Saturday, April 21, 2012

Remove the BIOS password on the Probook 6560b

Okay, I admit it. I forgot the BIOS password on my HP Probook 6560b laptop. Dur... I took this as a challenge though: “Oh goody, I get to kill my BIOS password!” So I booted into UBCD and tried my favorite BIOS password murdering tools like cmospwd. Didn’t go very well. Every time I would reboot out of the tool it would error out at a BIOS checksum error and not let me get into the BIOS. It would then force a reboot at which time it would restore the BIOS password. Lots of googling didn’t do it. Lots. Apparently the TPM chip stores the password and can restore it to the CMOS if it sees that it is gone. Security feature. Hmmm.

Sometimes the best hack is manufacturer support, lol. The first time I contacted HP they said I needed to drive 2 hours to an authorized vendor who I could pay to flash the TPM. That wasn’t what I wanted to hear. So I waited about 4 months and then contacted them again. Heh.

This time the chat support rep had someone from “HP Complex Problem Resolution & Quality” email me some cool instructions. As I say, sometimes the best hack comes from the manufacturer. It worked very hunkydorily. Below are instructions to clear the TPM and reset the BIOS, with my added juicy detail. This can't be found anywhere on the internet at the time of this post from what I can tell. The needed smc.bin can be found on my Google Sites storage here:

UPDATE: You must contact HP chat support directly and give them your UUID (easy to do) in order to get a smc.bin file which is generated for your specific device. Once you have this, you can proceed with the instructions below. Read the comments on this post for more information.

1.Save smc.bin to the root of a USB thumb drive “(or save the file to the root of drive D: HP_TOOLS)” -- I used a USB drive, btw...
2. Power the laptop off
3. Hold down Windows key + up arrow + down arrow and power the laptop on
4. Let go of the keys at the HP splashscreen
5. Press F10 repeatedly at the screen that shows up with "SMC command handled successfully"
6. This should bring you into the BIOS where you need to choose “Reset BIOS security to factory default” and confirm by choosing yes (duh)
7. Exit the BIOS, saving changes (duh)
8. When the laptop reboots, you will see the coveted prompt to clear the TPM, which is shown below.
9. Press F1 (duh again)
10. When the laptop reboots, the BIOS password is goners.
11. Feel hunkydory!




Really easy. HP didn't make me prove I was the owner or anything.

I opened the smc.bin file with Notepad 'cause I'm curious like that and some info that didn't seem like it was perhaps intended to be in there showed itself, lol:

AMERICAS\KNadeem
<Unavailable>
SMCServer
16.83.149.195
16.83.145.98
16.83.145.98


An nslookup on these IPs showed internal-host.americas.hpqcorp.net. Curiously strong, bro. Is americas a Windows domain name then? A whois shows that 16.0.0.0/8 belongs to HP. I didn't get all crazy and port scan 'em or anything but it's pretty funny that what looks like an internal domain name, internal username and two possibly internally accessed public IPs made it into this 807 byte file. #wazatsupozzedtohappen?

Doing some googling based on that username of KNadeem did show some interesting results, including a few possible matches of former/current HP employees on LinkedIn. (This was not the username of the support rep who emailed me.) Enough fun with that, though. The lesson on this one is that there are times to engage the vendor in your hacking endeavors. Ciao!

156 comments:

  1. Have the same problem on a Probook 4520s. I get a "SMC Command failure" message when I try to use the smc.bin file you posted. Appears that the file is specific for a given notebook and, perhaps UUID; did you need to provide the UUID when you logged the problem with HP?

    ReplyDelete
  2. Aha... I did have to give them the UUID. They didn't ask for any ownership information though, which is funny because what if the person contacting them stole it or something? Anyhow, I believe you're on to something here. Unfortunately, it's likely that they are generating the smc.bin file based on the UUID which is specific to the device. I went and tried my smc.bin file on an identical 6560b just now and it gave the "SMC Command failure" error as well.

    So as I highlight in the post, your best resource may be the manufacturer! Unless of course you want to get all crazy and find a way to either reverse engineer the smc.bin I've provided or reverse engineer a tool like this to change your UUID:

    http://www.myitforum.com/forums/SCCM-OSD-and-HP-6545b-m219471.aspx

    I'm gonna say though that you should contact HP. It's too bad that the file I've provided doesn't work on more devices than my own as I was hoping, but at least someone has documented on the web that this can even be done 'cause my Google searching pulled up just about nothing! Also, I'm going to go ahead and leave my smc.bin up in case anyone more skilled in reverse engineering than myself wants to play with it. Hope you get yours going! There is hope! Chat HP's support and if they give you trouble, tell them to escalate to a "Technical Solutions Consultant" from "HP Complex Problem Resolution & Quality"!

    ReplyDelete
    Replies
    1. The problem with my notebook is that it is about 6 months out of warranty and HP support is refusing to escalate an out of warranty problem. Doesn't create much brand loyalty for HP. I even offered to pay for the support!

      Delete
  3. Finally got HP to log the case on my out of warranty 4520S and pass it to tier two support. I provided the UUID at the time they logged the case. Received three emails from HP. The first acknowledged the case, the second indicated that it had been elevated, and the third contained the smc.bin file as an attachment. Ran the file and was able to clear the password. Bottom line is to be persistant with HP. Once the case is in their system and they have the UUID, the smc file can be quickly generated.

    ReplyDelete
  4. Awesome, glad you got it going. Hopefully, this post will help others who stumble upon it in Google results and see that it can be done...

    ReplyDelete
  5. Hey, does your smc.bin file have any weird stuff in it when opened with Notepad like mine?

    ReplyDelete
    Replies
    1. My file contains the same IP addresses and name as yours.

      Delete
  6. Yup. I can confirm that the BIN file contains the same IP address / plaintext stuff when opened in a hexeditor.

    ReplyDelete
  7. Yeah, I tried a hex editor, too, though it didn't reveal anything further...

    ReplyDelete
  8. how long did it take you to receive a reply from HP? emailed 3 times in the past 48 hours and still no reply...

    ReplyDelete
  9. I did a chat with them and then the chat person escalated it to another person who emailed me that same day. Try chatting them and see if you have better luck...

