Hacking IBM Thinkpad Bios Password
Loading ...
Loading ...
Lost your IBM ThinkPad Supervisor password? No problem, on this page i will show you how to recover your old password.
Although IBM claims their TP BIOS passwords are impossible to break, there is a easy and cheap way to fix this.
The stuff you need cost about 5 $ at your closest radio shack type of store. Also you need a spare PC with a serial port.
This article is based on a IBM ThinkPad T42. There are no guarantees and you might end up destroying your TP. So continue at your own risk. Other models this ought to work with are:
- 240, 240x
- 390E, 390x
- 570, 570E
- 600e, 600X
- 770Z
- A20m, A21e, A21m, a22m, A30p, A31, A31p
- G40, G41
- R30, R31, R32, R40, R50, R51
- Transnote, T20, T21, T22, T30, T40, T40p, T41, T42, T42p
- X20, X21, X22, X23, X24, X30, X31, X40, X41
The supervisor (SVP) password is stored in a chip called ATMEL 24RF08.It can not be reset by disconnecting the BIOS battery or shorting any jumper. It has to be read in order to deciffer the password. For this we need some kind of hardware so read on…
Soldering the ATMEL 24RF08 Chip reader
To read this chip we need to interface with it using a secondary computer and some simple electronics. You will need to purchase this:
- 2 x 2200 Ohm Resistors
- 2 x C5V1 Zener diodes (For example BZX55/C5V1 )
- Serial Port 9 pin Female
The serial port can be salvaged from any old PS2 type mouse. The zeners and resistors can be found in scrap electronics, but they are rather cheap so i would not bother. Solder them according to the image below. Leave the wires leading to SDA , SCL and GND. These will be connected to the TP later.
Here is a simplified schematic for those unfamilliar with the above symbols:
Locating the ATMEL chip
Usually the ATMEL chip is located somewhere below the touchpad. Start off by remving the keyboard and mousepad. This is done by unscrewing a couple of screws located under the TP. It is quite clearly illustrated on the bottom side of your ThinkPad.
Pull the TP keyboard up and let it rest against the screen. Pry off the touchpad part and fold it over where the keyboard used to be. Remove the WiFi card.
Under it all you should find a chip with something like this printed:
ATMEL
24RFC8
0446
Heres a closeup of the Atmel chip. Click to enlarge.
You can see the Atmel right under were the Wifi card used to sit:
Soldering the ThinkPad
Now this is the tricky part. You will have to solder 3 wires to the motherboard of your TP. Two wires to the ATMEL chip and one to ground. The ground is a piece of cake, just solder it anywhere you can find ground. The mounting screw holes on the motherboard is a good place. Solder 3 wires according to the image below:
As you can see, the SCL and SDA are located right next to eachother. It can be difficult to hold them in place while soldering. I have used some tape to hold them in place. The tape can be left there to minimze the risk of pulling off the soldered wires during the next steps.
Leave these wires unconnected and make them ready by peeling off the insulation. These will be connected to the reader ciruit later on. Make sure they can not reach ground or short circuit in any way.
Preparing the spare PC
You have made the hardware to read the chip, so now you need to supply the software. There is this great sofware made by http://www.allservice.ro/ that can be found here:
http://home.ripway.com/2005-7/365678/index.htm - Select R24RF08 v2.0b - Reader for ATMEL 24RF08 (Freeware)
While you are at it, download the Supervisor Password decoder IBM Pass 2.0 Lite found here:
http://home.ripway.com/2005-7/365678/index.htm
Also great software made available by http://www.allservice.ro/ .
Note:
Softpedix wrote that the download mirror has limited bandwidth. If you can’t download with the above, try these:
http://www.allservice.ro/forum/viewtopic.php?t=61 – Programmer
http://www.allservice.ro/forum/viewtopic.php?t=56 – IBMpass Lite
Install the software.
Connect the ATMEL chip reader to the spare PC.
Fire up a command promt(Start->run type cmd) and navigate to the folder where you installed R24RF08 v2.0b. Type in (don’t hit Enter):
r24rf08 dump.bin
Dumping the password
- Turn on your ThinkPad with all the wiring you just soldered.
- Press F1 during the startup to enter the BIOS.
- Wait untill all activity stops, blinking HDD leds and such.
- Connect the ATMEL Chip reader. GND first then the SDA and SCL.
- Now go to your spare PC and Hit enter on the command prompt.
Now there should be a file created in the same folder with the name dump.bin. Disconnect all the wiring off your TP and assemble it back together.
Decoding the Supervisor Password
On your Spare PC start the program IBM Pass 2.0 Lite. Load the file you just created (dump.bin). Navigate with the scroll list to the memory address of 0×330. Tada! It should look something like this:
Tuesday, October 10th 2006 at 6:44 pm
Very well written. I would only mention that the download mirror has limited bandwith. The following links are from the www.allservice.ro:
http://www.allservice.ro/forum/viewtopic.php?t=61 –programmer
http://www.allservice.ro/forum/viewtopic.php?t=56 –IBMpass Lite
Tuesday, October 10th 2006 at 9:15 pm
Hacking IBM Thinkpad Bios Password…
This dude solderes some wires to the laptop to retrieve a password stored in a chip….
Tuesday, October 10th 2006 at 9:55 pm
Wish there were a way for the T60p
Wednesday, October 11th 2006 at 12:34 am
“Wish there were a way for the T60p ”
Have you checked what kind of chips there are on the motherboard?
Friday, October 13th 2006 at 6:32 am
There is a solution for T60! Didn’t you see the download page?
It points to this:
http://www.serviceforum.lx.ro/viewtopic.php?p=1061#1061
Monday, October 16th 2006 at 6:55 pm
I was really happy when I found your page about hacking ibm-bios password. But when I start doing this, I found hard to recognize this ATMEL, 24RFC8, 0446!! Is atmel on the top of the cpu? Cause there is writen TPC8002, 2C as on many other chips!! and not 24RFC8!! but it has 8 leads! Please help me! Have a nice day, Jernej
Tuesday, October 17th 2006 at 12:34 am
Jernej, you need to find a chip has written Atmel , 24RFC8 written on it. Check above, ive added a couple more images with closeups.
The atmel is located under the CPU looking chip.
Wednesday, October 18th 2006 at 12:28 am
I am doing this for my R40, i found that the amtel chip is actually underneath the motherbaord, between the hard drive and the bottom of the motherboard. i had to completely dissasemble my TP as far as i could go to get at it.
ill let you know how it goes.
Wednesday, October 18th 2006 at 1:21 pm
Tim, maybe you could post a pic of the location of the chip? Then i could include it in the post so others can find it.
Friday, October 20th 2006 at 1:59 pm
Digg this story at digg:
http://digg.com/security/Hacking_ibm_thinkpad_bios_password
Saturday, October 28th 2006 at 4:53 pm
Hi there is realy good what you did, i start doing but get to a stage were i found the the eprom is difrent the only atmel the board got is 16contacts not 8. and the numbers on it are ATMEL / 24RF08CT / 9952. Do you know in what contacts shoud i weld the wires, do the software work the same way??????
Thanks
Nuno
Monday, October 30th 2006 at 12:43 am
Hi Nuno!
Are you sure your 24RF08 has got 16 pins? There is one with 14 pins. however, allservice has got this schematic for the wiring.
Also, what model is your TP?
Thursday, November 2nd 2006 at 8:50 am
I searched for the Atmel chip on the MB of a TP A21m. Found a 14 pin chip underneath the MB near the memory slots. Again, had to disassemble the whole thing to get at it so I guess I’ll have to run the wires out of the case to get it running again. I hope this is the one I need. It is marked ATMEL F 24RF08CT 0042. I will try using the diagram from allservice and hope that I get the right pins connected. I did take a couple of photos showing the chip and it’s location but I’m not sure how to post them.
Saturday, November 4th 2006 at 1:05 pm
hey.
is there any way that I can read the bios password, while im in windows??
i want to update my bios but it requires password, and I dont remeber it?
By the way, its a ibm r51 i’m talking about.
Sunday, November 5th 2006 at 1:48 pm
Hi, i have an old tp570, but not the supervisor password.
i have found the chips Atmel (8 pins like the T42) near the bottom-left corner.
I was done all step by step, and now i have my 1024kb dump.
But the password don’t appear at the address 0×0330. Only Null bytes.
Any help, please ?
PS great this page, thanks.
Sunday, November 5th 2006 at 4:47 pm
According to allservice.ro, The SVP is not set. You have to reset only the power on password, by removing the RTC battery.
Sunday, November 5th 2006 at 10:02 pm
>> Hi, i have an old tp570, but not the supervisor password.
>> I have found the chips Atmel (8 pins like the T42) near the bottom-left corner.
>> I was done all step by step, and now i have my 1024 bytes dump.
>> But the password don’t appear at the address 0×0330. Only Null bytes.
Using IBMpass’s DOS version, the password appear ! Thanks !
Note the password is store with Qwerty english keyboard character set.
Great thanks !
Monday, November 6th 2006 at 11:40 am
Thankyou very much for all of this.
I have an A22M with CRC ERROR (lovly message) because I loose all the information in the eeprom
so it will be great if you find for me the .bin file for the 24rf08 from any ather A22M laptop
even with wrong information .
sorry for my bad English
GREAT THANKS .
Monday, November 6th 2006 at 4:41 pm
I haven’t seen another post in reference to the T21 model, so I guess I’m the first in to try finding the elusive chip. I’m thinking mine must be bottom side like the R40, since I have a complete view of the top with no luck finding it yet.
Anyone else with a T21 done this yet?
Joe
Tuesday, November 7th 2006 at 3:31 am
To everyone following this post!
If you manage to find the ATMEL chip on your TP please email me with pictures of the location so i can put them here for others!
Mail me with your TP Model and a picture with the chip circled in.
Also i would like one original pic(without the chip circled in)!
Mail me at pekka ( atsign ) brevk (dot) org .
Thank you!
Tuesday, November 7th 2006 at 7:23 pm
Way too easy on a T21.
So much for “security”…
Wednesday, November 8th 2006 at 3:28 am
can someone please send me a picture of the actual wiring of the diodes and resistors and how they are grounded (i am not very good in this kind of stuff.. especially reading a schemetics)
thank you
Thursday, November 9th 2006 at 1:21 am
hello there.i built the system. i fould out that the simbol on my screen is a little computer and the command prompt says “Eeprom not available”
can somebody tell me how to get this thing going.
Thursday, November 9th 2006 at 4:36 am
hi all.. can some one tell me if the sketch of the 9 pin female is the back or the front that we see. and also where do you solder the ground.
thank you
Thursday, November 9th 2006 at 8:54 am
The wiring is(DB9 / Technican PC side):
5 - GND
The ground on the ThinkPad side can usually be just about anywhere. For example one of the mounting screw holes.
Thursday, November 9th 2006 at 5:09 pm
Hi, I have a Thinkpad Tp42p and my son put in a password which I forgot. I did all the procedures, and yes I managed to download the dump file, but, on line 330 does not reaveal my password. Please help
Thursday, November 9th 2006 at 6:48 pm
Hello.
I have read this over and over and i still can’t find where you have to ground the Zener diodes and serial port.
The one in the portable is clear.
The ground of the serial port is going on ground of the extra pc ore also to the portabel ?
Thursday, November 9th 2006 at 7:02 pm
Ground is common on the Thinkpad AND the technican PC
Just wire all grounds together:
Ground on the Technican PC DB9 is pin 5.
Ground on the ThinkPad can be any of the mounting screw holes (or pin 4 on 24rf08 with 8 leads / pin 6 on 24rf08 with 14 leads)
Ground on the diodes should be wired to Ground on the DB9 and Thinkpad ground.
DO NOT ATTACH IF NOT GROUNDED PROPERLY!
Thursday, November 9th 2006 at 10:08 pm
Fiezel:
I’m at work and using the T21 I unlocked, so I don’t havce access to the IBMPass program.
I had the same thing happen to me, but I fould that there was a button on the left just above the data from the .bin file that said “somethinorother” OFF. Clicking it got rid of the heiroglyphics and the rows of periods after the memory dump lines. It also magically made the password “Q21WSD” appear following line 0×330.
I hope this helps.
Joe
Thursday, November 9th 2006 at 10:45 pm
Is there any way you could provide more pictures of how the wiring setup is done? I’ve been through electronics classes but it’s been a while, and i just want to make sure i get this right. If you could provide any more information on this i would greatly appreciate it. Thanks.
Friday, November 10th 2006 at 12:03 am
hi all.. Can someone PLEASE help me.. I have taken my TP T21 apart and CANNOT find the Atmel chip can someone tell me where it coul be?
Thank you
Friday, November 10th 2006 at 2:45 pm
Frank:
Put your T21 back together. Turn it over. Remove the RAM access door. Viola! a 14 pin AMTEL chip conveniently hidden under RAM slot 1(closest to the outer edge of the laptop).
ADMIN:
What are the possibilities of setting up different “folders” for specific models? I’m willing to help if I can.
Joe
Friday, November 10th 2006 at 4:06 pm
Joe, i have mailed you.
Sunday, November 12th 2006 at 4:45 am
Here goes some addition information on how to do this! or even buy the reader from this person. Here goes the website: www.passwordmethod.com
Sunday, November 12th 2006 at 1:02 pm
Thank you verry verry much.
Thinkpad is up and running again.
Monday, November 13th 2006 at 6:26 am
hello admin.
this is the great thing you guys are doing and i really appreciate it. As my request for bios password for my Ibm TP 40 is been knocked back by IBM saying that it is impossible to recover the passwor and the only option i am left with is either buy another m/b from them that itself is the cost of laptop or dump it in the rubbish bin. but i refused to both the offers. so while surfing i accidently found your site through google. its pretty explanatory on how to do the wiring and other stuff.
anyway my question is regarding the ATMEL chip thats found under the WiFi card. i have done it all dissemble the laptop as i have gone thro this procedure before few times. i did find the chip as shown in the diagram with all the circuits and numbers whatever shown in the photo in the website. but only problem is that its number is different than written above. its written as ATMEL 24RF08 and some other numbers instead of ATMEL 24RFC8 0446. Still got the 8 pins as shown in the diagram and curcuits. looks exactly the same except above numbers. just wanna make sure it works even the numbers are different.
I have IBM TP 40 [(2373PM1) is the model no.] with 1.3 Ghz and 32 MB Video and 768 RAM with 14.1″ screen. any help will be appreciated. and once again keep up the good work.
Regards
funkyboyoz
Monday, November 13th 2006 at 2:44 pm
funkyboyoz , those last numbers are probably just the batch number of the chip.
You´ ve found the right one. As long as it says Atmel 24RF08.
Wednesday, November 15th 2006 at 6:05 pm
Hi,
I have a TP R30. Looking for the atmel chip. all i have found is a atmel 93c46
Is this it? it is also a 8 pin. if not please let me know were to find this little sucker
Friday, November 17th 2006 at 12:10 am
i have a thinkpad R60 and its dssassembled the only amtel chip i can find has this number
Amtel at97sc3203 1.2.8.05 ***** ***** and its a 28 pin chip.
and its located under the pci xpress expansion slot. any help would be greatly appreciated.
can post pics if needed please someone help me!!!
Mike
Friday, November 17th 2006 at 12:42 am
i found a diagram of the 28 lead chip if that helps located here >>>>>> http://www.atmel.com/dyn/resources/prod_documents/doc5010.pdf
hope that helps.
Friday, November 17th 2006 at 4:23 pm
Admin- Will this work or is it needed with the older 760xl series?
Thanks!
Saturday, November 18th 2006 at 9:02 pm
I have a ThinkPad 600X. I opened the laptop but did not find any of the chips you mentioned. Instead I find TPC8002(8 legs).
Please tell me what should I do.
Monday, November 20th 2006 at 6:03 am
Hello:
I was following your instruction on navigating the folder where I installed the R24RF08 v2.0b and IBMpass lite to the hard drive (c drive). Then I type in r24rf08 dump.bin and setting up the wiring and connecting the ATMEL chip reader. When I go to my spare PC and hit enter on the command prompt. It will exit the r24rf08 program as stated in the instruction and the password won’t dump on the dump bin that I created. Can you tell me what do I do wrong? Looking forward for your reply.
Regards,
John
Monday, November 20th 2006 at 8:03 am
Hello:
I have 2 errors message when I press on F1 during the startup to enter the BIOS.
Error 0271 - check date and time setting
Error 0176 - System sercurity. The system has been tempered with.
Is it a problem?
Tuesday, November 21st 2006 at 9:17 am
Hi,
I have found the ATMEL chip on the motherboard and been able to find the supervisor password following your instructions. Thank you very much for the information you provided here.
Santonu
Wednesday, November 22nd 2006 at 3:52 am
Hello, thanks for these guide. I have an R50e notebook and Ive managed to find a atmel chip that seems the one on you are talking about, but im not shure if these procedures will work couse the numbrer is slightly diferent. The one Ive found is an
Atmel
24rf08 CN
0536
Do you think these guide will work for my chip?(it has 8pins and is located just there). finally another question, what if the password is also on the HD? couse i have read that there are 3 types of password SVC, POP, and HD password. It seems that my notebook has HD password and POP or SVC password couse even if I remove the HD there still is a password on boot (before booting) so I cant acess windows or any OS
well if anyone could give me a had my mail is ramironospam&argentina.com
(remove nospam to e-mail me, that is done to prevent automated bots finding my real mail)
Wednesday, November 22nd 2006 at 7:17 pm
i have an T30 and i dont seem to find the atmel chip it may be named othervise any ideas where i can find it?
Thursday, November 23rd 2006 at 5:49 pm
ibm thinkpad T42
i have read the bin file but whene i open it with pass tool password is encoded how to decode it ?
Friday, November 24th 2006 at 12:30 am
I was able to find the password using the dump bin but as soon as I entered onto the laptop, there was a OK signal but eventually denial it ? Why is it that way? What do I do wrong? Looking forward for suggestion.
Thanks,
John
Saturday, November 25th 2006 at 4:22 am
Hi there i am also looking for a picture on how you connect the diodes to the seriel port and how you ground the 2 zener diodes too i have over 10 laptops with the bios password,so i will post back if i have any differeiculties with them.if some1 can email me on be great
Many Thanks
Angel
Saturday, November 25th 2006 at 7:37 pm
Hi i have got a tp 390x but unabell to find the the ATMEL 24RFC8 CHIP . Can anbody please help
Saturday, November 25th 2006 at 7:43 pm
Hi i have got a tp 390x but unable to find the Atmel chip. Can anbody please help
Monday, November 27th 2006 at 1:06 pm
Hi,
The way your explained here, is the only way I found until now. I could buy a new Atmel chip, too. would you prefer this??
Because, I don’t think, that I will find the atmel chip on my T30 2366. hmm I even can’t remove the case
hehe
Can u tell me the place of the atmel chip and scl and sda on a T30 / 2366 ?????
I can see under the mousepad a big chip with intel, but there is one more little board under the mainboard next to the RAMs. I hope u understand it, because my english is not so well. Or do you know any germany websites, where the same thing is explained??
the most important thing for me noow is the place of that ATMEL CHIP and SCL and SDA on a T 30 ??
If there are any pictures, this would be very very nice.
Aaron E.A.
Wednesday, November 29th 2006 at 9:01 am
Hi Victor and others from ALLservice, I admire your devotion to help the community suffering from (or enjoying) TP security and patience needed to answer all the questions, often pretty stupid
. Among many others, you have saved myself being locked out from my TP T42 after 3 tries to guess the SVP. Worked as charm with the simple interface, I only had to try 2 technician computers (my good old TP 560X could not find the eeprom, DELL C610 could). There is one problem left in my case: How do I get rid of the of the ERROR 0199: System Security – IBM Security password retry count exceeded? It is still there although I turned SVP off… It must be possible to reset this somewhere, isn’t it?
