Deprecated: Assigning the return value of new by reference is deprecated in /home/sodoityo/public_html/wp-settings.php on line 512

Deprecated: Assigning the return value of new by reference is deprecated in /home/sodoityo/public_html/wp-settings.php on line 527

Deprecated: Assigning the return value of new by reference is deprecated in /home/sodoityo/public_html/wp-settings.php on line 534

Deprecated: Assigning the return value of new by reference is deprecated in /home/sodoityo/public_html/wp-settings.php on line 570

Deprecated: Assigning the return value of new by reference is deprecated in /home/sodoityo/public_html/wp-includes/cache.php on line 103

Deprecated: Assigning the return value of new by reference is deprecated in /home/sodoityo/public_html/wp-includes/query.php on line 61

Deprecated: Assigning the return value of new by reference is deprecated in /home/sodoityo/public_html/wp-includes/theme.php on line 1109
 » Hacking IBM Thinkpad Bios Password : SoDoItYourself.com

Hacking IBM Thinkpad Bios Password
339 Votes | Average: 3.93 out of 5339 Votes | Average: 3.93 out of 5339 Votes | Average: 3.93 out of 5339 Votes | Average: 3.93 out of 5339 Votes | Average: 3.93 out of 5
Loading ... Loading ...

IBM T42 Supervisor Password recoveryLost your IBM ThinkPad Supervisor password? No problem, on this page i will show you how to recover your old password.

Although IBM claims their TP BIOS passwords are impossible to break, there is a easy and cheap way to fix this.

The stuff you need cost about 5 $ at your closest radio shack type of store. Also you need a spare PC with a serial port.

This article is based on a IBM ThinkPad T42. There are no guarantees and you might end up destroying your TP. So continue at your own risk. Other models this ought to work with are:supervisor (SVP) password

  • 240, 240x
  • 390E, 390x
  • 570, 570E
  • 600e, 600X
  • 770Z
  • A20m, A21e, A21m, a22m, A30p, A31, A31p
  • G40, G41
  • R30, R31, R32, R40, R50, R51
  • Transnote, T20, T21, T22, T30, T40, T40p, T41, T42, T42p
  • X20, X21, X22, X23, X24, X30, X31, X40, X41

The supervisor (SVP) password is stored in a chip called ATMEL 24RF08.It can not be reset by disconnecting the BIOS battery or shorting any jumper. It has to be read in order to deciffer the password. For this we need some kind of hardware so read on…

Soldering the ATMEL 24RF08 Chip reader

To read this chip we need to interface with it using a secondary computer and some simple electronics. You will need to purchase this:

Electronic components

  • 2 x 2200 Ohm Resistors
  • 2 x C5V1 Zener diodes (For example BZX55/C5V1 )
  • Serial Port 9 pin Female

The serial port can be salvaged from any old PS2 type mouse. The zeners and resistors can be found in scrap electronics, but they are rather cheap so i would not bother. Solder them according to the image below. Leave the wires leading to SDA , SCL and GND. These will be connected to the TP later.

Allservice schematic for reader
Here is a simplified schematic for those unfamilliar with the above symbols:

Simplified atmel reader schematic

Location of ATMEL chipLocating the ATMEL chip

Usually the ATMEL chip is located somewhere below the touchpad. Start off by remving the keyboard and mousepad. This is done by unscrewing a couple of screws located under the TP. It is quite clearly illustrated on the bottom side of your ThinkPad.

Pull the TP keyboard up and let it rest against the screen. Pry off the touchpad part and fold it over where the keyboard used to be. Remove the WiFi card.

Under it all you should find a chip with something like this printed:

ATMEL

24RFC8

0446

Heres a closeup of the Atmel chip. Click to enlarge.

Locating the Atmel Chip

You can see the Atmel right under were the Wifi card used to sit:

Another closeup

Soldering the ThinkPad

Now this is the tricky part. You will have to solder 3 wires to the motherboard of your TP. Two wires to the ATMEL chip and one to ground. The ground is a piece of cake, just solder it anywhere you can find ground. The mounting screw holes on the motherboard is a good place. Solder 3 wires according to the image below:

DSC_0154.JPG

As you can see, the SCL and SDA are located right next to eachother. It can be difficult to hold them in place while soldering. I have used some tape to hold them in place. The tape can be left there to minimze the risk of pulling off the soldered wires during the next steps.

Leave these wires unconnected and make them ready by peeling off the insulation. These will be connected to the reader ciruit later on. Make sure they can not reach ground or short circuit in any way.

Preparing the spare PC

You have made the hardware to read the chip, so now you need to supply the software. There is this great sofware made by http://www.allservice.ro/ that can be found here:

http://home.ripway.com/2005-7/365678/index.htm - Select R24RF08 v2.0b - Reader for ATMEL 24RF08 (Freeware)

While you are at it, download the Supervisor Password decoder IBM Pass 2.0 Lite found here:

http://home.ripway.com/2005-7/365678/index.htm

Also great software made available by http://www.allservice.ro/ .

Note:

Softpedix wrote that the download mirror has limited bandwidth. If you can’t download with the above, try these:
http://www.allservice.ro/forum/viewtopic.php?t=61 – Programmer
http://www.allservice.ro/forum/viewtopic.php?t=56 – IBMpass Lite

Install the software.

Connect the ATMEL chip reader to the spare PC.

Fire up a command promt(Start->run type cmd) and navigate to the folder where you installed R24RF08 v2.0b. Type in (don’t hit Enter):

r24rf08 dump.bin

Dumping the password

  1. Turn on your ThinkPad with all the wiring you just soldered.
  2. Press F1 during the startup to enter the BIOS.
  3. Wait untill all activity stops, blinking HDD leds and such.
  4. Connect the ATMEL Chip reader. GND first then the SDA and SCL.
  5. Now go to your spare PC and Hit enter on the command prompt.

Now there should be a file created in the same folder with the name dump.bin. Disconnect all the wiring off your TP and assemble it back together.

Decoding the Supervisor Password

On your Spare PC start the program IBM Pass 2.0 Lite. Load the file you just created (dump.bin). Navigate with the scroll list to the memory address of 0×330. Tada! It should look something like this:

Image of passwor dump

 

Add 'Hacking IBM Thinkpad Bios Password' to Del.icio.us Add 'Hacking IBM Thinkpad Bios Password' to digg Add 'Hacking IBM Thinkpad Bios Password' to FURL Add 'Hacking IBM Thinkpad Bios Password' to blinklist Add 'Hacking IBM Thinkpad Bios Password' to My-Tuts Add 'Hacking IBM Thinkpad Bios Password' to reddit Add 'Hacking IBM Thinkpad Bios Password' to Feed Me Links! Add 'Hacking IBM Thinkpad Bios Password' to Technorati Add 'Hacking IBM Thinkpad Bios Password' to Socializer 

1,362 comments to “Hacking IBM Thinkpad Bios Password”

  1. Comment by softpedix:

    Very well written. I would only mention that the download mirror has limited bandwith. The following links are from the http://www.allservice.ro:
    http://www.allservice.ro/forum/viewtopic.php?t=61 –programmer
    http://www.allservice.ro/forum/viewtopic.php?t=56 –IBMpass Lite

  2. Comment by www.techtagg.com - See Tech Taggers view on this story!:

    Hacking IBM Thinkpad Bios Password…

    This dude solderes some wires to the laptop to retrieve a password stored in a chip….

  3. Comment by Ian:

    Wish there were a way for the T60p

  4. Comment by Mike Douglas:

    “Wish there were a way for the T60p ”

    Have you checked what kind of chips there are on the motherboard?

  5. Comment by softpedix:

    There is a solution for T60! Didn’t you see the download page?
    It points to this:
    http://www.serviceforum.lx.ro/viewtopic.php?p=1061#1061

  6. Comment by Jernej:

    I was really happy when I found your page about hacking ibm-bios password. But when I start doing this, I found hard to recognize this ATMEL, 24RFC8, 0446!! Is atmel on the top of the cpu? Cause there is writen TPC8002, 2C as on many other chips!! and not 24RFC8!! but it has 8 leads! Please help me! Have a nice day, Jernej

  7. Comment by Mike:

    Jernej, you need to find a chip has written Atmel , 24RFC8 written on it. Check above, ive added a couple more images with closeups.

    The atmel is located under the CPU looking chip.

  8. Comment by Tim:

    I am doing this for my R40, i found that the amtel chip is actually underneath the motherbaord, between the hard drive and the bottom of the motherboard. i had to completely dissasemble my TP as far as i could go to get at it.

    ill let you know how it goes.

  9. Comment by Mike:

    Tim, maybe you could post a pic of the location of the chip? Then i could include it in the post so others can find it.

  10. Comment by Mike:

    Digg this story at digg:
    http://digg.com/security/Hacking_ibm_thinkpad_bios_password

  11. Comment by Nuno Martins:

    Hi there is realy good what you did, i start doing but get to a stage were i found the the eprom is difrent the only atmel the board got is 16contacts not 8. and the numbers on it are ATMEL / 24RF08CT / 9952. Do you know in what contacts shoud i weld the wires, do the software work the same way??????

    Thanks
    Nuno

  12. Comment by admin:

    Hi Nuno!

    Are you sure your 24RF08 has got 16 pins? There is one with 14 pins. however, allservice has got this schematic for the wiring.

    Also, what model is your TP?

  13. Comment by James:

    I searched for the Atmel chip on the MB of a TP A21m. Found a 14 pin chip underneath the MB near the memory slots. Again, had to disassemble the whole thing to get at it so I guess I’ll have to run the wires out of the case to get it running again. I hope this is the one I need. It is marked ATMEL F 24RF08CT 0042. I will try using the diagram from allservice and hope that I get the right pins connected. I did take a couple of photos showing the chip and it’s location but I’m not sure how to post them.