    ReplyDelete
  10. I greet all of the forum and ask for help for my HP ProBook 6540b that I forgot the password, there is a way to eliminate this TPM password with responses

    ReplyDelete
  11. Not sure exactly what you are asking for. The benefit of this post is that it gives you better instructions than HP provides after you contact them. However, you still have to contact them. Also, another big benefit to this post is that it documents that there is an actual solution which exists, even if you have to contact HP to get it. Before this blog post, there was nothing showing that this could even be done. Believe me, I researched heavily. Have you contacted HP?

    ReplyDelete
  12. Strange!!!!!

    I just contacted with hp chat support and they refused that there is not any kind of SMC.bin file to remove bios password, instead they adv me if I can log into windows which I cannot because its already been crashed there is no other way to reset bios password.

    And at the end they offer me to either replace the motherboard or send the notebook to them to resolve the problem.

    ReplyDelete
  13. Guys, I have tried many times but hp support says the only option is to replace your motherboard even my warranty status is still "Active"

    ReplyDelete
  14. You just have to keep calling back until you get someone who knows what they are talking about... :( Tell them to escalate it. Ask to talk to their supervisor, etc. :(

    ReplyDelete
  15. SMC.bin could be a firmware from chipset manufacturer SMC. I gues it could be ale to decompose from the bios file.

    ReplyDelete
  16. Ok, so the update is
    "Have contacted again and this time I asked to put me through a supervisor, the tech guy referred to a supervisor who asked some personal details and I was given a ticket no and was told to be contacted in 2-3 days from level 2 support"

    Just waiting now, lets see what happens!!

    ReplyDelete
  17. the update is ....

    HP is asking a proof of purchase which I do not have and without that they are asking to replace motherboard even its still under warranty.

    ReplyDelete
  18. This SMC File is specific to that laptop model. So you need to contact support to get one for yours

    ReplyDelete
    Replies
    1. I have hp probook 6540b, i need the SMC.bin for this model.
      thanks.

      Delete
  19. I have tried countless times to get this resolved. Here is my response.




    Dear HP Customer,

    Good Afternoon!

    This is in reference with the chat interaction that you had with me in the HP Instant Chat Session reference case ID: 4641971176 regarding your Notebook PC.


    I regret to inform you that there is no way to reset the BIOS password, however you can try carrying the unit to the service center they can try to assist you, or I can arrange for an onsite but it will be on chargeable basis.


    As of now I shall close this case if you need any further assistance then you need to get back to us on chat session.


    Thank you for choosing HP.

    Regards,
    Sitara
    Technical Support Engineer-HP e-Solutions

    Note: We request you to please do not reply to this e-mail as the source inbox is not monitored.



    Hopeless.

    ReplyDelete
  20. As stated earlier, I would strongly advise readers of this post (of which there are surprisingly thousands per month!!) to contact HP multiple times as I did until you get someone who will give you an smc.bin file which is specific to your individual chassis. Don't give up. Keep trying them every few weeks until you get someone who knows what they are talking about. Ask to be transferred to someone from HP Complex Problem Resolution & Quality. Tell them that there is indeed a method to reset the password via the smc.bin. Demand a supervisor. Keep trying!

    Unfortunately, I cannot help you here other than that. I don't have an smc.bin that will work for *anyone's* laptop. You must get one that is specific to your device. It's *not* by model number, it's by your *specific chassis*.

    Now if someone smarter than me can reverse engineer the smc.bin I've provided, that would be awesome. Until someone does that, your best route is to keep knocking at HP's door over and over again! Sorry I can't help you more!

    One other note: Please read this ENTIRE post and ALL of the comments before commenting. You need to understand the issue before just writing a drive-by comment that says, "I need a smc.bin for my ____ model laptop..."

    ReplyDelete
  21. Hi, James. Is it possible for you to post or send me the UUID you have used to open the case on HP Support service? I would like to try to decipher your SMC.BIN file and I'm pretty sure that I need the number used to generate it.

    ReplyDelete
    Replies
    1. Hi Antonio, James.
      I have an SMC.BIn and a uuid I'd be happy to send you guys to try to decipher.

      It's for a 2740p but the file contains the same information.
      It's interesting to me that I received the email from the same account you guys did, and that it contained the same user information, etc.

      It seems like who ever this poor person (if that's what is going on) is, he must be the busiest person at HP.
      I think maybe it's a general account used for TPM resets only or something.

      Anyways, good luck!
      -Eric

      Delete
    2. http://www.4shared.com/zip/rwuc0kO8/uuid.html <- this zip has a text file with my uuid and the smc.bin in it.
      SORRY FOR THE MULTIPLE POSTS FEEL FREE TO EDIT APPROPIATELY!

      Delete
    3. I figured out that you can use a hex editor to edit the sbapkey.exe with the uuid and the serial number of your system.
      Just search for "UUID" in the hex editor, and you'll find it.

      Voila!

      EVERYTHING YOU NEED TO RESET A HP 6550B BIOS PASSWORD, JUST READ THE INSTRUCTIONS.

      http://www.4shared.com/file/OdZvYoF3/6550-bios-hack.html

      Delete
  22. Antonio,

    Alas! I no longer have the laptop or any access to it and never recorded the UUID. Sad that didn't think to record the UUID!...

    Sigh,

    James

    P.S. Anyone who does read this and then later is able to resolve it with HP, please consider providing your smc.bin and UUID!!

    ReplyDelete
  23. James, just wanted to say to you that I had the EXACT SAME EXPERIENCE in November 2012, and CREEPILY, I got the EXACT SAME SUPPORT REP!
    (Or at least the email I got was from the same guy you posted, and the SMC.BIN contained the same ips and info as yours!)

    So as of November 2012 the guy still works there, and is still helping people somehow.
    Craziness.
    As of today, January 09, 2013, I ran accross another HP with the same issue, I'm going to try something where I'm going to change the UUID of the notebook I have in front of me to the UUID of the notebook in front of me now to the UUID of the other notebook, and see if this will work.
    Will post back shortly.

    Great to finally find a post about this though!

    ReplyDelete
  24. I just submitted my UUID on a ProBook 4430s and the chat support rep has taken my information and escalated the case. I will provide my UUID and the SMC file when I obtain it.

