I used a hole punch device to cut the foam just where the screws are. That ends up looking quite decent.Is there a non-destructive way to remove the foam to get to the screws? My efforts so far have not been successful
$20 mini PC (Dolby controller) with unknown firmware password
- Thread starter ru me
- Start date
Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
read BIOS( SPI programmer ), modify and reflash required without knowing the password.
I ordered a unit because I was intrigued about the tools and methods attempted to get into this securely locked system.
Once I received the item I had to reread the thread a couple of times to extract the relevant bits. Initially, I thought just flashing the modified BIOS (as posted) would be sufficient, but this locked up the hardware completely. So, to make things easier for anyone interested in making this hw useful for general purpose use:
1. Get a ch341a programmer. They're available online for a couple of bucks, Amazon delivers quickly for about $10-15.
2. Learn how to use it. I found this webpage very helpful with video and instructions both for Windows and Linux.
3. Open the device and find the flash chip on the back of the mobo.
4. Make a backup of the original content. Make a second one and compare them using crc or another hash function. Only now can you be sure that you have a reliable copy.
5. Find a recent copy of UEFITool_NE. Open your backup and search for "AMITSESetup" to find the encrypted password of the admin account.
6. Use your favorite Hex editor (suggested in the thread and used by me is HxD) to search for all instances of the encrypted password and overwrite it with zeros ("0") to remove password and enable access to UEFI. Save.
7. Find a copy of AMIBCP (I found version 5.02.0031) and open the saved file from the last step and find the "Attempt Secure Boot" BIOS setting as shown in post#74. Modify to disabled and save.
8. Use programmer to write saved changes back to device. Re-read the just written BIOS and verify the CRC with the saved file to make sure the writing was successful.
9. On boot enter UEFI by pressing Delete key on keyboard. Gotta be quick, the device boots rather quickly. I suggest modifying boot order to boot installer or OS of your choice.
Fwiw, I gave up on my hashcat attempts. I got halfway through 9 characters, but only have a single A6000 available, so it would have taken another few weeks just to get through 9 characters.
Also, just a PSA: AMIBCP is a commercial tool. There isn't an official way to freely download it, and all the unofficial sources I have seen don't look super trustworthy. If you do download it, I would run it in a temporary VM, or burn your Windows installation after using it.
Also, just a PSA: AMIBCP is a commercial tool. There isn't an official way to freely download it, and all the unofficial sources I have seen don't look super trustworthy. If you do download it, I would run it in a temporary VM, or burn your Windows installation after using it.
Sharing some info I gathered.
I installed Fedora 41. Works nicely out of the box (considering the hw limitations). I find web browsing, even youtube, not painful on 4k screen. This dual core 6th gen CPU system clearly is not as snappy as any recent hw.
Device idles around 10-11W. powertop reports that package doesn't go below C3. autotune doesn't help a lot, but causes keyboard and mouse to sleep. Pain in the rear - not doing that again.
I find that the UEFI turns off ASPM on one slot. Enabling doesn't make a difference (aehm - I think the wifi function disappears - bluetooth still works. But I don't plan on using wifi anyhow).
Considering a use as pfsense appliance. Removing capture and wifi cards. Now package power reaches C6 at idle ~7.8W.
Adding a Samsung PM991 to the empty m.2 slot. Well, I'm not really succeeding because some bonehead tightened the m.2 screw so hard that I stripped it trying to remove it. Also, something's wrong with the m.2 slot. The nvme tests as 1.6GB read and only 50MB write speeds (tried two different nvmes). Adds about 0.5W at idle.
For some reason neither pfsense nor proxmox iso's boot from my ventoy (sigh). So, more stuff to figure out over the weekend...
I installed Fedora 41. Works nicely out of the box (considering the hw limitations). I find web browsing, even youtube, not painful on 4k screen. This dual core 6th gen CPU system clearly is not as snappy as any recent hw.
Device idles around 10-11W. powertop reports that package doesn't go below C3. autotune doesn't help a lot, but causes keyboard and mouse to sleep. Pain in the rear - not doing that again.
I find that the UEFI turns off ASPM on one slot. Enabling doesn't make a difference (aehm - I think the wifi function disappears - bluetooth still works. But I don't plan on using wifi anyhow).
Considering a use as pfsense appliance. Removing capture and wifi cards. Now package power reaches C6 at idle ~7.8W.
Adding a Samsung PM991 to the empty m.2 slot. Well, I'm not really succeeding because some bonehead tightened the m.2 screw so hard that I stripped it trying to remove it. Also, something's wrong with the m.2 slot. The nvme tests as 1.6GB read and only 50MB write speeds (tried two different nvmes). Adds about 0.5W at idle.
For some reason neither pfsense nor proxmox iso's boot from my ventoy (sigh). So, more stuff to figure out over the weekend...
You could try not sure if you have the latest Ventoy they have problems sometimes the older version with proxmox but seems fixed for us.
pfsense not sure if it works on ventoy or needs to be directly on the usb.
Just FYI, it seems to boot fine with 12V. Did not do any extended tests. No idea how 12V vs 19V might affect power consumption. Even POE seems to work.
Added a small NVMe and mine is now running Proxmox reliably.
It turns out the device has a surprise for all of us trying to run it headless: the device suspends within minutes if no HDMI is connected. Luckily, I had a spare port on my PiKVM...
Now that you've all figured out how to build a cluster of these, there's probably none left on ebay lol ;-)
hmm, I haven't had the suspend problem. had it running Ubuntu headless server, in case that matters.
Unfortunately, no. I had a copy of the EC, rewrote the original but it didnt work.
if i read the EC BIOS and compare the data, it is always not same. i guess it is not safe to read/flash in circuit(on some boards)
i can read both chips, but the result was different each time( 3.3V ch341a didn't work, had to use unmodifed version)
looks to me i got other version of the device.
For me the result was different every time on Windows (read). Switching to Linux made the read results consistent.
Maybe the chip is not fully supported by your Windows software?
1000% supported. and the same config worked/works with other boards.
after erasing the BIOS chip is seems the data is intact first, but after some time...obviously the USB programmer powers up the SoC and or EC.
I dumped the EMMC image: dolby_emmc.img.xz
It is 8GB but it looks only the first 4GB is used.
Code:
Disk /dev/mmcblk0: 7.28 GiB, 7820083200 bytes, 15273600 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 70482433-ED5B-4D56-9F17-D93C7E0B8921
Device Start End Sectors Size Type
/dev/mmcblk0p1 2048 63487 61440 30M Microsoft basic data
/dev/mmcblk0p2 63488 96255 32768 16M Microsoft basic data
/dev/mmcblk0p3 96256 2193407 2097152 1G Linux filesystem
/dev/mmcblk0p4 2193408 2226175 32768 16M Microsoft basic data
/dev/mmcblk0p5 2226176 4323327 2097152 1G Microsoft basic data
/dev/mmcblk0p6 4323328 4585471 262144 128M Microsoft basic data
/dev/mmcblk0p7 4585472 6682623 2097152 1G Microsoft basic data