To help the community a little: I also looked at the driven interface and I have 2 ideas to possibly make life even easier.
1. What about using MAX233 (or 233A) instead of MAX232 (A)? MAX233 includes built-in capacitors and you would only need one more (designated C3 in the driven-i2cprog.pdf) which would simplify the circuit design (if I understand it well).
2. For obtaining any of the chips, consider visiting www.maxim-ic.com. You can get a really good price there. One possibility is to buy them and the minimum batch will suffice to anybody till his/her last day. What I’d recommend is to order a free sample. Just choose from the many variants a chip package that you can use (a while ago I ordered a sample of other stuff in legless form – not very suitable for soldering by hand). If you do not insist that you get it ASAP, 2 specimens come by regular post completely gratis packed neatly in a little box right to your home (otherwise you pay the express delivery). Know any cheaper source?
I wish you all the best and good luck. JL
Thursday, November 30th 2006 at 1:15 am
So its not possible to get the password this way on a R60 ?????? i’ll just have to frk ove he cash for a new laptop. :S:S:S
Thursday, November 30th 2006 at 2:37 pm
Has anybody already tried this on an X40 resp. can tell me where the Atmel Chip is placed on the board? I searched for it but didn’t find it.
Another question. Im not quite fit about this whole Resistor-stuff. There are many different types of 2,2kOhm resistors. Which ones do I have to buy?
Thanks
Uli
Friday, December 1st 2006 at 12:25 am
@Mike:
You can get rid of the password on a R60 by using the PC8394 Tools from allservice. I saw they just added this model, and I understand that almost all new models can be unlocked with the new software.
Friday, December 1st 2006 at 8:48 pm
Hi
I’m having a similar problem but its the boot password that I cannot get rid of. Is there a way to do this on the TP R40? I’ve disconnected the batteries (both the cmos battery and the laptop battery).
Any help would be appreciated!
Monday, December 4th 2006 at 1:08 am
Please send me the exact diagram with the two resistors and two diodes and the socket 9
9 pin socket I
Monday, December 4th 2006 at 12:56 pm
We Tried and it works well
thanks
Rajesh
Monday, December 4th 2006 at 8:10 pm
Thank you all. Took me less than 30 min to assemble the kit and get my password recovered of a T21. Just fixed another TP X40. Worked like a charm. By the way the chip is located beside the CMOS Battery, You just have to take the keyboard out peel off plastic covering on the chips. Its a 14 pin chip just like a T21. Have FUN guys and good luck.
Take care,
Imran
Tuesday, December 5th 2006 at 7:02 am
any comments on the G40
Tuesday, December 5th 2006 at 8:04 am
@Imran
Sure, that the X40-Atmel is nearby the CMOS-battery? What Type do you have? I just disassembled my keyboard again and found nothing there (Type 2371-79G). But I also read, that on the X41 it is placed on the bottom of the board nearby thy PCMCIA-slot. Maybe its also there on my X40 … I hope so.
Cheers
Uli
Tuesday, December 5th 2006 at 12:58 pm
HI
Does anybody have some experience with Thinkpad A31 model? Forgotten power -on password, should be usually removed by disconnecting backup and power batteries, but in this model it doesn’t work. What is the type of Atmel chip here, and where it is located? Advices will be appreciated. Thanks.
Tuesday, December 5th 2006 at 3:01 pm
To Brian:
Here is a topiuc on G40
http://www.allservice.ro/forum/viewtopic.php?t=380&highlight=g40
Tuesday, December 5th 2006 at 3:36 pm
Aqui tampoco trabaja el metedo de desactivar la baterias ( batery off ) para desactivar el POOWER ON PASSWORD.
AGRADECERIA INFORMACION.
incursion1@gmail.com
Tuesday, December 5th 2006 at 3:42 pm
Necesito desactivar la POWER ON PASSWORD DEL TP A20m de IBM ( NoteBook)
SI alguien sabe como, favor escribir
incursion1@gmail.com
Wednesday, December 6th 2006 at 2:17 am
Hi, I just built a simple programmer, and run r24rf08, I get a file ,mynb.bin in my computer,
but whe I run IBMPASS, I found the all data are Zreo in the file. Could you tell me how to solve this problem?
Wednesday, December 6th 2006 at 11:32 pm
Hi.
My ibm X40 has ath ATMEL Chip number AT97SC3201 with 28 pins. Anybody knows how to attaach the I2C cirruit with this chip? Any help will be greatly appreciated.
Thanx
Mana
Thursday, December 7th 2006 at 8:39 am
@Mana
This is not the right one. The chip you found is the security chip. The password-Chip is the same one all others have (24RF08). You have to keep on searching. Im still not sure, where the chip is placed on the X40. Some say, under the keyboard, nearby the CPU, others say it’s on the bottom of the board near the PCMCIA-slot. When you found it, please tell it here.
Thx
Uli
Thursday, December 7th 2006 at 9:49 am
@Mana
@Uli
Please mail me pictures to the mail above =)
Thursday, December 7th 2006 at 10:03 am
@admin
Of course I do. I’ll get the X40 sometime in the next week and will start with disassembling directly (the circuit is already bulit). Where should I send the pictures to (mailaddress)?
Cheers
Uli
Thursday, December 7th 2006 at 10:05 am
OK, reading helps
pekka ( atsign ) brevk (dot) org
Thursday, December 7th 2006 at 2:05 pm
dear friends who succeded,
could anyone be so kind to post a photo about these wires-resistors-zeners setup?
for dummies in electronics like myself…
i have all the “ingerdients” but i don’t even have idea where the gnd (ground?) wires go
grazie mille,
-chaos
chaos at financier dot com
Thursday, December 7th 2006 at 2:07 pm
@uli
i would appreciate the pics of the circuit and the chip also
thanks and sunny regards,
-chaos
chaos at financier dot com
Thursday, December 7th 2006 at 2:42 pm
@chaos
In this thread there’s a picture of a finished (simple) circuit.
http://www.allservice.ro/forum/viewtopic.php?t=380&highlight=g40
It’s much easier to built, when you have such a breadboard, because you can change the setup quite fast. I also bought a small one here in Germany for 6,95 Euro, so it’s not that expensive.
Regarding the ground wire. On the one side, you solder it to the DB9-connecter to pin5, then you go further and connect it to the Zener-diodes and then to the notebook ground (e.g. to the screw of the VGA-port or somewherer else).
Cheers
Uli
Thursday, December 7th 2006 at 6:14 pm
danke sehr Uli
Friday, December 8th 2006 at 12:04 am
Thank you everyone who have mailed me pictures.
