.
You can also use a compressible logic analyzer clip, to
access all eight pins using one piece of spring loaded plastic.
The chip also needs power while you're accessing it.
See, there are people who know their stuff here :-)
Not every company has to do it the same way.
If some posters went to the HP forum and dumped this
quality of info, their posts would be removed from
the server. You need "enthusiast" forums, to find
a recipe for this stuff.
https://www.techspot.com/community/topics/dell-bios-password-removal.18780/page-5
Paul