Unlock SVP Lenovo Thinkpad T14 Gen2

[jonico2007]

Please help me to unlock this bios for Lenovo T14 2nd gen
Serial : HT4B0/HP4B0/HP5B1/HT4B2
NM-D353 Rev 3.0
Bios Chip serial: W25Q256JVEN
Serial Number : PF-443HPX

[anhbanxoi]

Yes, that was done as well. Hard to tell from the picture, but it is moved.

I know some people can unlock these models but because they're doing this for business so I don't get much information but beside MEC1503 there is NPCX997 EC chip from Nuvoton also. I did some research on Nuvoton chip and found that they're program it via SWD interface so maybe you can change a different approach on MEC chip.

The MEC152x offers a software development system interface that includes a Trace FIFO Debug port, a host accessible serial debug port with a 16C550A register interface, a Port 80 BIOS Debug Port, and a 2-pin Serial Wire Debug (SWD) interface. Also included is a 4-wire JTAG interface used for Boundary Scan testing.

[speed488]

Have you moved the reset resistor yet? From pull down to pull up.

Yes, that was done as well. Hard to tell from the picture, but it is moved.

[anhbanxoi]

However, I do not seem to see the MEC in the JTAG chain. The Segger captures the 0v to 3.3v when I plug in the power supply to the board, but that's about it. The fan on the motherboard spins a few times and the heat pipes eventually become hot (not burning hot, but hot).

Any pointers?

Have you moved the reset resistor yet? From pull down to pull up.

[Vesko356]

There is a dedicated sub-section for schematic/BV, if you want to share a schematic and/or BV please upload them in Schematic Requests ONLY! sub-section.

Read Reminder: rules and organization of this section thread.

[speed488]

Here are the documents I have found online - I can't remember if it was on a site or a telegram channel.

[speed488]

I did a bit more research and found this (see bottom link for source)


Looks like the T15 / T14 / P14 all have similar MEC1503 chips.

I also found the schematics and board layout PDFs while searching to correlate the image found on the other thread


I then did the rework and plugged in a Segger J Link Plus to it:



However, I do not seem to see the MEC in the JTAG chain. The Segger captures the 0v to 3.3v when I plug in the power supply to the board, but that's about it. The fan on the motherboard spins a few times and the heat pipes eventually become hot (not burning hot, but hot).

Any pointers?

[speed488]

Hi. I googled my motherboard model of my Lenovo P14s Gen2 : HT4B0/HP4B0/HT5B1/HP5B1/HT4B2 NM-D353 Rev: 1.0 and I stumbled on this page.
From what I can see, resetting the supervisor password is not possible at the moment.

However, I was wondering if it is not possible while keeping components on the motherboard. Meaning that if I had the possibility to remove the MEC (or other) component, this might help to find a solution to this problem.

Is there more technical data on what theoretically should be done to remove/reset the supervisor password on these boards? For example, write a specific pattern to an offset in the internal eeprom of the MEC or spoof the data on a communication bus when address range X is being read.

I'm looking for a lead to get my hands dirty with the hardware I have in had.

Thanks!

[arkb]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

Found some info claiming that MEC152x is a recommended replacement for 150x and the corresponding spec is https://cdn.badcaps-static.com/pdfs/...690ab72918.pdf.
According to it, MEC1523 has 2KB of EEPROM and it is likely that the password is stored in there if MEC1503 also has it.
I guess the old spec that I found before was written before MEC1503 was released, that's why it is not mentioned in there.

On the investigation side, I connected my JTAG controller based on FT232H and played around with pyftdi and openocd. What is interesting, MEC reports the correct ID right after reset, but returns garbage to any command including IDCODE which is supposed to return the same ID as right after reset. I confirmed that by listening to the communication with a logic analyzer. I am really puzzled.
One thing that still might be incorrect is that I tied MEC's reset directly to VCC instead of moving the pulldown to the pullup position (works for MEC1663), did not connect RESET to the JTAG board. I also accidently desoldered and lost the capacitor, so the RESET line could be a little noisy at power up.