I will try to get them online as soon as i get the time.
Those of you requesting a picture of the actual reader, i have paintbrushed a simplified schematic. I know you wanted a picture but i find it hard to get a shot that is easy to understand.
The simplified picture above in the post is the first draft, so bear in mind that it might have errors, as its late at night were i live, and i make mistakes while tired. Please let me know if you find something that is incorrect!
Also, check out @uli´s link a coulpe post up. There’s some good shots of the reader.
I would also like to mention that anyone with information on other models are free to create their own post here at sodoityourself.com and post instructions.
Friday, December 8th 2006 at 7:25 am
@admin
Your schematic looks bloody good and is definitely easier to understand. Thanks for this.
@the rest
But mayby some more remarks to kill some confusion.
1. Resistors
The 2.2KOhm resistors I bought e.g. have 3 red stripes and not red-red-orange. I also read in the allrevice.ro-Forum that there are different kinds of color-codes for resistors with the same resistance around the world. Just to confuse the people a little more …
I also read that it’s recommended to buy resistors with as less Watt as possible. The smallest ones I got, had 0,1 Watt (1/10). 0,25 and more Watt might be too much (as I read). So try to buy resistors with 0.1W at 2.2kOhm.
2. Zener diodes
Regarding the Zener Diodes. I don’t have to be excactly BZX79. The only important thing is, that they have 5.1 Volt. There are many different types of Zeners, so if you need to buy some, just check that they have 5.1 Volt, the rest does not matter. When you built the circle later then, please remember that diodes have a polarization. This means, that they just work in one direction and when you connect them in the wrong direction, nothing will work. Normally a ring around the diode shows you which way it works. You can also see it in the schematic Admin paintbrushed.
Enough electrics for today …
Cheers
Uli
Saturday, December 9th 2006 at 1:33 pm
CARL:
Did u find the correct chip? I also have a R30. Only ATMEL chip I could find is the 93c46 one. Is this the correct one?
Thanks
Chris
Monday, December 11th 2006 at 11:31 am
ok never mind
found it..
on the R30 it’s located on the underside of the board below pcmcia bay.
Monday, December 11th 2006 at 3:18 pm
also, i used the ibmpass 1.1 command line tool with /a switch to get password from bin dump.
PEACE
Monday, December 11th 2006 at 5:43 pm
Great info, however I’m having problems reading the atmel. I keep getting an error message saying can’t find eeprom. Can anyone help.
Monday, December 11th 2006 at 6:08 pm
@Paul
Check your connections, also what TP do you have?
Monday, December 11th 2006 at 6:52 pm
Hello Admin
Thankyou for all your support. Just located the ATMEL chip on my TP X40 Type 2371. It is located under the motherboard close to the USB port and RAM slot. Its an eight pin chip with this Number on it. ATMEL 93C46. I will try to read the dump today. will let everybody know how it goes.
Regards,
Mana
Monday, December 11th 2006 at 6:56 pm
Hello
It me again. Please ignore my last comment. the actual chip is under the mothrboard directly beneath the PCMCIA slot. It is ATMEL eight pin with this number on it. ATMEL 24RF08CM. Again its a TP X40.
Regards,
Mana
Monday, December 11th 2006 at 11:42 pm
Hello All,
trying to work on my X40. Keeps getting error “Circuit not found or bus error”. I know my circuit is working fine becuae when I pluged the same with another T21 just for a try, it game me the dump file right away and I could read the dump file and the password. I dont know what I am doing wrong in this case (S40). Any suggestions??
Mana
Tuesday, December 12th 2006 at 3:38 am
Hi Mike, the TP is a 390X. I’ll check connections and let you know if there is any difference. Also, for Ian, posted above for 390X, the atmel chip is next to the usb port at the back end, near the power plug.
Tuesday, December 12th 2006 at 4:20 pm
Hi Mike, it was a connection problem. Works fine now. Thanks. If you need pics let me know and I’ll gladly send them in. Again many thanks.
Tuesday, December 12th 2006 at 4:55 pm
There are mistakes in your paintbrushed schematic.
1. You mistaken the SCL and SDA, the red must be SDA and the green is SCL.
2. The color code is wrong, 2.2K=2200=red, red ,red.
Good luck!
Wednesday, December 13th 2006 at 4:31 am
@Softpedix
Thank you, you are so right. I have corrected the pic.
Its no good to read schematics while tired
Wednesday, December 13th 2006 at 11:38 pm
Hi.
I have T30.
Found ATMEL - under the RAM chip.
Soldered fine - have enough of this experience.
Conected. Started DOS prompt.
Had a respond: can not create the file (data .bin file).
What’s wrong?
Could anybody help me? I’m going nuts for the last few days.
Thursday, December 14th 2006 at 12:27 am
Hello… Let me start by saying that I have been playing with, and searching for ways to reset the bios password forever. I have a Thinkpad R40 that used to be a goverment laptop. I have this thing tore apart to do a few little upgrades, with the motherboard totally out of the shell. I found the ATMEL chip under the harddrive caddy. Question is does anyone have a picture out of a R40 that is wired or can instruct me on what needs to be wired and where? Building these things is no problem, but I am kind of leary trying to rewire something so small but what do i have to lose? A laptop that i cant use, lol… I think it is worth it. I kind of understood the instructions, and then i amde the mistake of reading everyones comments, and now im not totally sure. Any help or advise would be great, Thanks!!!
Will
Thursday, December 14th 2006 at 12:54 am
Helo Admin i have find in my Thinkpad 600E the chip Atmel 24RF08CT but with 14pin. please can you write me, which pins are the SCL and SDA?
many thanks,
tonic
Thursday, December 14th 2006 at 1:04 am
To tonic: open this: http://www.allservice.ro/forum/dl/simple-i2cprog.pdf
and you will find all information. Just read forum carefully.
Thursday, December 14th 2006 at 7:07 am
i cant afford 199 to fix my stuff its my laptop for school :S is there no wireing for the r60??? like all the other models shown here ????? can i bypass it manually?
Thursday, December 14th 2006 at 9:05 pm
I have a IBM Thinkpad R30 and it will not hold the date/time everytime I shut down it looses it. I went to Radio shack and bought a new cmos battery, installed it and it still will not hold system time. Any ideas out there?
Thanks,
Julie
Thursday, December 14th 2006 at 9:15 pm
I am having the same problem as listed in every other post about the r40. I wanna know how to bypass my power on password that I never even set or even know how it got there. Ibm wants me to send it in but wont tell me how to do it. My question is…
Is there an easier way to bypass? Do I have to mess with the eee thing? As you can see I have not a clue on what I am doing. Please help. Also I have another question are the passwords all the same a co-worker has the same laptop as I do and is there a way she can get into her programs some how and give me her password. Or if anyone else already reseted theirs and have a password that I may be able try.
