Lenovo Thinkpad Ec Pwd Bypass

[Usering]

this is strange, too. i tried it like 100 times and nothing died (t15 gen 2).

nm-d362 io mec1503 (short ESPI inside CPU)
nm-981 io npcx997 (short 3V PCH inside CPU)

[Usering]

One day we will manage to remove pass from MEC1503 too, for example right now we know there is 2kb rom on it that writes all data (serial, model, bios pw) everytime the laptop posts. One day someone will manage find a workaround on it too.

It may be difficult, Lenovo ThinkPad will work on protection like MacBook, M1 M2 M3, no solution

[Andreasbest]

the data won't be rewritten with every post, that's wrong. the 2 kb eeprom information is not stored in the bios but only in the mec.

I'm not deep in programming, i read only what others, much skilled than me are saying ↓

It's PROGRAMMBLE but MEC1503 SRAM-based nature. It's not a rom. So you can't program from programmer. Mec1503 collect data from main bios when power on. • SRAM is volatile memory, which means it does not retain data when the power is turned off.

[Andreasbest]

It may be difficult, Lenovo ThinkPad will work on protection like MacBook, M1 M2 M3, no solution

Life have show me that eventually everything cracks or bypass somehow, for example before 3 days someone managed to decrypt the Hypervisor of PS5, a task that before some years seemed impossible.
One day this will crack too.

Problem with Mac is other, you can't bypass iCloud lock because laptop must connect to Apple servers and download ticket with decryption to work 100%, perhaps one day we will manage to bypass it but Apple services will not work.
Except if someone cracks the encryption but that's very unlikely to happen.

[rediii]

I'm not deep in programming, i read only what others, much skilled than me are saying ↓

this is nonsense.

[Stefan Steff]

this is nonsense.

Right...

MEC1503
Flash : 16384 kB
Flash bank : 0x1000000 Bytes @ 0x60000000
RAM : 224 kB
RAM : 0x00038000 Bytes @ 0x00038000
Architecture : Cortex-M4

[ibo]

Right...

MEC1503
Flash : 16384 kB
Flash bank : 0x1000000 Bytes @ 0x60000000
RAM : 224 kB
RAM : 0x00038000 Bytes @ 0x00038000
Architecture : Cortex-M4

So you can read the chip?

[Usering]

Life have show me that eventually everything cracks or bypass somehow, for example before 3 days someone managed to decrypt the Hypervisor of PS5, a task that before some years seemed impossible.
One day this will crack too.

Problem with Mac is other, you can't bypass iCloud lock because laptop must connect to Apple servers and download ticket with decryption to work 100%, perhaps one day we will manage to bypass it but Apple services will not work.
Except if someone cracks the encryption but that's very unlikely to happen.

The new and upcoming generation, the userdata information will be inside the CPU, and until now no one has been able to decode the access to the CPU via JTAG, also the microchip is used on the MEC1723 chip, the stubborn Cortex processor, it is not possible to enter or pass to the EEPROM chip except with commands and key Checksum , each kbc chip and each spi rom image , And also lock the jtag port, This is good for protecting people's information, and killing help computer thieves.

[Stefan Steff]

So you can read the chip?

No my friend...I don't know anyone who did that.
Readed somewhere that the swapping method is the only way ro get rid of the password on this models.

[arestlessknight]

Well it's known that it can be done but with programmer.
If you have many Lenovo with eSPI then it's worth it to buy a SVOD programmer and do it your self.

Hello again,
does this apply to the T14 Gen. 3 AMD laptop's as well?
If so do you know where I might find more information on reprogramming the npcx997?

[rediii]

Hello again,
does this apply to the T14 Gen. 3 AMD laptop's as well?
If so do you know where I might find more information on reprogramming the npcx997?

impossible atm.

[Usering]

Hello again,
does this apply to the T14 Gen. 3 AMD laptop's as well?
If so do you know where I might find more information on reprogramming the npcx997?

Risk
Devices with ESPI Protocol, IO Mec1503 , Mec1723 , NPCX997 (do not work in LPC Method , can burn and short CPU).

[arestlessknight]

impossible atm.

Impossible for this method or in general?
I can get some of these npcx977 ICs pre-flashed for a thinkpad motherboard.
Would a chip swap work (I understand that it's not the easiest solder job)?

[rediii]

Impossible for this method or in general?
I can get some of these npcx977 ICs pre-flashed for a thinkpad motherboard.
Would a chip swap work (I understand that it's not the easiest solder job)?

it works neither via the espi nor via programming (as currently no programmer can communicate with the chip in such a way that it can be read or written to). it is possible to exchange it, of course. the problem here is probably most likely to remove the sealing cleanly. as is well known, lenovo has not done itself any favours in terms of ease of repair.

[arestlessknight]

it works neither via the espi nor via programming (as currently no programmer can communicate with the chip in such a way that it can be read or written to). it is possible to exchange it, of course. the problem here is probably most likely to remove the sealing cleanly. as is well known, lenovo has not done itself any favours in terms of ease of repair.

Ah, okay. I will likely take the latter route then.
Just for the sake of curiosity, does the Nuvoton (Nu-Link2-Pro) programmer not work with the npcx997 either? I'm surprised that these chips cannot even be read from.

[rediii]

Ah, okay. I will likely take the latter route then.
Just for the sake of curiosity, does the Nuvoton (Nu-Link2-Pro) programmer not work with the npcx997 either? I'm surprised that these chips cannot even be read from.

that's a good question, but reading and writing the ec flash while the chip is ON the mainboard is not possible as far as i know (the same applies to npcx797). however, this refers more explicitly to the programmer successor and svod4.

[arestlessknight]

Ah okay. So regardless, desoldering is currently a must (as far as anyone is aware at least). Thank you for all of the valuable info rediii.

[rediii]

Ah okay. So regardless, desoldering is currently a must (as far as anyone is aware at least). Thank you for all of the valuable info rediii.

thank you. i would appreciate a feedback, after you did the soldering job.

[Andreasbest]

Anyone knows what EC is on NM-C881 ( Lenovo ThinkPad X1 Carbon 8th Gen ) ?

[Maxpower3]

Anyone knows what EC is on NM-C881 ( Lenovo ThinkPad X1 Carbon 8th Gen ) ?

Re: mec 16xx dump with info block

how to read mec1663 with vetyanov ihave nm-c881 motherbord thanks