  14. Comment by Cool:

    hey.
    is there any way that I can read the bios password, while im in windows??
    i want to update my bios but it requires password, and I dont remeber it?

    By the way, its a ibm r51 i’m talking about.

  15. Comment by tof:

    Hi, i have an old tp570, but not the supervisor password.
    i have found the chips Atmel (8 pins like the T42) near the bottom-left corner.
    I was done all step by step, and now i have my 1024kb dump.

    But the password don’t appear at the address 0×0330. Only Null bytes.

    Any help, please ?

    PS great this page, thanks.

  16. Comment by softpedix:

    According to allservice.ro, The SVP is not set. You have to reset only the power on password, by removing the RTC battery.

  17. Comment by tof:

    >> Hi, i have an old tp570, but not the supervisor password.
    >> I have found the chips Atmel (8 pins like the T42) near the bottom-left corner.
    >> I was done all step by step, and now i have my 1024 bytes dump.
    >> But the password don’t appear at the address 0×0330. Only Null bytes.

    Using IBMpass’s DOS version, the password appear ! Thanks !

    Note the password is store with Qwerty english keyboard character set.

    Great thanks !

  18. Comment by AMMAR:

    Thankyou very much for all of this.
    I have an A22M with CRC ERROR (lovly message) because I loose all the information in the eeprom
    so it will be great if you find for me the .bin file for the 24rf08 from any ather A22M laptop
    even with wrong information .
    sorry for my bad English
    GREAT THANKS .

  19. Comment by Joe:

    I haven’t seen another post in reference to the T21 model, so I guess I’m the first in to try finding the elusive chip. I’m thinking mine must be bottom side like the R40, since I have a complete view of the top with no luck finding it yet.

    Anyone else with a T21 done this yet?

    Joe

  20. Comment by Admin:

    To everyone following this post!

     

     

    If you manage to find the ATMEL chip on your TP please email me with pictures of the location so i can put them here for others!

    Mail me with your TP Model and a picture with the chip circled in.

    Also i would like one original pic(without the chip circled in)!

    Mail me at pekka ( atsign ) brevk (dot) org .

    Thank you!

  21. Comment by Joe:

    Way too easy on a T21.

    So much for “security”…

  22. Comment by Frank:

    can someone please send me a picture of the actual wiring of the diodes and resistors and how they are grounded (i am not very good in this kind of stuff.. especially reading a schemetics)
    thank you

  23. Comment by jose:

    hello there.i built the system. i fould out that the simbol on my screen is a little computer and the command prompt says “Eeprom not available”

    can somebody tell me how to get this thing going.

  24. Comment by Frank:

    hi all.. can some one tell me if the sketch of the 9 pin female is the back or the front that we see. and also where do you solder the ground.
    thank you

  25. Comment by To Frank:

    The wiring is(DB9 / Technican PC side):
    5 - GND

    The ground on the ThinkPad side can usually be just about anywhere. For example one of the mounting screw holes.

  26. Comment by Feizel:

    Hi, I have a Thinkpad Tp42p and my son put in a password which I forgot. I did all the procedures, and yes I managed to download the dump file, but, on line 330 does not reaveal my password. Please help

  27. Comment by Ruud:

    Hello.

    I have read this over and over and i still can’t find where you have to ground the Zener diodes and serial port.

    The one in the portable is clear.

    The ground of the serial port is going on ground of the extra pc ore also to the portabel ?

  28. Comment by Ruud:

    Ground is common on the Thinkpad AND the technican PC

    Just wire all grounds together:

    Ground on the Technican PC DB9 is pin 5.
    Ground on the ThinkPad can be any of the mounting screw holes (or pin 4 on 24rf08 with 8 leads / pin 6 on 24rf08 with 14 leads)
    Ground on the diodes should be wired to Ground on the DB9 and Thinkpad ground.

    DO NOT ATTACH IF NOT GROUNDED PROPERLY!

  29. Comment by Joe:

    Fiezel:

    I’m at work and using the T21 I unlocked, so I don’t havce access to the IBMPass program.
    I had the same thing happen to me, but I fould that there was a button on the left just above the data from the .bin file that said “somethinorother” OFF. Clicking it got rid of the heiroglyphics and the rows of periods after the memory dump lines. It also magically made the password “Q21WSD” appear following line 0×330.
    I hope this helps.
    Joe

  30. Comment by Bale:

    Is there any way you could provide more pictures of how the wiring setup is done? I’ve been through electronics classes but it’s been a while, and i just want to make sure i get this right. If you could provide any more information on this i would greatly appreciate it. Thanks.

  31. Comment by Frank:

    hi all.. Can someone PLEASE help me.. I have taken my TP T21 apart and CANNOT find the Atmel chip can someone tell me where it coul be?
    Thank you

  32. Comment by Joe:

    Frank:
    Put your T21 back together. Turn it over. Remove the RAM access door. Viola! a 14 pin AMTEL chip conveniently hidden under RAM slot 1(closest to the outer edge of the laptop).

    ADMIN:
    What are the possibilities of setting up different “folders” for specific models? I’m willing to help if I can.

    Joe

  33. Comment by admin:

    Joe, i have mailed you.

  34. Comment by Ruud:

    Thank you verry verry much.

    Thinkpad is up and running again.

  35. Comment by funkyboyoz:

    hello admin.

    this is the great thing you guys are doing and i really appreciate it. As my request for bios password for my Ibm TP 40 is been knocked back by IBM saying that it is impossible to recover the passwor and the only option i am left with is either buy another m/b from them that itself is the cost of laptop or dump it in the rubbish bin. but i refused to both the offers. so while surfing i accidently found your site through google. its pretty explanatory on how to do the wiring and other stuff.

    anyway my question is regarding the ATMEL chip thats found under the WiFi card. i have done it all dissemble the laptop as i have gone thro this procedure before few times. i did find the chip as shown in the diagram with all the circuits and numbers whatever shown in the photo in the website. but only problem is that its number is different than written above. its written as ATMEL 24RF08 and some other numbers instead of ATMEL 24RFC8 0446. Still got the 8 pins as shown in the diagram and curcuits. looks exactly the same except above numbers. just wanna make sure it works even the numbers are different.

    I have IBM TP 40 [(2373PM1) is the model no.] with 1.3 Ghz and 32 MB Video and 768 RAM with 14.1″ screen. any help will be appreciated. and once again keep up the good work.
    Regards

    funkyboyoz

  36. Comment by Mike:

    funkyboyoz , those last numbers are probably just the batch number of the chip.

    You´ ve found the right one. As long as it says Atmel 24RF08.

  37. Comment by Carl:

    Hi,

    I have a TP R30. Looking for the atmel chip. all i have found is a atmel 93c46

    Is this it? it is also a 8 pin. if not please let me know were to find this little sucker

  38. Comment by Mike:

    i have a thinkpad R60 and its dssassembled the only amtel chip i can find has this number
    Amtel at97sc3203 1.2.8.05 ***** ***** and its a 28 pin chip.
    and its located under the pci xpress expansion slot. any help would be greatly appreciated.
    can post pics if needed please someone help me!!!

    Mike

  39. Comment by Mike:

    i found a diagram of the 28 lead chip if that helps located here >>>>>> http://www.atmel.com/dyn/resources/prod_documents/doc5010.pdf

    hope that helps.

  40. Comment by Brian:

    Admin- Will this work or is it needed with the older 760xl series?
    Thanks!

  41. Comment by Santonu:

    I have a ThinkPad 600X. I opened the laptop but did not find any of the chips you mentioned. Instead I find TPC8002(8 legs).
    Please tell me what should I do.

  42. Comment by John:

    Hello:
    I was following your instruction on navigating the folder where I installed the R24RF08 v2.0b and IBMpass lite to the hard drive (c drive). Then I type in r24rf08 dump.bin and setting up the wiring and connecting the ATMEL chip reader. When I go to my spare PC and hit enter on the command prompt. It will exit the r24rf08 program as stated in the instruction and the password won’t dump on the dump bin that I created. Can you tell me what do I do wrong? Looking forward for your reply.

    Regards,
    John

  43. Comment by John:

    Hello:
    I have 2 errors message when I press on F1 during the startup to enter the BIOS.
    Error 0271 - check date and time setting
    Error 0176 - System sercurity. The system has been tempered with.

    Is it a problem?

  44. Comment by Santonu:

    Hi,
    I have found the ATMEL chip on the motherboard and been able to find the supervisor password following your instructions. Thank you very much for the information you provided here.

    Santonu

  45. Comment by Ramiro85:

    Hello, thanks for these guide. I have an R50e notebook and Ive managed to find a atmel chip that seems the one on you are talking about, but im not shure if these procedures will work couse the numbrer is slightly diferent. The one Ive found is an
    Atmel
    24rf08 CN
    0536
    Do you think these guide will work for my chip?(it has 8pins and is located just there). finally another question, what if the password is also on the HD? couse i have read that there are 3 types of password SVC, POP, and HD password. It seems that my notebook has HD password and POP or SVC password couse even if I remove the HD there still is a password on boot (before booting) so I cant acess windows or any OS

    well if anyone could give me a had my mail is ramironospam&argentina.com
    (remove nospam to e-mail me, that is done to prevent automated bots finding my real mail)

  46. Comment by polico:

    i have an T30 and i dont seem to find the atmel chip it may be named othervise any ideas where i can find it?

  47. Comment by Gsmtechno:

    ibm thinkpad T42

    i have read the bin file but whene i open it with pass tool password is encoded how to decode it ?

