Use this tool: AMITSESetup Decryptor & Unlocker | Alien Server
Greetings everyone,
a thread started here, Bostjan … about time to chime in, as - first of all - I do feel pretty bad for not responding to your bump, Jay, and second, as it feels good to see this thread is not yet buried under the sand of time.
I pretty much threw in a towel, after ‘lfb6’ chimed in for the last time and announced resignation from further efforts (if he was out of ideas, then what on earth were my odds…). Pleased as I was for trying at least, I also felt utterly lost in the jungle of BIOS+NVRAM related knowledge, that was admittedly completely out of my league.
Fast forward - “AMITSESetup Decryptor and Unlocker” online utility, provided by ‘Hackeraj’, truly sparked a renewed hope. I did try it both ways - uploading the .bin file and commencing decrypting right away, as well as unlocking first and then decrypting. Neither method produced a fireworks, as I always get the same result in the text output …
Chunk 1:
Boot Password not available or could not be extracted.
Admin Password not available or could not be extracted.
So at least for me, it’s still no go …
BTW - I’m still trying out the “AMITSESetup Decryptor and Unlocker” every now and then, not because I’d be hoping for a miracle, but just to keep an eye on any potential news and developments. Half of the time I’m trying to load the web page with Hackeraj’s AMTSISetup tool on Allien Server, I get the following error …
“Error 1033 - Argo Tunnel Error” (see details in the screenshot below).
Kind regards,
Bostjan
Greetings ‘lfb6’,
I’m not sure how I missed these perfectly clear instructions of yours, but hey, I guess it’s never too late (time will tell though…). I just flashed an empty Winbond 25Q64FVSIG, with firmware image you uploaded for me, after you cleared its NVARM (“CAPB-2051_Lancom_R&S_NVRAM.zip”), but halfway as programmer was doing its job, I remembered that it won’t work … that image you cleared NRAM of, was a custom modified R&S Lancom firmware with console redirection disabled. What I’d require would be the factory default Caswell firmware image with cleared NVRAM (original Caswell firmware is in attachment - “CAPB-2051-4801-G10-R154.zip”), to have a go with flashing the cleared firmware onto Winbond chip and see how it goes.
I’m not hoping too much that you will even read this, let alone respond to this message, but hope dies last …
Kind regards,
Bostjan
CAPB-2051-4801-G10-R154.zip (2.5 MB)
A stock bios has by definition a clean / empty NVRAM- there’s nothing to empty or clean.
Thank you kindly,
that’s a bummer then, as there’s definitely a BIOS admin password set (I can invoke login screen on boot/reboot with key, when I put in there a BIOS chip flashed with Caswell’s provided image … has the console redirection enabled by default).
Just out of spite, to really try everything I’m (sort of) up to task with my knowledge, I tried the recipe of this guy, who managed to clear the admin password on Wintel Box CX-W8 mini PC …
Article: “Resetting the BIOS Admin Password on CloudGate Square/Sunchip CX-W8”
Yes I know, completely different board, and consumer grade on top of that (less security measures as Rohde & Schwarz / Caswell implemented), but nevertheless. I was actually able to find two instances of GUID variables under NVRAM section - “SecureBootSetup” and “Intel ME”, but I had no idea which one to try out with hex editor, and I had absolutely no idea where to write those zeros, once I extracted the files (one for each of those Variable GUIDs) with “Extract body” in UEFITool NE.
My crusade continues, for having fun if nothing else. Thank you once more, to find the time to chime in 
Bostjan
Due to the internet problem showing like this. If not working then try after sometimes try Again. It will be Working.
For More Details about Alien Server: GitHub - HackerajOfficial/Alien-Server: Alien Server is World Largest LCD/LED BIOS, EC BIOS, Main BIOS, Onboard RAM Disable BIOS, Schematic Diagram, Boardview, Repair Guide, Onboard RAM Disable, Datasheet, and Software Collections.
Related Tutorial: https://www.youtube.com/watch?v=foQpgeDwkiU
Thanks ‘Hackeraj’, I figured this out in the meantime. I wish I was one of those, who could triumph with your tool …
Bostjan
Hey ‘lfb6’.
for what it’s worth … I remembered I could use the internal COM header (COM1), as that’s the one that Rohde & Schwarz apparently enabled in BIOS for serial console redirection (as opposed to Caswell default - COM0: Enabled, COM1: Disabled). With Lancom R&S firmware (with cleared NVRAM) I was able to access BIOS Settings (hitting “TAB” key), but I was immediately stopped with BIOS password popup, as I was pretty much expecting (see screenshot attached).
Oh well … at least I tried, or should I say - you tried
Bostjan
