Unlock SVP Lenovo Thinkpad T14 Gen2

[anhbanxoi]

However, I do not seem to see the MEC in the JTAG chain. The Segger captures the 0v to 3.3v when I plug in the power supply to the board, but that's about it. The fan on the motherboard spins a few times and the heat pipes eventually become hot (not burning hot, but hot).

Any pointers?

Have you moved the reset resistor yet? From pull down to pull up.

[speed488]

Have you moved the reset resistor yet? From pull down to pull up.

Yes, that was done as well. Hard to tell from the picture, but it is moved.

[anhbanxoi]

Yes, that was done as well. Hard to tell from the picture, but it is moved.

I know some people can unlock these models but because they're doing this for business so I don't get much information but beside MEC1503 there is NPCX997 EC chip from Nuvoton also. I did some research on Nuvoton chip and found that they're program it via SWD interface so maybe you can change a different approach on MEC chip.

The MEC152x offers a software development system interface that includes a Trace FIFO Debug port, a host accessible serial debug port with a 16C550A register interface, a Port 80 BIOS Debug Port, and a 2-pin Serial Wire Debug (SWD) interface. Also included is a 4-wire JTAG interface used for Boundary Scan testing.

[jonico2007]

Please help me to unlock this bios for Lenovo T14 2nd gen
Serial : HT4B0/HP4B0/HP5B1/HT4B2
NM-D353 Rev 3.0
Bios Chip serial: W25Q256JVEN
Serial Number : PF-443HPX

[Svyatpro]

Hello folks!
Can anyone help me with the BIOS for this model?
MB: NM-D352 Rev 1.0
SN:PF-3B5XV8
Type Number: 20W1-S2E400

BIOS dumps attached.

[docenciarz]

anhbanxoi, did you manage to read and write MEC1503 correctly with the segger programmer?

[speed488]

anhbanxoi, did you manage to read and write MEC1503 correctly with the segger programmer?

I think you were addressing the question to me. No success with the Segger programmer. I rechecked all the connections and everything looks good.

Here is the output of the Segger software. I selected MEC1503 JTAG and all other configuration to auto.



From reading the logs, I'm wondering if I should also wire up the CPU reset nRESET_IN of the MEC to the Segger's RESET pin? From the schematics, it should be this (image with circle in red). The only thing that bugs me is that it is a direct connection from UTE1 (Thinkengine BD4179) to the MEC; there's only a pull up resistor on the line.

[santoslao]

I think you were addressing the question to me. No success with the Segger programmer. I rechecked all the connections and everything looks good.
Here is the output of the Segger software. I selected MEC1503 JTAG and all other configuration to auto.

Were you able to solve it using Segger?

[joby91]

I am also realy interested in this topic if there is anything that we can do to finaly read this chip

[clrscr]

I think you were addressing the question to me. No success with the Segger programmer. I rechecked all the connections and everything looks good.

Here is the output of the Segger software. I selected MEC1503 JTAG and all other configuration to auto.



From reading the logs, I'm wondering if I should also wire up the CPU reset nRESET_IN of the MEC to the Segger's RESET pin? From the schematics, it should be this (image with circle in red). The only thing that bugs me is that it is a direct connection from UTE1 (Thinkengine BD4179) to the MEC; there's only a pull up resistor on the line.

Do you have a solution for it yet? I know many people can read it, but I still haven't found a solution

[joby91]

I have found on one Russian Website that they are able to read the chip, but only if desoldered if i understood that correctly.

https://mslw.com/bb/showthread.php?t...c1503#pid97749

[joby91]

they are also able to read NPCX797 and NPCX997 chip:

https://mslw.com/bb/showthread.php?t...cx797#pid94250

This is done with UFPI Tool:

https://mslw.com/product/ufpi-box-silver/

[clrscr]

they are also able to read NPCX797 and NPCX997 chip:

https://mslw.com/bb/showthread.php?t...cx797#pid94250

This is done with UFPI Tool:

https://mslw.com/product/ufpi-box-silver/

Are you using it yet? Does it really work well? The solution to removing the "IO" to process it is too complicated

[joby91]

No, i am not using it, But i am planing to get the Programmer. NPCX Chips are supported without desoldering the chip. For the
MEC15xx and MEC17xx is only a matter of time when they wil also be supported without desoldering.
I am not sure what vertyanov is doing and if he is doiing anything to get the support for this chips.

