VOGONS


First post, by jdmcs

User metadata
Rank Newbie
Rank
Newbie

TL;DR I'm hoping someone here has knowledge with editing Quadtel BIOSes to bypass the password checks, as the BIOS for the Emerson 500EC computer has a bad implementation of passwords.

I bought a vintage 286 computer that talks from eBay, the place where I buy lots of things I later regret... It's a 16MHz screamer and supports a whopping 8MB of RAM (take that, whoever actually said, "no one will ever need more than 640K of memory.")

Just one problem: The original BIOS that shipped on this board has a big, nasty bug that makes the computer next to useless.

Quadtel BIOS Menu.png
Filename
Quadtel BIOS Menu.png
File size
174.91 KiB
Views
365 views
File comment
Quadtel BIOS 3.05.09 Menu on Emerson 500EC
File license
CC-BY-4.0

The original BIOS, version 3.05.09, has a System Security feature that allows one to set passwords and permissions for twenty users. You can prevent users from being able to access Setup, serial and parallel ports, drives, and even booting. And therein lies the bug, as apparently the BIOS depends on unknown data being pre-loaded into the DS1287 module. And, of course, the original DS1287 battery died sometime over the past 32 years, and well before I bought the computer.

Once I replaced the RTC module with a compatible replacement, I was able to get into Setup to set the initial settings. However, after saving and exiting, all successive boot attempts result in a password prompt to even boot the system.

  • I have no documentation for the system, so I do not know if there is a default password.
  • Yes, I have tried the obvious ones from BIOS password lists without success.
  • Presumably the "password" it is looking for is uninitialized RTC memory, which probably means I couldn't type it anyways.
  • You get three attempts at guessing before the system halts, requiring a press of the difficult to press reset button or a power cycle.
  • If I set passwords on that one time I can get into Setup (because the checksum was invalid), those passwords are not recognized.
  • I even tried the battery mod on the original DS1287, thinking it was an issue with not being compatible with the DS12885 or bq3285, but alas, the behavior still persists.

One of my livestream viewers pointed me to the Emerson 4412 BIOS on the Vogons Driver Library (http://www.vogonsdrivers.com/getfile.php?file … menustate=30,29), after seeing that the motherboard for that computer looks like mine. Unfortunately, that BIOS has two issues: one, it doesn't support the speech functionality, and two, version 3.05.08 are earlier of the BIOS are incompatible with Windows 3.x (https://jeffpar.github.io/kbarchive/kb/083/Q83904/) without a workaround I don't want to have to do... but yes, for now, I have that BIOS in the system so that it is at least useable.

I can't find any info on modifying BIOSes. It seems as if any information I do find assumes you're trying to do it for a modern computer. I also know that even old BIOSes were often compressed, and I am very rusty in x86 assembly.

But I don't want anyone else that happens to have a 500EC to think it's a brick, especially if they go through the trouble of replacing the RTC just to get stuck at a password prompt. This computer talks (even if just the BIOS error messages), and a 16MHz 286 can play many vintage games well. But limiting oneself to the DOS in ROM (it's barebones as all get out) and a 360k floppy disk isn't a great retro experience either...

Is there anyone up to the challenge?

Attachments

  • Filename
    Emerson 500EC 3.05.09.zip
    File size
    173.89 KiB
    Downloads
    29 downloads
    File comment
    Quadtel HT113 286 BIOS 3.05.09 for Emerson 500EC
    File license
    Fair use/fair dealing exception

I'm Justin D. Morgan, Host of Computerized Start™
If you use one of the photos I post on Vogons, I would appreciate being credited by name (Justin D. Morgan) instead of by user name. Thanks!

Reply 1 of 6, by jdmcs

User metadata
Rank Newbie
Rank
Newbie

I realized that the following screen grabs might help locate the System Security functionality in the BIOS.

The password prompt looks like this:

Screen Shot 2023-09-13 at 6.12.50 PM.png
Filename
Screen Shot 2023-09-13 at 6.12.50 PM.png
File size
92.46 KiB
Views
353 views
File comment
Password Prompt
File license
CC-BY-4.0

On the first or second unsuccessful guess, this is the message you see:

Screen Shot 2023-09-13 at 6.13.45 PM.png
Filename
Screen Shot 2023-09-13 at 6.13.45 PM.png
File size
93.4 KiB
Views
353 views
File comment
Invalid Password Error for First or Second Unsuccessful Attempt
File license
CC-BY-4.0

And on the third unsuccessful guess, the system is disabled:

Screen Shot 2023-09-13 at 6.14.57 PM.png
Filename
Screen Shot 2023-09-13 at 6.14.57 PM.png
File size
41.62 KiB
Views
353 views
File comment
System Disabled on Third Unsuccessful Attempt
File license
CC-BY-4.0

I do wonder if 01A14E means anything...