Please help I am going Insame and am ready to strangle my teenage daughter!
Thursday, December 14th 2006 at 9:28 pm
Another quick question while surfing the web I noticed some forums talk about Jumpers. Do the ibm R40 have any? I have a power on password problem that I need to clear.
Friday, December 15th 2006 at 2:38 am
I have an IBM ThinkPad 600E with ATMEL 24RF08BT chip on it. There are 14 legs on the chip. I used simple-i2cprog.pdf to connect wires to the chip but with no success.
Can You help me please!
Friday, December 15th 2006 at 8:22 am
Hi Mike,
Started to build the dongle. Cut an old serial cable in half and used the femaile 9 pin. The parts were a total of $2.50 tax included at RadoShack.
The breadboard was a piece thin carton where I punched the holes for the 2 resistors and 2 Zehner diodes. The whole looked terrible but no shorts .
Anyway tried to look for the Atmel Eeprom but could not find it until I noticed that on your list above of TP models the TP23 was not listed. Was this a real omission in your list? So I’am out of luck?
Pls help.
Friday, December 15th 2006 at 8:52 am
Never mind Mike,
I went to the Allservice site and found this:
Locate the eeprom first according to your model (E.g. T20-23 and T30 have the eeprom underneath and can be accessed by removing the RAM modules cover, no need to dismantle the laptop.)
Darn, wished I found it earlier, my whole tp23 is all apart.
Friday, December 15th 2006 at 7:02 pm
This is the next step to revive the T23 my neighbor gave since he could not do anything. The Atmel Eeprom is the larger one . This means too that the contact are closer together and looking at my solder iron I realized that the width is 3 factors wider than the trace. You don’t wan’t to drop solder between the traces or burn a trace because its too hot and start ordering a new motherboard.
So I filed my solder tip conically into a very small tip. Beats buying a new fine tip soldering iron.
I’ll keep you abreast of my project next.
Friday, December 15th 2006 at 7:12 pm
@walter
Don´t you think the taking apart part is the fun part? Now you know what it looks like inside
Good luck to you, and i would really like pictures if you got the time: pekka (atsign) brevk (dot) org .
Friday, December 15th 2006 at 8:12 pm
I located the eeprom on my r40 Ibm. It is on the motherboard under the hard drive. It is a two colored green and black chip. I wanna go ahead and do the whole wire thing but I dont have any idea where to begin or on what side is the SDL /SDA. Someone any one please i am begg’n now.
Thank you.
Also my coworker has the same computer as I do hers is not locked at all nor did she ever set a pass word. Is there a way we can get into her eeprom and see her code and use it to unlock mine?
Friday, December 15th 2006 at 9:29 pm
Hi Jodim
I would not do it the hardware way as decribed here. Too risky. If you short out something or burn a trace you ‘ve got 2 TP’s out of service.
The soldering is very delicate if you don’t do it every day especially with the 14 pin chip. I suggest practicing it first and have definitely a sharp tip. It works great with my old solder iron. Will send a pic also from the chip location. Oh ya check with an Ohmmeter if the wires are not shorted to the next pin before you turn things on.
So just worked on your locked TP. Good luck.
BTW I still have not finished mine yet. Came upon software related problems.+
Friday, December 15th 2006 at 10:21 pm
Thank you Walter for the responce to my cry. I still have no idea where to solder the wires. My chip has 8 pins. How do I find out where to solder the wires on that chip. The manual list nothing about that. I was so excited to find this forum and it’s terrific that we have you men/women to help us dummies out but I am still lost. I see one other person unlocked their IBM R40 too bad he didn’t list the password!!!….
Saturday, December 16th 2006 at 12:19 am
OK Guys,
all the hardware prep went smooth. Followed all the instructions but at the cmd prompt it would not do anything.
had to use dos commands cd\ to get to rootdirectory and then cd\Allservice\dir
and then again cd\Allservice\24RF08
then \dir
then r24rf08.exe /p
it saves the file in c drive under P
went into windows and selected IBMPass20 Lite
opened th p file in C
click on the A to A conversion top left which gave me the above printout and look at line 330
BUT the pass word brought me to OK and after that went into LOCK again.
Help ! what do I do now.
Saturday, December 16th 2006 at 4:46 am
Can Mike or somebody explain how to read the line on 330. Mine read….you wouldn’t guess it …..IBM….twice like on the sample above ……..and all that work I did to get it…duuuuh.
Anyway how do I get through the other stages.
What is the second name on line 340 representing and what can I do with the numbers who are the same like the sample above.
I’m determined to get this lockup problem solved. Right now the score its IBM two - Walter one
thanks for all the help you can give me.
Saturday, December 16th 2006 at 7:32 am
Will you please disregard my instruction on how to use the dos commands.
Victor of Allservice has a better instruction on the Allservice forum. He is the one who wrote the program. Go read the forum if you need the instruction.
Sunday, December 17th 2006 at 2:18 pm
hi
i have a IBM laptop.model no is X21.and its pentium 3.i have a problem with it .i had a bios code in it..so i cannot ON the laptop now ..i want to break it ..so plsss u help me..because i visit ur site..and i think u can help me ..i will be waiting for ur reply…
Monday, December 18th 2006 at 11:55 am
@zohaib
Just read the instructions on the top of the page and follow it. You have to built a little electric circuit and solder some cables to a chip on your notebook. But this is all described on the top of the page. Please read.
Cheers
Uli
Monday, December 18th 2006 at 3:46 pm
hi,
Ive had a readout frome my a20m, but the paswoord is not compleet? What’s with thate?
Mi readout 0*0330 -ob bo-
0*0340 bo—ob
Since you can’t put in (-)? tried the ovious combinations, but nothing.
PS: every readout is exaxtly the saim.
Greets,
Stef
Monday, December 18th 2006 at 9:43 pm
@stef
Make sure you have clicked the button in the upper left corner in ibmpass ( with a little aA label).
Tuesday, December 19th 2006 at 1:58 am
OK guys,
Guess what, I’m writing this on a thinkpad T23 with a locked password my neighbor could not unlock and give the TP to me. Thanks to this forum and Victor of Alservice and $2.50 on radioshack parts an HD from a Compaq which had heatup problems my son gave me I’m now now the proud owner of a pretty good working laptop.
I changed the easy password now. Good luck guys and don’t give up.
Tuesday, December 19th 2006 at 3:26 am
I have a problem. I just followed all instructions on how to do this from this forum and allservice, Well I have the dump file but it is all zero’s. where should I go from here?
Tuesday, December 19th 2006 at 9:57 am
Thanks for youre reply mike. Don that and this was the resolt. So decrypter on but still no clear password.
