Lenovo Ideapad MIIX 720-12IKB

[AAAC]

Re: Lenovo Ideapad MIIX 720-12IKB

@RethoricalCheese
I just find out, it's actually a SHA256 hash, but they only store the first 16-bytes (128-bits) into the SaDataBase variable. I've already verified this with a different manufacturer BIOS, I've checked hash from post #10 (extracted from Mybios.zip file) but couln't find a match so far, did found a match for post #1 file (password string is encoded as Unicode-16 prior to SHA256 hashing, passw0rd= 111111 <- put it in an hex file and calculate the SHA-256 hash like this: 310031003100310031003100).

[Maxpower3]

Re: Lenovo Ideapad MIIX 720-12IKB

@RethoricalCheese
I just find out, it's actually a SHA256 hash, but they only store the first 16-bytes (128-bits) into the SaDataBase variable. I've already verified this with a different manufacturer BIOS, I've checked hash from post #10 (extracted from Mybios.zip file) but couln't find a match so far, did found a match for post #1 file (password string is encoded as Unicode-16 prior to SHA256 hashing, passw0rd= 111111 <- put it in an hex file and calculate the SHA-256 hash like this: 310031003100310031003100).

It looks a lot like that, doesn’t it?
Does anyone know how to do Fuji with this method?


GUID: SaDataBase 889CB747-7223-43EA-B198-AF2826E2AEB5
PwdUnlockChallengeVar 3F6E3B29-F842-4BA4-AE23-FF27C34F101C

[Maxpower3]

Re: Lenovo Ideapad MIIX 720-12IKB

PwdUnlockChallengeVar only displays after 3 bad tries
(ENTER key is not supported, text is required).
guid variable is deleted after changing password but the data is still written until the next lock

here are 3 different dumps
no password, 1234 and 4321 with also when locked
read with fpt

[AAAC]

Re: Lenovo Ideapad MIIX 720-12IKB

@Maxpower3 (post #23)
PwdUnlockChallengeVar = "Hint Code" or Unlock Key Hint Number, but on Lenovo laptops that have this code there must be a key stroke for this code to be shown on the screen, I haven't been able to find the keyboard key combination. Yes, PwdUnlockChallengeVar variable keeps changing every 3 incorrect passwords but never shown.



As for this screen capture of SaDataBase variables, it contains both SHA256 hashes, the first 16-bytes (128-bits) of "1234" and "4321" of SHA256 hashes calculated as: SHA256($HEX[3100320033003400]) and SHA256($HEX[3400330032003100]).

SaDataBase.Password =
4F37C061F1854F9682F543FECB5EE9D6
52C803235970202DE97C6E40C8361766

SaDataBase.Password =
A0CA5293E264C1649C44B71A4AF548DF
E6809C611C49B74597F5EA786D37203E