A $10 Programmer Clears Supervisor Passwords on Locked Lenovo ThinkPads

A used ThinkPad with a supervisor password is one of the cheapest laptops you can buy, and one of the least useful until someone deals with the lock. A technique circulating among repair technicians now makes that lock much easier to remove. It needs a programmer that costs about $10, a second computer, and a few keystrokes. Rebooted by Hileeq turned the method into a step-by-step YouTube tutorial, and that's what pushed it past the repair bench and into wider view.

The scope matters. The method applies to ThinkPads with Intel 4th- to 8th-generation CPUs. Newer machines aren't covered by what's been demonstrated so far. Even so, that range includes a large number of business laptops that have passed through corporate fleets, so the pool of machines this helps is far from small.

Why these ThinkPads end up cheap

Companies often set supervisor passwords on the ThinkPads they issue to staff as a basic IT security measure. When those machines are retired, the storage is frequently pulled and destroyed, and the supervisor password almost never travels with the hardware. What's left is a working-looking laptop that won't get past its own firmware gate for the next owner. Sellers price these accordingly, and many of them end up as e-waste because the cost of recovering them looks too high to anyone without the right tools. The lock is a firmware-level control, not a disk encryption key, which is why the storage removal doesn't help the buyer. The password sits in the machine's firmware and controller, and getting around it means working below the operating system.

How the workarounds developed

The path to a usable bypass ran through several hands. Victor Voinea posted a supervisor-removal exploit on a Romanian forum, but his version generated a random password on each run. Users had to contact him for the key tied to the hardware ID of their specific machine, and that key wasn't free. That made it a workable service rather than a repeatable procedure. In 2020, Knucklegrumble posted a free method on the Badcaps electronics repair forum. Its core is an auto-patching workflow that modifies the BIOS image so the password check can be cleared. Mark Juvan, an ethical hacker, later reverse-engineered that exploit for his cybersecurity master's thesis at Radboud University Nijmegen in the Netherlands. His paper is the most detailed public account of why it works, and it's worth reading if you plan to rely on the method beyond following a video.

The procedure, step by step

The workflow starts with hardware. A CH341A programmer clips or connects to the EEPROM chip on the motherboard, and the programmer plugs into a USB port on a second PC or laptop. The original BIOS is read out and saved to that second machine. Hileeq uses NeoProgrammer, a utility built for CH341A devices, to perform the dump. Next, the auto-patching workflow Knucklegrumble developed is applied to the dumped image, producing a modified BIOS. That patched image is written back to the EEPROM. With the patched firmware in place, the laptop boots, and a short sequence of keystrokes clears the supervisor password stored in the Embedded Controller, the separate chip that holds security data and handles other system tasks. Once that's done, the original BIOS is flashed back, and the machine runs normally without the password. Two details make this more than a lucky hack. The first is that the sequence reads and writes a chip you can physically reach, so nothing depends on Lenovo's software tools or a network connection. The second is that the procedure reuses a known-good firmware image as its starting point rather than inventing one from scratch each time.

Why the lock is weaker than it looks

Juvan's analysis points at the firmware's verification and driver design. Lenovo ships an EmulatedEepromDxe driver, and that driver permits reads and writes to the EEPROM. The Embedded Controller's supervisor password happens to be stored where the firmware treats the memory as EEPROM. So the same driver that handles legitimate EEPROM access also gives an attacker a path to overwrite or remove the password. The lock is only as strong as the boundary between those two storage regions, and in these models that boundary doesn't hold against someone with physical access and a programmer. That's the part that interests me most. The exploit doesn't break encryption or crack a password. It exploits a design assumption, and that kind of flaw is harder to patch in older hardware because the fix would have to reach firmware already in circulation.

What to watch before you try it

Flashing firmware always carries risk. A failed write, a wrong image, or an interrupted process can leave a board unable to boot, and a clip-on programmer adds its own failure modes, such as poor contact on the chip. Teams in this position typically dump and save the original BIOS before changing anything, verify the image before writing it, and keep a second copy somewhere safe. Those habits matter more here because the whole method depends on the image being correct. The exploit also depends on the specific firmware and the hardware generation. Anyone trying it on a machine outside the 4th- to 8th-generation range should expect to find that the steps don't carry over cleanly. Open questions remain about whether later Lenovo firmware closes the EEPROM path, and whether the same design pattern shows up in newer ThinkPads. The Reddit discussion raised the possibility of a domino effect that unlocks newer generations, but nothing in the public material shows that yet. Still, the practical effect is clear. A technique that once needed a forum-paid key or deep reverse engineering now fits in a tutorial and a $10 part, and that's likely to put more of these machines back into use than the e-waste route ever did.