Unlock SVP Lenovo Thinkpad T14 Gen2

[rediii]

So in theory it is not possible to read or delete the MEC1503 by setting up the RT809H for MEC1663, as it looks like in the video. Thank you for the clarification.

Edit: Oh, wait... There's no LPC_eSPI_I03 in the D341 board schematics, only ESPI_I03 and that is connected not to GND but to GPP_A3/ESPI_IO3/SUSACK# of the chipset, via R10806 (15 Ohm).

The JTAG_RST# pin of the MEC is pulled down to GND via R8715 (10K) as the usual method to disable the JTAG port but it is easy to move it to the positon R8714 to enable it (this 10K resistor is what I referenced as "the selector" in my earlier post).

Or I hardly misunderstood something. 🙃

why should the lpc or espi signal be pulled to ground? even if the reset signal can be pulled high by shifting the resistor the jtag is blocked for programming and will ever be via efuse!

[img1]

is not MEC1503 its Mec1663 . the MEC15xx or 17xx come with efuse . otp JTAG/SWD disable . if you want enable jtag you need patch EC FW flash in SPI ..... and the EC FW is protected hash signature verification ECDSA if you have KEY you can do what you whant ... LPC_eSPI_I03 shorted with gnd not kill board ...

So in theory it is not possible to read or delete the MEC1503 by setting up the RT809H for MEC1663, as it looks like in the video. Thank you for the clarification.

Edit: Oh, wait... There's no LPC_eSPI_I03 in the D341 board schematics, only ESPI_I03 and that is connected not to GND but to GPP_A3/ESPI_IO3/SUSACK# of the chipset, via R10806 (15 Ohm).

The JTAG_RST# pin of the MEC is pulled down to GND via R8715 (10K) as the usual method to disable the JTAG port but it is easy to move it to the positon R8714 to enable it (this 10K resistor is what I referenced as "the selector" in my earlier post).

Or I hardly misunderstood something. 🙃

[rediii]

is not MEC1503 its Mec1663 . the MEC15xx or 17xx come with efuse . otp JTAG/SWD disable . if you want enable jtag you need patch EC FW flash in SPI ..... and the EC FW is protected hash signature verification ECDSA if you have KEY you can do what you whant ... LPC_eSPI_I03 shorted with gnd not kill board ...

this

[cgtec]

Hi!

I found a video about MEC1503 and RT809H. I'll test it and reply back in the next few days or weeks when I get my hands on a ThinkPad X1 Carbon G9 (NM-D341).

https://youtu.be/QOw7NWO_6RM

is not MEC1503 its Mec1663 . the MEC15xx or 17xx come with efuse . otp JTAG/SWD disable . if you want enable jtag you need patch EC FW flash in SPI ..... and the EC FW is protected hash signature verification ECDSA if you have KEY you can do what you whant ... LPC_eSPI_I03 shorted with gnd not kill board ...

[img1]

Really! I don't know this machine, so I clearly see the board model! When you have it in hand, please post the result, we look forward to seeing it happen.

Sure, this is why I mentioned. I'm excited too. :-)

[santoslao]

Good point.

The MoBo in the video is seemingly the NM-D341 with MEC1503, which is the exact board of the TP X1 Carbon G9.

The TP Carbon is on it's own way to me (the customer lives in another city and he 'll jump over sometime, but IDK when exactly), time will tell. JTAG jig is not a problem because I already made my custom one for MEC ECs (pullup resistors on the board, so not all the resistors soldering needed, just the mode selector) which I successfully used with some MEC16xxs before. So the hardware is ready by the time the TP Carbon arrives. Anyway, I would have tried it by myself because I have an RT809H on hand and it's worth a try. :-)

Really! I don't know this machine, so I clearly see the board model! When you have it in hand, please post the result, we look forward to seeing it happen.

[img1]

In the description it says it's this model, but me honestly? I don't think it's MEC1503 that he's programming! It doesn't show from the beginning of the video, I believe it's just a video to have views! They say that to read or write in this MEC, it is necessary to have a 10k resistor at some points on the board.

Good point.

The MoBo in the video is seemingly the NM-D341 with MEC1503, which is the exact board of the TP X1 Carbon G9.