  48. Comment by John:

    I was able to find the password using the dump bin but as soon as I entered onto the laptop, there was a OK signal but eventually denial it ? Why is it that way? What do I do wrong? Looking forward for suggestion.

    Thanks,
    John

  49. Comment by Angel:

    Hi there i am also looking for a picture on how you connect the diodes to the seriel port and how you ground the 2 zener diodes too i have over 10 laptops with the bios password,so i will post back if i have any differeiculties with them.if some1 can email me on be great
    Many Thanks
    Angel

  50. Comment by ian:

    Hi i have got a tp 390x but unabell to find the the ATMEL 24RFC8 CHIP . Can anbody please help

  51. Comment by ian:

    Hi i have got a tp 390x but unable to find the Atmel chip. Can anbody please help

  52. Comment by Aaron:

    Hi,
    The way your explained here, is the only way I found until now. I could buy a new Atmel chip, too. would you prefer this??

    Because, I don’t think, that I will find the atmel chip on my T30 2366. hmm I even can’t remove the case :-) hehe

    Can u tell me the place of the atmel chip and scl and sda on a T30 / 2366 ?????
    I can see under the mousepad a big chip with intel, but there is one more little board under the mainboard next to the RAMs. I hope u understand it, because my english is not so well. Or do you know any germany websites, where the same thing is explained??

    the most important thing for me noow is the place of that ATMEL CHIP and SCL and SDA on a T 30 ??

    If there are any pictures, this would be very very nice.

    Aaron E.A.

  53. Comment by JL:

    Hi Victor and others from ALLservice, I admire your devotion to help the community suffering from (or enjoying) TP security and patience needed to answer all the questions, often pretty stupid :-). Among many others, you have saved myself being locked out from my TP T42 after 3 tries to guess the SVP. Worked as charm with the simple interface, I only had to try 2 technician computers (my good old TP 560X could not find the eeprom, DELL C610 could). There is one problem left in my case: How do I get rid of the of the ERROR 0199: System Security – IBM Security password retry count exceeded? It is still there although I turned SVP off… It must be possible to reset this somewhere, isn’t it?

    To help the community a little: I also looked at the driven interface and I have 2 ideas to possibly make life even easier.
    1. What about using MAX233 (or 233A) instead of MAX232 (A)? MAX233 includes built-in capacitors and you would only need one more (designated C3 in the driven-i2cprog.pdf) which would simplify the circuit design (if I understand it well).
    2. For obtaining any of the chips, consider visiting http://www.maxim-ic.com. You can get a really good price there. One possibility is to buy them and the minimum batch will suffice to anybody till his/her last day. What I’d recommend is to order a free sample. Just choose from the many variants a chip package that you can use (a while ago I ordered a sample of other stuff in legless form – not very suitable for soldering by hand). If you do not insist that you get it ASAP, 2 specimens come by regular post completely gratis packed neatly in a little box right to your home (otherwise you pay the express delivery). Know any cheaper source?
    I wish you all the best and good luck. JL

  54. Comment by Mike:

    So its not possible to get the password this way on a R60 ?????? i’ll just have to frk ove he cash for a new laptop. :S:S:S

  55. Comment by Uli:

    Has anybody already tried this on an X40 resp. can tell me where the Atmel Chip is placed on the board? I searched for it but didn’t find it.

    Another question. Im not quite fit about this whole Resistor-stuff. There are many different types of 2,2kOhm resistors. Which ones do I have to buy?

    Thanks
    Uli

  56. Comment by softpedix:

    @Mike:

    You can get rid of the password on a R60 by using the PC8394 Tools from allservice. I saw they just added this model, and I understand that almost all new models can be unlocked with the new software.

  57. Comment by JJ:

    Hi
    I’m having a similar problem but its the boot password that I cannot get rid of. Is there a way to do this on the TP R40? I’ve disconnected the batteries (both the cmos battery and the laptop battery).
    Any help would be appreciated!

  58. Comment by help help:

    Please send me the exact diagram with the two resistors and two diodes and the socket 9
    9 pin socket I

  59. Comment by Rajesh C:

    We Tried and it works well

    thanks

    Rajesh

  60. Comment by Imran:

    Thank you all. Took me less than 30 min to assemble the kit and get my password recovered of a T21. Just fixed another TP X40. Worked like a charm. By the way the chip is located beside the CMOS Battery, You just have to take the keyboard out peel off plastic covering on the chips. Its a 14 pin chip just like a T21. Have FUN guys and good luck.

    Take care,
    Imran

  61. Comment by Brian:

    any comments on the G40

  62. Comment by Uli:

    @Imran

    Sure, that the X40-Atmel is nearby the CMOS-battery? What Type do you have? I just disassembled my keyboard again and found nothing there (Type 2371-79G). But I also read, that on the X41 it is placed on the bottom of the board nearby thy PCMCIA-slot. Maybe its also there on my X40 … I hope so.

    Cheers
    Uli

  63. Comment by VSS:

    HI
    Does anybody have some experience with Thinkpad A31 model? Forgotten power -on password, should be usually removed by disconnecting backup and power batteries, but in this model it doesn’t work. What is the type of Atmel chip here, and where it is located? Advices will be appreciated. Thanks.

  64. Comment by Simon:

    To Brian:
    Here is a topiuc on G40

    http://www.allservice.ro/forum/viewtopic.php?t=380&highlight=g40

  65. Comment by Luis:

    Aqui tampoco trabaja el metedo de desactivar la baterias ( batery off ) para desactivar el POOWER ON PASSWORD.

    AGRADECERIA INFORMACION.
    incursion1@gmail.com

  66. Comment by Luis:

    Necesito desactivar la POWER ON PASSWORD DEL TP A20m de IBM ( NoteBook)
    SI alguien sabe como, favor escribir
    incursion1@gmail.com

  67. Comment by Hsu:

    Hi, I just built a simple programmer, and run r24rf08, I get a file ,mynb.bin in my computer,
    but whe I run IBMPASS, I found the all data are Zreo in the file. Could you tell me how to solve this problem?

  68. Comment by Mana:

    Hi.
    My ibm X40 has ath ATMEL Chip number AT97SC3201 with 28 pins. Anybody knows how to attaach the I2C cirruit with this chip? Any help will be greatly appreciated.

    Thanx
    Mana

  69. Comment by Uli:

    @Mana

    This is not the right one. The chip you found is the security chip. The password-Chip is the same one all others have (24RF08). You have to keep on searching. Im still not sure, where the chip is placed on the X40. Some say, under the keyboard, nearby the CPU, others say it’s on the bottom of the board near the PCMCIA-slot. When you found it, please tell it here.

    Thx
    Uli

  70. Comment by Admin:

    @Mana
    @Uli

    Please mail me pictures to the mail above =)

  71. Comment by Uli:

    @admin

    Of course I do. I’ll get the X40 sometime in the next week and will start with disassembling directly (the circuit is already bulit). Where should I send the pictures to (mailaddress)?

    Cheers
    Uli

  72. Comment by Uli:

    OK, reading helps :)

    pekka ( atsign ) brevk (dot) org

  73. Comment by chaos:

    dear friends who succeded,

    could anyone be so kind to post a photo about these wires-resistors-zeners setup?
    for dummies in electronics like myself…

    i have all the “ingerdients” but i don’t even have idea where the gnd (ground?) wires go

    grazie mille,
    -chaos

    chaos at financier dot com

  74. Comment by chaos:

    @uli

    i would appreciate the pics of the circuit and the chip also

    thanks and sunny regards,
    -chaos

    chaos at financier dot com

  75. Comment by Uli:

    @chaos

    In this thread there’s a picture of a finished (simple) circuit.

    http://www.allservice.ro/forum/viewtopic.php?t=380&highlight=g40

    It’s much easier to built, when you have such a breadboard, because you can change the setup quite fast. I also bought a small one here in Germany for 6,95 Euro, so it’s not that expensive.

    Regarding the ground wire. On the one side, you solder it to the DB9-connecter to pin5, then you go further and connect it to the Zener-diodes and then to the notebook ground (e.g. to the screw of the VGA-port or somewherer else).

    Cheers
    Uli

  76. Comment by chaos:

    danke sehr Uli ;)

  77. Comment by admin:

    Thank you everyone who have mailed me pictures.

    I will try to get them online as soon as i get the time.

    Those of you requesting a picture of the actual reader, i have paintbrushed a simplified schematic. I know you wanted a picture but i find it hard to get a shot that is easy to understand.

    The simplified picture above in the post is the first draft, so bear in mind that it might have errors, as its late at night were i live, and i make mistakes while tired. Please let me know if you find something that is incorrect!

    Also, check out @uli´s link a coulpe post up. There’s some good shots of the reader.

    I would also like to mention that anyone with information on other models are free to create their own post here at sodoityourself.com and post instructions.

  78. Comment by Uli:

    @admin

    Your schematic looks bloody good and is definitely easier to understand. Thanks for this.

    @the rest

    But mayby some more remarks to kill some confusion.

    1. Resistors

    The 2.2KOhm resistors I bought e.g. have 3 red stripes and not red-red-orange. I also read in the allrevice.ro-Forum that there are different kinds of color-codes for resistors with the same resistance around the world. Just to confuse the people a little more … :D
    I also read that it’s recommended to buy resistors with as less Watt as possible. The smallest ones I got, had 0,1 Watt (1/10). 0,25 and more Watt might be too much (as I read). So try to buy resistors with 0.1W at 2.2kOhm.

    2. Zener diodes

    Regarding the Zener Diodes. I don’t have to be excactly BZX79. The only important thing is, that they have 5.1 Volt. There are many different types of Zeners, so if you need to buy some, just check that they have 5.1 Volt, the rest does not matter. When you built the circle later then, please remember that diodes have a polarization. This means, that they just work in one direction and when you connect them in the wrong direction, nothing will work. Normally a ring around the diode shows you which way it works. You can also see it in the schematic Admin paintbrushed.

