Recover P53s Supervisor PW (doesn't want to erase it)

[esp13]

Hi,

I came here to free my hardware (brand new Lenovo Thinkpad P53s machine) that is locked with a supervisor password where I want to install linux. I have the possibility of getting it unlocked by sending the machine back to my support service, but I want to avoid some extra fees and time loss (and potential damage...)

I have other machines locked with the same password (I hope so) so my idea was not to simply reset the password (like here https://www.badcaps.net/forum/showthread.php?t=87588), but to found it and recover it from one EEPROM of the mainboard.

Is it possible or is it protected?
I found that was possible on older thinkpads but don't found about this P53s.

I have some arduinos or ESP or programmers so I think I'm able to read an I2C memory by finding SDA/SCL pins.

Can you help me or tell me a first step help?

Thank for having read,
Sorry for my bad English skills.

[Maxpower3]

Re: Recover P53s Supervisor PW (doesn't want to erase it)

Hi,

I came here to free my hardware (brand new Lenovo Thinkpad P53s machine) that is locked with a supervisor password where I want to install linux. I have the possibility of getting it unlocked by sending the machine back to my support service, but I want to avoid some extra fees and time loss (and potential damage...)

I have other machines locked with the same password (I hope so) so my idea was not to simply reset the password (like here https://www.badcaps.net/forum/showthread.php?t=87588), but to found it and recover it from one EEPROM of the mainboard.

Is it possible or is it protected?
I found that was possible on older thinkpads but don't found about this P53s.

I have some arduinos or ESP or programmers so I think I'm able to read an I2C memory by finding SDA/SCL pins.

Can you help me or tell me a first step help?

Thank for having read,
Sorry for my bad English skills.

no chance for the moment to find the password.
For the P53s, I think it will be necessary to read EC.
The patch works for some models.
But P53 I do not believe too much.
It will in any case a hardware intervention.

[AAAC]

Re: Recover P53s Supervisor PW (doesn't want to erase it)

@esp13
IMHO password recovery is not possible, maybe just the password hash, which will be useless unless you brute-force crack it (it just takes too much time). To brute-force crack the password hash you will need to learn how the firmware is hashing the password and which hashing function is being used.

[esp13]

Re: Recover P53s Supervisor PW (doesn't want to erase it)

no chance for the moment to find the password.
For the P53s, I think it will be necessary to read EC.

@esp13
IMHO password recovery is not possible, maybe just the password hash, which will be useless unless you brute-force crack it (it just takes too much time). To brute-force crack the password hash you will need to learn how the firmware is hashing the password and which hashing function is being used.

Thank you for your answers.
I had a hope because I saw paid services like all****ice.ro list my computer in their done list. But maybe it's just a PW reset too.

The patch works for some models.
But P53 I do not believe too much.
It will in any case a hardware intervention.

So I guess Lenovo bios auto-patcher https://www.badcaps.net/forum/showthread.php?t=87588 will not work on this computer?

Going hardware don't scare me too much if I know what I'm doing, has someone a detailed procedure what to do?

Edit: I found this https://www.synacktiv.com/en/publica...anagement.html, it's a start but not enough for my low levels.

[RethoricalCheese]

Re: Recover P53s Supervisor PW (doesn't want to erase it)

You can read MEC eeprom content using vertyanov.

[esp13]

Re: Recover P53s Supervisor PW (doesn't want to erase it)

You can read MEC eeprom content using vertyanov.

Hi,
Thank you for you answer, I don't have a vertyanov card. Not possible to read it with an arduino or a raspberry like I can read I2C eeprom with them?

If recovering the password is not possible at this moment, is it already possible to erase it myself for my computer model?

[RethoricalCheese]

Re: Recover P53s Supervisor PW (doesn't want to erase it)

You need to read/write to delete. So there's no real difference.

Even if you read, you won't be able to get the password from that because it's not plain text.

And ofcourse it's possible to use arduino or raspberry for that. The problem is that you would also need to write the code for them to do that because nobody has written or published it.

[TopMan007]

Re: Recover P53s Supervisor PW (doesn't want to erase it)

@RethoricalCheese,
have you tried to read and write P53 with success via Vertyanov?
Thx

[RethoricalCheese]

Re: Recover P53s Supervisor PW (doesn't want to erase it)

Haven't used it on P53s yet. But if you are asking if I have read MEC1663, then yes, I have.