[REQUEST] Lenovo Ideapad Y700-15ISK (CDCNxxWW) BIOS Unlock

[SweaNisseGaming]

so what do you need to dump the embedded controller (EC) firmware from
LENOVO Y700 15ISK?

[sajmonella9]

""Error 316" Protected Range Registers are currently set by BIOS, preventing flash access"

I change that "desc.bin" file like on guide. But without success. Still no permission after use "fptw -bios -d bios.bin".
Model : y700-15isk

[Dudu2002]

""Error 316" Protected Range Registers are currently set by BIOS, preventing flash access"

I change that  "desc.bin" file like on guide. But without success. Still no permission after use "fptw -bios -d bios.bin".
Model : y700-15isk

Hi
Your bios is rewrite protected...you need SPI-programmer+SOIC8 clip only

[ataigun]

Step 1 - Unlocking ManagementEngine and descriptor
First, extract file "DESC_ME_Unlock.zip"
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

WinTest C45 D80
WinTest C40 D02

laptop restarting and ME + descriptor is unlocked. Audio sound chipset of laptop not working. 

Step 2 - make dump of descriptor
After restarting, run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

fptw -D desc.bin -DESC

Step 3 - modify your dump "desc.bin" file with HEX editor, at adress 00000080 according this picture, and save as "desc_unlocked.bin"


Step 4 - flash modified descriptor file "desc_unlocked.bin"
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

fptw -rewrite -F desc_unlocked.bin -DESC

Step 5 - dump your bios
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

fptw -bios -d bios.bin

bios.bin 6MB dump file is generated

Step 6 - modify your bios, and save as "bios_mod.bin" file
with help from other users (work in progress...)


Step 7 - flash modified bios file "bios_mod.bin"
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

fptw -rewrite -bios -f bios_mod.bin

Step 8 - IMPORTANT!!! YOU MUST LOCK ManagementEngine FOR ENABLE AUDIO SOUND CHIPSET OF LAPTOP
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

Wintest C45 D81
Wintest C40 D02

[suffkopp37]

this method works without SPI-programmer+SOIC8 clip and provide full access to lenovo y700-15isk (i5-6300hq) bios menue?
i need to replace my wifi card with intel ax200,
i can provide my biosdump in pm if someone guide me please
thank you

[ataigun]

this method works without  SPI-programmer+SOIC8 clip and provide full access to lenovo y700-15isk (i5-6300hq) bios menue?
i need to replace my wifi card with intel ax200,
i can provide my biosdump in pm if someone guide me please
thank you

is only for flash without SPI programmer

not for unlocking bios hidden menu

Step 6 - modify your bios, and save as "bios_mod.bin" file

with help from other users (work in progress...)

[gvbilokorenko]

Hi, can anyone help me in unlocking bios for lenovo y700-15 using method described by ataigun in previous posts.
Thanks for any help!

[Outsyde]

Step 6 - modify your bios, and save as "bios_mod.bin" file
with help from other users (work in progress...)

Hi, can anyone help me in unlocking bios for lenovo y700-15 using method described by ataigun in previous posts. Thanks for any help!

I have this laptop and unlocked BIOS flashing on it so that you can just do fptw -bios -f bios.bin (for example) to flash the BIOS without disassembling anything:

   

More specifically, an UEFI module can be patched to remove Protected Range Registers (PRR0 and PRR1).

Before:

Code:

SPI Protected Ranges
------------------------------------------------------------
PRx (offset) | Value    | Base     | Limit    | WP? | RP?
------------------------------------------------------------
PR0 (84)     | 87FF06C0 | 006C0000 | 007FFFFF | 1   | 0
PR1 (88)     | 857F029A | 0029A000 | 0057FFFF | 1   | 0
PR2 (8C)     | 00000000 | 00000000 | 00000000 | 0   | 0
PR3 (90)     | 00000000 | 00000000 | 00000000 | 0   | 0
PR4 (94)     | 00000000 | 00000000 | 00000000 | 0   | 0

[!] SPI protected ranges write-protect parts of BIOS region (other parts of BIOS can be modified)

After:

Code:

SPI Protected Ranges
------------------------------------------------------------
PRx (offset) | Value    | Base     | Limit    | WP? | RP?
------------------------------------------------------------
PR0 (84)     | 00000000 | 00000000 | 00000000 | 0   | 0
PR1 (88)     | 00000000 | 00000000 | 00000000 | 0   | 0
PR2 (8C)     | 00000000 | 00000000 | 00000000 | 0   | 0
PR3 (90)     | 00000000 | 00000000 | 00000000 | 0   | 0
PR4 (94)     | 00000000 | 00000000 | 00000000 | 0   | 0

[!] None of the SPI protected ranges write-protect BIOS region

The Flash Configuration Lockdown (FLOCKDN) flag remains set but no longer matters.

Caveats:

1. You'd still need to use an external programmer once to flash the modified BIOS.
   
2. Every BIOS you flash later must be modified the same way or you will lock yourself out.
   
3. If you mess something up, you might still need an external flash to recover (less serious problems such as settings mismatch can be solved by taking off the bottom cover and disconnecting both batteries for a while).
   

If anybody is interested in the details, let me know and I can share them here.

[ataigun]

Step 1 - Unlocking ManagementEngine and descriptor
First, extract file "DESC_ME_Unlock.zip"
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

WinTest C45 D80
WinTest C40 D02

laptop restarting and ME + descriptor is unlocked. Audio sound chipset of laptop not working. 

Step 2 - make dump of descriptor
After restarting, run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

fptw -D desc.bin -DESC

Step 3 - modify your dump "desc.bin" file with HEX editor, at adress 00000080 according this picture, and save as "desc_unlocked.bin"


Step 4 - flash modified descriptor file "desc_unlocked.bin"
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

fptw -rewrite -F desc_unlocked.bin -DESC

Step 5 - dump your bios
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

fptw -bios -d bios.bin

bios.bin 6MB dump file is generated

Step 6 - modify your bios, and save as "bios_mod.bin" file
with help from other users (work in progress...)


Step 7 - flash modified bios file "bios_mod.bin"
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

fptw -rewrite -bios -f bios_mod.bin

Step 8 - IMPORTANT!!! YOU MUST LOCK ManagementEngine FOR ENABLE AUDIO SOUND CHIPSET OF LAPTOP
Run CMD as administrator, and go to inside folder "DESC_ME_Unlock"
and type these commands:

Code:

Wintest C45 D81
Wintest C40 D02

You followed steps 1 to 4 ? 
Step 1 is extracted from Lenovo official old version bios update for Y700 15ISK

[Outsyde]

You followed steps 1 to 4 ? 
Step 1 is extracted from Lenovo official old version bios update for Y700 15ISK

Yeah, I also did that but it's a separate thing. Doing that won't allow you to flash BIOS, and also once you get rid of the PRRs you can reflash the BIOS without any other extra steps (just fptw64 -bios -f bios.bin). By the way, I described it on W-R in more detail, you can have a look. I know you're also a member there.