Unlock SVP Lenovo Thinkpad T14 Gen2

[speed488]

2KB EEPROM just for serial, model, bios password. Laptop still can turn on without those informations. You can later program it with U1 tool

OK so that is it. This is why people focus around the MEC1503: because the BIOS password is saved there.
But, from what you are saying, just replacing the MEC1503 with a blank one should work to unlock the unit?

[TiagoNecer]

I already tried to buy a new chip (blank) on aliexpress, I changed it and the board didn't turn on, I only did the test, trying once, has anyone ever managed to make this procedure work?

[CJ Mangasep]

Hello, I am asking those who know a way to remove the supervisor/bios password for my laptop

HTB40/HP4B0/HT5B1/HP5B1/HT4B2 NM-D353 Rev:1.0

serial number: PF-3NA82Y
type number: 20W5-S0NH00

Should I do some kind of shorting the chips? In that case which one should i short?
Or should i do some kind of programming?

Thank you

[peste]

post merged..

[acedogblast]

Hello I can confirm that replacing MEC1503 chip with another from a laptop without SVP does work. You can see how I did it in my post here: https://www.badcaps.net/forum/troubl...-and-x13-gen-2

[cgtec]

The MEC has an EEPROM though.

According to this: https://docs.nordicsemi.com/bundle/n...doc/index.html
MEC152x is identical to MEC150x except for an enhanced Boot-ROM SPI loader.

So we can take a look at the MEC152X datasheet: https://ww1.microchip.com/downloads/...S00003427A.pdf
2K byte Internal EEPROM (MEC1523 Only) - Which should be present in the MEC1503 as well

So is the password stored there?

If it's the case, I was wondering if this approach would be a viable option:

• Dump the BIOS
• Patch the BIOS to skip password checking popup
• Write the patched BIOS
• Boot and set a new blank password
• Write the original BIOS

Am I missing or overlooking something?

you can not path bios .... any more

[cgtec]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2



I did try with Nm-d351 schematic and boardview to locate jtag, my board was nm-d352, these boards looks identical.
it only read once(rt809f), then stopped reading chip due to low voltage(3v),
the customer took the machine before i can add the 10k resistors for 3v.

you can try it out maybe you can win.
[Mod. Edit] Schematic and boardview -> https://www.badcaps.net/forum/showth...77#post1248377

Reminder: rules and organization of this section
https://www.badcaps.net/forum/showthread.php?t=117483

to enable jtag need script . most work on this chip use SWD .....

[santoslao]

Does anyone know this person or confirm that they are working this way?

T14 Gen2 MEC1503 ▼

Unlock Lenovo T14 Gen 2 ''MEC1503''

[santoslao]

I talked to him and look what he said.
🤦🏻♂️

[anhbanxoi]

Try replacing the MEC, take a bit longer time but it works.

[santoslao]

Try replacing the MEC, take a bit longer time but it works.

In the comments, he says it's done via patch and claims there's no way to read it on the MEC1503, so I contacted him, and he says it's only possible with the equipment in hand.
It's impossible that to this day this information remains a top secret; no one sells it, and no one performs the procedure remotely, only by hand.
He claims it's a patch, and we already have a clue about that, if that's indeed the case.

[cgtec]

I talked to him and look what he said.
🤦🏻♂️

If you want to try... without breaking your head. try espi I03 and shorted with gnd but there is time exact to short . so this is it ... this it the methode ....

[santoslao]

If you want to try... without breaking your head. try espi I03 and shorted with gnd but there is time exact to short . so this is it ... this it the methode ....

I heard that this method doesn't work for this model. And it's very risky to kill the machine! I've already done it in other models like T14 gen1.

[rediii]

I heard that this method doesn't work for this model. And it's very risky to kill the machine! I've already done it in other models like T14 gen1.

it is not risky... i tried this hundreds of times. not a single machine died

[santoslao]

it is not risky... i tried this hundreds of times. not a single machine died

And some "T14 Gen 2 intel" that you tried worked?

[img1]

Is there a solution for the MEC1503?

Hi!

I found a video about MEC1503 and RT809H. I'll test it and reply back in the next few days or weeks when I get my hands on a ThinkPad X1 Carbon G9 (NM-D341).

https://youtu.be/QOw7NWO_6RM

[santoslao]

Hi!

I found a video about MEC1503 and RT809H. I'll test it and reply back in the next few days or weeks when I get my hands on a ThinkPad X1 Carbon G9 (NM-D341).

https://youtu.be/QOw7NWO_6RM

In the description it says it's this model, but me honestly? I don't think it's MEC1503 that he's programming! It doesn't show from the beginning of the video, I believe it's just a video to have views! They say that to read or write in this MEC, it is necessary to have a 10k resistor at some points on the board.

[img1]

In the description it says it's this model, but me honestly? I don't think it's MEC1503 that he's programming! It doesn't show from the beginning of the video, I believe it's just a video to have views! They say that to read or write in this MEC, it is necessary to have a 10k resistor at some points on the board.

Good point.

The MoBo in the video is seemingly the NM-D341 with MEC1503, which is the exact board of the TP X1 Carbon G9.

The TP Carbon is on it's own way to me (the customer lives in another city and he 'll jump over sometime, but IDK when exactly), time will tell. JTAG jig is not a problem because I already made my custom one for MEC ECs (pullup resistors on the board, so not all the resistors soldering needed, just the mode selector) which I successfully used with some MEC16xxs before. So the hardware is ready by the time the TP Carbon arrives. Anyway, I would have tried it by myself because I have an RT809H on hand and it's worth a try. :-)

[santoslao]

Good point.

The MoBo in the video is seemingly the NM-D341 with MEC1503, which is the exact board of the TP X1 Carbon G9.

The TP Carbon is on it's own way to me (the customer lives in another city and he 'll jump over sometime, but IDK when exactly), time will tell. JTAG jig is not a problem because I already made my custom one for MEC ECs (pullup resistors on the board, so not all the resistors soldering needed, just the mode selector) which I successfully used with some MEC16xxs before. So the hardware is ready by the time the TP Carbon arrives. Anyway, I would have tried it by myself because I have an RT809H on hand and it's worth a try. :-)

Really! I don't know this machine, so I clearly see the board model! When you have it in hand, please post the result, we look forward to seeing it happen.

[img1]

Really! I don't know this machine, so I clearly see the board model! When you have it in hand, please post the result, we look forward to seeing it happen.

Sure, this is why I mentioned. I'm excited too. :-)

[cgtec]

Hi!

I found a video about MEC1503 and RT809H. I'll test it and reply back in the next few days or weeks when I get my hands on a ThinkPad X1 Carbon G9 (NM-D341).

https://youtu.be/QOw7NWO_6RM

is not MEC1503 its Mec1663 . the MEC15xx or 17xx come with efuse . otp JTAG/SWD disable . if you want enable jtag you need patch EC FW flash in SPI ..... and the EC FW is protected hash signature verification ECDSA if you have KEY you can do what you whant ... LPC_eSPI_I03 shorted with gnd not kill board ...