Announcement

Collapse
No announcement yet.

Unlock SVP Lenovo Thinkpad T14 Gen2

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Unlock SVP Lenovo Thinkpad T14 Gen2

    Hello everybody
    is there a solution for the Lenovo Thinkpad t14 gen 2 with MEC1503 chip ?? Jtag or Other solution ?

    MB : NM-D353 Rev 3.0

    #2
    Re: Unlock SVP Lenovo Thinkpad T14 Gen2

    Originally posted by mmccomputer View Post
    Hello everybody
    is there a solution for the Lenovo Thinkpad t14 gen 2 with MEC1503 chip ?? Jtag or Other solution ?
    MB : NM-D353 Rev 3.0
    Post the laptop serial number - https://www.badcaps.net/forum/showthread.php?t=103570

    .
    All donations to badcaps are welcome, click on this link to donate. Thanks to all supporters

    Comment


      #3
      Re: Unlock SVP Lenovo Thinkpad T14 Gen2

      excuse me sir this is the SN :

      SN : PF-4693CW
      Type Number : 20W1-S3NNON

      please help me

      Comment


        #4
        Re: Unlock SVP Lenovo Thinkpad T14 Gen2

        No solution at the moment. The password is stored inside MEC1503 chip, and this chip is currently impossible to programming.

        Comment


          #5
          Re: Unlock SVP Lenovo Thinkpad T14 Gen2

          Originally posted by anhbanxoi View Post
          No solution at the moment. The password is stored inside MEC1503 chip, and this chip is currently impossible to programming.
          thanks for your reply

          Comment


            #6
            Re: Unlock SVP Lenovo Thinkpad T14 Gen2

            Originally posted by mmccomputer View Post
            Hello everybody
            is there a solution for the Lenovo Thinkpad t14 gen 2 with MEC1503 chip ?? Jtag or Other solution ?

            MB : NM-D353 Rev 3.0
            I did try with Nm-d351 schematic and boardview to locate jtag, my board was nm-d352, these boards looks identical.
            it only read once(rt809f), then stopped reading chip due to low voltage(3v),
            the customer took the machine before i can add the 10k resistors for 3v.

            you can try it out maybe you can win.
            [Mod. Edit] Schematic and boardview -> https://www.badcaps.net/forum/showth...77#post1248377

            Reminder: rules and organization of this section
            https://www.badcaps.net/forum/showthread.php?t=117483
            Attached Files
            Last edited by Vesko356; 10-26-2023, 05:38 AM. Reason: Attached schematic and boardview removed and replaced with link.

            Comment


              #7
              Re: Unlock SVP Lenovo Thinkpad T14 Gen2

              Hello

              Things I've discovered so far about this EC.

              -Recorders such as Vertyanov and RT809H do not work for this model (MEC1503).

              -I think the reason these recorders don't work is because the component's JTAG interface is not being Enabled (I tested with JTAGULATOR), even moving from the "-EC_JTAG_RST" signal to High logic level.

              Even placing all 10K resistors on the corresponding lines, the interface was not enabled, making reading and writing impossible.

              I'm still trying some things, if anyone has more information to help resolve this EC, I'd appreciate it...

              Comment


                #8
                Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                I managed to activate the JTAG interface by removing resistor R4313 and leaving R4411 (not inserted) in place of R4410 (inserted).

                By doing this you can recognize the MEC1503 on the Vertyanov and the RT809H

                ID found is attached in the image.

                But not everything is perfect.

                In both tools, reading and writing is not done correctly... the EC is recognized, but the flash is being done incorrectly (like it is blocked).

                I'll keep trying, if anyone managed to find anything, and contribute to removing this password, I'd appreciate it.
                Attached Files

                Comment


                  #9
                  Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                  I managed to remove the password on the t14 but the resistors are mandatory

                  Comment


                    #10
                    Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                    Originally posted by mmccomputer View Post
                    I managed to remove the password on the t14 but the resistors are mandatory
                    great! Could you please be more specific?

                    thanks

                    Comment


                      #11
                      Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                      Originally posted by mmccomputer View Post
                      I managed to remove the password on the t14 but the resistors are mandatory

                      Thank you brother for feedback

                      Comment


                        #12
                        Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                        Originally posted by mmccomputer View Post
                        I managed to remove the password on the t14 but the resistors are mandatory
                        Could you please share some details? Especially, what programmer you were using and what MEC chip you selected in there?
                        I use RT809H and finally was able to get some output from the MEC. Sometimes the expected ID shows up right on the first read attempt, but it is always wrong on the subsequent ones and after 3-5 reads it shows up as 0 and stays that way no matter how many times I try to read or reset. I have to recycle power to get a non-0 ID and even if I do that, it is not always the right one.
                        I removed R4313 to enable JTAG, I moved R4410 to R4411 position to pull JTAG_RESET to Vcc, I added 10k pullups to 4 other JTAG signals.
                        I do not understand the randomness of JTAG output. I suspect this might be because the internal CPU is still active and also controls those JTAG pins since they are shared and the programmer is supposed to stop the CPU.
                        I tried all MECs that RT809H has in the list but none of them work.
                        Please help.

