AMITSESetup Decryptor

[EineWildeStehlampe]

As a lot of older firmware images use the well known, incredibly secure AMI XOR key to encode the supervisor password in the firmware image, I wrote a small Python tool to automate the process of searching through the image and decrypting the key. It is far from perfect but works well enough for me to share.

The tool uses UEFIExtract to dump the entire image, naively search for a folder ending in "AMITSEDecrypt", iterate through the body.bin to find all possible hashes stored in there, decrypt them with the XOR key, remove every second byte, then convert to ASCII.

Usage: python3 AMITSEDecrypt <Path/to/image.bin>

Hope it'll be of use to someone and excuse my horrible Python skills.

[crowntoy99]

good jobe

[Maxpower3]

good job, untested for the moment, thanks

[Ghamidi]

great job thank you

[EineWildeStehlampe]

Originally Posted by EineWildeStehlampe

The tool uses UEFIExtract to dump the entire image, naively search for a folder ending in "AMITSEDecrypt", iterate through the body.bin to find all possible hashes stored in there, decrypt them with the XOR key, remove every second byte, then convert to ASCII.

I meant "AMITSESetup" obviously.

[Ghamidi]

Originally Posted by EineWildeStehlampe

I meant "AMITSESetup" obviously.

I tested work perfect

thank you so much

[EineWildeStehlampe]

Glad it's of use to someone. I'd love to keep a list of devices using the AMITSESetup variable if only I could find out how to edit my posts

[Maxpower3]

Originally Posted by EineWildeStehlampe

Glad it's of use to someone. I'd love to keep a list of devices using the AMITSESetup variable if only I could find out how to edit my posts

see with a moderator to modify your first post.

[LatinMcG]

this works with some of the Panasonic laptops.. not all tho.

[EineWildeStehlampe]

Confirmed to work with at least those devices, will add more when I have some in:
- Microsoft Surface (Pro) 3
- Advantech MIO-5251
- Medion Lifetab P8912
- ASUS Vivobook Flip 14 TP412

I've noticed there's also a few AMI implementations storing the password in cleartext instead of scancodes, I'll probably add something to parse those aswell. And then there's some that look like SHA1 hashes, so I might at least add some functionality to detect those.

[onizzbox]

Originally Posted by EineWildeStehlampe

Confirmed to work with at least those devices, will add more when I have some in:
- Microsoft Surface (Pro) 3
- Advantech MIO-5251
- Medion Lifetab P8912
- ASUS Vivobook Flip 14 TP412

I've noticed there's also a few AMI implementations storing the password in cleartext instead of scancodes, I'll probably add something to parse those aswell. And then there's some that look like SHA1 hashes, so I might at least add some functionality to detect those.

@EineWildeStehlampe
Similar to this here?
I'm finishing the script in C++ to make it faster, I'll post it in Badcaps next week.

[Maxpower3]

Originally Posted by onizzbox

@EineWildeStehlampe
Similar to this here?
I'm finishing the script in C++ to make it faster, I'll post it in Badcaps next week.

nice job as usual onizzbox

[onizzbox]

Originally Posted by Maxpower3

nice job as usual onizzbox

Thanks! Maxpower3
Would you like to anticipate the release?

[Maxpower3]

Originally Posted by onizzbox

Thanks! Maxpower3
Would you like to anticipate the release?

no need, I already know your work and you have already shared a lot of knowledge and tools with me

[onizzbox]

Originally Posted by onizzbox

@EineWildeStehlampe
Similar to this here?
I'm finishing the script in C++ to make it faster, I'll post it in Badcaps next week.

@SMDFlea
I forgot to remove my credentials in the attached video, I can't edit the post anymore. Could you please remove it?

[onizzbox]

Originally Posted by Maxpower3

no need, I already know your work and you have already shared a lot of knowledge and tools with me

Thank you Max!
Helping users on the forums or outside of them has always been a hobby, I don't depend on it for a living. I've always liked to share my knowledge, that's the only way we can evolve.

[SMDFlea]

Originally Posted by onizzbox

@SMDFlea
I forgot to remove my credentials in the attached video, I can't edit the post anymore. Could you please remove it?

removed.

[BootLoader1]

I wrote small software for decrypt AMI BIOS Password. Software can read Admin and Boot password, just open file or drag and drop a file.
Enjoy.

[onizzbox]

Originally Posted by BootLoader1

I wrote small software for decrypt AMI BIOS Password. Software can read Admin and Boot password, just open file or drag and drop a file.
Enjoy.

@BootLoader1
Very cool, but it doesn't work!!
Needs repairs...

[BootLoader1]

Working, working, but I forgot about this case. Now fixed and working well.