The TP Carbon is on it's own way to me (the customer lives in another city and he 'll jump over sometime, but IDK when exactly), time will tell. JTAG jig is not a problem because I already made my custom one for MEC ECs (pullup resistors on the board, so not all the resistors soldering needed, just the mode selector) which I successfully used with some MEC16xxs before. So the hardware is ready by the time the TP Carbon arrives. Anyway, I would have tried it by myself because I have an RT809H on hand and it's worth a try. :-)

[santoslao]

Hi!

I found a video about MEC1503 and RT809H. I'll test it and reply back in the next few days or weeks when I get my hands on a ThinkPad X1 Carbon G9 (NM-D341).

https://youtu.be/QOw7NWO_6RM

In the description it says it's this model, but me honestly? I don't think it's MEC1503 that he's programming! It doesn't show from the beginning of the video, I believe it's just a video to have views! They say that to read or write in this MEC, it is necessary to have a 10k resistor at some points on the board.

[img1]

Is there a solution for the MEC1503?

Hi!

I found a video about MEC1503 and RT809H. I'll test it and reply back in the next few days or weeks when I get my hands on a ThinkPad X1 Carbon G9 (NM-D341).

https://youtu.be/QOw7NWO_6RM

[santoslao]

it is not risky... i tried this hundreds of times. not a single machine died

And some "T14 Gen 2 intel" that you tried worked?

[rediii]

I heard that this method doesn't work for this model. And it's very risky to kill the machine! I've already done it in other models like T14 gen1.

it is not risky... i tried this hundreds of times. not a single machine died

[santoslao]

If you want to try... without breaking your head. try espi I03 and shorted with gnd but there is time exact to short . so this is it ... this it the methode ....

I heard that this method doesn't work for this model. And it's very risky to kill the machine! I've already done it in other models like T14 gen1.

[cgtec]

I talked to him and look what he said.
🤦🏻♂️

If you want to try... without breaking your head. try espi I03 and shorted with gnd but there is time exact to short . so this is it ... this it the methode ....

[santoslao]

Try replacing the MEC, take a bit longer time but it works.

In the comments, he says it's done via patch and claims there's no way to read it on the MEC1503, so I contacted him, and he says it's only possible with the equipment in hand.
It's impossible that to this day this information remains a top secret; no one sells it, and no one performs the procedure remotely, only by hand.
He claims it's a patch, and we already have a clue about that, if that's indeed the case.

[anhbanxoi]

Try replacing the MEC, take a bit longer time but it works.

[santoslao]

I talked to him and look what he said.
🤦🏻♂️

[santoslao]

Does anyone know this person or confirm that they are working this way?

T14 Gen2 MEC1503 ▼

Unlock Lenovo T14 Gen 2 ''MEC1503''

[cgtec]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2



I did try with Nm-d351 schematic and boardview to locate jtag, my board was nm-d352, these boards looks identical.
it only read once(rt809f), then stopped reading chip due to low voltage(3v),
the customer took the machine before i can add the 10k resistors for 3v.

you can try it out maybe you can win.
[Mod. Edit] Schematic and boardview -> https://www.badcaps.net/forum/showth...77#post1248377

Reminder: rules and organization of this section
https://www.badcaps.net/forum/showthread.php?t=117483

to enable jtag need script . most work on this chip use SWD .....

[cgtec]

The MEC has an EEPROM though.

According to this: https://docs.nordicsemi.com/bundle/n...doc/index.html
MEC152x is identical to MEC150x except for an enhanced Boot-ROM SPI loader.

So we can take a look at the MEC152X datasheet: https://ww1.microchip.com/downloads/...S00003427A.pdf
2K byte Internal EEPROM (MEC1523 Only) - Which should be present in the MEC1503 as well

So is the password stored there?

If it's the case, I was wondering if this approach would be a viable option:

• Dump the BIOS
• Patch the BIOS to skip password checking popup
• Write the patched BIOS
• Boot and set a new blank password
• Write the original BIOS

Am I missing or overlooking something?

you can not path bios .... any more

[acedogblast]

Hello I can confirm that replacing MEC1503 chip with another from a laptop without SVP does work. You can see how I did it in my post here: https://www.badcaps.net/forum/troubl...-and-x13-gen-2