Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
I'm thinking Intel Management Engine. I have not tried booting it with that jumper in the alternate position yet.
From @rachet06 dump "A@4MA1" EDIT: "AK4MA1"
1A 93 FD 26 25 BA 21 4D 86 E0 13 74 7D 07 D8 9A
^ XOR
5B 93 B6 26 11 BA 6C 4D C7 E0 22 74 7D 07 D8 9A
=
41 00 4B 00 34 00 4D 00 41 00 31 00 00 00 00 00
PS. I don't own the the MB I just thought this was a fun challenge but I would love to tinker with 1
1A 93 FD 26 25 BA 21 4D 86 E0 13 74 7D 07 D8 9A
^ XOR
5B 93 B6 26 11 BA 6C 4D C7 E0 22 74 7D 07 D8 9A
=
41 00 4B 00 34 00 4D 00 41 00 31 00 00 00 00 00
PS. I don't own the the MB I just thought this was a fun challenge but I would love to tinker with 1
Last edited:
@up-n-atom Thanks for this, however it doesnt work on my board. Maybe different on my board. How does one look for the string so I can compare if I have the same?
thanks!
thanks!
From @rachet06 dump "A@4MA1"
1A 93 FD 26 25 BA 21 4D 86 E0 13 74 7D 07 D8 9A
^ XOR
5B 93 B6 26 11 BA 6C 4D C7 E0 22 74 7D 07 D8 9A
=
41 00 40 00 34 00 4D 00 41 00 31 00 00 00 00 00
PS. I don't own the the MB I just thought this was a fun challenge but I would love to tinker with 1
And would this work on a AMI Flash dump or do I need a USB flash programmer to get the flash dump?
thanks
thanks
From @rachet06 dump "A@4MA1"
1A 93 FD 26 25 BA 21 4D 86 E0 13 74 7D 07 D8 9A
^ XOR
5B 93 B6 26 11 BA 6C 4D C7 E0 22 74 7D 07 D8 9A
=
41 00 40 00 34 00 4D 00 41 00 31 00 00 00 00 00
PS. I don't own the the MB I just thought this was a fun challenge but I would love to tinker with 1
It's also not working on my board currently
Thanks for the puzzle solving! unfortunately it also did not work for me. I do not doubt that string is "something" but it is not the droid we're looking for at this moment. I also tried the character map here which translates one of the characters as a <PG><DWN> so I think you used the right map.
@zjr8 dump does not contain the said encoded text. So I'm uncertain if they just missed checking options when dumping or not.
It's plain text so just Ascii Table - ASCII character codes and html, octal, hex and decimal chart conversion Just to make certain it's without the quotes and that's a one (1) at the end.
@up-n-atom, looks like you had a typo in your XOR. The password is "AK4MA1"
Ah yes, I definitely miss inputed the hex FD ^ B6 = 4B = K
Sorry for screwing that up but I'm glad it all worked out
The thing that really interests me is the two epoxy blobsright above the Artix FPGA.
One of them seems to be labeled "BU8_<something>", the other either isn't labelled or the epoxy is covering the label.
I can't think of any reason there'd be a directly bonded IC on a motherboard like this. I wonder if it actually covers a normal IC and is a security thing. That would also maybe indicate the FPGA is doing some sort of operation which requires protected key material (encryption?).
Looking at the traces, I don't see any clear connections between the FPGA and anything else. Any chance we can get a pictures of the back of the board too?
------
The mezzanine connectors are weird too. Just following a few of their pins makes me think they're pinned out for the standard OCP 2.0 mezzanine interface, but the headers are *backwards*. The connectors would be pointed towards the CPUs if you install mezz card that fits the OCP standard.
One of them seems to be labeled "BU8_<something>", the other either isn't labelled or the epoxy is covering the label.
I can't think of any reason there'd be a directly bonded IC on a motherboard like this. I wonder if it actually covers a normal IC and is a security thing. That would also maybe indicate the FPGA is doing some sort of operation which requires protected key material (encryption?).
Looking at the traces, I don't see any clear connections between the FPGA and anything else. Any chance we can get a pictures of the back of the board too?
------
The mezzanine connectors are weird too. Just following a few of their pins makes me think they're pinned out for the standard OCP 2.0 mezzanine interface, but the headers are *backwards*. The connectors would be pointed towards the CPUs if you install mezz card that fits the OCP standard.
Last edited:
Great job! I was waiting for a full chip dump, but you beat me at thisFrom @rachet06 dump"A@4MA1"EDIT: "AK4MA1"
1A 93 FD 26 25 BA 21 4D 86 E0 13 74 7D 07 D8 9A
^ XOR
5B 93 B6 26 11 BA 6C 4D C7 E0 22 74 7D 07 D8 9A
=
41 00 4B 00 34 00 4D 00 41 00 31 00 00 00 00 00
PS. I don't own the the MB I just thought this was a fun challenge but I would love to tinker with 1
EDIT: Now it's time to figure out how to remove the password
EDIT2: I think password could be removed by simply changing it, now that we can access the bios. Or we can flash the bios back with the password section zeroed out and see if it does the trick.
Last edited: