Panasonic Toughbook CF-C2 please remove bios password!

[RethoricalCheese]

Try shorting pins 5 and 6 on that eeprom at some point after turning the laptop on

[Maxpower3]

Originally Posted by RethoricalCheese

Try shorting pins 5 and 6 on that eeprom at some point after turning the laptop on

backup before maybe

[Andreasbest]

5 and 6 pin of 402R6 you mean?
And backup before?

[Maxpower3]

Originally Posted by Andreasbest

5 and 6 pin of 402R6 you mean?
And backup before?

402r6 is 24cXX eprom, try to read it if you can first

[Maxpower3]

Originally Posted by Andreasbest

With your (both) .bin i'm able to enter bios and change everything, except the supervisor password.
Anyway, i managed to enter bios, supervisor passwords are clear and everything can be modified

test see if you can change the password with this version

[Andreasbest]

Sure, i left Athens before a while for a task, i'll return Monday.
What do you want me to do first?
Backup and bridge pin 5 & 6 of 402r6
or
Try this last dump?

[Andreasbest]

According to a Toughbook specialist and regarding specifically the CF-C2:
bios is, - bios MAIN chip, Bios EC chip, and the part of the bios that is programmed in the main microcontroller on the motherboard (KBC), if the password is of administrative type, then the main will have to be changed, both EC and microcontroller with SVOD programmer will have to be reprogrammed. if it is a user type password, then it is stored in the MAIN chip, but not in the NVRAM (amit setup) bios part, but in the same file, in another part where the part is responsible for the EC.
Good luck with that!

He also told me in previous messages that specifically the CF-C2 is storing the passwords like tha, unlikely the rest Toughbooks..

[Maxpower3]

try save 402r6 and then you can test the shunt method. I am intrigued to know what is in it. it seems logical identical to old lenovo

yes too bad if in EC

[Andreasbest]

Originally Posted by Maxpower3

try save 402r6 and then you can test the shunt method. I am intrigued to know what is in it. it seems logical identical to old lenovo

yes too bad if in EC

Unfortunately i can't read it, it's too small for any of my adapters.
Can you decrypt the password of the first post bios dump?
At least this way i will be able to sell it.

[Andreasbest]

Also i remove it, restored defaults and supervisor reappeared, seems like the password and rest defaults are not stored in this.
And your last bios allowed me to change the supervisor password BUT (i forgot to mention it later) it doesn't allow me to boot any Windows under any configuration (get BSOD with message ACPI BIOS ERROR

So as i see it i have 3 options:
1) decrypt the supervisor code
2) edit the purchased dump to disable the "restore defaults" option in bios
3) edit the bios like it should and then desolder the "write" pin of eeprom from the board (not sure if it's that's simple)

[SMDFlea]

If the pass is stored in the EC then the only method would be to program a new EC . Finding the JTAG points and a dump would be the hard part

[Andreasbest]

Originally Posted by SMDFlea

If the pass is stored in the EC then the only method would be to program a new EC . Finding the JTAG points and a dump would be the hard part

It's a 8 years old laptop that i bought for 50€, not worth it.
Plus i think we all lost enough time with it.
Is there anyway to vanish the "load defaults" option from bios dump?

[SMDFlea]

Originally Posted by Andreasbest

It's a 8 years old laptop that i bought for 50€, not worth it.
Plus i think we all lost enough time with it.
Is there anyway to vanish the "load defaults" option from bios dump?

Here`s another bios,if you`re willing to have one more go .

[Andreasbest]

What is the difference in this?

[Andreasbest]

Originally Posted by SMDFlea

Here`s another bios,if you`re willing to have one more go .

With this dump it doesn't post (power up, nothing on screen)
Can we disable the "restore defaults" option from purchased bios?

[AAAC]

@Andreasbest
Try using one of the files that temporarily unlock the laptop, then go into Setup and set your own password, then disable the password by using the previous password you set and just pressing ENTER on New Password and Confirmation Password. Have you tried that?

[Andreasbest]

@AAAC thank you for your reply
Yes i tried it too, no matter what i do when i press "load defaults" a new supervisor pw set by Panasonic into EC is restored.
Now we are try to disable the "load defaults" option

[AAAC]

@Andreasbest
I just found something interesting, when you use "load default" options it loads the password that is hard coded into one of the uefi modules, so one option is to decode that password and the other is to replace that uefi module with one that is not customized (extracted from bios update).

[AAAC]

@Andreasbest
I've removed the password of your original file and removed the "pre-set" password that is loaded when using "Load Defaults" option.

There seem to be a problem with your original file, as when I open it with UEFITool it gives me this (so it may not work):

parseFileHeader: file alignment 10h is greater than parent volume alignment 8h
parseFileHeader: invalid data checksum E0h, should be 07h
parseFileHeader: invalid data checksum D9h, should be F5h
parseFileHeader: invalid data checksum FFh, should be 87h
parseFileHeader: invalid data checksum CFh, should be BCh
parseFileHeader: invalid data checksum 1Bh, should be A1h
parseFileHeader: invalid data checksum 2Ah, should be 36h
parseFileHeader: invalid data checksum 86h, should be 99h
parseFileHeader: invalid data checksum 6Ch, should be 7Dh
parseFileHeader: invalid data checksum 6Ch, should be B3h
parseFileHeader: invalid data checksum 82h, should be 8Ah
parseVolumeNonUefiData: non-UEFI data found in volume's free space
parseIntelMicrocodeHeader: invalid microcode checksum E44A4EF2h, should be E44AE97Fh
parseSections: non-UEFI data found in sections area
parseSections: non-UEFI data found in sections area
parseSections: non-UEFI data found in sections area
parseCompressedSectionBody: decompression failed with error Standard decompression failed
parseCompressedSectionBody: decompression failed with error Standard decompression failed
parseCompressedSectionBody: decompression failed with error Standard decompression failed
parseCompressedSectionBody: decompression failed with error Standard decompression failed
parseCompressedSectionBody: decompression failed with error Standard decompression failed
parseCompressedSectionBody: decompression failed with error Standard decompression failed
parseFileHeader: file alignment 1000h is greater than parent volume alignment 8h
parseFileHeader: invalid data checksum 5Ah, should be AAh
parseFileHeader: file alignment 1000h is greater than parent volume alignment 8h
parseFptRegion: FPT partition table header checksum is invalid

Have also removed "pre-set" password of file from post #14, but UEFITool also give some message about file:

parseFileHeader: file alignment 10h is greater than parent volume alignment 8h
parseFileHeader: file alignment 1000h is greater than parent volume alignment 8h
parseFileHeader: invalid data checksum 5Ah, should be AAh
parseFileHeader: file alignment 1000h is greater than parent volume alignment 8h
parseFptRegion: FPT partition table header checksum is invalid
parseNvarStore: unknown extended data format
parseNvarStore: extended header size (FFFFh) is greater than body size (FFF5h)

[Andreasbest]

Originally Posted by AAAC

@Andreasbest
I just found something interesting, when you use "load default" options it loads the password that is hard coded into one of the uefi modules, so one option is to decode that password and the other is to replace that uefi module with one that is not customized (extracted from bios update).

@aaac I was thinking of decoding the default pw too unfortunately is impossible to do.
It's not worth to replace the modulez the laptop is 8 years and bought it for 50€, i only play with bios because i'm curious
I'll try the 2nd modded bios you uploaded.
The 1st has many limitations, including the boot lock on some specific device (when i try to load any OS it return BSOD with message ACPI BIOS ERROR)