    ReplyDelete
  25. I used a hex editor to find the uuid in the smc.bin file posted above and replace it with the uuid of my ProBook 4430s. I still got SMC Command Error. So either there is information in the file that is model specific or something has to be entered in on HP's side in the servers that the IP numbers in the file reference.

    I am waiting for my own SMC.bin file from HP Support still.

    ReplyDelete
  26. Brett,

    Thanks for your comments. When I reset mine last year I don't recall that I had a network cable plugged in during the reset. For this reason, I'm going to guess that no internet connection is made during the process.

    Maybe there is some kind of encryption going on here. See Antonio Dias' comment.

    Hope you are able to get yours going! Please don't forget to let us know how it goes!

    James

    ReplyDelete
  27. I received the SMC.bin file today from HP Support and it worked flawlessly. Here is the smc file, my uuid and the instructions they sent. This was for a ProBook 4430s
    http://www.4shared.com/zip/Nt3IyxEf/4430s_SMC.html

    ReplyDelete
  28. Exact same history here, also with a 6560b. Tried HP support in my country and they asked for a proof of ownership, which I don't have since I bought it 2nd hand. But they said I would have had to bring it to an authorized service anyway. So they story ends here. Still waiting for an UUID-free smc.bin. :)

    ReplyDelete
    Replies
    1. I say keep trying! Call once a week. Call a support line for a different country. Ask for supervisor. Be aggressive.

      Delete
  29. smb.bin file contains ip addresses ?

    My bet: when you phone HP with your UUID it gets added to a database of allowable UUID's of machines where the BIOS password can be reset.

    I suspect the boot process contacts those HP servers, using the ip addresses from the smb.bin, passing the UUID.

    The server will look up the UUID in the database and if it is found it returns a BIOS reset code back to the laptop to reset the password.

    To see if i am correct, i would promisciously wireshark or tcpdump all the traffic on the network, while using the smb.bin file, looking for a BIOS reset code.

    ReplyDelete
    Replies
    1. Hmm. Maybe. But I don't recall even having a network cable plugged in during the process.

      Delete
    2. Here's the thing, I've done this on at least 3 occassions at my workplace with absolutely no active internet connection on the system at all.
      So it cannot be that.
      And as far as finding the UUID in the smc.bin file, here's what I found, if using http://www.cjmweb.net/vbindiff/ to compare SMC.BIN files, it appears they are the same except for some things at the beginning, and the end.
      The difference at the end of the file COULD BE your UUID somehow encrypted, because it appears it's 2 16 "digit" values, seperated by a 7 "digit" value that is the SAME in both FILES (Maybe the UUID is somehow encrypted there, and the beginning SMC.bin is proprietary to the model???!)

      Now if only we could somehow MAP the SMC.BIN encryption, we'd be getting somewhere...
      The great thing is, I'm awaiting another 2740P SMC.Bin, and POTENTIALLY 28 MORE, (potentially the key word there, and if SO, we'd have a much better chance to work with this!!!)

      Hope that helps someone with decryption, maybe...
      :-)

      Either way, I know it's not connecting to a server in any way shape or form...

      Delete
    3. P.S. I can now confirm that the characters at the beginning of the 2 files are 256 bytes, and that the characters at the end of the file are 2 strings seperated by 1 space and 8 spaces, anyways, here's a screen shot of what I'm saying, maybe it'll help illustrate it for you:

      http://imgur.com/tN7JqI3,SOYN49X

      We're getting closer?

      Delete
  30. I've used HP's password reset a LOT recently and the machines in question most definitely weren't connected to the internet. Some were lacking hard drives.

    The current method at HP uses a little more than your UUID as far as I'm aware. You now make a bootable USB with HPREADID.exe and send the resulting file to HP, it'll look like this (details changed to protect laptops!)


    UUID: EAE4F472365CDL99B94191248F054709
    BIOS: Hewlett-Packard 68PCU Ver. F.20 12/08/2011
    Serial Number: CZC******
    Platform ID: 30db
    SKU Number: J1421180
    Model Name: HP EliteBook 6930p
    Asset Tag: User User

    Based of this, you will be emailed the SMC.BIN *or* an exe called sbapkey.exe which will come with instructions.

    As for trying to break the SMC and make your own, why not let HP do it? It only takes two working days and doesn't open up the possibility of laptop thieves doing their evil as easily :)



    ReplyDelete
  31. This worked great. It took maybe 5 minutes & the password was gone. Thanks James for the tip.

    ReplyDelete
  32. I just tried this Called HP on a Friday and it was escalated that day. Monday afternoon I had the email with the SMC.bin file worked perfect

    ReplyDelete
  33. I contacted HP to reset the password on a 6445b. I gave them the UUID. First they gave me a file called sbapkey.exe, and I was to boot to DOS on the flash drive and run it. It didn't work, said "Failed to load defaults, error code: 87"

    Then they gave me the SMC.bin. It didn't work, said "SMC Command Failure." He said something about "6545 and 6445 models are not supported by SMC server." So, it may be impossible with this model.

    Now they are having me ship it in and they'll replace the mainboard.

    ReplyDelete
  34. **A HUGE UPDATE!!!**
    I HAD AN SMC.BIN FILE NOT WORK ON ONE OF MY 6550B RESETS, SO I TALKED TO HP, AND THEY SENT ME THE SBAPKEY.EXE.
    I noticed this program did something that displayed the UUID and the Serial number.
    I popped the .exe file in a hex editor, and changed those values, crossed my fingers, and tried it on another 6550B, and VOILA!
    It worked!

    Change the UUID and Serial number in the key.exe file, and run it on the machine!!

    I put instructions in the file I uploaded, including a .img file for a bootable floppy that should help!

    No support on this by any means, use at your own risk, but yeah, enjoy!!!


    http://www.4shared.com/file/OdZvYoF3/6550-bios-hack.html

    ReplyDelete
    Replies
    1. Would you mind tell me where did you run the key.exe? I tried to run it on Windows and it say unsupported 16-bit application.

      Delete
    2. You have to run it in a DOS startup type environment, I included a "boot disk" to help that.

