Unlock SVP Lenovo Thinkpad T14 Gen2

[rediii]

is not MEC1503 its Mec1663 . the MEC15xx or 17xx come with efuse . otp JTAG/SWD disable . if you want enable jtag you need patch EC FW flash in SPI ..... and the EC FW is protected hash signature verification ECDSA if you have KEY you can do what you whant ... LPC_eSPI_I03 shorted with gnd not kill board ...

this

[img1]

is not MEC1503 its Mec1663 . the MEC15xx or 17xx come with efuse . otp JTAG/SWD disable . if you want enable jtag you need patch EC FW flash in SPI ..... and the EC FW is protected hash signature verification ECDSA if you have KEY you can do what you whant ... LPC_eSPI_I03 shorted with gnd not kill board ...

So in theory it is not possible to read or delete the MEC1503 by setting up the RT809H for MEC1663, as it looks like in the video. Thank you for the clarification.

Edit: Oh, wait... There's no LPC_eSPI_I03 in the D341 board schematics, only ESPI_I03 and that is connected not to GND but to GPP_A3/ESPI_IO3/SUSACK# of the chipset, via R10806 (15 Ohm).

The JTAG_RST# pin of the MEC is pulled down to GND via R8715 (10K) as the usual method to disable the JTAG port but it is easy to move it to the positon R8714 to enable it (this 10K resistor is what I referenced as "the selector" in my earlier post).

Or I hardly misunderstood something. 🙃

[rediii]

So in theory it is not possible to read or delete the MEC1503 by setting up the RT809H for MEC1663, as it looks like in the video. Thank you for the clarification.

Edit: Oh, wait... There's no LPC_eSPI_I03 in the D341 board schematics, only ESPI_I03 and that is connected not to GND but to GPP_A3/ESPI_IO3/SUSACK# of the chipset, via R10806 (15 Ohm).

The JTAG_RST# pin of the MEC is pulled down to GND via R8715 (10K) as the usual method to disable the JTAG port but it is easy to move it to the positon R8714 to enable it (this 10K resistor is what I referenced as "the selector" in my earlier post).

Or I hardly misunderstood something. 🙃

why should the lpc or espi signal be pulled to ground? even if the reset signal can be pulled high by shifting the resistor the jtag is blocked for programming and will ever be via efuse!

[img1]

why should the lpc or espi signal be pulled to ground? even if the reset signal can be pulled high by shifting the resistor the jtag is blocked for programming and will ever be via efuse!

No, it shouldn't. I think he meant that like "do not pull that signal to the ground".

[santoslao]

I bought the MEC1503 on Aliexpress ready to use already programmed "according to the seller" the chip arrived I made the replacement very carefully, and at the end of the process the machine didn't even turn on. He is accusing at the source 0.200 of consumption.

[lint4u]

I bought the MEC1503 on Aliexpress ready to use already programmed "according to the seller" the chip arrived I made the replacement very carefully, and at the end of the process the machine didn't even turn on. He is accusing at the source 0.200 of consumption.

put back the original one and see the result.
if ok it's mean the raw material got issue or solder short

Tq

[anhbanxoi]

I bought the MEC1503 on Aliexpress ready to use already programmed "according to the seller" the chip arrived I made the replacement very carefully, and at the end of the process the machine didn't even turn on. He is accusing at the source 0.200 of consumption.

There are 2 BIOS chip in other side of the board. 1 for system BIOS another for EC. Try flash different EC EEPROM and it will boot.

[santoslao]

There are 2 BIOS chip in other side of the board. 1 for system BIOS another for EC. Try flash different EC EEPROM and it will boot.

The machine worked normally before, when changing the MEC1503 chip, shouldn't the machine turn on? Have you ever done this before?

See this experience of a friend of the group: https://www.badcaps.net/forum/troubl...ce=chatgpt.com

[anhbanxoi]

The machine worked normally before, when changing the MEC1503 chip, shouldn't the machine turn on? Have you ever done this before?

See this experience of a friend of the group: https://www.badcaps.net/forum/troubl...ce=chatgpt.com

Yes I changed 3 other ICs and still stuck at 0.2A but after flash EC with other file it turn on normally.