    Enough electrics for today … ;)

    Cheers
    Uli

  79. Comment by Chris:

    CARL:
    Did u find the correct chip? I also have a R30. Only ATMEL chip I could find is the 93c46 one. Is this the correct one?

    Thanks
    Chris

  80. Comment by Chris:

    ok never mind
    found it..

    on the R30 it’s located on the underside of the board below pcmcia bay.

  81. Comment by Chris:

    also, i used the ibmpass 1.1 command line tool with /a switch to get password from bin dump. :)

    PEACE

  82. Comment by Paul:

    Great info, however I’m having problems reading the atmel. I keep getting an error message saying can’t find eeprom. Can anyone help.

  83. Comment by Mike.D:

    @Paul

    Check your connections, also what TP do you have?

  84. Comment by Mana:

    Hello Admin
    Thankyou for all your support. Just located the ATMEL chip on my TP X40 Type 2371. It is located under the motherboard close to the USB port and RAM slot. Its an eight pin chip with this Number on it. ATMEL 93C46. I will try to read the dump today. will let everybody know how it goes.

    Regards,
    Mana

  85. Comment by Mana:

    Hello
    It me again. Please ignore my last comment. the actual chip is under the mothrboard directly beneath the PCMCIA slot. It is ATMEL eight pin with this number on it. ATMEL 24RF08CM. Again its a TP X40.

    Regards,
    Mana

  86. Comment by Mana:

    Hello All,
    trying to work on my X40. Keeps getting error “Circuit not found or bus error”. I know my circuit is working fine becuae when I pluged the same with another T21 just for a try, it game me the dump file right away and I could read the dump file and the password. I dont know what I am doing wrong in this case (S40). Any suggestions??

    Mana

  87. Comment by Paul:

    Hi Mike, the TP is a 390X. I’ll check connections and let you know if there is any difference. Also, for Ian, posted above for 390X, the atmel chip is next to the usb port at the back end, near the power plug.

  88. Comment by Paul:

    Hi Mike, it was a connection problem. Works fine now. Thanks. If you need pics let me know and I’ll gladly send them in. Again many thanks.

  89. Comment by Softpedix:

    There are mistakes in your paintbrushed schematic.
    1. You mistaken the SCL and SDA, the red must be SDA and the green is SCL.
    2. The color code is wrong, 2.2K=2200=red, red ,red.

    Good luck!

  90. Comment by Mike.D:

    @Softpedix

    Thank you, you are so right. I have corrected the pic.

    Its no good to read schematics while tired :(

  91. Comment by oleg m:

    Hi.
    I have T30.
    Found ATMEL - under the RAM chip.
    Soldered fine - have enough of this experience.
    Conected. Started DOS prompt.
    Had a respond: can not create the file (data .bin file).
    What’s wrong?
    Could anybody help me? I’m going nuts for the last few days.

  92. Comment by Will:

    Hello… Let me start by saying that I have been playing with, and searching for ways to reset the bios password forever. I have a Thinkpad R40 that used to be a goverment laptop. I have this thing tore apart to do a few little upgrades, with the motherboard totally out of the shell. I found the ATMEL chip under the harddrive caddy. Question is does anyone have a picture out of a R40 that is wired or can instruct me on what needs to be wired and where? Building these things is no problem, but I am kind of leary trying to rewire something so small but what do i have to lose? A laptop that i cant use, lol… I think it is worth it. I kind of understood the instructions, and then i amde the mistake of reading everyones comments, and now im not totally sure. Any help or advise would be great, Thanks!!!

    Will

  93. Comment by tonic:

    Helo Admin i have find in my Thinkpad 600E the chip Atmel 24RF08CT but with 14pin. please can you write me, which pins are the SCL and SDA?

    many thanks,

    tonic

  94. Comment by oleg m:

    To tonic: open this: http://www.allservice.ro/forum/dl/simple-i2cprog.pdf
    and you will find all information. Just read forum carefully.

  95. Comment by Mike:

    i cant afford 199 to fix my stuff its my laptop for school :S is there no wireing for the r60??? like all the other models shown here ????? can i bypass it manually?

  96. Comment by Julie:

    I have a IBM Thinkpad R30 and it will not hold the date/time everytime I shut down it looses it. I went to Radio shack and bought a new cmos battery, installed it and it still will not hold system time. Any ideas out there?

    Thanks,
    Julie

  97. Comment by jodim65:

    I am having the same problem as listed in every other post about the r40. I wanna know how to bypass my power on password that I never even set or even know how it got there. Ibm wants me to send it in but wont tell me how to do it. My question is…
    Is there an easier way to bypass? Do I have to mess with the eee thing? As you can see I have not a clue on what I am doing. Please help. Also I have another question are the passwords all the same a co-worker has the same laptop as I do and is there a way she can get into her programs some how and give me her password. Or if anyone else already reseted theirs and have a password that I may be able try.
    Please help I am going Insame and am ready to strangle my teenage daughter!

  98. Comment by jodim65:

    Another quick question while surfing the web I noticed some forums talk about Jumpers. Do the ibm R40 have any? I have a power on password problem that I need to clear.

  99. Comment by Anil:

    I have an IBM ThinkPad 600E with ATMEL 24RF08BT chip on it. There are 14 legs on the chip. I used simple-i2cprog.pdf to connect wires to the chip but with no success.
    Can You help me please!

  100. Comment by walter:

    Hi Mike,
    Started to build the dongle. Cut an old serial cable in half and used the femaile 9 pin. The parts were a total of $2.50 tax included at RadoShack.
    The breadboard was a piece thin carton where I punched the holes for the 2 resistors and 2 Zehner diodes. The whole looked terrible but no shorts .

    Anyway tried to look for the Atmel Eeprom but could not find it until I noticed that on your list above of TP models the TP23 was not listed. Was this a real omission in your list? So I’am out of luck?

    Pls help.

  101. Comment by walter:

    Never mind Mike,
    I went to the Allservice site and found this:
    Locate the eeprom first according to your model (E.g. T20-23 and T30 have the eeprom underneath and can be accessed by removing the RAM modules cover, no need to dismantle the laptop.)

    Darn, wished I found it earlier, my whole tp23 is all apart.

  102. Comment by walter:

    This is the next step to revive the T23 my neighbor gave since he could not do anything. The Atmel Eeprom is the larger one . This means too that the contact are closer together and looking at my solder iron I realized that the width is 3 factors wider than the trace. You don’t wan’t to drop solder between the traces or burn a trace because its too hot and start ordering a new motherboard.
    So I filed my solder tip conically into a very small tip. Beats buying a new fine tip soldering iron.

    I’ll keep you abreast of my project next.

  103. Comment by Mike:

    @walter

    Don´t you think the taking apart part is the fun part? Now you know what it looks like inside ;)

    Good luck to you, and i would really like pictures if you got the time: pekka (atsign) brevk (dot) org .

  104. Comment by jodim65:

    I located the eeprom on my r40 Ibm. It is on the motherboard under the hard drive. It is a two colored green and black chip. I wanna go ahead and do the whole wire thing but I dont have any idea where to begin or on what side is the SDL /SDA. Someone any one please i am begg’n now.
    Thank you.

    Also my coworker has the same computer as I do hers is not locked at all nor did she ever set a pass word. Is there a way we can get into her eeprom and see her code and use it to unlock mine?

  105. Comment by walter:

    Hi Jodim

    I would not do it the hardware way as decribed here. Too risky. If you short out something or burn a trace you ‘ve got 2 TP’s out of service.
    The soldering is very delicate if you don’t do it every day especially with the 14 pin chip. I suggest practicing it first and have definitely a sharp tip. It works great with my old solder iron. Will send a pic also from the chip location. Oh ya check with an Ohmmeter if the wires are not shorted to the next pin before you turn things on.
    So just worked on your locked TP. Good luck.
    BTW I still have not finished mine yet. Came upon software related problems.+

  106. Comment by jodim65:

    Thank you Walter for the responce to my cry. I still have no idea where to solder the wires. My chip has 8 pins. How do I find out where to solder the wires on that chip. The manual list nothing about that. I was so excited to find this forum and it’s terrific that we have you men/women to help us dummies out but I am still lost. I see one other person unlocked their IBM R40 too bad he didn’t list the password!!!….

  107. Comment by walter:

    OK Guys,
    all the hardware prep went smooth. Followed all the instructions but at the cmd prompt it would not do anything.
    had to use dos commands cd\ to get to rootdirectory and then cd\Allservice\dir
    and then again cd\Allservice\24RF08
    then \dir
    then r24rf08.exe /p
    it saves the file in c drive under P
    went into windows and selected IBMPass20 Lite
    opened th p file in C
    click on the A to A conversion top left which gave me the above printout and look at line 330

    BUT the pass word brought me to OK and after that went into LOCK again.
    Help ! what do I do now.

  108. Comment by walter:

    Can Mike or somebody explain how to read the line on 330. Mine read….you wouldn’t guess it …..IBM….twice like on the sample above ……..and all that work I did to get it…duuuuh.
    Anyway how do I get through the other stages.
    What is the second name on line 340 representing and what can I do with the numbers who are the same like the sample above.

    I’m determined to get this lockup problem solved. Right now the score its IBM two - Walter one
    thanks for all the help you can give me.

  109. Comment by walter:

    Will you please disregard my instruction on how to use the dos commands.
    Victor of Allservice has a better instruction on the Allservice forum. He is the one who wrote the program. Go read the forum if you need the instruction.

