Dell Precision 3450 SFF D15S004

[thanghn90]

- Model: Dell Precision 3450 Small Form Factor, D15S004
- Service tag: JT11VH3
- Board model number: TBC0521 CG4MW
- Request: unlock BIOS admin password.
- Reason: 8FC8 code suffix - no public password generator. Full code: JT11VH3-8FC8

I've been searching on 8FC8 BIOS password unlock for a while, and looks like aside from paid service, there is a trick to modify the BIOS dump. However, the unlock script/zip file is long gone, and the instruction is clearly aimed for the more advanced folks.

If you can help providing the "master" password without requiring the BIOS dump, that would be the easiest way. If not, I need help getting the BIOS dump. Consider me as a newbie when it comes to chip programming. The most in-depth task I've done so far regarding BIOS dump is to unbrick my old chromebook with a CH341a programmer and SOIC8 clip, following MRchromebox unbrick guide.

I don't even know for sure where the BIOS chip is on the main board. I've attached photos of the main board, in as much detail as possible. I ^think^ the BIOS chip is the Winbond 25R256JVFN in picture label "2", which appears to be an SOIC16 300mil chip, but please correct me if I'm wrong. I need guidance of which tools/adapters I should buy, without breaking the bank, to first be able to dump the BIOS.

Many thanks ahead for the good samaritans who spent countless amount of time and effort helping newbies like me!

[minhdigital]

- Model: Dell Precision 3450 Small Form Factor, D15S004
- Service tag: JT11VH3
- Board model number: TBC0521 CG4MW
- Request: unlock BIOS admin password.
- Reason: 8FC8 code suffix - no public password generator. Full code: JT11VH3-8FC8

I've been searching on 8FC8 BIOS password unlock for a while, and looks like aside from paid service, there is a trick to modify the BIOS dump. However, the unlock script/zip file is long gone, and the instruction is clearly aimed for the more advanced folks.

If you can help providing the "master" password without requiring the BIOS dump, that would be the easiest way. If not, I need help getting the BIOS dump. Consider me as a newbie when it comes to chip programming. The most in-depth task I've done so far regarding BIOS dump is to unbrick my old chromebook with a CH341a programmer and SOIC8 clip, following MRchromebox unbrick guide.

I don't even know for sure where the BIOS chip is on the main board. I've attached photos of the main board, in as much detail as possible. I ^think^ the BIOS chip is the Winbond 25R256JVFN in picture label "2", which appears to be an SOIC16 300mil chip, but please correct me if I'm wrong. I need guidance of which tools/adapters I should buy, without breaking the bank, to first be able to dump the BIOS.

Many thanks ahead for the good samaritans who spent countless amount of time and effort helping newbies like me!

BIOS chip is the Winbond 25R256JVFN

[thanghn90]

Thanks minhdigital for the confirmation! Googling "25R256JVFN" reveals very little information of how to dump this chip, and almost always fell back to "25R256JVEN", which is the WSON-8 sibling of the chip family. Any suggestion on which programmer + adapter for the 25R256JVFN?

[mon2]

Has replay protection so it is secure.

Replay Protected Memory Block - Wikipedia

[thanghn90]

mon2 pardon my noobness, but does that Replay Protected Memory Block (RPMB) mean if I flash a modified BIOS dump, the machine will detect it and won't boot at all? And before that, how did you know the Dell Precision 3450 has such a feature? I could not find it in the product specs by searching Dell service tag anywhere that has "RPMB" in it...

[SMDFlea]

mon2 pardon my noobness, but does that Replay Protected Memory Block (RPMB) mean if I flash a modified BIOS dump, the machine will detect it and won't boot at all? And before that, how did you know the Dell Precision 3450 has such a feature? I could not find it in the product specs by searching Dell service tag anywhere that has "RPMB" in it...

You don`t need to read or write to the protected area,ignore it. You can use your CH341A (Use NeoProgrammer,AsProgrammer or flashrom software) with a SOP16 clip or solder wires to the legs. If you have the tools to desolder it though use a SOP16 adapter

[thanghn90]

You don`t need to read or write to the protected area,ignore it. You can use your CH341A (Use NeoProgrammer,AsProgrammer or flashrom software) with a SOP16 clip or solder wires to the legs. If you have the tools to desolder it though use a SOP16 adapter

Roger that, SMDFlea. I will need to get the SOP16 clip for CH341A. Wish me luck, though...

