RCUnlocker

[unilock01]

So, how does RCUnlocker work? Or is that a secret?

I have some guesses, but they're rather extravagant. Occam's Razor and all that.

[RethoricalCheese]

No need to use your imagination. Just compare files using hex editor

[unilock01]

I think I got it.

For HP, you erase the NVRAM region (not entirely sure how this is detected)
For Chromebooks, you flip the devmode and enrollment bits (I guessed correctly!)
For Apple devices, you clear a 289 byte region starting with 0xAA557F00 (maybe HP works the same way - clear a XXX byte region starting with 0xYYYYYYYY)

Very cool

EDIT: Ah, yes. For HP, it wipes a region starting with a bunch of 0xFF and "NvramActiveRegn", and ending with [something I didn't bother to remember].
Sure would've been nice if you had uploaded this as a Python script instead of a PE executable, so I wouldn't have had to open up a Windows VM and copy a bunch of files back and forth to "reverse-engineer" this XP

[Korreia]

Hello all,

I've try to run RCUnloager on my HP EliteBook 820 G3 but I keep on getting averification error.

Here the screenshot of the successful RCUnlocker

Here the NeoProgrammer Verification Error screenshot

I've also attach the extracted bin file from the WSON8 chip call org.bin as well as the RCUnlocker output org_unlocked.bin

Any help our guidance on the verrification error would be greatly appreciated.

[adil12]

Hello,
I have been trying to use this software ( by dropping the locked bios dump file on it) however I keep getting an error (missing un lockable content). could anyone kindly advise what am i doing wrong?
Thank you in advance

[Korreia]

Originally Posted by adil12

Hello,
I have been trying to use this software ( by dropping the locked bios dump file on it) however I keep getting an error (missing un lockable content). could anyone kindly advise what am i doing wrong?
Thank you in advance

Do not open the RCUnlocker, just Drag and drop .bin file to .exe file.

It will create a new file in the same directory as your bin file. It will be named [BinFileName]_unlocked.bin

[RethoricalCheese]

Your verification has nothing to do with the unlocker. It's just that ch341a can be quite unreliable. Check your connections.

Missing unlockable content means the program didn't find any keywords it was looking for. That suggests you are trying to unlock something which either is not supported or you just have a faulty read.

So maybe help us and give some more information. Like what are you trying to unlock and what is your file like.

[Korreia]

Originally Posted by RethoricalCheese

Your verification has nothing to do with the unlocker. It's just that ch341a can be quite unreliable. Check your connections.

Missing unlockable content means the program didn't find any keywords it was looking for. That suggests you are trying to unlock something which either is not supported or you just have a faulty read.

So maybe help us and give some more information. Like what are you trying to unlock and what is your file like.

I believe you were replying to my post. I'm not knowledgeable in this area, so I'm not sure if you were able to see that their was some missing unlockable content.

I'm not trying anything fancy.

1. I'm reading the BIN from the WSON8 chip
2. Saving it to HDD
3. Unlocking it using your program.
4. Loading the new BIN_unprotected
5. Cliking the verify, and that is when it fails

Maybe I'm missing a configuration in the NeoProgrammer?

If anyone could try it out to see if your able to unprotect and verify without verification error that would be really appreciated.

org.zip

thanks for your help and support

[RethoricalCheese]

Might be a stupid question but... Have you tried programming instead of just verifying?

[Korreia]

Originally Posted by RethoricalCheese

Might be a stupid question but... Have you tried programming instead of just verifying?

Same error as it is trying to verify before programming the chip

[adil12]

Thank you for your reply, this is what im trying to do im dragging the file and doping it on the exe file but instead im getting this mesg missing unlckable content. Is this software compatible with windows 10?
Thanks

[RethoricalCheese]

Korreia, please describes what steps you take. It should be read, verify, patch, erase, write, verify.

adil12, as I said, you either have a faulty read or you are trying to unlock something which is not supported. So please do help me help you. What are you trying to unlock? Upload your file. Did you verify your readout?

[Korreia]

Originally Posted by RethoricalCheese

Korreia, please describes what steps you take. It should be read, verify, patch, erase, write, verify.

Tank you Sir, that worked, I was not erasing.

[mido77]

Originally Posted by RethoricalCheese

Do what it says. Read the 16MB chip and use that instead of 32MB chip...

hi Sir

Would this work with your tool ??
copy the last 16MB Hex code ( 1000000h lenght ) from the 32MB file and paste it in a new empty hex file in any hex editor and save it, then use the RCUnlocker to unlock the saved file (16MB), then in the original 32MB dump paste/write the last 16MB with the generated file,

would like to try it but i have no case for now on which i can test that.
will appreciate it a lot if you can test that, thank you very much in advance, if no time for that just ignore my request will test that whenever got a case with 32MB and 16MB ones .

[RethoricalCheese]

Hahahaha. The issue is that you need to modify 16MB chip. Yes, there is a way to do it using the 32MB chip but not like this. Why don't you just patch the 16MB chip? Too difficult to unscrew the motherboard?

[mido77]

Originally Posted by RethoricalCheese

Hahahaha. The issue is that you need to modify 16MB chip. Yes, there is a way to do it using the 32MB chip but not like this. Why don't you just patch the 16MB chip? Too difficult to unscrew the motherboard?

Not difficult at all, i always got all the boards out of the cases before dealing with them, it's just i have no case to test that at the moment, there's a way of doing it on both chips in fact, it's just an idea that crossed my mind and i will test it for sure whenever got a case with 16/32MB chips;

Thank you for answering
have a good day/night, bye

[ALRAHI]

Capture.JPG

Originally Posted by RethoricalCheese

Try this instead.

not work for me

[Asachan]

Hello,

Your tool works on the older generation of Probooks but i can't get it working on g8 as both ec and spi roms are 32mb, i might need some help from someone more skilled than me. If anyone could give me some advice or give me a hand, i would really appreciate !

I'm attaching the dumps from my computer in case you want to have a look at it !

Thank you !

[RethoricalCheese]

ALRAHI, you did not follow instructions.

Asachan, thanks for the files. I've never seen a G8 so I'll take a look at the files soon. S

[Asachan]

Hello RethoricalCheese and thank you ! If you need any more informations let me know ! I try to unlock it by myself too, i'll let you know if i find out .
I'm also looking for an unlocked g8 spi and ec dump to compare them but no chance so far !