                        P.S. Was anyone able to find the spec for MEC1503?

                        Comment


                          #13
                          Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                          I don't know if this information can be useful, but the EC file size is 256KB, I took it from Lenovo's official website.

                          If we can at least write the "clean" file, I think the password would be removed
                          Attached Files

                          Comment


                            #14
                            Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                            I managed to find the datasheet:
                            According to it, MEC1503 does not have embedded flash at all.
                            I see couple of flash chips that are connected to MEC: U2201 (W25R256JVEIQ) and U2202 (MX25L25673GM2I). Both of them are in WSON8 package, so it will be tricky to read/write to it.

                            Comment


                              #15
                              Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                              Originally posted by arkb View Post
                              I managed to find the datasheet:
                              According to it, MEC1503 does not have embedded flash at all.
                              I see couple of flash chips that are connected to MEC: U2201 (W25R256JVEIQ) and U2202 (MX25L25673GM2I). Both of them are in WSON8 package, so it will be tricky to read/write to it.
                              Really? Then, what "256KB Code/Data SRAM" means?
                              ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
                              Due to a lack of donations, server free space at a critical level, and possible closure of Bios Requests
                              all donations are welcome,
                              see the donate button at the bottom of the page, or
                              >>>>>
                              click on this link to donate via PayPal. <<<<<
                              Every donation made will go towards server fees and maintenance costs.
                              ----------------------------------------------------------------------------------------------------------------------------------------------------------------------

                              Comment


                                #16
                                Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                                Well, SRAM usually means static RAM, though I might be wrong. My guess it is used to copy code from the flash for speedy execution and for program variables etc. I doubt that it is suitable to store information across power cycles.

                                Comment


                                  #17
                                  Re: Unlock SVP Lenovo Thinkpad T14 Gen2

                                  Found some info claiming that MEC152x is a recommended replacement for 150x and the corresponding spec is https://cdn.badcaps-static.com/pdfs/...690ab72918.pdf.
                                  According to it, MEC1523 has 2KB of EEPROM and it is likely that the password is stored in there if MEC1503 also has it.
                                  I guess the old spec that I found before was written before MEC1503 was released, that's why it is not mentioned in there.

                                  On the investigation side, I connected my JTAG controller based on FT232H and played around with pyftdi and openocd. What is interesting, MEC reports the correct ID right after reset, but returns garbage to any command including IDCODE which is supposed to return the same ID as right after reset. I confirmed that by listening to the communication with a logic analyzer. I am really puzzled.
                                  One thing that still might be incorrect is that I tied MEC's reset directly to VCC instead of moving the pulldown to the pullup position (works for MEC1663), did not connect RESET to the JTAG board. I also accidently desoldered and lost the capacitor, so the RESET line could be a little noisy at power up.

                                  Comment


                                    #18
                                    Hi. I googled my motherboard model of my Lenovo P14s Gen2 : HT4B0/HP4B0/HT5B1/HP5B1/HT4B2 NM-D353 Rev: 1.0 and I stumbled on this page.
                                    From what I can see, resetting the supervisor password is not possible at the moment.

                                    However, I was wondering if it is not possible while keeping components on the motherboard. Meaning that if I had the possibility to remove the MEC (or other) component, this might help to find a solution to this problem.

                                    Is there more technical data on what theoretically should be done to remove/reset the supervisor password on these boards? For example, write a specific pattern to an offset in the internal eeprom of the MEC or spoof the data on a communication bus when address range X is being read.

                                    I'm looking for a lead to get my hands dirty with the hardware I have in had.

                                    Thanks!

                                    Comment


                                      #19
                                      I did a bit more research and found this (see bottom link for source)
                                      Click image for larger version

Name:	fetch?id=2259258.jpg
Views:	1391
Size:	219.6 KB
ID:	3229034

                                      Looks like the T15 / T14 / P14 all have similar MEC1503 chips.

                                      I also found the schematics and board layout PDFs while searching to correlate the image found on the other thread
                                      Click image for larger version

Name:	Screenshot_20240305_081553.png
Views:	1291
Size:	206.2 KB
ID:	3229035 Click image for larger version

Name:	Screenshot_20240305_081719.png
Views:	1300
Size:	168.6 KB
ID:	3229036

                                      I then did the rework and plugged in a Segger J Link Plus to it:
                                      Click image for larger version

Name:	Screenshot_20240305_082303.png
Views:	1395
Size:	1.53 MB
ID:	3229037


                                      However, I do not seem to see the MEC in the JTAG chain. The Segger captures the 0v to 3.3v when I plug in the power supply to the board, but that's about it. The fan on the motherboard spins a few times and the heat pipes eventually become hot (not burning hot, but hot).

                                      Any pointers?

                                      Comment


                                        #20
                                        Here are the documents I have found online - I can't remember if it was on a site or a telegram channel.
                                        Last edited by Vesko356; 03-05-2024, 08:23 AM. Reason: Attached schematic removed

                                        Comment

                                      Working...
                                      X