Greets,
Stef
Tuesday, December 19th 2006 at 11:12 pm
need location of t he chip on TP A31 any help would be great
regards
Scott
Wednesday, December 20th 2006 at 10:10 am
Dear all,
I finally received my X40 yesterday and was so happy, that I can start soldering. So I first took it out of the box, switched it on and saw …. a power-on-password. So I disassembled the keyboard, disconnected the BIOS-battery, waited 10sec, connected it again, switched it on and: I directly work
I’m so disappointed that I’m not allowed to solder something now
Nevertheless, many thanks for this very valueable information.
Cheers
Uli
Friday, December 22nd 2006 at 6:50 am
CAn someone tell me the location of the chip I need to solder? I have an A21m Thinkpad
Friday, December 22nd 2006 at 6:28 pm
Hi,
I am going to try this. Hopefully it will help me as it did for most ppl here. I have found the ATMEL chip on the T22, but I’m a dimwit when it comes to electronics. Can someone please let me know if I’m doing the right thing. I am looking at the schematic and this is what I see visually :
1. Registers are soldered to pin 4 & pin 7 on the Serial Port.
2. Other kind of wires are soldered to pin 5 (GND) & pin 8 (what kind of wires are these ?)
3. The first diode wire is soldered to three (3) wires: the register wire from pin 4; the other wire from pin 8; and the wire coming from pin 5 (GND).
4. The second diode is soldered to two (2) wires: the register wire coming from pin 7; and the wire from pin 5 (GND).
The pic of what to buy doesn’t show that the wires in pin 5 & pin 8 are needed nor what kind of wire they can be. What kind of wires to use ?
For soldering wires to the motherboard, it shows to solder two to the ATMEL chip. Ground is easy but can the two to be soldered to the ATMEL chip be soldered anywhere on the chip or is there specific location on the chip ? And finally, connecting these wires to the circuit, means connecting these wires to the wires from pin 4 & 7 and the ground one to the wire from pin 5 ?
PLEASE HELP … email diagrams or complete instructions & what is needed to majortroubles@hotmail.com
THANKS THANKS THANKS in advance !!
Saturday, December 23rd 2006 at 8:25 am
i have IBM 240X. Ifound the ATMEL chip @ the other side of the motherboard….
following all the instructions… Why is it that there was no file created??? i typed r24rf08 dump.bin hit enter after i have connected the wires to the chip… what seems to be wrong??? I tried to use the patcher.exe it produces error “eeprom not available”…. but i checked out the atmel and it is well connected.. please help me
Monday, December 25th 2006 at 2:02 pm
i have IBM 390X japan model i can’t find the ATMEL chip can you plsss. help me what is the exact chip number of this model…
Monday, December 25th 2006 at 2:46 pm
I tried the above precedure with labtop ibm x40 actualy when i run the program
i received the message ( error eprom not available)
but after i tried several times i was able to enter the setup and I changed the password and the problem solved iam so gratful for the person who put me on the road so for further information fel free to abroach me
Tuesday, December 26th 2006 at 2:26 pm
Hi all and especially owner and writer of Sodoityourself.com.
After having been given a free IBM R61 and using the guide on this site to solve the supervisor issues, i just wanna post a big thanks for the guide and a job well done by the writer. Merry Christmas to everybody, and again thanks. H.Herold Denmark
Wednesday, December 27th 2006 at 7:13 am
I’m writing this on my revived T23. I would like to tell the people who started the project but encountered the several problems described above, please recheck your work. the instructions are correct and clear enough. If you found the eeprom and you have problems understanding the schematics go to www.allservice.ro and look for the picture where somebody soldered the resistors (not registers Rob) direct to the 9 pin female connector. Just copy what he did and you don’t have to understand the schematic. Be sure to solder the Zehner diodes with polarity on the right place (black band)
On the soldering I can’t emphasized enough to be careful with soldering. The darn thing is so small and if you don’t have a fine solderpoint vile the point to a conical sharp tip. Use the smallest solder wire you can get at Radio Shack. Do not use electrical or automotive solder wire. Use a magnifier to do the soldering and even hold your breath while touching the solderpoint. before turning the tp check for shorts caused by solder bridges between traces or chip legs and check continuity with an ohmmeter.
The 000 reading or other faulty readings is because you haven’t downloaded any data due to bad connections or shorts.
Good luck.
Wednesday, December 27th 2006 at 4:24 pm
Hello!
I have an IBM T60 laptop and have moved my BIOS password!
Can one help me?
Friday, December 29th 2006 at 5:08 am
Hello Reichel,
help yourself first by reading this forum from the beginning and the one at www.Allservice.ro about this subject.
If you have problems understanding any of them then maybe we can help.
Also explain what you mean with ‘moved’ password. Do you just simply forgot?
Walter.
Friday, December 29th 2006 at 6:48 am
Thanks. This worked perfectly on a T41. IBM said we had to replace the MB after a supervisor password was changed by an employee, but this procedure sorted it perfectly. Better than replacing a 1 yo machine!
Friday, December 29th 2006 at 3:28 pm
I have a IbmT42 Laptop, The Password has been given to the HDD I belive, If I Insert the HDD I will not be able to choose the Boot Sequence it will ask for password, If I remove HDD i will be able to enter into CMOS Setup and Can Change Boot Priority. But When i insert the HDD it will again ask for Password. I tried with many Utility Boot Cd But it is of No use. Can you help me to break open the HDD
Saturday, December 30th 2006 at 1:20 pm
Hallo!
Ich komme aus Deutschland, daher kann ich nicht so gut Englisch!
Ich habe auch ein Problem mit Bios-Passwort bei IBM T60, kann mir da einer weiterhelfen?
Geht diese Methode auch bei einem IBM T60, wie oben beschrieben?
HILFE, HILFE
))
Thanks.
Saturday, December 30th 2006 at 9:13 pm
Besten Reichel,
Ihre T60 is nicht in die Liste oben fuer diesen Methoden. Aber diese Artikeln ist von
http://www.allservice.ro/forum/viewtopic.php?p=1061#1061
Newer T43/T43p and R52 don’t use 24RF08 but PC8394T-VJG TPM chip.
PC8394 Tools are needed to read this chip .
T60/T60p, R60 and Z60 support is included in PC8394 Tools now.
Dieses is ein kompletes Methode und Sie brauchen nichts zu bilden.
Es kost ungefaehr 100 Euro .
Toi toi toi
Gruesse von Land zu Land
Walter.
Saturday, December 30th 2006 at 9:26 pm
Hi Jon,
I had a locked bios supervisor password and a HDD lock password.