      Delete
    3. I tried on my probook 6360b, it said that the notebook is not supported. I probably need to change the product number also. Do you mind look at your product number? It might hid somewhere in the exe file.

      Delete
    4. Ive been trying different variations of your method Eric but at this point cant get the method to work and clear my bios password. I keep getting the response that this was designed to work on j*** laptop. I presume this is your username.
      Any ideas?? Would love to get this sorted asap im cracking up ha
      Thanks anyway

      Delete
    5. does anyone have the SBAPKEY.EXE file for a hp 6530B??

      Delete
    6. does anyone have the SBAPKEY.EXE file for hp 6530B?

      Delete
    7. Thanks Eric - this worked on a second hand 6550b with bios locked. The UUID and serial number were all I needed and they were in some information option available when the machine boots up. So product number is not needed and neither is the exe file locked to any user.

      Delete
  35. Yes, we had that same problem here trying to switch models.
    Our product number was: WZ242UT#ABA
    Good luck!
    -Eric

    ReplyDelete
    Replies
    1. Hi,
      Couldn't find any match in the exe. :(

      I will probably try HP support again. They refuse to help me due to I don't have US address and HP support in Sweden asking for the proof of purchase which I don't have.

      Delete
  36. UUID 79FC86209FB5E011A71B4E6234018041
    SN 4CZ1270R67

    ReplyDelete
  37. Eric Ward: Which hex editor did you use? Was the information you found in plaintext?

    ReplyDelete
    Replies
    1. Hi Buddy.
      I used HxD, yes the values were found in plain text.
      Sorry for the way late response.
      :-)
      -Eric

      Delete
  38. Hello,

    I have a HP Probook 4535s have been locked out of the BIOS after i formatted the PC. There's a User called BIOS-Administrator and of course, I don't have a password to that account.

    HP support sent me the hpreadid.exe and then the smc.exe.

    My problem is, that i keep getting the 'smc failure' error.

    I've tried various flashdrives, nothing worked out.

    HP now wants to exchange the mainboard at my costs.

    Does anybody have an idea of what else I could try?

    - Tony

    ReplyDelete
  39. Hi Tony,
    Could you share that smc.exe file to give us a try please? Thank you in advance

    ReplyDelete
  40. Hey thanks a lot for taking the time to write this and put it out there. I would've never contacted HP otherwise...

    ReplyDelete
    Replies
    1. You're welcome! I've gotten a lot of major breakthroughs over the years by information people have posted online and I figured it was time I gave back!

      Delete
  41. Hey Sergey,

    I am sorry, it was a Typo its smc.bin, I was on mobile and not fully concentrated.

    But I do also have a question, is anybody able to upload the "SBAPKEY.EXE" they've gotten from hp?

    ReplyDelete
  42. To find UUID and Serials numbers please use following scripts.

    save script file as sn.vbs

    strComputer = "."
    Set objSWbemServices = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colSWbemObjectSet = objSWbemServices.ExecQuery _
    ("SELECT * FROM Win32_ComputerSystemProduct")
    For Each objSWbemObject In colSWbemObjectSet
    strIdentifyingNumber = objSWbemObject.IdentifyingNumber
    strName = objSWbemObject.Name
    strVersion = objSWbemObject.Version
    Next
    Wscript.Echo "IdentifyingNumber: " & strIdentifyingNumber
    Wscript.Echo "Name: " & strName
    Wscript.Echo "Version: " & strVersion

    save script file as UUID.vbs

    'Displays the UUID of a computer
    'By Mitch Tulloch (www.mtit.com)
    strComputer = "."
    strWMINamespace = "\root\CIMV2"
    Set objSWbemServices = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colSWbemObjectSet = objSWbemServices.ExecQuery("SELECT * FROM Win32_ComputerSystemProduct")
    For Each objSWbemObject In colSWbemObjectSet
    strIdentifyingNumber = objSWbemObject.IdentifyingNumber
    strName = objSWbemObject.Name
    strVersion = objSWbemObject.Version
    Next
    strWMIQuery = ":Win32_ComputerSystemProduct.IdentifyingNumber='" & strIdentifyingNumber _
    & "',Name='" & strName & "',Version='" & strVersion & chr(39)
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & strWMINamespace & strWMIQuery)
    For Each objItem in objWMIService.Properties_
    If objItem.name = "UUID" Then
    Wscript.Echo objItem.name & " = " & objItem.value
    End If
    Next

    ReplyDelete
  43. Hi Eric,

    Thanks a lot for posting the files up to 4shared. I've run into a snag though (unless I've just farked up your process completely) ...

    I've made the bootable USB (using "rufus"), and I've copied my newly-saved (from HxD w/modified UUID/SERIAL) key.exe to that USB stick.

    At this point - I want to boot to the USB stick from the affected laptop, correct? If so, I cannot - since the HP Laptop is asking for the BIOS password first. If I select F9 to change boot order, it asks for the BIOS passwd.

    I cannot boot to USB drive as far as I know.

    What should we do now? We had these machines returned to us from "clients" and now we're in a tough spot!


    Thanks for all your help.

    ReplyDelete
    Replies
    1. Hi Rob, I realize this reply is VERY LATE, but for anyone else who this may help:
      IF YOU CANNOT BOOT FROM USB, COPY THE FILES TO A PHYSICAL SATA HARD DRIVE AND THEN PUT IT INTO THE MACHINE AND BOOT OFF IT.
      I'm sorry I can't explain that in more detail, but it should help someone.
      -Eric

      Delete
  44. well I cannot find no uuid nos with any hex editor

    ReplyDelete
  45. Eric - If your machine isn't letting you boot from USB you will need the SMC.BIN file, not sbapkey.exe.

    ReplyDelete
  46. I wrote an auto patcher ill post it to box.com. It will edit in binary mode, the hex value for SN and UUID of key.exe automatically after you supply the new values. The kit will include files and utility to make a bootable Usb... Tested on 6550B works every time.

    ReplyDelete
    Replies
    1. Can you post a link to your auto patcher?
      Thanks in advance?
      /Jacob

      Delete
    2. Please send a link to your auto patcher - thanks

      Delete
  47. I have a hard drive, which was a HP Probook 6560b in and asks for a DriveLock Password. How do I delete the password. Many thanks in advance for your help.

