AMITSESetup Decryptor

[EineWildeStehlampe]

As a lot of older firmware images use the well known, incredibly secure AMI XOR key to encode the supervisor password in the firmware image, I wrote a small Python tool to automate the process of searching through the image and decrypting the key. It is far from perfect but works well enough for me to share.

The tool uses UEFIExtract to dump the entire image, naively search for a folder ending in "AMITSEDecrypt", iterate through the body.bin to find all possible hashes stored in there, decrypt them with the XOR key, remove every second byte, then convert to ASCII.

Usage: python3 AMITSEDecrypt <Path/to/image.bin>

Hope it'll be of use to someone and excuse my horrible Python skills.

[crowntoy99]

Re: AMITSESetup Decryptor

good jobe

[Maxpower3]

Re: AMITSESetup Decryptor

good job, untested for the moment, thanks

[Ghamidi]

Re: AMITSESetup Decryptor

great job thank you

[EineWildeStehlampe]

Re: AMITSESetup Decryptor

The tool uses UEFIExtract to dump the entire image, naively search for a folder ending in "AMITSEDecrypt", iterate through the body.bin to find all possible hashes stored in there, decrypt them with the XOR key, remove every second byte, then convert to ASCII.

I meant "AMITSESetup" obviously.

[Ghamidi]

Re: AMITSESetup Decryptor

I meant "AMITSESetup" obviously.

I tested work perfect

thank you so much

[EineWildeStehlampe]

Re: AMITSESetup Decryptor

Glad it's of use to someone. I'd love to keep a list of devices using the AMITSESetup variable if only I could find out how to edit my posts

[Maxpower3]

Re: AMITSESetup Decryptor

Glad it's of use to someone. I'd love to keep a list of devices using the AMITSESetup variable if only I could find out how to edit my posts

see with a moderator to modify your first post.

[LatinMcG]

Re: AMITSESetup Decryptor

this works with some of the Panasonic laptops.. not all tho.

[EineWildeStehlampe]

Re: AMITSESetup Decryptor

Confirmed to work with at least those devices, will add more when I have some in:
- Microsoft Surface (Pro) 3
- Advantech MIO-5251
- Medion Lifetab P8912
- ASUS Vivobook Flip 14 TP412

I've noticed there's also a few AMI implementations storing the password in cleartext instead of scancodes, I'll probably add something to parse those aswell. And then there's some that look like SHA1 hashes, so I might at least add some functionality to detect those.

[onizzbox]

Re: AMITSESetup Decryptor

Confirmed to work with at least those devices, will add more when I have some in:
- Microsoft Surface (Pro) 3
- Advantech MIO-5251
- Medion Lifetab P8912
- ASUS Vivobook Flip 14 TP412

I've noticed there's also a few AMI implementations storing the password in cleartext instead of scancodes, I'll probably add something to parse those aswell. And then there's some that look like SHA1 hashes, so I might at least add some functionality to detect those.

@EineWildeStehlampe
Similar to this here?
I'm finishing the script in C++ to make it faster, I'll post it in Badcaps next week.

[Maxpower3]

Re: AMITSESetup Decryptor

@EineWildeStehlampe
Similar to this here?
I'm finishing the script in C++ to make it faster, I'll post it in Badcaps next week.

nice job as usual onizzbox

[onizzbox]

Re: AMITSESetup Decryptor

nice job as usual onizzbox

Thanks! Maxpower3
Would you like to anticipate the release?

[Maxpower3]

Re: AMITSESetup Decryptor

Thanks! Maxpower3
Would you like to anticipate the release?

no need, I already know your work and you have already shared a lot of knowledge and tools with me

[onizzbox]

Re: AMITSESetup Decryptor

@EineWildeStehlampe
Similar to this here?
I'm finishing the script in C++ to make it faster, I'll post it in Badcaps next week.

@SMDFlea
I forgot to remove my credentials in the attached video, I can't edit the post anymore. Could you please remove it?

[onizzbox]

Re: AMITSESetup Decryptor

no need, I already know your work and you have already shared a lot of knowledge and tools with me

Thank you Max!
Helping users on the forums or outside of them has always been a hobby, I don't depend on it for a living. I've always liked to share my knowledge, that's the only way we can evolve.

[SMDFlea]

Re: AMITSESetup Decryptor

@SMDFlea
I forgot to remove my credentials in the attached video, I can't edit the post anymore. Could you please remove it?

removed.

[BootLoader1]

Re: AMITSESetup Decryptor

I wrote small software for decrypt AMI BIOS Password. Software can read Admin and Boot password, just open file or drag and drop a file.
Enjoy.

[onizzbox]

Re: AMITSESetup Decryptor

I wrote small software for decrypt AMI BIOS Password. Software can read Admin and Boot password, just open file or drag and drop a file.
Enjoy.

@BootLoader1
Very cool, but it doesn't work!!
Needs repairs...

[BootLoader1]

Re: AMITSESetup Decryptor

Working, working, but I forgot about this case. Now fixed and working well.