[minhdigital]

You @thanghn90 can programmer it with WSON-8, same me

[thanghn90]

Thanks minhdigital for the detailed pin layout conversion from SOIC16 to WSON8! Though I think I first need to make sure my CH341A programmer has the 3.3V fix applied so I won't fry my chip. I'm slowly wading through a mountain of BIOS guides and will definitely come back with a lot of questions. If you can briefly summarize the steps you do to dump your BIOS chip, please feel free to do so.

[thanghn90]

Sorry for the late response. I finally had time to apply the 3.3v mod to my CH341A (picture 1). I admit I'm not proud of it, but at least it works, and the data pins now report 3.3V instead of 5V as before. Plus, my nose no longer senses some weird flame retardant smell when plugging the CH341A to my laptop, and the CH341A doesn't get too hot as before, either. Both the old CH341A Programmer and NeoProgrammer can recognize my CH341A after driver installation, so I think I did the 3.3v mod correctly.
Now, unlike minhdigital who is brave enough to solder a bunch of wires from the original chip to what looks like a dummy chip on his RT809F (I didn't notice the scary detail of your photo till today when I zoom in, which did make my heart dropped a bit), I have purchased a SOIC16 clip (picture 2). Since the CH341A was not designed for the pin layout of the W25R256JV chip, I think I will need to do some de-soldering of the wires connecting to the clip and rearrange them according to minhdigital 's schema (picture 3). It's going to be messy, but not as "frankenstain" as minhdigital 's setting.

[minhdigital]

thanghn90 Congratulations, I do not recommend using clamps because their contacts and wires are quite poor, leading to readable data or errors.

[thanghn90]

Update 20241002: I've successfully modified the SOIC16 wiring, read, modded, and write the chip using NeoProgrammer. All thanks to esteemed badcapers in this forum!

See the first 5 pictures for the modded clamp wiring. I had to de-solder and re-solder each wire separately on the clamp end. It's very important to put some tagging tape on each wire so you know which one is which. Equally important is the need to mark the FIRST pin of the SOIC16 pin that corresponds to the 1st pin of an equivalent WSON8 pinout. Many thanks to minhdigital for the guidance. Picture 6 show my table to map the 16-pin chip to the CH341A 25xx section.

As much as I hate to agree with minhdigital about the instability of clamping method, I also admit that I have a terrible soldering skill as well, and the chance that I would short-circuit two pins together when attempting minhdigital 's method would be way higher than the chance that I mess up the clamping. FYI, all I have is a not-so-small soldering iron that I've used for fixing mice's buttons, but not for this micro-scale of BIOS chip wiring. And, of course, a lot of patience.

I could not emphasize enough the importance of reading the BIOS guide (also from this forum), section 1.1.1.6. The 3.3v mod makes my CH341A runs cooler and much more stable. To figure out the chip maker's ID and memory type ID (in adding chip support to NeoProgrammer), simply search for "ID15" in your chip's datasheet. You should end up in a table showing device ID and the value of memory type that you need (in my case, the W25R256JV has device ID "EF", memory type "4019", so the ID in NeoProgrammer's input.xml should be "EF4019").

After being able to read the chip (check your clamping if NeoProgrammer say "chip not responding"), I followed this 8FC8 patcher guide, also from this forum. Kudos to SMDFlea for this brilliant idea of tweaking two bytes to get the chip to factory mode, and blackshift for speaking the steps out loud LOL. Simply search "00FCAA" in hex mode (also using NeoProgrammer), replace it with "00FC00" within address range 0x00001000 and 0x00100000, then repeat by searching and replacing "00FDAA" with "00FD00" in the same region, and write the modded image to the chip. I have no idea how you come up with the two byte locations for enabling factory mode though, so this remains a mystery to me.
An Alt+F key combination is required to get the machine out of factory mode and set the Service Tag. I could never dream of a day I can change the service tag number of a machine. Note that the service tag field will not have the blinking cursor when you type, but will update when you start typing in it.

Again, many thanks for your guidance. It took me a lot of courage and patience to get this done. I must say, it's still well beyond the grasp of regular computer technicians. Given how tedious this process is, I really wonder if all the paid offers to unlock 8FC8 chips with "master passwords" are valid. If not, how many innocent people have fallen to such scam?

[emersonneo]

I need BT1 (rtc) connection points, can't find the shcematic

Dell precision 3450

motherboard TBC0521 CG4MW

[thanghn90]

emersonneo what problem are you encountering?

[emersonneo]

@thanghn90 lost track of cmos positive, it is located on the inner layer of the board (google tradutor), can understand me?

[thanghn90]

I don't get it when you said:

lost track of cmos positive?

Do you mean you forgot your BIOS password? If that's the case, you need to follow the steps listed in this thread to modify the BIOS chip. I believe resetting CMOS no longer clears the BIOS password on these newer Dell machine.