I'm Justin D. Morgan, Host of Computerized Start™
If you use one of the photos I post on Vogons, I would appreciate being credited by name (Justin D. Morgan) instead of by user name. Thanks!

Reply 2 of 6, by jdmcs

User metadata
Rank Newbie
Rank
Newbie

And for good measure, a few other screen grabs... these are from my livestream (https://youtube.com/live/C9SjoHLP-wk?feature=share), so please ignore the camera overlay in the lower righthand corner.

Here's the interface for user zero, the admin user:

Screen Shot 2023-09-13 at 6.23.55 PM.png
Filename
Screen Shot 2023-09-13 at 6.23.55 PM.png
File size
228.31 KiB
Views
349 views
File comment
User 0 Settings
File license
CC-BY-4.0

No, there is never a prompt for user number, just password. Presumably the BIOS is checking to see if the password matches any one of the 21 total, and if so, applies permissions and continues booting.

Here's the password entry prompt. Yes, I just noticed that I could have pressed F1 for help:

Screen Shot 2023-09-13 at 6.25.41 PM.png
Filename
Screen Shot 2023-09-13 at 6.25.41 PM.png
File size
141.96 KiB
Views
349 views
File comment
Enter Password Prompt
File license
CC-BY-4.0

Here's the password accepted confirmation:

Screen Shot 2023-09-13 at 6.26.08 PM.png
Filename
Screen Shot 2023-09-13 at 6.26.08 PM.png
File size
128.63 KiB
Views
349 views
File comment
Password Changes Saved
File license
CC-BY-4.0

And here's what user 1 looks like by default (users 2-20 look the same by default):

Screen Shot 2023-09-13 at 6.24.48 PM.png
Filename
Screen Shot 2023-09-13 at 6.24.48 PM.png
File size
237.43 KiB
Views
349 views
File comment
User 1 Settings
File license
CC-BY-4.0

I'm Justin D. Morgan, Host of Computerized Start™
If you use one of the photos I post on Vogons, I would appreciate being credited by name (Justin D. Morgan) instead of by user name. Thanks!

Reply 3 of 6, by jakethompson1

User metadata
Rank Oldbie
Rank
Oldbie

I think you can suppress the security system with these changes.

odd, offset 0x1BE06, change 0x00 to 0x01
odd, offset 0x1D106, change 0x1A to 0x90
even,offset 0x1D106, change 0x75 to 0x90
even,offset 0x1D113, change 0x74 to 0xEB

Reply 4 of 6, by jdmcs

User metadata
Rank Newbie
Rank
Newbie
jakethompson1 wrote on 2023-09-14, 14:10:
I think you can suppress the security system with these changes. […]
Show full quote

I think you can suppress the security system with these changes.

odd, offset 0x1BE06, change 0x00 to 0x01
odd, offset 0x1D106, change 0x1A to 0x90
even,offset 0x1D106, change 0x75 to 0x90
even,offset 0x1D113, change 0x74 to 0xEB

The good news is that did suppress the security system. The bad news is that is also suppresses the speech functionality...

I have, however, determined where the passwords (or potentially their hashes) are located: they appear to be stored in an NMC9346N chip on the board. I'm probably fighting the passwords the previous owner set.

When I removed this chip from the motherboard and reinstall the original BIOS, with the NMC9346N removed, I get a security system failure on every boot.

I'm Justin D. Morgan, Host of Computerized Start™
If you use one of the photos I post on Vogons, I would appreciate being credited by name (Justin D. Morgan) instead of by user name. Thanks!

Reply 5 of 6, by Overkill

User metadata
Rank Newbie
Rank
Newbie

Jdmcs, I have a 500EC as well. I think I figured out what was going on with your Compact Flash cards and hard drive in the video from a month ago. Every other byte read or written to the drive is mirrored. Most likely a case of a design error when they routed the IDE connector. It appears that the bits 8-15 on the IDE connection flipped. The end result is that any data written to the IDE drive on another PC would not be readable by this machine. I need to ohm this out to be sure, but if I'm right, an adaptor would solve the issue. Flipping there pins 4 & 18, 6 & 16, 8 & 14, 10 & 12 should fix it. Once I've confirmed that it's the issue, I'll throw together a PCB

Reply 6 of 6, by Overkill

User metadata
Rank Newbie
Rank
Newbie

@jdmcs Yeah. The data lines on bits 8-15 are flipped alright. It only works at all because the IDE commands are all only 8 bits longs. Also, FYI, you will need the Int 5C patch in order to install Windows 3.1. I know Microsoft's KB article says you only need it for older bios versions, but you still need it for this guy for some reason.