Unlock SVP Lenovo Thinkpad T14 Gen2

[CJ Mangasep]

Hello, I am asking those who know a way to remove the supervisor/bios password for my laptop

HTB40/HP4B0/HT5B1/HP5B1/HT4B2 NM-D353 Rev:1.0

serial number: PF-3NA82Y
type number: 20W5-S0NH00

Should I do some kind of shorting the chips? In that case which one should i short?
Or should i do some kind of programming?

Thank you

[TiagoNecer]

I already tried to buy a new chip (blank) on aliexpress, I changed it and the board didn't turn on, I only did the test, trying once, has anyone ever managed to make this procedure work?

[speed488]

2KB EEPROM just for serial, model, bios password. Laptop still can turn on without those informations. You can later program it with U1 tool

OK so that is it. This is why people focus around the MEC1503: because the BIOS password is saved there.
But, from what you are saying, just replacing the MEC1503 with a blank one should work to unlock the unit?

[anhbanxoi]

The MEC has an EEPROM though.

According to this: https://docs.nordicsemi.com/bundle/n...doc/index.html
MEC152x is identical to MEC150x except for an enhanced Boot-ROM SPI loader.

So we can take a look at the MEC152X datasheet: https://ww1.microchip.com/downloads/...S00003427A.pdf
2K byte Internal EEPROM (MEC1523 Only) - Which should be present in the MEC1503 as well

So is the password stored there?

If it's the case, I was wondering if this approach would be a viable option:

• Dump the BIOS
• Patch the BIOS to skip password checking popup
• Write the patched BIOS
• Boot and set a new blank password
• Write the original BIOS

Am I missing or overlooking something?

2KB EEPROM just for serial, model, bios password. Laptop still can turn on without those informations. You can later program it with U1 tool

[speed488]

Just replace the MEC. This MEC doesnt have any firmware inside. The firmware for EC chip is inside BIOS. Check your bios with uefitool you will see a region call EC.

The MEC has an EEPROM though.

According to this: https://docs.nordicsemi.com/bundle/n...doc/index.html
MEC152x is identical to MEC150x except for an enhanced Boot-ROM SPI loader.

So we can take a look at the MEC152X datasheet: https://ww1.microchip.com/downloads/...S00003427A.pdf
2K byte Internal EEPROM (MEC1523 Only) - Which should be present in the MEC1503 as well

So is the password stored there?

If it's the case, I was wondering if this approach would be a viable option:

• Dump the BIOS
• Patch the BIOS to skip password checking popup
• Write the patched BIOS
• Boot and set a new blank password
• Write the original BIOS

Am I missing or overlooking something?

[anhbanxoi]

Do anyone have a MEC1503 dump (with some info on the laptop it comes from: S/N, password lock, bios version, etc...) or, at least, info on how I can dump mine? I'd like to dig in the binary trying to understand what's inside.

Just replace the MEC. This MEC doesnt have any firmware inside. The firmware for EC chip is inside BIOS. Check your bios with uefitool you will see a region call EC.

[speed488]

Do anyone have a MEC1503 dump (with some info on the laptop it comes from: S/N, password lock, bios version, etc...) or, at least, info on how I can dump mine? I'd like to dig in the binary trying to understand what's inside.

[speed488]

Hi all, sorry I put the project on the shelf for the summer time and I redid part of my home lab so I wasn't able to do much for a few months.
So I caught up with trying the "CPU reset nRESET_IN of the MEC to the Segger's RESET pin" and it's a "no go". The entire motherboard resets and shuts down.

I've read the other posts and I cannot register to https://mslw.com. They say: "Sorry, your email or IP matches that of a known spammer. If you feel this is a mistake, please contact an administrator." 😂
So I wasn't able to get more info.

I might be able to get a hold of a MEC1503 chip from a donor board. Would this work? The donor board doesn't have the exact same specs as mine. Or should I buy a blank one, find the a dump somewhere online, program it with the Segger and then solder it on?

I'm starting to wonder if it is possible to dump the MEC1503 reading all that was said since my last post.

[clrscr]

No, i am not using it, But i am planing to get the Programmer. NPCX Chips are supported without desoldering the chip. For the
MEC15xx and MEC17xx is only a matter of time when they wil also be supported without desoldering.
I am not sure what vertyanov is doing and if he is doiing anything to get the support for this chips.

I contacted UFPI Tool,He said: MEC1503 chips not supported - JTAG disabled by default in this chips, so even if we remove the MEC chip from the motherboard, I don't think it can be processed. . The only way is to replace a new chip.

[joby91]

No, i am not using it, But i am planing to get the Programmer. NPCX Chips are supported without desoldering the chip. For the
MEC15xx and MEC17xx is only a matter of time when they wil also be supported without desoldering.
I am not sure what vertyanov is doing and if he is doiing anything to get the support for this chips.

[clrscr]

they are also able to read NPCX797 and NPCX997 chip:

https://mslw.com/bb/showthread.php?t...cx797#pid94250

This is done with UFPI Tool:

https://mslw.com/product/ufpi-box-silver/

Are you using it yet? Does it really work well? The solution to removing the "IO" to process it is too complicated

[joby91]

they are also able to read NPCX797 and NPCX997 chip:

https://mslw.com/bb/showthread.php?t...cx797#pid94250

This is done with UFPI Tool:

https://mslw.com/product/ufpi-box-silver/

[joby91]

I have found on one Russian Website that they are able to read the chip, but only if desoldered if i understood that correctly.

https://mslw.com/bb/showthread.php?t...c1503#pid97749

[clrscr]

I think you were addressing the question to me. No success with the Segger programmer. I rechecked all the connections and everything looks good.

Here is the output of the Segger software. I selected MEC1503 JTAG and all other configuration to auto.



From reading the logs, I'm wondering if I should also wire up the CPU reset nRESET_IN of the MEC to the Segger's RESET pin? From the schematics, it should be this (image with circle in red). The only thing that bugs me is that it is a direct connection from UTE1 (Thinkengine BD4179) to the MEC; there's only a pull up resistor on the line.

Do you have a solution for it yet? I know many people can read it, but I still haven't found a solution

[joby91]

I am also realy interested in this topic if there is anything that we can do to finaly read this chip

[santoslao]

I think you were addressing the question to me. No success with the Segger programmer. I rechecked all the connections and everything looks good.
Here is the output of the Segger software. I selected MEC1503 JTAG and all other configuration to auto.

Were you able to solve it using Segger?

[speed488]

anhbanxoi, did you manage to read and write MEC1503 correctly with the segger programmer?

I think you were addressing the question to me. No success with the Segger programmer. I rechecked all the connections and everything looks good.

Here is the output of the Segger software. I selected MEC1503 JTAG and all other configuration to auto.



From reading the logs, I'm wondering if I should also wire up the CPU reset nRESET_IN of the MEC to the Segger's RESET pin? From the schematics, it should be this (image with circle in red). The only thing that bugs me is that it is a direct connection from UTE1 (Thinkengine BD4179) to the MEC; there's only a pull up resistor on the line.

[docenciarz]

anhbanxoi, did you manage to read and write MEC1503 correctly with the segger programmer?

[Svyatpro]

Hello folks!
Can anyone help me with the BIOS for this model?
MB: NM-D352 Rev 1.0
SN:PF-3B5XV8
Type Number: 20W1-S2E400

BIOS dumps attached.

[jonico2007]

Please help me to unlock this bios for Lenovo T14 2nd gen
Serial : HT4B0/HP4B0/HP5B1/HT4B2
NM-D353 Rev 3.0
Bios Chip serial: W25Q256JVEN
Serial Number : PF-443HPX