Surface 3 Clean Bios? (noob)

[Chaos-Acid]

Hi all,

been lurking for a couple of weeks now, managed to get my hands on a cheap surface 3, UEFI password locked though..

I'm a complete noob at this and i think i've dumped the bios, anyone able to show me how to get the password or upload a clean bios for me to update with?

Many thanks to you all!

[RethoricalCheese]

Your rar file is 2.9KB thus invalid. Use flash programming tool (fptw64.exe -bios -d surface3.bin) to read bios region. Then upload it and I can get the password from there.

I think you need TXE2 flash programming tool for that.

[Chaos-Acid]

Yah, i think i'm getting that issue at the moment, using \Intel ME System Tools v10.0 r7\MEInfo\WIN64>MEInfoWin64.exe

i get the error Error 9460: Unknown or unsupported hardware platform

So i assume i have to go right back a version, the TXE2 version?

Also thank you for your help and sorry - i'm such a noob.
Havent been a windows user since XP..

[RethoricalCheese]

Yes, as I said, TXE2 should work.

[Chaos-Acid]

Thank you - I think i found the correct version and the command you gave me worked!
___________
Intel (R) Flash Programming Tool. Version: 2.0.5.3107
Copyright (c) 2007 - 2015, Intel Corporation. All rights reserved.

Platform: Cherry Trail
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
MX25U6435F ID:0xC22537 Size: 8192KB (65536Kb)


- Reading Flash [0x800000] 4096KB of 4096KB - 100% complete.
Writing flash contents to file "surface3.bin"...

Memory Dump Complete
FPT Operation Passed
_________________

Thank you again for your help, i'm learning a lot researching all these

[Chaos-Acid]

Attachement:

[RethoricalCheese]

1234567890

[Chaos-Acid]

Originally Posted by RethoricalCheese

1234567890

hhahahah, ofcourse that worked!! why didn't i try that when i was trying to guess it in the first place!!!!

Thank you as always my friend - if i may ask, how did you find it out - i assume by looking through the dump and finding a hex key?

[RethoricalCheese]

It is located in AMITSESetup section but it is slightly encrypted so some decryption is needed.

[Chaos-Acid]

oh amazing! wow, you sir are a god among men and i cannot thank you enough!!

[keczuk]

Originally Posted by RethoricalCheese

It is located in AMITSESetup section but it is slightly encrypted so some decryption is needed.

wow i try check this file, and don't see AMITSESetup section. Can you tell more about this ?

[lapfix]

Originally Posted by keczuk

wow i try check this file, and don't see AMITSESetup section. Can you tell more about this ?

You can use search on UEFI Views , but as RethoricalCheese say : it's encrypted !

[KingBonecrusher]

Hi!

If i`am correct AMI uses an XOR key to encrypt the SHA1 hash of the stored password (maybe scancode)? Would you provide some more infos how to recover the sha1 hash or password?

[KingBonecrusher]

Originally Posted by KingBonecrusher

Hi!

If i`am correct AMI uses an XOR key to encrypt the SHA1 hash of the stored password (maybe scancode)? Would you provide some more infos how to recover the sha1 hash or password?

Ok, found the solution...

3132333435363738393000000000000000000000

Rest is simple

[RethoricalCheese]

Well done!

[keczuk]

Originally Posted by KingBonecrusher

Ok, found the solution...

3132333435363738393000000000000000000000

Rest is simple

Still cant find in this bios file encrypted password. Some one can show where is lockated this encrypted password ?

[RethoricalCheese]

Open with uefitool. Open search, write AMITSESetup. You will get maybe 10 of those. Usually only 1 or 2 of them have content.

[KingBonecrusher]

Check the AMITseSetup variable body with UEFITool, there is:

00000000000000000000000000000000
00000000000000000000000000000000
00000000000000006A93842622BA584D
F2E014744A07E09A0A2EBEC1E95444E8
9F7BFA0E55A2B0350BC9665CC1EF1C83
01

You need only:

6A93842622BA584D
F2E014744A07E09A0A2EBEC1E95444E8
9F7BFA0E55A2B0350BC9665CC1EF1C83

This needs to be decrypted with the known AMI XOR Key...

[keczuk]

Originally Posted by KingBonecrusher

Check the AMITseSetup variable body with UEFITool, there is:

00000000000000000000000000000000
00000000000000000000000000000000
00000000000000006A93842622BA584D
F2E014744A07E09A0A2EBEC1E95444E8
9F7BFA0E55A2B0350BC9665CC1EF1C83
01

You need only:

6A93842622BA584D
F2E014744A07E09A0A2EBEC1E95444E8
9F7BFA0E55A2B0350BC9665CC1EF1C83

This needs to be decrypted with the known AMI XOR Key...

https://md5decrypt.net/Xor/

This site working for decrypt ??

[keczuk]

no one help ?