    ReplyDelete
    Replies
    1. Lira,

      This is separate issue which is outside of the scope of this post, unfortunately. There are tools out there which claim to be able to remove hard drive passwords, but I have no experience with them. You could try the tools on the UBCD (Google it), or try contacting HP.

      Sorry I don't know how to do it off the top of my head.

      -Me

      Delete
  48. I have a hard drive, which was a HP Probook 6560b in and asks for a DriveLock Password. How do I delete the password. Many thanks in advance for your help.

    ReplyDelete
  49. i have contacted a hp support and they sended me hpreadid.exe which i cant open....cant boot from usb, plz help

    ReplyDelete
    Replies
    1. I've not used the hpreadid.exe method before, although it has been reported in the comments that it works. Have you followed their instructions to make a bootable USB? Have you chosen the option to boot to the USB when it boots? If so, kindly paste the instructions that HP gave you right here in the comments and I'll see what I can do.

      Delete
    2. bootable USB: yes , choosen the option to boot to the usb when it boots: no...i have only 1 option...boot from HDD. (after press F9)

      When i copy and paste into d:\hp_tools smc.bin file and then start the laptop with winkey+up arrow+down arrow, than show me: SMC Command Failure...also i can boot from d:\hp_tools .

      I contact already hp support and waiting for files. I maked info.txt manual (i typed in all info uuid, sn, bios date etc) i can boot only from hdd also that was 1 option to make the info.txt file.

      My instruction that hp gave me is in German language, and show how u can read info from bios to make info.txt.

      Sorry for my English

      Delete
    3. Maybe the USB boot is disabled in the BIOS? If so, that would be kind of a problem. Are you using any kind of docking station or USB hub? If so, check this out: http://tinyurl.com/llsqbdg

      Try a different USB drive. Some of the more modern ones take a while to "settle in". Try to do anything you can to delay the BIOS boot like hitting a bunch of keys or booting to the HDD with it disconnected. That may delay it just enough for the USB drive to settle in. Try booting another computer to the USB drive in order to test it. Also, maybe there is a way you could do this with a USB floppy drive. Just some ideas...

      Delete
    4. Oh, and also try different USB ports...

      Delete
  50. When i try to boot from USB, i have black screen and procesor fan is Loud...thats all whats happen

    ReplyDelete
  51. Does someone have the files for HP 4530s?

    ReplyDelete
  52. Does someone have the files for 4530s?

    ReplyDelete
  53. Has anyone been succesfull with a hp Eltiebook 8730w i downloaded the files, edited it to use my uuid and serialnumber but the apps just says my system is not supported. any suggestions?

    ReplyDelete
  54. I have about 20 models with keys that might work for you, one of them is 8730w. Porting link here

    http://www.4shared.com/rar/RWlV5vHJ/keys.html

    ReplyDelete
    Replies
    1. And if your model is not on the list, try with a model close.
      Worked for me with key 6460b on a 6360b

      Delete
    2. Hi,
      I did reset 6360b with the tool provided above but now I got Product Information Not Valid and my uuid is now fffffffffffffffff. How do you get around this problem?
      thanks

      Delete
    3. Hi,

      I fixed the problem now, thanks

      Delete
  55. What about 2570p? Can I use key file from 2560p? Or how can I port the file for other model?

    ReplyDelete
    Replies
    1. Well it worked for me, cant tell for sure if it will work for you, i just changed the uuid and the serial as some other ppl did on the first file uploaded.

      Delete
  56. @ AnonymousOctober 1, 2013 at 9:49 AM Thank you really much for sharing that link. one of the three files for the 8730w did the unlock my bios password. Which is great thank you.

    ReplyDelete
  57. Anyone got a 6530B key exe?

    ReplyDelete
    Replies
    1. I would try the 6535b key that is in the link here.
      http://www.4shared.com/rar/RWlV5vHJ/keys.html

      Delete
  58. Sadly, the two 6535B exes both don't seem to work with a 6530, error with unknown notebook model. Any way to alter the model that anyone knows of?

    ReplyDelete
    Replies
    1. A bit of a late reply, but try the 6730b one. It worked fine for me.

      Delete
  59. **UPDATE**

    Saludos para saber UUID HP 6530B

    Crear USB booteble con HPUSBFW.EXE y DOS system files
    Una vez creada la usb booteable, descomprimir el contenido de hpdmitodos en la raiz de la USB

    Reiniciar el equipo, bootear desde la USB

    teclear

    hpset146.exe

    presionar enter.

    despues pulsar la tecla D

    y Listo nos muestra el UUID del equipo. Ahora si pueden comunicarse a HP

    https://mega.co.nz/#!3E9xgbqa!W8JSMxu_1NcKx-cAWp_yd1dEtc1Lwcs7alMx9QnWv1w




    ReplyDelete
  60. ***UPDATE 6530 ***

    DOWNLOAD EDITOR
    http://www.physics.ohio-state.edu/~prewett/hexedit/hexedit.exe

    DOWNLOAD PASSWORD REMOVER
    https://mega.co.nz/#!6AtRiLaa!RGIRy2hfF5PnjA2ymW0pzT-NgFE_zU6WhzLjj8upXBc

    Editar archivo sbapkey.exe hexedit.exe

    Remplazar 11111111111111111111111111111111 por tu UUID
    Remplazar CNU1111111 por tu s/n
    Ejecutar desde Pendrive booteble, disco de inicio win98

    sbapkey.exe


    TESTED

    By CoM_gUnNeR

    ReplyDelete
    Replies
    1. Just gives "error in exe" for either the edited or provided SBAPKEY.exe?

      Delete
  61. www.youtube.com/watch?v=Bs8p927SyVU

    ReplyDelete
  62. How do I make this file for a 64bit HP EliteBook 8770?

    ReplyDelete
  63. How do I make this file for a 64bit HP EliteBook 8770w ?

    ReplyDelete
  64. i tested in my hp probook 6470b and does not remove the password. it say Utility to clear Bios password. Version 1.2 ***** This tool is only allowed to run by ******.Notebook is not supported (179c)
    any ideas ????