I have been able to unlock the bios password using the description on this thread but need another method to unlock the HD. This method is advertised in www. Allservice .ro but cost you over $100. Luckily I had a spare HD from another not working TP.
If you can find an used HD for less than $100 I would go that direction.
Walter.
Sunday, December 31st 2006 at 4:34 am
Hi!
I successfully removed the password from my T30 using the description provided above.
I found ATMEL chip in the area where system memory [SO-DIMM] is installed.
No need to disassemble the laptop.
Excellent experience. Thank you very much!!!!
Dmitriy
Sunday, December 31st 2006 at 7:00 pm
Julie wrote:
I have a IBM Thinkpad R30 and it will not hold the date/time everytime I shut down it looses it. I went to Radio shack and bought a new cmos battery, installed it and it still will not hold system time. Any ideas out there?
Hi Julie,
I know you wrote this 1/2 month ago. My unlocked TP suddenly showed the same problem, possibly caused by putting the TP together not correctly after looking for the eeprom. The problem seemed not the backup battery underneath the main battery but two ‘watch batteries’ somewhere close to the rams. It had loose contacts which I fixed. Its OK now.
Sunday, December 31st 2006 at 7:15 pm
I like to add to this that I did not suspect the backup battery because it had a fixed connector and the watch batteries had spring clip connectors and my problem occurred when I was moving the TP quite a bit. I bend the clips some more for better contact pressure and cleaned it with alcohol.
Walter.
Tuesday, January 2nd 2007 at 1:56 am
i recently bouhgt a used ibm 600e laptop the cmos battery was dead and when i went yo replace it the holder that it plugs into came off the motherboard and i cannot find out where it goes so i can resolder it back on. i did not mention that the cmos battery has two wires on it and plugs into a holder on the board the holder on the board is the one that has came off i have checked all the web sights trying to find out where it refastens but have found none. on the holder it looks loke it has only one solder connection as if the positive and negative side are looped together if so how could a battery work in this manner any and all help would be appreciated on this as i want to give it to my granddaughter after i get it fixed thanks a million in advance Sonny
Tuesday, January 2nd 2007 at 5:17 am
YOU GUYS ROCK. I AM NOT VERY GOOD AT READING ELECTRONIC SCHMATICS. AND I AM NO GOOD AT SODERING. BUT I FOLLOWED THE DIRECTIONS ABOVE AND NOT ONLY UNLOCKED MY IBM THINKPAD T42.. BUT I ALSO ULOCKED MY FRIENDS… EASY TO FOLLOW.. THANK VERY MUCH FOR THIS WEBPAGE LIKE I SAID YOU GUYS ROCK.. MIKE M KWIQ69@MSN.COM
Tuesday, January 2nd 2007 at 7:05 am
Hi Sonny,
Download from the IBM site a free manual for your model where you can find where the battery connector goes to.
If you keep the cmos battery at its place and use the wires as a guide you will find where they came off from. It should look like a upside down plastic U housing with a slot in the middle to prevent the connector from connecting with the wrong polarities. If this plastic U is broken you will still find the two pins usually bent under 90 % from the motherboard.
Use a ohmmeter to determine the polarity. The -side should read zero ohm to any ground of the motherboard or chassis.
The pins looked looped together because when the housing broke it got bent. Or somebody tried to unlock the cmos by shorting the batteries.
Separate them and determine the polarity as described above and if you can not fix the connector housing just solder the batterie wires to it. Recheck your soldering. Good luck.
Walter.
Tuesday, January 2nd 2007 at 1:11 pm
Hi,
I have an X60 that asks for an unknown supervisor password. Before buying the RPC8394 tools, I’d like to make sure that I can access the PC8394 chip. Does anyone know where this is located?
Thanks,
Paul.
Tuesday, January 2nd 2007 at 2:13 pm
I don’t know if X60 has PC8394, but as I spoke with Victor of allservice.ro, the software is compatible with all new IBM models, maybe you can ask him.
Thursday, January 4th 2007 at 4:46 pm
Great work. It reminds me that no good deed goes unpunished! Thanks for the effort and for publishing it.
Friday, January 5th 2007 at 10:10 am
Error C0175 on thinkpad t21. Need clean EEPROm file
Friday, January 5th 2007 at 10:13 am
please mail me on digitalguymx@hotmail.com
Saturday, January 6th 2007 at 4:54 am
Unbelievable!!! Works FLAWLESSLY! I bought a T40 for a mere $200.00 1.6GHz/80GB/512MB/CDRW-DVD/32MB Vid/14.1″ XGA had a bios pw could not axcess notebook at all
But thanks to this wonderful very helpful guide I was using T40 in appx. 45 minutes (took my time soldering onto mainboard) of buying parts from rat shack for less then $5.00 bucks 
I want to thank the author(s) of this guide, and keep up the excellent work!!
FYI: Atmel chip was underneath WiFi Card next to another 8 pin chip, the atmel chip had “Atmel G
24RF08CN
0334″ written on it. Good luck people.
Saturday, January 6th 2007 at 11:07 pm
Hello, I could´t find any Atmel chip in IBM 600X. (2645-4EG)
Can someone help where it is, or is there any? Or is there some other type of chip?
Saturday, January 6th 2007 at 11:08 pm
Then you have to thank to Victor Voinea from www.allservice.ro. The credit is all his.
Sunday, January 7th 2007 at 9:30 pm
I have T20 and when I tried to do it. The command give a “ERROR: EEPROM not available.” I have double triple check my wiring. Please help.
Sunday, January 7th 2007 at 10:17 pm
I have one thinkpad R30 with forgotten bios password set and i’m not intrested in hacking it. If someone wants to buy it, please mail ronikantis [AT] gmail.com
Monday, January 8th 2007 at 1:31 am
It works fine
IBM T42 unlocked with no problems. Thanks for this great tutorial 
Monday, January 8th 2007 at 6:28 pm
circuit not found or bus error
Monday, January 8th 2007 at 6:30 pm
can some one give some idea of what I am doing wrong I follow all the info but still can’t get it to work. I still have the message circuit not found or bus error.
Monday, January 8th 2007 at 6:34 pm
I have one thinkpad R32 with forgotten bios password I found the Atmel ship with 4 pin in each side total 8 pin. I make all the circuit but still not circuit found or bus error. can some one give and idea.
Tuesday, January 9th 2007 at 11:47 pm
I have a problem with my T30.
I make dump.bin, but when I use IBM pass lite 2.1, I get password,
but this is not good, and don’t work. I try with AA on, but the same, not work.
What can I do?
Wednesday, January 10th 2007 at 10:38 am
I HAVE 390X JAPAN MODEL, CAN ANY ONE HELP ME PLSS.. WHAT IS THE EXACT ATMEL CHIP.