T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

[wangbreeze]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

Does it work with rt809f? I cannot erase, read or write, because chip gets identified as OxCDCDCDCD

well. I worked on another t490 today and had this exact issue. The only difference I can see between this new one and the one I worked on two days ago was the bios version (note that they are both t490). I wonder if you were able to resolve the issue. Thanks.

[wangbreeze]

well. I worked on another t490 today and had this exact issue. The only difference I can see between this new one and the one I worked on two days ago was the bios version (note that they are both t490). I wonder if you were able to resolve the issue. Thanks.

A quick follow up to this issue. Turned out to be the RT809F usb driver issue... Didn't know how the driver got corrupted..

[badcaps411]

This method also works if I don't have a BIOS password in it, but I have Secure Boot on through Grub 2.02, which is password protected. I can't turn off Secure Boot in the BIOS.

[Tech insider]

hello everyone. can someone please help me with this issue?


context : i am using rt809h to remove password of t490 / mec 1663. i have successfully read it by jtag connections mentioned above .

issue : when i try to rewrite it following the steps mentioned above my programmer gives an error. after reading the mec my laptop is dead. 3/5 V are working.

error: File has been loaded, checksum: 16bits_0x2B43 £¬32bits_0x01E12B43 :
032: MEC Chip ID: 0x200024B1
033: Start writing chip......
034: Auto erasing...
035: Erase successful£¬Elapsed time£º0.614 seconds¡£
036: Start writing...
037: Write successful£¬Elapsed time£º17.86 seconds¡£
038: Auto verifying...
039: Chip verification error, start position: 0x15C34.
040: Verification failure£¬Elapsed time£º1.679 seconds¡£
041: Write error, operation terminated.


help please.

[wangbreeze]

hello everyone. can someone please help me with this issue?


context : i am using rt809h to remove password of t490 / mec 1663. i have successfully read it by jtag connections mentioned above .

issue : when i try to rewrite it following the steps mentioned above my programmer gives an error. after reading the mec my laptop is dead. 3/5 V are working.

error: File has been loaded, checksum: 16bits_0x2B43 £¬32bits_0x01E12B43 :
032: MEC Chip ID: 0x200024B1
033: Start writing chip......
034: Auto erasing...
035: Erase successful£¬Elapsed time£º0.614 seconds¡£
036: Start writing...
037: Write successful£¬Elapsed time£º17.86 seconds¡£
038: Auto verifying...
039: Chip verification error, start position: 0x15C34.
040: Verification failure£¬Elapsed time£º1.679 seconds¡£
041: Write error, operation terminated.


help please.

I would try another USB port or add external power supply to the programmer. I read it could be due to usb not providing enough current. Worth trying.

[Tech insider]

I would try another USB port or add external power supply to the programmer. I read it could be due to usb not providing enough current. Worth trying.

Already done that. it is reading fine but when it verify then error come.

[qsenc]

A quick follow up to this issue. Turned out to be the RT809F usb driver issue... Didn't know how the driver got corrupted..

Hi there,

How you managed to read/write with RT809F ? My latest version is 220315 and dont support MEC1663. Please share the version you have and method.

Many thanks

[volinakis]

Hi there,

How you managed to read/write with RT809F ? My latest version is 220315 and dont support MEC1663. Please share the version you have and method.

Many thanks

choose MEC1633_256K

[qsenc]

choose MEC1633_256K

Worked like a charm. thanks

[fox95]

I am posting my experiences here to help the next person who may find this not so easy.

I have a rt 809h programmer that i intended to use to remove the sv password and bios password from a lenovo T490s laptop 20NY-sv3n00. this is a Gen 8 laptop i5 processor.

in the rt809h software you MUST select MEC1633_256K (do not select MEC1633#ISP) for your initial read out.

if you select the wrong one and read the file out and erase the chip you will not have the complete file and will be unable to re flash the chip. it will not work. I learned this the hard way. when i initially tried in the way the board leds would not light up and it appeared I bricked the chip. and board. Nothing would work, it would not boot, no fans, nothing.