    ReplyDelete
  65. Yesterday I was attempting to install Win8 on my HP ProBook 4421s which was having Windows 7 Home Edition (32-bit). Because of some problems I wanted and executed the BIOS--Reset defaults. It restarted and everything was gone, screen was completing black....no display at all. Fan kept running it not possible to close the laptop....it kept restarting.......no display everytime..I had to remove the power and battery to close it.

    Googling pointed to BIOS corruption and I also attempted to following instruction about Bios update using USB key, but could not. Please help. Any help would be highly appreciated.

    ReplyDelete
  66. Hi!

    Anybody have an sbapkey.exe for the 8440p?

    ReplyDelete
  67. Ok Guys, some very interesting news!

    I have disassembled the key files. I was able to remove all checks for serial,uuid and model :-) So i have an universal spabkey.exe. The key files just check the hard coded s/n & uuid, no additional calculation is made. If everything is "ok" it will write something into the nand.

    On this base i have modified spabkey.exe for the 6930p to work on the 8440p. Sucessfully removed the password, no problem!

    It should be no problem to remove the s/n & uuid check, BUT i could brick your system if you remove the p/n (platform) check, and use on another platform.

    regards...

    ReplyDelete
    Replies
    1. Is that available for download somewhere? would it work on a 6530 ?

      Delete
    2. I would be really interested in this spabkey.exe for 8440p, can you send link or contact me to alc@email.cz?

      Delete
    3. There is more going on here then just that. There are multiple key files of varying file size. Some files of same size have different hex make up (excluding any SN or UUID info). Some keys for one model with work on another, and yet not on a 3rd. So far my method has yielded great results:

      [CONFIRMED]
      Probook 8540w
      Probook 6460b
      Probook 6450b
      Elitebook 6930p
      Elitebook 8560w
      Elitebook 8530p
      Elitebook 2560p
      Probook 6550b
      Probook 6460b
      Elitebook 2560p
      Elitebook 2740p
      Elitebook 8440p
      Elitebook 8640p

      [NEED CONFIRMATION]
      HP 2230s
      HP 2730p
      HP 4310s
      HP 4510s
      HP 6455p
      HP 6535b
      HP 6545b
      HP 6730b
      HP 6735b
      HP 8530w
      HP 8540w
      HP 8560p
      HP 8730w
      There may be more....

      See my video, read the comments, download my toolset (link in video description). No spam, all legit, safe Box.Com site for DL Just saying

      Delete
    4. forgot the video link:
      www.youtube.com/watch?v=Bs8p927SyVU

      Delete
    5. Sorry, but that is not correct... There are at least 3 different versions.

      1) 14KB
      2) 26KB
      3) 27KB

      Just analyse the code, doesn`t matter which 14KB File, every time the same hex offsets. 14KB = 700 and 6C9, just open and replace this checks with 9090 (NOP). The rest are Strings and are absolutely not from interest.

      One patched 14KB files works here on 2530p / 6930p / 6730b / 8530p...


      Delete
    6. Hi jhayton, thanks so much for all your work.
      The only thing I can offer to your work is this cool EXE that reads the UUID, that way you don't have to use HPSET14A.
      https://mega.co.nz/#!d5JRBArA!H_14mES8xUnveIa3EvWb7UdlKNZD1LTYl36jwT6orAc

      Thanks again for the work and the UPDATES!

      Delete
    7. Anonymous November 19, 2013 at 1:38 AM

      If indeed you dug further into the Key Files, and figured something out, can you send the info to epctech.eric@gmail.com, it'd be a huge help.
      -Eric

      Delete
  68. smc.bin contains ARM code, so maybe anyone have a arm debugger/disassembler?

    ReplyDelete
  69. I saw this on HP: "Portátiles HP Elite/ProBook: cómo eliminar la cuenta de usuario de ProtectTools del BIOS"



    http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?sp4ts.oid=5229461&spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03785037-1%257CdocLocale%253Des_MX%257CcalledBy%253DSearch_Result&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

    ReplyDelete
  70. 6440b works with patched 14KB Key!

    ReplyDelete
  71. HP ProBook 6470b Notebook is not supported (179c) with 14KB Key

    ReplyDelete
  72. I have an 8460p I purchased from a reseller that has no usb or dvd drive boot options & the bios is locked. I contacted HP & was given a smc.bin file specific to my UUID & S/N. I followed their directions to the T, but rec'd a smc failure message. I was told by HP that System Configuration ID listed in the F1 system info contains a digit that indicates the prior owner disabled the only method used to unlock the Bios p/w.
    Can anyone help ?

    ReplyDelete
  73. Anonymous in the USDecember 11, 2013 at 2:57 AM

    I posted a question regarding an HP 8460p with the issue of not able to access the BIOS due to admin password already set but unknown to me. Purchased laptop from reseller who did not unlock it - nor did they list any other boot options than notebook hard drive.... no usb or cd/dvd drive boot options. The ssm.bin file fix from HP did not work. They stated "System Configuration ID (as viewed in the F1 System Information menu at POST) contains a digit that indicates the prior owner had disabled the only method we can use to unlock the BIOS password. This coupled with the prior owner also disabling USB boot devices probably means they had locked the system down tightly." Can someone please help with this issue ?

    ReplyDelete
  74. Anonymous in the USDecember 11, 2013 at 4:28 PM

    Correction to my prior post re:HP 8460p - file I recd from HP was actually a SMC.Bin file. Can anyone help with this issue ?

    ReplyDelete
    Replies
    1. Anonymous December 11, 2013, get a regular HDD that's empty (NOT USB!) and email me at epctech.eric@gmail.com, and we can TRY to help you from there.
      -Eric

      Delete
  75. Hi guys, I have ProBook 6570b with password on boot. This is what i did:
    - Pressed "Windows Key + Arrow UP Key + Arrow Down Key" all keys at same time and turn on the system
    - Released all keys and press F10 at HP logo, then I got a screen- login as guest-
    now I,m in bios :) next -reset security settings to default- then save settings and restart. After restart I got Clear the TPM screen, F1 to accept and that is all, worked well for me.





    ReplyDelete
  76. https://www.youtube.com/watch?v=VHRcCRi4KZY

    Here I demo a 8530w and an 8460p, using my system.