[clrscr]

No, i am not using it, But i am planing to get the Programmer. NPCX Chips are supported without desoldering the chip. For the
MEC15xx and MEC17xx is only a matter of time when they wil also be supported without desoldering.
I am not sure what vertyanov is doing and if he is doiing anything to get the support for this chips.

I contacted UFPI Tool,He said: MEC1503 chips not supported - JTAG disabled by default in this chips, so even if we remove the MEC chip from the motherboard, I don't think it can be processed. . The only way is to replace a new chip.

[speed488]

Hi all, sorry I put the project on the shelf for the summer time and I redid part of my home lab so I wasn't able to do much for a few months.
So I caught up with trying the "CPU reset nRESET_IN of the MEC to the Segger's RESET pin" and it's a "no go". The entire motherboard resets and shuts down.

I've read the other posts and I cannot register to https://mslw.com. They say: "Sorry, your email or IP matches that of a known spammer. If you feel this is a mistake, please contact an administrator." 😂
So I wasn't able to get more info.

I might be able to get a hold of a MEC1503 chip from a donor board. Would this work? The donor board doesn't have the exact same specs as mine. Or should I buy a blank one, find the a dump somewhere online, program it with the Segger and then solder it on?

I'm starting to wonder if it is possible to dump the MEC1503 reading all that was said since my last post.

[speed488]

Do anyone have a MEC1503 dump (with some info on the laptop it comes from: S/N, password lock, bios version, etc...) or, at least, info on how I can dump mine? I'd like to dig in the binary trying to understand what's inside.

[anhbanxoi]

Do anyone have a MEC1503 dump (with some info on the laptop it comes from: S/N, password lock, bios version, etc...) or, at least, info on how I can dump mine? I'd like to dig in the binary trying to understand what's inside.

Just replace the MEC. This MEC doesnt have any firmware inside. The firmware for EC chip is inside BIOS. Check your bios with uefitool you will see a region call EC.

[speed488]

Just replace the MEC. This MEC doesnt have any firmware inside. The firmware for EC chip is inside BIOS. Check your bios with uefitool you will see a region call EC.

The MEC has an EEPROM though.

According to this: https://docs.nordicsemi.com/bundle/n...doc/index.html
MEC152x is identical to MEC150x except for an enhanced Boot-ROM SPI loader.

So we can take a look at the MEC152X datasheet: https://ww1.microchip.com/downloads/...S00003427A.pdf
2K byte Internal EEPROM (MEC1523 Only) - Which should be present in the MEC1503 as well

So is the password stored there?

If it's the case, I was wondering if this approach would be a viable option:

• Dump the BIOS
• Patch the BIOS to skip password checking popup
• Write the patched BIOS
• Boot and set a new blank password
• Write the original BIOS

Am I missing or overlooking something?

[anhbanxoi]

The MEC has an EEPROM though.

According to this: https://docs.nordicsemi.com/bundle/n...doc/index.html
MEC152x is identical to MEC150x except for an enhanced Boot-ROM SPI loader.

So we can take a look at the MEC152X datasheet: https://ww1.microchip.com/downloads/...S00003427A.pdf
2K byte Internal EEPROM (MEC1523 Only) - Which should be present in the MEC1503 as well

So is the password stored there?

If it's the case, I was wondering if this approach would be a viable option:

• Dump the BIOS
• Patch the BIOS to skip password checking popup
• Write the patched BIOS
• Boot and set a new blank password
• Write the original BIOS

Am I missing or overlooking something?

2KB EEPROM just for serial, model, bios password. Laptop still can turn on without those informations. You can later program it with U1 tool