  110. Comment by zohaib:

    hi
    i have a IBM laptop.model no is X21.and its pentium 3.i have a problem with it .i had a bios code in it..so i cannot ON the laptop now ..i want to break it ..so plsss u help me..because i visit ur site..and i think u can help me ..i will be waiting for ur reply…

  111. Comment by Uli:

    @zohaib

    Just read the instructions on the top of the page and follow it. You have to built a little electric circuit and solder some cables to a chip on your notebook. But this is all described on the top of the page. Please read.

    Cheers
    Uli

  112. Comment by stef:

    hi,

    Ive had a readout frome my a20m, but the paswoord is not compleet? What’s with thate?
    Mi readout 0*0330 -ob bo-
    0*0340 bo—ob

    Since you can’t put in (-)? tried the ovious combinations, but nothing.

    PS: every readout is exaxtly the saim.

    Greets,
    Stef

  113. Comment by Mike:

    @stef

    Make sure you have clicked the button in the upper left corner in ibmpass ( with a little aA label).

  114. Comment by walter:

    OK guys,
    Guess what, I’m writing this on a thinkpad T23 with a locked password my neighbor could not unlock and give the TP to me. Thanks to this forum and Victor of Alservice and $2.50 on radioshack parts an HD from a Compaq which had heatup problems my son gave me I’m now now the proud owner of a pretty good working laptop.

    I changed the easy password now. Good luck guys and don’t give up.

  115. Comment by jodim65:

    I have a problem. I just followed all instructions on how to do this from this forum and allservice, Well I have the dump file but it is all zero’s. where should I go from here?

  116. Comment by stef:

    Thanks for youre reply mike. Don that and this was the resolt. So decrypter on but still no clear password.

    Greets,
    Stef

  117. Comment by scott:

    need location of t he chip on TP A31 any help would be great

    regards
    Scott

  118. Comment by Uli:

    Dear all,

    I finally received my X40 yesterday and was so happy, that I can start soldering. So I first took it out of the box, switched it on and saw …. a power-on-password. So I disassembled the keyboard, disconnected the BIOS-battery, waited 10sec, connected it again, switched it on and: I directly work :)

    I’m so disappointed that I’m not allowed to solder something now ;)

    Nevertheless, many thanks for this very valueable information.

    Cheers
    Uli

  119. Comment by biged143:

    CAn someone tell me the location of the chip I need to solder? I have an A21m Thinkpad

  120. Comment by Rob:

    Hi,

    I am going to try this. Hopefully it will help me as it did for most ppl here. I have found the ATMEL chip on the T22, but I’m a dimwit when it comes to electronics. Can someone please let me know if I’m doing the right thing. I am looking at the schematic and this is what I see visually :

    1. Registers are soldered to pin 4 & pin 7 on the Serial Port.
    2. Other kind of wires are soldered to pin 5 (GND) & pin 8 (what kind of wires are these ?)
    3. The first diode wire is soldered to three (3) wires: the register wire from pin 4; the other wire from pin 8; and the wire coming from pin 5 (GND).
    4. The second diode is soldered to two (2) wires: the register wire coming from pin 7; and the wire from pin 5 (GND).

    The pic of what to buy doesn’t show that the wires in pin 5 & pin 8 are needed nor what kind of wire they can be. What kind of wires to use ?

    For soldering wires to the motherboard, it shows to solder two to the ATMEL chip. Ground is easy but can the two to be soldered to the ATMEL chip be soldered anywhere on the chip or is there specific location on the chip ? And finally, connecting these wires to the circuit, means connecting these wires to the wires from pin 4 & 7 and the ground one to the wire from pin 5 ?

    PLEASE HELP … email diagrams or complete instructions & what is needed to majortroubles@hotmail.com

    THANKS THANKS THANKS in advance !!

  121. Comment by catoy:

    i have IBM 240X. Ifound the ATMEL chip @ the other side of the motherboard….
    following all the instructions… Why is it that there was no file created??? i typed r24rf08 dump.bin hit enter after i have connected the wires to the chip… what seems to be wrong??? I tried to use the patcher.exe it produces error “eeprom not available”…. but i checked out the atmel and it is well connected.. please help me

  122. Comment by toygwenn:

    i have IBM 390X japan model i can’t find the ATMEL chip can you plsss. help me what is the exact chip number of this model…

  123. Comment by ENGINEER HASSAN:

    I tried the above precedure with labtop ibm x40 actualy when i run the program
    i received the message ( error eprom not available)
    but after i tried several times i was able to enter the setup and I changed the password and the problem solved iam so gratful for the person who put me on the road so for further information fel free to abroach me

  124. Comment by Henrik Herold:

    Hi all and especially owner and writer of Sodoityourself.com.

    After having been given a free IBM R61 and using the guide on this site to solve the supervisor issues, i just wanna post a big thanks for the guide and a job well done by the writer. Merry Christmas to everybody, and again thanks. H.Herold Denmark

  125. Comment by walter:

    I’m writing this on my revived T23. I would like to tell the people who started the project but encountered the several problems described above, please recheck your work. the instructions are correct and clear enough. If you found the eeprom and you have problems understanding the schematics go to http://www.allservice.ro and look for the picture where somebody soldered the resistors (not registers Rob) direct to the 9 pin female connector. Just copy what he did and you don’t have to understand the schematic. Be sure to solder the Zehner diodes with polarity on the right place (black band)

    On the soldering I can’t emphasized enough to be careful with soldering. The darn thing is so small and if you don’t have a fine solderpoint vile the point to a conical sharp tip. Use the smallest solder wire you can get at Radio Shack. Do not use electrical or automotive solder wire. Use a magnifier to do the soldering and even hold your breath while touching the solderpoint. before turning the tp check for shorts caused by solder bridges between traces or chip legs and check continuity with an ohmmeter.

    The 000 reading or other faulty readings is because you haven’t downloaded any data due to bad connections or shorts.

    Good luck.

  126. Comment by Reichel@list.ru:

    Hello!

    I have an IBM T60 laptop and have moved my BIOS password!

    Can one help me?

  127. Comment by walter:

    Hello Reichel,
    help yourself first by reading this forum from the beginning and the one at http://www.Allservice.ro about this subject.
    If you have problems understanding any of them then maybe we can help.
    Also explain what you mean with ‘moved’ password. Do you just simply forgot?
    Walter.

  128. Comment by kogvos:

    Thanks. This worked perfectly on a T41. IBM said we had to replace the MB after a supervisor password was changed by an employee, but this procedure sorted it perfectly. Better than replacing a 1 yo machine!

  129. Comment by jon:

    I have a IbmT42 Laptop, The Password has been given to the HDD I belive, If I Insert the HDD I will not be able to choose the Boot Sequence it will ask for password, If I remove HDD i will be able to enter into CMOS Setup and Can Change Boot Priority. But When i insert the HDD it will again ask for Password. I tried with many Utility Boot Cd But it is of No use. Can you help me to break open the HDD

  130. Comment by Reichel@list.ru:

    Hallo!

    Ich komme aus Deutschland, daher kann ich nicht so gut Englisch!

    Ich habe auch ein Problem mit Bios-Passwort bei IBM T60, kann mir da einer weiterhelfen?

    Geht diese Methode auch bei einem IBM T60, wie oben beschrieben?

    HILFE, HILFE :-)))

    Thanks.

  131. Comment by walter:

    Besten Reichel,

    Ihre T60 is nicht in die Liste oben fuer diesen Methoden. Aber diese Artikeln ist von

    http://www.allservice.ro/forum/viewtopic.php?p=1061#1061

    Newer T43/T43p and R52 don’t use 24RF08 but PC8394T-VJG TPM chip.
    PC8394 Tools are needed to read this chip .
    T60/T60p, R60 and Z60 support is included in PC8394 Tools now.

    Dieses is ein kompletes Methode und Sie brauchen nichts zu bilden.
    Es kost ungefaehr 100 Euro .

    Toi toi toi

    Gruesse von Land zu Land

    Walter.

  132. Comment by walter:

    Hi Jon,
    I had a locked bios supervisor password and a HDD lock password.
    I have been able to unlock the bios password using the description on this thread but need another method to unlock the HD. This method is advertised in http://www. Allservice .ro but cost you over $100. Luckily I had a spare HD from another not working TP.

    If you can find an used HD for less than $100 I would go that direction.

    Walter.

  133. Comment by Dmitriy:

    Hi!

    I successfully removed the password from my T30 using the description provided above.
    I found ATMEL chip in the area where system memory [SO-DIMM] is installed.
    No need to disassemble the laptop.
    Excellent experience. Thank you very much!!!!

    Dmitriy

  134. Comment by walter:

    Julie wrote:
    I have a IBM Thinkpad R30 and it will not hold the date/time everytime I shut down it looses it. I went to Radio shack and bought a new cmos battery, installed it and it still will not hold system time. Any ideas out there?

    Hi Julie,
    I know you wrote this 1/2 month ago. My unlocked TP suddenly showed the same problem, possibly caused by putting the TP together not correctly after looking for the eeprom. The problem seemed not the backup battery underneath the main battery but two ‘watch batteries’ somewhere close to the rams. It had loose contacts which I fixed. Its OK now.

  135. Comment by walter:

    I like to add to this that I did not suspect the backup battery because it had a fixed connector and the watch batteries had spring clip connectors and my problem occurred when I was moving the TP quite a bit. I bend the clips some more for better contact pressure and cleaned it with alcohol.

    Walter.