    My new software system is DOS based. This is the version that I've been writing in C and it's just about ready for release! It's faster, and now even more easy to recover from a forgotten or lost BIOS password. My new system will get your UUID and SN automatically. It's so Simple. It's menu driven. Just boot, select your model and it will do the rest, just follow the prompts! No more entering 10 digit serial numbers, no more miss-typed 32 character UUIDs! No more booting to windows for key creation. It does it all in one stop. I hope to have a release with at least 10 Models supported by end of year. When I Have my 10, I will release the software. As of now the 6550b, 2530p, 6930p, 8530w, 8460p, 6460b, 2230s and 6455b are coded in and are in test stages. That's 8, so 2 more to go. Sorry for the cheese video, but I wanted to show something. Stay tuned and look my my new release soon!

    100% Legit, not fake. Want a quick easy software solution? See my YouTube video posts, read the comments.

    "DUDE! Thanks a million. I just unlocked a 6550b and a 6730b with no issues. The reset tool works great too - I needed it for 6550b. I get a lot of units with these stinking passwords. Worked fantastically! If I could give you 10 "likes" I would."

    "Hi,
    First of all thanks for this utility! You're helping a lot of people out there. Kudos for that!"

    "Waoow just did probook 6550B in one go perfect.Thx mate"

    "Confirmed working on ProBook 4510s
    Thanks alot."

    "Confirmed working on elitebook 8530P"

    "THANK YOU!!! Worked like a charm on EliteBook 6930p after messing around some times since I didn't understand at first. Have a great week."

    ReplyDelete
    Replies
    1. Well is it going to be posted somewhere?

      Delete
  77. Thank you guys for info! Finally unlocked my 6930p :-)

    ReplyDelete
    Replies
    1. Can you explain how you did that.
      I've tried everything.
      I get this error message: Clear all passwords ...
      The currrent Bios does not support this feature.
      Reboot the system.

      Thanks

      Delete
    2. Can you tell me how?
      Thanks

      Delete
  78. Tried on probook 6475b without success. Tried the method by Eric and the other one provided by Mazzif. Nothing working. <every thing and every key but no vain. I get the error " Notebook not supported with error code (180f). Btw the laptop does only boot from HDD. What a luck :(

    ReplyDelete
    Replies
    1. The current Bios does not support this feature.
      Reboot the system.

      Your BIOS is too old to support the reset of the TPM. You'd need to update the BIOS, but being password protected will most likely prompt for a password when you flashed update. i have heard rumors of a hacked BIOS that can be flashed bypassing the need for password but I have yet to confirm.

      I have also heard rumors that you can force a recovery/update (at your own risk of course)

      1. Download the BIOS from hp support and drivers of your laptop, then extract the exe file.

      2. Get a new version of the BIOS rom file, there are two, one is ROM.CAB, another is 68CVD.bin (Or simular) in Rompaq folder.I am not sure which one works, so I copied both to the root folder of a USB drive.
      3. Then turn off the laptop, plug in the USB drive with new version of ROM file.
      4. Holding the "Windows" key and "B" key (Win+B), then hit the Power button.
      5.See "Cap Lock" indicator light is flashing, and nothing shows on the LCD screen.
      6. After couple seconds, the light on the USB flash drive is blinking, this means hopefully it is reading the BIOS rom
      from the USB. Release the Win+B at this moment.
      7. After that it takes a while to upgrade the BIOS, and reboot 2-3 tims.
      8. At last it should show some BIOS recovery information on the screen.
      9. Enter the windows, check the BIOS version to confirm it has already been upgrade.

      Run mazzif tool to create key to unlock your lasptop.


      I will look into the 6475. I have not seen this model yet.

      Delete
    2. Thanks for úr concern. I will sure wait for your next comment if you get any new info. As for the flashing the bios its not a big problem coz I have a programmer ( one which I called willem but im not sure if the bios chips I this laptop is supported. Do anyone by any chance have the chipset number.

      Delete
    3. Nothing worked trying to update the bios with the above methods nor with the 4 arrow keys. Have you sir looked upon this model, any news?

      Delete
    4. I have just performed these steps to force a BIOS update on a Password Protected Elitebook 8440P.

      I have formatted a 1GB USB Thumbdrive to FAT32 non bootable.
      I have downloaded bios from HP (F.13 22 Aug 2011) sp54348.exe

      I used Universal Extractor to extract all files to directory sp54348
      In that file directory I have a file named ROM.CAB.
      I open ROM.CAB with winrar and inside I have:

      rom.bin
      efbios.sig
      rom.sig
      ver.sig
      ver.txt

      ver.txt reads
      _ROM_ 68CCU v0F.13 08/22/20110x180000 0x00010000
      0x280000 0x00080000
      0x0 0x00010000

      I extract rom.bin and efbios.sig and place at root USB

      I rename rom.bin to 68CCU.Bin and efbios.sig to 68CCU.sig (From ver.txt)

      I power on laptop holding Win+B
      As soon as USB starts to flash I let go of keys.

      laptop is black for a moment and reboots a few times
      then I get this screen

      http://imgur.com/Sw5xF5s

      Success BIOS update to F.13 8/22/2011 (Prior was 2009)

      Delete
  79. Thx and happy new year for all participants.

    I will give this a try tonight or tomorrow.


    Get back with positive results I hope.

    ReplyDelete
  80. tried the recommended recovery flash method exactly the same steps as u mentioned. Nothing happens. as I start the laptop holding win+B I see the usb flashes once, at the same time the caps lock led keeps blinking . I let go the win+B, the fan kicks in after a while at high speed, the screen I black, noting else happens from here on though I left it run for about ½ h. At this stage its impossible to shut off the device except by getting out the battery and disconnecting the powercord. When booting the laptop, everything seems the same as before.


