Microsoft Surface Pro 3 UEFI password

[jangut4]

Originally Posted by RethoricalCheese

manado

hey im unable to dump my bios im getting error

Error 316: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable Protected Range Registers.
FPT Operation Failed.

[wars]

Hey, sorry to jump-start an old-ish thread but I am having a similar issue with an SP3, I'm unable to read the BIOS from within Windows. Device has a BIOS password, I have Win10 installed but boot order is locked to HDD only, no USB booting. I do not want to remove the screen but need to make a dump as I have a few of these with the same (unknown) password so getting it would be very useful. I've tried to read using 'fptw64.exe -BIOS -D my-backup.bin' and 'fptw.exe -BIOS -D my-backup.bin' but no error and no file is created. I have also tried using afuwin64 and get 'error 46'. I've tried the ME tools v9 and v11, with V9 fptw I get the error "error 284: fail to load driver (PCI access for windows)".

Does anyone know what I'm doing wrong? I am running CMD as Administrator.

[RethoricalCheese]

You can try going to recovery options by holding down shift when pressing restart. There you can open command prompt and navigate to fptw folder and try from there.

And BTW, use v9. 5 not v9

[wars]

Originally Posted by RethoricalCheese

You can try going to recovery options by holding down shift when pressing restart. There you can open command prompt and navigate to fptw folder and try from there.

And BTW, use v9. 5 not v9

I should have said the full version number, I was using v9.5 r6. I've just done as you said and it's dumped it using cmd in recovery mode. You are amazing, thank you so much.

I *might* (not 100% yet) need some help decrypting the password, is there a utility to do this from the dump available somewhere?

[RethoricalCheese]

I will make a tool for that but not yet. Thus far I've done it manually. Its actually only a few lines of code but doing it manually is quite fast anyway so I haven't bothered.

[ospfarea51]

Hi RethoricalCheese I've used the command

"fptw64.exe -BIOS -D sp3_bios_locked_backup_10_23_2020.bin"

to create my dump file. Can you please give me a hand by decrypting the password for it thank you in advance.

Backstory if it matters I bought this surface pro 3 off of ebay and the posting didn't mention anything about a bios password. Secure boot is stuck on so I can't even reinstall windows on it says invalid signature on everything I try to boot from USB.

[BootLoader1]

Try this password :

- Admin Password : Blueblur45

[ospfarea51]

It worked! Thank you so much what a relief I thought I was going to have to return it lol.

How is the password found in the dump file? Is it just a matter of reversing a know encoding scheme or similar to a brute force like using hashcat?

Can you point out where it is in my dump file please.

[kherkesh]

Originally Posted by RethoricalCheese

manado

hi
can u decrypte pass to me?
tanx

[BootLoader1]

- Admin Password : DSB1os

[FlorianAdamczyk]

Hey Guys!

I have forgotten my UEFI Password on my Surface 3 Pro too and have often tried to recover or bypass it but always failed.
I have set the booting order to SSD only and have locked the Bios with an Administrator Password which I can't remember.

Now it seems as you have found a method to get it working!
Could you please help me?
I have some understanding of Computers and if you can give me a step by step explanation what I have to do I can upload the UEFI bin file and you can extract the password out of that? or what can I do?

thank you very much in advance.

greetings from Germany
Flo

[peste]

Originally Posted by FlorianAdamczyk

Hey Guys!

I have forgotten my UEFI Password on my Surface 3 Pro too and have often tried to recover or bypass it but always failed.
I have set the booting order to SSD only and have locked the Bios with an Administrator Password which I can't remember.

Now it seems as you have found a method to get it working!
Could you please help me?
I have some understanding of Computers and if you can give me a step by step explanation what I have to do I can upload the UEFI bin file and you can extract the password out of that? or what can I do?

thank you very much in advance.

greetings from Germany
Flo

yes ... post the laptop bios ...

[FlorianAdamczyk]

When I enter the Bios (by pressing and holding volume down when starting the surface) I am prompted to enter the admin pass(which I don't remember). When I hit enter without typing anything I can see the Bios (but can't change anything) and at the bottom it reads:
Version 2.6.1243. Copyright (C) 2013 American Megatrends, Inc.

for further Infos See the pictures

I hope that was what you asked for

[RethoricalCheese]

No, please read and follow previous posts.

[FlorianAdamczyk]

Originally Posted by RethoricalCheese

No, please read and follow previous posts.

Yes I did that before and tried it but i didn't understand.
I couldn't find the correct tool to download.
Now i got it and it would be very nice to anyone of you if you could help me with getting the admin pass.

thank you in advance

[FlorianAdamczyk]

Originally Posted by FlorianAdamczyk

Yes I did that before and tried it but i didn't understand.
I couldn't find the correct tool to download.
Now i got it and it would be very nice to anyone of you if you could help me with getting the admin pass.

thank you in advance

...

[RethoricalCheese]

Well done!

Here is your password. Or well, I better pm you this, contains some name it seems.

[FlorianAdamczyk]

It worked!
Thank you very much!

[Greenf1re]

Hey, my surface pro 3 is also bios locked. Can you help me decrypt it? I used the intel tool dumper, but I have no idea how to find the password.

[Greenf1re]

Originally Posted by Greenf1re

Hey, my surface pro 3 is also bios locked. Can you help me decrypt it? I used the intel tool dumper, but I have no idea how to find the password.

Edit: I've found my hash:
0B 93 D9 26 78 BA 18 4D A8 E0 10 74 4D 07 E9 9A 07 2E 8E C1 E9 54 44 E8 9F 7B FA 0E 55 A2 B0 35 0B C9 66 5C C1 EF 1C 83
But I'm still clueless as where to find the XOR key. Any guidance would be appreciated.