  136. Comment by sonny:

    i recently bouhgt a used ibm 600e laptop the cmos battery was dead and when i went yo replace it the holder that it plugs into came off the motherboard and i cannot find out where it goes so i can resolder it back on. i did not mention that the cmos battery has two wires on it and plugs into a holder on the board the holder on the board is the one that has came off i have checked all the web sights trying to find out where it refastens but have found none. on the holder it looks loke it has only one solder connection as if the positive and negative side are looped together if so how could a battery work in this manner any and all help would be appreciated on this as i want to give it to my granddaughter after i get it fixed thanks a million in advance Sonny

  137. Comment by mike l:

    YOU GUYS ROCK. I AM NOT VERY GOOD AT READING ELECTRONIC SCHMATICS. AND I AM NO GOOD AT SODERING. BUT I FOLLOWED THE DIRECTIONS ABOVE AND NOT ONLY UNLOCKED MY IBM THINKPAD T42.. BUT I ALSO ULOCKED MY FRIENDS… EASY TO FOLLOW.. THANK VERY MUCH FOR THIS WEBPAGE LIKE I SAID YOU GUYS ROCK.. MIKE M KWIQ69@MSN.COM

  138. Comment by walter:

    Hi Sonny,
    Download from the IBM site a free manual for your model where you can find where the battery connector goes to.

    If you keep the cmos battery at its place and use the wires as a guide you will find where they came off from. It should look like a upside down plastic U housing with a slot in the middle to prevent the connector from connecting with the wrong polarities. If this plastic U is broken you will still find the two pins usually bent under 90 % from the motherboard.
    Use a ohmmeter to determine the polarity. The -side should read zero ohm to any ground of the motherboard or chassis.

    The pins looked looped together because when the housing broke it got bent. Or somebody tried to unlock the cmos by shorting the batteries.
    Separate them and determine the polarity as described above and if you can not fix the connector housing just solder the batterie wires to it. Recheck your soldering. Good luck.
    Walter.

  139. Comment by Paul:

    Hi,

    I have an X60 that asks for an unknown supervisor password. Before buying the RPC8394 tools, I’d like to make sure that I can access the PC8394 chip. Does anyone know where this is located?

    Thanks,

    Paul.

  140. Comment by Ron:

    I don’t know if X60 has PC8394, but as I spoke with Victor of allservice.ro, the software is compatible with all new IBM models, maybe you can ask him.

  141. Comment by klaxon:

    Great work. It reminds me that no good deed goes unpunished! Thanks for the effort and for publishing it.

  142. Comment by Yasir:

    Error C0175 on thinkpad t21. Need clean EEPROm file

  143. Comment by BuddaTech:

    Unbelievable!!! Works FLAWLESSLY! I bought a T40 for a mere $200.00 1.6GHz/80GB/512MB/CDRW-DVD/32MB Vid/14.1″ XGA had a bios pw could not axcess notebook at all :( But thanks to this wonderful very helpful guide I was using T40 in appx. 45 minutes (took my time soldering onto mainboard) of buying parts from rat shack for less then $5.00 bucks :o I want to thank the author(s) of this guide, and keep up the excellent work!!

    FYI: Atmel chip was underneath WiFi Card next to another 8 pin chip, the atmel chip had “Atmel G
    24RF08CN
    0334″ written on it. Good luck people.

  144. Comment by hevosmies:

    Hello, I could´t find any Atmel chip in IBM 600X. (2645-4EG)
    Can someone help where it is, or is there any? Or is there some other type of chip?

  145. Comment by Kevin:

    I have T20 and when I tried to do it. The command give a “ERROR: EEPROM not available.” I have double triple check my wiring. Please help.

  146. Comment by R30 FOR SALE:

    I have one thinkpad R30 with forgotten bios password set and i’m not intrested in hacking it. If someone wants to buy it, please mail ronikantis [AT] gmail.com

  147. Comment by Darek:

    It works fine :) IBM T42 unlocked with no problems. Thanks for this great tutorial :)

  148. Comment by risa:

    circuit not found or bus error

  149. Comment by risa:

    can some one give some idea of what I am doing wrong I follow all the info but still can’t get it to work. I still have the message circuit not found or bus error.

  150. Comment by risa:

    I have one thinkpad R32 with forgotten bios password I found the Atmel ship with 4 pin in each side total 8 pin. I make all the circuit but still not circuit found or bus error. can some one give and idea.

  151. Comment by Zoran:

    I have a problem with my T30.

    I make dump.bin, but when I use IBM pass lite 2.1, I get password,
    but this is not good, and don’t work. I try with AA on, but the same, not work.
    What can I do?

  152. Comment by toygwenn:

    I HAVE 390X JAPAN MODEL, CAN ANY ONE HELP ME PLSS.. WHAT IS THE EXACT ATMEL CHIP.

  153. Comment by Mike:

    Hi; I sent you the pic about the 600X Atmel chip location yesterday. I’m having some problems though. The cable is done and correct to specs. I have downloaded the software and installed it. My problem is that I open the command prompt window and navigate to the folder, but what do I type in? I have tried the r24rf08dump.bin, also r24rf08 dump.bin , I am confused… When I navigate to the folder it has the address already typed in, if I hit enter on the address, it pops up a DOS screen, if I type in anything at the command prompt it doesn’t do anything.
    Also, on the chip it has a small circle in the corner, that is pin ONE correct? Any help would be appreciated

    This is the folder address… C:\ALLservice\24RF08\r24rf08.exe
    Do I just type C:\ALLservice\24RF08\r24rf08.exe\r24rf08dump.bin? that gives me an error…

    Thanks,
    Mike

  154. Comment by Mike:

    C:\ALLservice\24RF08\r24rf08 dump.bin Thats what I needed to type in! stupid me! That made it work right, I guess you just need to vent a lil steam once in a while to let new thoughts get in LOL

    Great site! keep up the good work!

    Mike

  155. Comment by Mako:

    hi, disarm an IBM TP X41, to look for the chip Atmel but only find one with the number 24c04, your you believe that I can do the procedure in this chip. Pardon but I am the great inexpert one.
    When I ignite the Tp only asks for the password me of windows, I need to do this procedure to find the key or you believe that with algun programmes I can extract the pass of windows.

    Thank you

  156. Comment by Sam:

    Hello, I have an Thinkpad R40 bought it at a pawn shop but I am locked out like most of you guys. I believe that I have found the bios chip but i don’t know which of the eight pin I need to connect to. Is there some way to “Read” the chips by counting from a certain point? Thanks.
    SamBrown99[at]aol[.] com
    (p.s. i am fixing it for my girlfriend) :)

  157. Comment by tonyc:

    Thanks for your devotion to help people we have a great friend on you. PLEASE help whit the thinkpad t43 what is about the chip

  158. Comment by max dekkers:

    I managed to assemble a reader. I dumped the contents of the atmel (TP41) in a 1024-byte file and contents looks good; i can see the machine-model as well as the serial number but on address 0×338 there is nothing but hexadecimal crap. So i took another unprotected T41 and read the chip; on 0×338 you see all x’00′. If i change the password to ‘A’ (1 character), on 0×338 the value becomes Ô÷ú›=Ê( in hex : d4 f7 fa 9b 3d ca 17 28 ) So , there seems to be some kind of encryption. Passlite does not provide the answer.. ANY suggestions ????????
    max.dekkers@cherrytronix.com

  159. Comment by Ron:

    MAX, your laptop is using TCPA encryption. I’ve seen that allservice provide a fix for this, you need the writer W24RF08 and to pay a TCPA reset or maybe is free, just talk with them.

  160. Comment by Ron:

    Hm, this guy Li is just one that wants money for free allservice software. Is a scammer.
    If you want to use the software always download from the source and support the authors not chinese suckers that will try to sell you a free software. Be aware, mike

  161. Comment by AAM:

    hi. my thinkpad is A22m and ATMEL on it have 14 pin ! which pins must be scl,sda ????????????????

  162. Comment by AAM:

    hi. my thinkpad is A22m and ATMEL on it have 14 pin ! which pins must be scl,sda ????????????????
    writed on ic :
    ATMEL F
    24RF08CT
    0042

  163. Comment by Gabi:

    I have some R40 pictures
    Can you tell me how should i send them to you?

  164. Comment by AmirAli:

    hi. my thinkpad is A22m and ATMEL on it have 14 pin ! which pins must be scl,sda ?
    writed on ic :
    ATMEL F
    24RF08CT
    0042
    what am i do ??????????????????????

  165. Comment by Demon:

    Confused as to what line password is on. Although line 330 is mentioned, only a “D” apears on that line which is not the password. Tried several dumps, all have had the same result. Any ideas?

  166. Comment by Musa Musa:

    i have a prblem on my ibm thinkpad t20 with error 188: invalid RFID derializtaion information area or bad crc2. can any one help me with clean t20 dump or tell me how to solve this.
    my email add is mallmusa@yahoo.com .

  167. Comment by Musa Musa:

    if u got problem with ur t21 thinkpad mail me and i’ll tell u how to fix them or if u need a clean dump for t21, t22 i can help u.

  168. Comment by jvela001:

    can u repair crc errors?….how i can recognize de bad area data in a dump?…and after i must delete this data???

  169. Comment by john d:

    hello… i built the simple-12cprog interface and used the info for my t40. it worked like a charm. thank you for your easy layout of the interface devive and the instructions on how to do it…. also i have a picture of the interface that i made if anyone wants to see it….. just let me know or leave a response….

