T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

[jacobk1508]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

you have to power the board before reading EC

I have already powered up the motherboard. The problem I'm having is reading EC data indicates empty file, it's not a problem of not reading EC

[volinakis]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

I have already powered up the motherboard. The problem I'm having is reading EC data indicates empty file, it's not a problem of not reading EC

check again wires, maybe you reversed TDI with TDO. And choose MEC1633_256k for RT809H

[jacobk1508]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

check again wires, maybe you reversed TDI with TDO. And choose MEC1633_256k for RT809H

This is the output I get when I try to read the MEC1663, I believe I followed the instructions correctly, the JTAG connection wires are correct.

[jacobk1508]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

This is the output I get when I try to read the MEC1663, I believe I followed the instructions correctly, the JTAG connection wires are correct.

I tried all the options in the programmer's list, MEC1633#ISP, MEC1633#256K etc.

[volinakis]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

This is the output I get when I try to read the MEC1663, I believe I followed the instructions correctly, the JTAG connection wires are correct.

happened to me the same at 1st laptop I unlocked with RT809H (chip may be damaged...). Read this maybe will help you. also, do not wire #RST.
https://www.badcaps.net/forum/showpo...&postcount=234

[mily.gawel]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

Hello. I have a problem with T14s and EC Mec1633-BA0 reading. I'm using SVOD4, after changing the place of the resistor and connecting the JTAG

MEC IDCODE: B1240020
Device ID: 0
Device Revision: 0
Device Status: 0
Flash Status: 0000000000
Boot Block in not protected mode
Flash Configuration: 0000000000
Start reading: 11.08.2023 08:00:39
End reading: 11.08.2023 08:00:40
CRC calculated 1D0F
CRC stored 0000
Read OK

But the read dump is empty, it seems to me that I connected the JTAG correctly, with the same connection in x390 it reads EC correctly. Does anyone have an idea?

[reverb]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

I'm facing the same problem as rumpumpel on a T14 Gen1. I successfully dumped the MEC with MEC1633#ISP setting. However, after reflashing there is no fan, no LED, nothing. After having a look at the dump it seems like the last bytes got cut off and I should've dumped it using the 256K option. But as I don't have a second device, now I don't have access to the full image anymore.

Would someone mind sharing their MEC1633 dump with me or has any idea where I can find one?

[reverb]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

I'm facing the same problem as rumpumpel on a T14 Gen1. I successfully dumped the MEC with MEC1633#ISP setting. However, after reflashing there is no fan, no LED, nothing. After having a look at the dump it seems like the last bytes got cut off and I should've dumped it using the 256K option. But as I don't have a second device, now I don't have access to the full image anymore.

Would someone mind sharing their MEC1633 dump with me or has any idea where I can find one?

Okay I fixed it by flashing the MEC1633 image of a T490 which is also 256kb. I found it in this post: https://www.badcaps.net/forum/showpo...&postcount=170

Now everything works fine and the supervisor password is indeed gone.

[ordinateur]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

Nice explanation and tutorial by coolshrimp regarding these Lenovo laptops. I have some ambiguities on how do I do this whole procedure with just Keyboard connector cable and with the least possible soldering (without JTAG). As I have the full set of RT809H when I bought it, I think I may not miss a single item because when I bought it I acquired the biggest set with over than 50 parts.

I saw RethoricalCheese used just the Keyboard connector to do the job, but I am not understanding the concept of Pull Up - Pull Down resistor, 10 K, and where do I solder that?

P.S.
Just noticed on the picture attached the description: Resistor Below goes here or place a 10K resistor. Move resistor below to the above position to enable R/W

Will be trying as coolshrimp described

In my case I Have Thinkpad T14 Gen1 AMD version


thanks in advance for such a great and helpful forum

[volinakis]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

Nice explanation and tutorial by coolshrimp regarding these Lenovo laptops. I have some ambiguities on how do I do this whole procedure with just Keyboard connector cable and with the least possible soldering (without JTAG). As I have the full set of RT809H when I bought it, I think I may not miss a single item because when I bought it I acquired the biggest set with over than 50 parts.

I saw RethoricalCheese used just the Keyboard connector to do the job, but I am not understanding the concept of Pull Up - Pull Down resistor, 10 K, and where do I solder that?

P.S.
Just noticed on the picture attached the description: Resistor Below goes here or place a 10K resistor. Move resistor below to the above position to enable R/W

Will be trying as coolshrimp described

In my case I Have Thinkpad T14 Gen1 AMD version


thanks in advance for such a great and helpful forum

you can't use keyboard connector with RT809H, only with svod3-4 or SAS programmer. "Pull-up - pull down" resistor have to move it to enable reset of the EC, otherwise you can't be able to erase it and write it. Are you sure Thinkpad T14 Gen1 AMD version has MEC1663 as EC?

[rbvndonh]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

Thanks for tutorial

[mily.gawel]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

what should be the size of the file after reading, 192 KB or 256 KB? I read 256KB correctly. After deleting the file, it reads 256 KB, I checked the MEC and it is empty and the laptop shows no signs of life. After 5 minutes, I program it again, move the resistor and the laptop starts up, but the password still remains.

[Dido210]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

Does anyone know if this process can be done with a EZP2023+ programmer?

[volinakis]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

what should be the size of the file after reading, 192 KB or 256 KB? I read 256KB correctly. After deleting the file, it reads 256 KB, I checked the MEC and it is empty and the laptop shows no signs of life. After 5 minutes, I program it again, move the resistor and the laptop starts up, but the password still remains.

you can start the motherboard connected to a monitor via HDMI without moving back the resistor to check if password is gone. Did you ERASE the EC before writing back the dump file? And you have to disconnect all power sources, including programmer, for 2-3 minutes after you erased EC.

I always choose MEC1336_256k to read EC with RT809H and extract EC file from bios update to write it back and worked all times. Also read
https://www.badcaps.net/forum/showth...light=MEC+16xx
and you'll find useful infos.

[fr3man]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

Does it work with rt809f? I cannot erase, read or write, because chip gets identified as OxCDCDCDCD

[fr3man]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

When i try to identify, i am getting this.
Any advice?
---------------------------
RT809F
---------------------------
Chip ID: 0x00FF0406, the device is not found in the corresponding partnumber, you can click "OK", and then manually add this partnumber with their ID, or copy this message content and chip partnumber, and feedback to the technical support forum: WWW.IFIX.NET.CN o
---------------------------
OK Cancel
---------------------------

[jm801]

someone will have the configuration of MEC1723
To be able to add it to my programmer I have the vertyanov but that one doesn't come there so I can program it

[wangbreeze]

Thanks for the work and sharing. If I read it correctly, we can add another 10k resistor to enable JTAG? Thought it’s easier to add and remove than to move the small resistor around. Thank you.

[wangbreeze]

Thanks for the tutorial. I have successfully removed the password. However, I cannot seem to modify the settings such as setting a new SVP password. It shows error “write protected”. Anyone has similar issues? Thanks.

[wangbreeze]

Thanks for the tutorial. I have successfully removed the password. However, I cannot seem to modify the settings such as setting a new SVP password. It shows error “write protected”. Anyone has similar issues? Thanks.

Reflashing BIOS obtained from Lenovo website resolved the issue. And the board serial number (B0) can be found from a sticker on the motherboard. It is much longer than the 11 character long serial number found from BIOS information screen but that’s what the Lenovo maintenance utility takes.