to solve this i found a generic bios file from a t490 and tried to flash this bios file into the chip after switching the rt809h software to MEC1633_256K. once i did this i was able to get the laptop to boot back up after i moved the resistor back to its original position.

before i flashed the generic bios file i made sure to erase the chip with the selection of MEC1633_256K I do not believe the entire chip will erased if you have MEC1633#ISP selected. So i changed the selection and clicked erase chip and then unplugged it for a few minutes then flashed the new bios file into the chip and that's when everything started working again upon re powering it back up.

pay very close attention to your soldering of the resistor. it is very easy to have it appear to be on correctly but not making good contact, if you do not have good contact it will not read or write the chip. also make sure your solder on the JTAG positions are not touching each other. it is very easy to short these with solder touching. lastly make sure you blow the board off with compressed air when finished to remove any microscopic balls of solder that may be floating around and touching other chips/pins etc.... when viewing all this under a microscope its easy to see tiny little solder balls fall off your connections. if re assembled the laptop could fail to work.


some things i encountered upon restarting and needing to flash a new bios and use the lenovo utility to enter the serial/model number..

i was getting a error on startup called "invalid product name" 2202 i think. for the t490s you much give it a name of "T490s" case sensitive!!!! when you read out the name it will show "ThinkPad T490s" (do not put Gen 8) in the name like you would with a x1 carbon.
next i was getting a error on start called "configuration error" This will eventually go away once the laptop is re assembled. its looking for the LCD screen and keyboard and charging components etc... that would normally be the configuration. but since you are using it on a bench with a separate monitor and usb keyboard it will give an error. because its not expecting only those items.

lastly.. once i got it all back assembled and running/booting properly with no errors I had a issue where the keyboard would not work properly. i thought this was a driver issue but it was not the case. since the mobo was being used solely with a external usb keyboard it was only recognizing that for some reason and the built in keyboard was not working well, some keys would work but others would not. so i had to remove the ssd and unplug it and unplug the battery and reseat the keyboard ribbon cable. this fixed it. i am unsure if it was just the ribbon cable or the laptop needed to be solely restarted from no power without the USB keyboard...??? but it now all works.

one other item to note. When using the lenovo utility the shift key would not work properly and would put a ^C on the screen then you could type. this was problematic because the brand name in the utility is case sensitive. the solution was to press shift key and type "T" but keep holding the shift key down and then hitting backspace twice and re-typing "T" if you do not do this correctly with proper case the error "invalid brand name" will appear on boot. it must appear "ThinkPad T490s" (no quotes marks) to get the error to disappear upon boot.

I spent many hours working on this and finally the bios is fully unlocked and everything works as normal. this was a great learning experience so if you're having trouble don't give up and be don't be afraid. I though I bricked mine many times and would need to just buy a new mobo. but in the end it was just the sequence of events and the correct settings that allowed it to be brought back to life. I then went to the lenovo web site and downloaded all the latest drivers and bios firmware's (there are two) and let the lenovo software install and flash the latest bios and it was fine.

all items on page 1 of this thread showing wiring and procedure are good to follow except for changing rt809h software to MEC1633_256K. pay attention to this. one final note. i did the software re-flash rt809h software within a windows 10 virtual machine (virtualbox) because I was skeptical of the rt809h software as it shows up as a trojan virus. a VM is always a good idea and i can confirm it worked fine for this process.

if you have any questions please ask. although i am not a expert and this is the first time i've ever taken apart a laptop and tried something like this. so if i can do it, you can too with some patience.

[fox95]

I forgot to mention one other item i think is very important. when you erase the chip and unplug power source, make sure you unplug the rt809h from the usb port. the wires from the rt809h will supply voltage to the JTAG connections and potentially keep the chip alive i think. to be sure after erase just unplug it.

[raulitiu]

Re: T14s - MEC-1663 - Jtag - Pinout - Bios Password Removal

Does anyone know if this process can be done with a EZP2023+ programmer?

Hi, same question here, does it work with EZP2023+ programmer? Thanks

[danito]

Hi, same question here, does it work with EZP2023+ programmer? Thanks

https://www.hklrf.com/24download/img...P2023-List.txt