  170. Comment by Malcala:

    Hey guys, thanks for all your posts. i was able to unlock my think pad T41. Now i had trouble at first because i made two mistakes, i just want to let yall know that they were with the hop it will help you ll.
    1 i misplaced the wires on my female 9 pin serial outlet, suggestion is to double check your connections in case of a problem. i kept getting ( EEPROM NOT AVAILABLE) when i ran the script.
    2 i unplugged the small battery and forgaot to place it back. this made me get a message that said (circuit not found or bus error.) just plug the small yellow battery and that will probably solve it.
    The following are just tips that helped me out
    *make sure that your welds on the board dont over lap with other componets to prevent a short or false contact.
    * check your connections with the diagram to make sure it correct
    *If you have problems trying to turn on the computer dont panic relax; this is what i did and it worked for me the problem was it only turned on for a few secons and just didnt stay on. first i unplugged the computers battery , then i also unplugged the smal yellow battery and left it alone for about 5 min , came back plugged every thing back and worked just fine.
    *i you are new to pc and have no clue how to use commander prompt this is what you can do; save all the files on the file: C: documents and settings\owner (the owner may change depending on how you labled this file it might have Administrator our your name) this is the defualt directory on the command promot, you can also just run command prompt and see what goes in place of owner.
    after you saved al your files in this archive just type:DIR and hit enter you should see all the the directories including the ones you recently installed in your pc
    Type the command given r24rf08 dump.bin and do what is instructed.
    I used a 2 2.2k resistors 1/4 watts 5% and 5.1 V diodes
    And Finally dont give up and kep trying, Good Luck and Thanks To who every started this.

  171. Comment by Rabi:

    I Have TP IBM T30 . found the Ship under the RAM cover.
    I solder the wire (so dificult , to small ! maybe I’ve done it wrong) Run the DOS program , and the message was : ERROR: EPROM Not Available .
    It might be the soldering . Does the Ship is burned ? or still working . Now I want just to sleep , anyway feel free to call me 1718 790 7950 .
    DOes the person upwaer

  172. Comment by danielk:

    Hi Everyone,

    I did this for a friends T40 and was able to read the eeprom perfectly.

    I get the file and go to the memory address 330 - and its Blank no password is shown.

    All the other information including hte serial number model number etc is visible, but no password. Has anyone else experienced this and know how to fix it?

    Thanks

  173. Comment by Demon:

    I am working on a t42 and am having a problem similar to danielk’s. On mine only a D apears on 330, which is not the password. I would appreciate help and i will let you know if i figure it out.

  174. Comment by Q:

    Hi, anyone know about the thinkpad Z61t series? I have pulled it right out and the only atmel chip I can see is located beside the docking port and has 28 pins (14 per side) on it. Any help would be appreciated.

  175. Comment by Martin:

    Thanks for this guide, it worked on a thinkpad T20 with the 14 pin chip!

  176. Comment by achmad:

    Hy guys…
    i have Thinkpad T60..
    i have the same problem…
    if i use this method, do i use exactly the same method or there are some changes
    i am not that familiar with chip dan IC..
    can you gut\ys help me please

  177. Comment by Slawek:

    Hi All,
    Finally I found the T41’s pass, great site! Thank’s guys!

    During my way I figured out that the picture of the circuit above (just below the text: Here is a simplified schematic for those unfamilliar with the above symbols:) shows BACK SIDE of the plug.
    That’s why I got the following message:

    ERROR: EEPROM not available

  178. Comment by Slawek:

    Hi All,
    Finally I found the T41’s pass, great site! Thank’s guys!

    During my way I figured out that the picture of the circuit above (just below the text: Here is a simplified schematic for those unfamilliar with the above symbols:) shows BACK SIDE of the plug.
    That’s why I got the following message:

    ERROR: EEPROM not available

  179. Comment by Q:

    I have now found two atmel chips on the motherboard, one is so badly written that I have to have large breaks after trying to read it (where is that magnifying glass) the other is a SC3203 which is apparently a security chip and not valid, though there are some reports on here that suggest this has the right number of pins but I can’t be sure. The chip that is hard to read is smaller and square in shape, has 10 pins on each side and 8356908 is written on the top. Can anyone confirm that these chips are either not applicable or are applicable?

    Thanks,

    Q

  180. Comment by René:

    enyone have don this on a Thinkpad T60??

  181. Comment by Mike:

    I would like to mail you a copy of my bin file. I followed the instructions listed above, and read the chip. I entered the work in but still will not unlock. Not sure what to do from this point. there are a couple characters after the word, but they are showing up blank in the text part of the editor. I’ll mail it to you and see what you think. My think pad if a T42.

  182. Comment by dood:

    Where is the amtel chip on a T60? I can’t find it next to the numerical co processor.

    plz help

  183. Comment by nick:

    I just done the job on a 600e. I used a white plus green LED instead in series of a zeener diode. These do the same job as the zeener and give a visual indication. The white LED has an Fv of 3v. The Green has a Fv of 2.1v.

    Mine has a 14 pin chip. SDA is pin 8. SCL is pin 10. Vcc is 12.

    Retrieving password from the 600 didn’t work following the above instructions. With machine on and powered, the result was no EEPROM. However, I did succeed as follows:

    Get a 5v supply with limited current (limited to around 200ma) (a current limited desktop power supply, or perhaps 3 AA cells plus 200ma fuse). The current needs to be limited as it is easy to short circuit and fry something. With machine off, connected the circuit. Had a probe with +5V. Touched the probe on Vcc then quickly ran patch.exe then the program to gather the data.

    The above procedure could fry something which is why I suggest limiting current, and only apply the voltage to VCC for the minimum time possible.

  184. Comment by marius:

    I have a problem with a password.
    My thinkpad is r32 and i will to reset my BIOS because i foget the SVP. Remove the the CMOS Battery and there it must to write a password.
    What is this password?
    What is wrong?

    Regards.
    Marius

  185. Comment by gerard:

    I have make all handling and the password only in 0×338 and not 0×340. You are to say itself why?

  186. Comment by yeahbut:

    Any clues on the location of the chip on an x41 tablet? I’ve searched all over, but can’t see it anywhere!

  187. Comment by muser:

    Hello,
    we are more than five user of old ibm tp570 - look—-http://www.notebookforum.at/showthread.php?p=93052#post93052—–
    and have the problem, that on each booting we must fill in the date and time again.
    the Bios batterie is proved :ok. The Bios ist updatet IMET 62. But the problem goes on.
    what is to do?
    Bernd Muser Germany Stuttgart

  188. Comment by mastrodiluna:

    hello, I have IBM t30, have taken apart the motehrboard and have found the chip atmel, I am mounted on one small card that is taken apart, I am a chip to 28pin!!! the acronym on the chip is: atmel at97sc3201 the acronym on the card is: p/n 26p8193, please you help me!!! how I can cancel the pasword? the guide serves for the chip to 8pin not for those to 28pin!! my email is: andrea.gt3@libero.it if you have a solution please you send it to me

  189. Comment by Edwin Suarez:

    Hello,

    I have a Lenovo ThinkPad T60. I forgot the BIOS supervisor password and need to unlock it. I have already purchased the parts to build the interface to connect to the security chip. Can someone please send me a picture or tell me where the security chip is located in the T60 and what leads to connect? My email address is: edwin108@msn.com

    Thanks,

    Edwin Suarez

  190. Comment by Q:

    FYI for those of you posting, Doesn’t look like anyone’s bothering to reply to these any more, either that or they’re all too hard. I’m giving up on getting ours going because (this site at least) is not longer helping.

  191. Comment by Murat ERDEM:

    Hi
    I have IBM Thınk T22 dont bios pasword help me but turkish write please

  192. Comment by IBM 390E TP:

    I just found my password using the instructions in the first 6 to seven pages of this sight. If you are getting data and it dosn’t look right make sure to turn on the button AA in left corner. I’ve been working on this several days and poof there it was there are a lot of little details that you have to pay attention too. Finding chip can be the hardest. Good luck don’t give up it can be done.

  193. Comment by Stjepan:

    Please! Location for ATMEL on TP A31, anibody nows?

  194. Comment by Laptop Freak:

    One of my readers asked me the following question:

    I bought an IBM T30 off eBay. Of course, he didn’t mention it needed a password to boot. Do you know of a way to recover or remove it?

    I linked him to your site.

  195. Comment by Gaza:

    Hi!
    Does anybody know if it works on ibm t22 ??? And does anybody know there exactly chip is placed??? And can you sent me some pictures of it ?
    Thanks in advance!!!!

  196. Comment by Lawrence VE7IT:

    I just successfully recovered an A20m laptop that was locked with the supervisor password.
    It is not for the faint at heart, but you have little to lose as the laptop is useless
    without the password. For the A20m, you have to completely strip down the laptop
    following the directions in the IBM service manual (available on IBM web site).
    The manual had slightly different screw arrangements than my laptop, but the sequence
    of parts to remove was correct. The eeprom is located on the bottom of the motherboard
    near the ram expansion connector but cannot be reached without taking the laptop apart.
    It is a 14 pin device. You will need to solder a
    couple of pieces of wire wrap wire onto the clk and data pins (about 2″ long) and
    route them towards the memory expansion connector. Make sure you use different colored wire
    for the clock and data signals and write down which is which.
    Then put the whole laptop back together
    by following the disassemble instructions in reverse. The 2 wires you added should
    be hanging out of the memory access door. You will also need to pick up a ground
    connection (I used a bare copper area near a mounting screw). Hopefully you dont have any parts
    or screws left over when you are finished…. expect it to take about 2 hours to do this
    process for the first time. I taped up the wires and left them on top of the memory
    expansion as I really did not want to take the laptop apart again to remove them.

  197. Comment by sami danio:

    could you please help me boot my ibm t42 using win xp sp2 without going throuh these procdure byu welding the atmp chip

  198. Comment by Dag Hovland:

    Thanks! I followed your procedure on a ThinkPad A31, Type 2652-J3G. It worked, and I now have my machine back. I have some experiences I want to share:

    - I benefitted from using IBMs “Hardware Maintenance Manual” for my model. It is free for download from IBMs website. Without this I would surely have broken more parts, as I had to take apart almost the whole computer to find the chip.