    BR

    ReplyDelete
    Replies
    1. @ Anoymous BR

      My greatest apologies, I see I have left out an all important instruction

      I created the nested directory at the root of USB
      "Hewlett-Packard\BIOS\Current\"
      I then extract rom.bin and efbios.sig and place at 'Current' on USB
      Then rename then to the string from ver.txt (68CCU for example)
      68CCU.sig 68CCU.bin
      I have performed the steps on these models with success

      HP 6930P
      HP 8440P
      HP 8530W

      See my post: http://bit.ly/1eJK2jc

      -Mazzif

      Delete
    2. will give it a new try tonight. Hope it would work but as long as I got to know through hp website is this this model not only have the TPM ( trusted platform module ) but even the MPM ( manufacturing programming mode ) property. Contacted hp and kept talking with several positions at support but seems no one was able to give a satisfying answer. All and every method they recommended led to nothing. I can understand now how furious it can be for some when contacting the support of hp. Even though I'm actually grateful to the support the spent such long time even while my machine is not until guarantee. Hope there will be some way to solve.

      Delete
  81. The works you have done are great. My hearty congradulations.

    ReplyDelete
  82. I have probook 6570b with locked bios what is the best way to reset?

    ReplyDelete
  83. @AnonymousJanuary 9, 2014 at 8:25 PM

    I would try my Windows based keygen and use the 'Make All'. See my videos, blog or other forum posts on the matter. I havent seen a **70, so I cant even begin to say my tools will work, but it certainly wont hurt to try.

    @ AnonymousJanuary 10, 2014 at 11:40 AM
    What is you model?

    ReplyDelete
  84. Any new developments referring to newer models referring to 6475b????

    ReplyDelete
  85. Tried on 8440 and work like charm at first attempt. Excellent work, never thought it was possible to do it till I found this forum. As for hp support go and update urself instead of telling that the mobo must be replaced when no answers are there to give.

    ReplyDelete
  86. Not sure how many this will work for, But I have a ProBook 4510s that the previous owner had set up a bios password. I tried this tool every way and many times. And Mazzif was amazing at responding to my questions we were still unfortunately unable to unlock it. On a whim I downloaded HP ProtectTools (You must be able to get into the operating system as Admin for it to work) went through the setup and created myself an administrator startup account and set the password to my windows logon. BAM, got in bios, deleted profiles, and all is well. Hope this helps out.
    |,,|.(*_*).|,,| ~ SU!C!D3

    ReplyDelete
    Replies
    1. Hi which version of protect tools were you using and what did you do exactly.
      I created an admin user but it can not configure users in bios.

      Delete
  87. Today 09.03.2014 on HP Probook 6450b HP BIOS Revision 68CDE Ver F.06 INTEL CPU successfully removed BIOS ADMINISTRATOR PASSWORD with this tool http://www.4shared.com/file/OdZvYoF3/6550-bios-hack.html?cau2=403tNull&ua=WINDOWS - i put my UUID AND S/N with the hex editor from the download package in the key.exe, i make a usb bootable with hirens, i I copied the hp_tools folder on usb flash drive ... last step I searched a file manager from DOS PROGRAMS in HIRENS ... i located the KEY.EXE - I RUN IT - A WINDOW APPEARED for i few sec i think was blocked ... power off from button --- power on -- and the i recieve the F1 MESSAGE TO CLEAR THE TPD. And thats all ... after that the password disappeared and i flash my BIOS to F.23.

    ReplyDelete
    Replies
    1. on a probook 4530s here... your link is not valid.

      Delete
    2. Link is no longer available... an you reupload somewhere else

      Delete
  88. Hy
    Searching bios unlock for hp 2570p

    ReplyDelete
    Replies
    1. Request from HP support. Its uniq for each 2570p. It also expires after some time, mine smc.bin was valid for 7 days only.

      Delete
  89. God bless you, topic starter, for this line : "5. Press F10 repeatedly at the screen that shows up with "SMC command handled successfully""

    ReplyDelete
  90. For HP 8570P ellitebook
    with the method described herein
    created the nested directory at the root of the USB
    "Hewlett-Packard \ BIOS \ Current \"
    I THEN extract rom.bin and efbios.sig and place at 'Current' on USB
    Then rename the then to the string from ver.txt (68ICF for example)
    68ICF.sig 68ICF.bin
    See my post: http://bit.ly/1eJK2jc
    I did update the BIOS
    I got the result in the photo ...
    BIOS password has been reset.
    was done and downgrade bios ... same result

    ReplyDelete
  91. Thanks for sharing this! Saved us from having to buy a new laptop!

    ReplyDelete
  92. Thank you Everyone in the comments for keeping this updated-
    06/04/14 I called, Gave my serial and UUid, and told the girl exactly what I needed, asked for it to be escalated-
    "Raju, Robin (AMS Resource Desk)"
    Replied back within the hour with my smc.bin!


    here is his contact Info- I would have appreciated it when I was looking for this solution

    Robin Raju
    Resource Desk Engineer
    CSS PPS CDC B AMS RD
    (M)(+91) 9742124445

    RD mail Box: AME RESOURCE DESK MAIL BOX |1-800-544-9976|

    ReplyDelete
  93. hp probook 6470b how to remove bios password

    ReplyDelete
  94. Hi,

    i bought a HP pro book 6560b from a car boot sale, the guy selling told me it was from his old work which he had left. Powered up the laptop, so i parted with £350 pounds.

    When i got home I tried to reset the laptop with a windows cd. However everything is password protected. Bios and password to get into windows (this does not look like a traditional area to enter a windows password, maybe bespoke not sure).

    is there away of me reseting this laptop or is this a waste of £350...

    Thanks in advance for our help

    ReplyDelete
  95. please help.....how to remove bios password in hp probook 6470b

    ReplyDelete
    Replies
    1. Are u good with soldering?
      If so then enter the bios info and see which version is installed.
      Buy a tiny programmer like this one.
      http://www.ebay.com/itm/261474752094?ssPageName=STRK:MEWAX:IT&_trksid=p3984.m1423.l2649
      Desolder the bios chip, very easy by the way.
      Download same bios version from hp.
      Erase chip, reprogram, verify, resolder and power on, that's all you need, I tried everyother shit with a probook 6745b, nothing worked.

      Delete
    2. I ment 6475b

      Delete
  96. Thanks for this post :) helped me alot

    ReplyDelete

Spammy/foul language comments or those with an explicit avatar will be tossed in a 55 gallon drum and a match thrown in after them. (Oooo, now I can warm my hands!!)