VOGONS


First post, by ajacocks

User metadata
Rank Member
Rank
Member

I just got a rather interesting low-profile 386SX/20 desktop from Zenith called the Z-LS/20. It’s a slim chassis with only a single 3.5” floppy drive, mounted facing right, rather like a SPARCstation 1, 1+, 2, or 10. When I received it, there was significant corrosion on the mounting tabs for the power supply, which turned out to be from long-remaining electrolyte from some leaked capacitors. I cleaned that up, scrubbed the PCB, and replaced the caps, and miracle-of-miracles, it actually worked.

The machine’s onboard VGA creates a sync signal, but I get nothing onscreen, so that needs to be troubleshot. However, with an accessory video card, I can see that the machine powers up and posts, and wants to have its CMOS options set. There is a BIOS password preventing that, though.

Normally, I’d use one of the DOS-based BIOS hacking tools to get the password, but I can’t set a boot device, and there is no option to skip the password. I also can’t find a reset jumper or set of pads, on the motherboard. It’s also interesting to me that there is a password at all, as the CMOS battery was 100% dead, when I received it. I assume that it must be a manufacturer-supplied default password.

I have already tried all of the passwords that I found on the various known BIOS password lists that I have found.

Any advice would be much appreciated.

Thanks!
- Alex

Reply 2 of 9, by Horun

User metadata
Rank l33t++
Rank
l33t++

Good thought jakethompson1 ! Reminds me: Some one else a year or so ago had a old board and it was set to always ask even if no password was ever set. Ended up a corrupt BIOS iirc..

Hate posting a reply and then have to edit it because it made no sense 😁 First computer was an IBM 3270 workstation with CGA monitor. Stuff: https://archive.org/details/@horun

Reply 3 of 9, by ajacocks

User metadata
Rank Member
Rank
Member

I finally managed to dump the BIOS for this machine. I'm not sure why I didn't get notified of your response @jakethompson.

I uploaded it to archive.org:
https://archive.org/details/zenith-z-ls-20-bios

And, attached it here, as well.

Thanks!
- Alex

Attachments

Reply 4 of 9, by ajacocks

User metadata
Rank Member
Rank
Member

Here's what the board looks like:

IMG_0066.jpeg
Filename
IMG_0066.jpeg
File size
679.16 KiB
Views
537 views
File license
CC-BY-4.0
IMG_0062.jpeg
Filename
IMG_0062.jpeg
File size
1.04 MiB
Views
537 views
File license
CC-BY-4.0
IMG_0065.jpeg
Filename
IMG_0065.jpeg
File size
1.75 MiB
Views
537 views
File license
CC-BY-4.0

- Alex

Reply 6 of 9, by jakethompson1

User metadata
Rank Oldbie
Rank
Oldbie
Predator99 wrote on 2023-03-01, 15:56:

Can you also post a Screenshot of the Password query please?

Do you have a POST card? Which Code does it show when the Password is requested?

Hello, Predator99. I was taking a look at this and talking to ajacocks. The "get password" function is F000:5989 and I'm having trouble determining how it validates the password as it doesn't seem to actually validate anything, but just accepts the password if certain unusual scan codes (0xFF or 0xFD) are received. The function that seems to determine whether or not to even prompt for a password (F000:5900) is also hard to follow and seems determined by values pulled from the KBC and keyboard rather than anything in the CMOS RAM.

Reply 7 of 9, by Predator99

User metadata
Rank l33t
Rank
l33t

Ok thanks for Information! Didnt take a look At the dump so far.

I would not try to crack the Password.

I would patch out the whole query and write back the modified BIOS.

Will need a Programmer of course.

Reply 8 of 9, by jakethompson1

User metadata
Rank Oldbie
Rank
Oldbie
Predator99 wrote on 2023-03-01, 16:33:
Ok thanks for Information! Didnt take a look At the dump so far. […]
Show full quote

Ok thanks for Information! Didnt take a look At the dump so far.

I would not try to crack the Password.

I would patch out the whole query and write back the modified BIOS.

Will need a Programmer of course.

The password was bypassed with:

1B833: 75 -> 90
1B834: 04 -> 90 (bypass ROM checksum)

15A17: 50 -> CB
15B16: 50 -> C3 (eliminate password check)

It's still unclear what causes the password prompt to be triggered in the first place, and even more unclear what determines a valid vs. invalid password.