jethrogb/lenovo-password

Implementation of Lenovo ThinkPad HDD password algorithm

Implementation of Lenovo ThinkPad HDD password algorithm

This repository contains an implementation of the Lenovo ThinkPad HDD encryption password hashing algorithm. This can be useful to unlock your drive on another computer when your laptop fails.

Usage

You'll need to save the ATA IDENTIFY block for the relevant hard drive (sda in this case):

sudo hdparm --Istdout /dev/sda > sda.ata_identify

Enter the password and store the password hash in environment variable P:

P="$(ruby pw.rb sda.ata_identify)"

The script will print an error message if there's something wrong with the input or output.

Next, use the password for one of the security commands of hdparm, e.g.:

sudo hdparm --security-unlock "$P" /dev/sda

To scan the partitions of this drive now that it is unlocked and ready for use, run:

sudo partprobe /dev/sda

See also https://jbeekman.nl/blog/2015/03/lenovo-thinkpad-hdd-password/

lenovo-password's Issues

Readme does not work with nvme drives

Hi, I got a new Lenovo T470 laptop in my workplace, which apparently has an nvme SSD (which I did not even know existed). I wondered what the HDD1 password BIOS setting was, so I got to your website and to this project. I wanted to try the first command in the readme, but that gives an error:

$ sudo hdparm --Istdout /dev/nvme0n1 > nvme0n1.ata_identify
 HDIO_DRIVE_CMD(identify) failed: Inappropriate ioctl for device

My hdparm is from Arch repo, and is the latest version (v9.56).
I wonder if this command could be somehow substituted with the nvme command in case of these nvme drives (see https://wiki.archlinux.org/index.php/Solid_State_Drive/NVMe).
Now I found a post which seems to support that:
https://forum.manjaro.org/t/hdparm-not-getting-info-for-ssd-samsung-960-evo-m-2/35445/2
"hdparm expects IDE, libata and SCSI-ATA devices. NVMe is not any of those. If you want to get info about your NVMe device, install the nvme-cli tools."
I tried the above hdparm command on a sda device and it spits out some hexadecimal data.
I installed nvme-cli from AUR, but I wonder if there is a command which would produce the same (or similar, but usable) output, and whether this project can work with nvme drives in the first place.
If not, maybe it should be clarified in the readme. Thanks.

Hint for non-QWERTY keyboards

Thanks for having made this tool @jethrogb!

Not an issue, but more a note for later / hint for other users, as it took me an hour to figure out why it was not working: if you have a non-QWERTY keyboard on your ThinkPad, then, when using ruby pw.rb, you have to enter your "QWERTY-translated" password...

... i.e. in Windows, temporarily set "EN" keyboard, and enter the keypresses of your password as usual, and see the result: this is what needs to be entered after ruby pw.rb.

I confirm it works on T520. Do you know @jethrogb if it works on T440, T450, T460, etc.?

SG_IO Error

I used your patch for hdparm 9.45 and successfully created "$P"
But then, I receive the following error on security-unlock:

SG_IO: bad/missing sense data, sb[]: 70 00 ...
SG_IO: bad/missing sense data, sb[]: 70 00 ...

And binary characters are displayed along with some other messages in the terminal.
Do you know why this is happening?