[santoslao]

Yes I changed 3 other ICs and still stuck at 0.2A but after flash EC with other file it turn on normally.

In my case the machine is at 5v-0.200A. Do you really think this can solve?
Ps: the consumption of 0.140A of the image is because it is without the battery.

[anhbanxoi]

In my case the machine is at 5v-0.200A. Do you really think this can solve?
Ps: the consumption of 0.140A of the image is because it is without the battery.

Try flash other file for U2202

[TiagoNecer]

Yes I changed 3 other ICs and still stuck at 0.2A but after flash EC with other file it turn on normally.

Did removing the password work with this method?

[anhbanxoi]

Did removing the password work with this method?

Yes, the password is stored in a 2KB EEPROM within the EC chip, so removing it will clear the password unless you solder a replacement EC chip containing a password. After soldering, you need the Lenovo U1 Tool to program the serial number, model, and type.

[santoslao]

Yes I changed 3 other ICs and still stuck at 0.2A but after flash EC with other file it turn on normally.

I confess to you that what happened in your case may be pure coincidence!
I flashed it using 8 different files on the u2202, and the machine maintains the same consumption (5v-0.2A), and not even the power LED lights up.
Do you have the file you used on this machine so I can test it here?

[anhbanxoi]

I confess to you that what happened in your case may be pure coincidence!
I flashed it using 8 different files on the u2202, and the machine maintains the same consumption (5v-0.2A), and not even the power LED lights up.
Do you have the file you used on this machine so I can test it here?

My case it was T14s gen 2. Try flash both file (for BIOS and EC) from another laptop without password. file for BIOS should be ME cleared.

[santoslao]

My case it was T14s gen 2. Try flash both file (for BIOS and EC) from another laptop without password. file for BIOS should be ME cleared.

Sorry friend, but it doesn't make sense! The machine should at least give 20v to the source even if it didn't turn on. I will resort to other options. See that in the friend's post here in the group he didn't do any of this, he just changed the MEC installed and corrected the parameters with U1 pendrive. He practically made a guide to get around this damn lockdown! The board is the same as the T14s (NM-D352). Anyway, thank you for the support.

[santoslao]

put back the original one and see the result.
if ok it's mean the raw material got issue or solder short

Tq

Really, after I remove the MEC and return with the original, the machine now has 20v, thus proving that the chip was defective. I don't have a stencil for this chip so I managed to remove the defective one very perfectly, so much so that even the spheres were on the board, so I put the original back. Lucky I bought 2 MEC1503, I'll test the other one and see if it works or if it's also defective.

[santoslao]

Really, after I remove the MEC and return with the original, the machine now has 20v, thus proving that the chip was defective. I don't have a stencil for this chip so I managed to remove the defective one very perfectly, so much so that even the spheres were on the board, so I put the original back. Lucky I bought 2 MEC1503, I'll test the other one and see if it works or if it's also defective.

After installing the second MEC chip, the machine turns on normally, but I had an unfortunate surprise! The chip sent by the vendor has a password to access the bios! I was deceived! I'm going to dispute on Aliexpress because these chips are not cheap. I'm very frustrated with this whole situation, I wasted hours and hours of my time to get to this point! I can't believe I waited for 14 days to receive 2 MEC chips with different defects. If the adm authorizes it, I'll post the link to this larápio's store here!

[lint4u]

Really, after I remove the MEC and return with the original, the machine now has 20v, thus proving that the chip was defective. I don't have a stencil for this chip so I managed to remove the defective one very perfectly, so much so that even the spheres were on the board, so I put the original back. Lucky I bought 2 MEC1503, I'll test the other one and see if it works or if it's also defective.

You can used the universal stencils with the same size, i did it before when i don't have the correct one.

Tq

[santoslao]

You can used the universal stencils with the same size, i did it before when i don't have the correct one.

Tq

It wasn't necessary since the pair of chips came already packed! But I had the surprise of a
Be defective and the other has a password! Ask me a question? Can I use a new chip or does it need to be programmed like the one I bought?