[arkb]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

Well, SRAM usually means static RAM, though I might be wrong. My guess it is used to copy code from the flash for speedy execution and for program variables etc. I doubt that it is suitable to store information across power cycles.

[volinakis]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

I managed to find the datasheet:
According to it, MEC1503 does not have embedded flash at all.
I see couple of flash chips that are connected to MEC: U2201 (W25R256JVEIQ) and U2202 (MX25L25673GM2I). Both of them are in WSON8 package, so it will be tricky to read/write to it.

Really? Then, what "256KB Code/Data SRAM" means?

[arkb]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

I managed to find the datasheet:
According to it, MEC1503 does not have embedded flash at all.
I see couple of flash chips that are connected to MEC: U2201 (W25R256JVEIQ) and U2202 (MX25L25673GM2I). Both of them are in WSON8 package, so it will be tricky to read/write to it.

[TiagoNecer]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

I don't know if this information can be useful, but the EC file size is 256KB, I took it from Lenovo's official website.

If we can at least write the "clean" file, I think the password would be removed

[arkb]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

I managed to remove the password on the t14 but the resistors are mandatory

Could you please share some details? Especially, what programmer you were using and what MEC chip you selected in there?
I use RT809H and finally was able to get some output from the MEC. Sometimes the expected ID shows up right on the first read attempt, but it is always wrong on the subsequent ones and after 3-5 reads it shows up as 0 and stays that way no matter how many times I try to read or reset. I have to recycle power to get a non-0 ID and even if I do that, it is not always the right one.
I removed R4313 to enable JTAG, I moved R4410 to R4411 position to pull JTAG_RESET to Vcc, I added 10k pullups to 4 other JTAG signals.
I do not understand the randomness of JTAG output. I suspect this might be because the internal CPU is still active and also controls those JTAG pins since they are shared and the programmer is supposed to stop the CPU.
I tried all MECs that RT809H has in the list but none of them work.
Please help.

P.S. Was anyone able to find the spec for MEC1503?

[Mudau]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

I managed to remove the password on the t14 but the resistors are mandatory

Thank you brother for feedback

[rumpumpel1]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

I managed to remove the password on the t14 but the resistors are mandatory

great! Could you please be more specific?

thanks

[mmccomputer]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

I managed to remove the password on the t14 but the resistors are mandatory

[TiagoNecer]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

I managed to activate the JTAG interface by removing resistor R4313 and leaving R4411 (not inserted) in place of R4410 (inserted).

By doing this you can recognize the MEC1503 on the Vertyanov and the RT809H

ID found is attached in the image.

But not everything is perfect.

In both tools, reading and writing is not done correctly... the EC is recognized, but the flash is being done incorrectly (like it is blocked).

I'll keep trying, if anyone managed to find anything, and contribute to removing this password, I'd appreciate it.

[TiagoNecer]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

Hello

Things I've discovered so far about this EC.

-Recorders such as Vertyanov and RT809H do not work for this model (MEC1503).

-I think the reason these recorders don't work is because the component's JTAG interface is not being Enabled (I tested with JTAGULATOR), even moving from the "-EC_JTAG_RST" signal to High logic level.

Even placing all 10K resistors on the corresponding lines, the interface was not enabled, making reading and writing impossible.

I'm still trying some things, if anyone has more information to help resolve this EC, I'd appreciate it...

[Mudau]

Re: Unlock SVP Lenovo Thinkpad T14 Gen2

Hello everybody
is there a solution for the Lenovo Thinkpad t14 gen 2 with MEC1503 chip ?? Jtag or Other solution ?

MB : NM-D353 Rev 3.0

I did try with Nm-d351 schematic and boardview to locate jtag, my board was nm-d352, these boards looks identical.
it only read once(rt809f), then stopped reading chip due to low voltage(3v),
the customer took the machine before i can add the 10k resistors for 3v.

you can try it out maybe you can win.
[Mod. Edit] Schematic and boardview -> https://www.badcaps.net/forum/showth...77#post1248377

Reminder: rules and organization of this section
https://www.badcaps.net/forum/showthread.php?t=117483