    - As a totally unexperienced solderer I realized very late that there is enough tin on the chip already to fasten the wire. Do not bother to add more tin, just heat the pin and stick the wire to it.

    If anyone else are using ThinkPad A31 (it is probably valid also for A30, A30p, and A31p as the hardware manual is identical) - some specific tips:

    - The atmel chip is below the “sub card for pc card slot”.

    - I needed to remove the following parts in this order: battery pack, CD-player (”Ultrabay plus device”), modem daughter card, ethernet daughter card, backup battery, hard-disk drive, keyboard, keyboard cru insulator, keyboard bezel, ultrabay plus slot (note the procedure here, it is ease to break it) and finally “sub card for pc card slot”.

    - The chip orientation is as on the pictures, with the two important ones down to the right. After only connecting the keybaord, the machine starts without problems in this unmounted state. All the names are taken from IBMs manual. Without this, I think you will not manage, at least without breaking most parts.

    Thanks again! - and good luck to you others :)

  199. Comment by Martin:

    Hallo every body,
    at IBM 770z you only have to remove the dimm cover. you can find a 24c01 chip right next to the bios battery. It’s the only chip with 8 pins you can see there. the there is no need to open the notebook.

  200. Comment by Acid_CooL:

    i have a thinkpad R60 and its dssassembled the only amtel chip i can find has this number
    Amtel at97sc3203 1.2.8.05 ***** ***** and its a 28 pin chip.
    and its located under the pci xpress expansion slot. any help would be greatly appreciated.
    can post pics if needed please someone help me!!!

    i found a diagram of the 28 lead chip if that helps located here >>>>>> http://www.atmel.com/dyn/resources/prod_documents/doc5010.pdf

    can someone please help me get this pass please

  201. Comment by Hubert:

    hello,
    I have a same problem like some one above. My laptop is IBM thinkpad R40, I set POP, Supervisor and HD password. but after I installed asome software, my POP did not work, it was changed. So Iwonder cani recover my supervisor password through above method or not. I think some kind virus attacked the bios.

  202. Comment by ViX:

    Hi,
    Thanks for the guide.

    However, I always got “Circuit not found or bus error!” message. Just wonder whether I got the right components:
    Resister 2.2k 1/4w (should I use 1w ones?)
    T/R Zener 5.1v 20ma 400mw (Have to be BZX55/C5V1? difference?)

    Thanks in advance.

    Best,
    ViX

  203. Comment by wassem shehata:

    hi all
    please i need help ( i have IBM R50e and i forget password and i test all steps put i cant’t write this password Ž{–i-:Jc
    can u help me

    Best Reg.
    Wassem Shehata

  204. Comment by David:

    Thanks a lot guys! TP 390x had to take the computer completely apart and I found that chip in the corner of the motherboard by where you plug in the power cable. I found a repair guide to take it apart so I knew where every screw went at ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/09n8604.pdf. Thanks again!!

  205. Comment by nblueman:

    I have ibm tp r50e i found the atmel i solder it and i have my dumb.bin but in ox330 i see some weird characters for example : BOZI . fBi , i tryed all the combinations but nothing

  206. Comment by nblueman:

    i have exactly teh same problem as wassem shehata the pasword tha i got i cant write it is like BoZi . fBi but the o in word Bozi is not an o or a 0 is something weird

  207. Comment by Knude:

    Not any solution for R60 model yet ?

  208. Comment by Hubert:

    Hello:

    Is there any one who did recover the supervisor password for IbM thinpad R40 using this mehod?

  209. Comment by Steve:

    Hello!

    I´ve done all this like it´s told on your page. After doing this all the programm tells “Eeprom is not available”. What do i have to do? The File “Bump.bin is created, but its about 0KB. I´ve got an A20M. Is it necessary to put all the components together (it´s only the naked board without RAMS, Fan, etc.)?
    Thanks for your help.
    Steve

  210. Comment by softpedix:

    @nblueman
    Turn on the AA button in IBMpass, if the password is not revealed then is a TCPA lock, ask allservice.ro for the service

    @Hubert
    This method works for all TPs using 24RF08 and 24C01

    @Knude
    For R60 you need PC8394 tools to read the TPM chip

  211. Comment by nblueman:

    @softpedix
    Thank you for the reply.
    I had turn the AA button on and back off again,i can read the password(if it is the password) but it doesnt work,and many of them could not type it in ibm for example
    symbols like ; or #

    What is TCPA lock and how i can ask the allservice?

  212. Comment by Hubert:

    @softpedix Thank you for you response. I will try it. My laptop is also using one kind of 24RF08, I have found it on the motherboard. Thinks

  213. Comment by Edwin Suarez:

    Is there any way to remove the bios password from within windows on a thinkpad t60?

  214. Comment by dan3412:

    Worked on a T41 ok yesterday. Bit difficult to get the soldering right but got it in the end and recovers the p/w OK. Thanks

  215. Comment by justsomewellerdude:

    Found a real easy way to fix these. Buy an ISO loader made for reading smart cards ( about $29.99) then open it and go to the atmel. look for the dimple or PIN 1 on your atmel and replace. Anyone with soldering skills can do this in less that 5 minutes. The get the program XP Atmel 2.0 also found all over the net. Download the correct .bin for the Bios and solder it in on your ISO. Run XPAtmel and choose your file, it will show Atmel model and Vendor Family, ect ect. If your ISO loader has red dip switches, you use it woth pins 1 & 5, or 1 & 6 to flash your chip.

    Good luck

  216. Comment by justsomewellerdude:

    sorry for poor spelling.

    1. Get ISO
    2. Open ISO
    3. Remove Atmel chip from your IBM
    4 Solder in your IBM Atmel
    5 with seperate PC download from IBM the correct flash for your unit.
    6 with seperate PC download the XPAtmel 2.0 program found all over net
    7 open XpAtmel2.0
    8 choose the file and click download

    *note*

    make sure your file is in the same folder as XP Atmel
    if your ISO has dip switches you use either 1&5 on or 1&6 on to program.

    9. Then re-solder in your Atmel into the Thinkpad

    *you now also have most current flash file (BIOS) for that unit.

    Enjoy.

  217. Comment by Au Duy Vuong:

    I have just bought an IBM T43 but the touchpad and finger print sensor are not connected to the mainboard. I want to disassamble the machine to fix the problem. Unfortunately, I do not have service manual of the IBM T43.

    Should you have any information can help me, please tell me at auduyvuong@yahoo.com

    Thank you

  218. Comment by ber:

    I could not get this thing running I’ve done all the wiring and soldering right and still could not detect the eeprom, or circuit not available. Is there anything I need to do, it’s a R51 thinkpad. Please help.

  219. Comment by Livi:

    Hi,
    I would like to buy someones assembeled stuff to unlock a t30… ready to use so Icould just solder to the chip, plug in the serial port and download the software. I would be more confortable knowing that you used it and worked. Please email me the price with shipping included to zip code 60077. livrom@yahoo.com
    THANKS

    P.S. I Need This ASAP

  220. Comment by jan:

    Great job guys, I’m still looking for the location
    of the eeprom (atmel 24rf08 or atmel 24c01a) on
    the system board of my TP600 Pentum II type2645.
    Could you or someone please post a picture of the same
    system board and circule the location of the
    chip for me, or does it have a different
    number. many thanks. JAN.

  221. Comment by heeroyuri:

    i have already succesfully acces my TP but when i did this what shows on the screen - Setup Warning!! PAP will overwrite to HDP-1. Does anyone know what options should i take. Help needed asap. and also which one of this options will totally remove the Supervisor Password? tyvm for any comments and suggestions.

  222. Comment by Southern:

    Hello everybody,

    Thanks, thanks, thanks!!!!

    Two TP (T41 and X40) unlocked.

    I just followed the instructions and everything worked perfect!

    Thanks again,

    Southern

  223. Comment by Livi:

    Can someone please help me, I have a T30, I conected everything, when I execute the patch it shows me that the clock it’s ok but when I execute the r24rf08 I don’t know how to make that bim file, I typed r24rf08 dump.bin with space and without the space and when I hit enter the black window it’s gone and there is no bim file created in the folder. I’m doing this over 5 hours and it’s just so frustrating I unsoldered everything put it back together and I get the the same results. What should I do? A fast reply would be much appreciated. Thanks

  224. Comment by Livi:

    I made it, Just unlocked the T30. This is the answer I was looking for(I found it in the forum).I might help someone:

    A little DOS tutorial:
    For example you installed the software in “c:\allservice\24rf08″ folder (or directory).
    You have to launch it from a console window.
    Start>Run, type “cmd” or “command” and press OK to open this console window.
    You should see the system prompt:
    C:\bla_bla…bla\>
    Now to run the reader, type exaclty:
    cd c:\allservice\24rf08 - with space between cd and the rest.
    r24rf08 a.bin- a.bin passed as command line parameter -see?

    Of course, do this at the right time exactly as in the procedure. means to strike the Enter key. In the example above the binary will be stored in a file named “a.bin” which will be in the same folder with the reader, c:\allservice\24rf08

  225. Comment by Konsolator:

    Czesc. mam laptopa t60 ale niemoge znalesc tam tego atmela, znalazlem za to blisko mostka jakis chip na ktorym pisze mx -150 albo 15g 25l1654m2c ale niemam zielonego pojecia czy to jest to zbudowalem juz ten czytnik. czy moze mi ktos powiedziec gdzie mam szukac atmela?? blagam o napisanie maila na konsolator@gmail.com!!

  226. Comment by Stefan S:

    Hello! I´ve got a problem with my TP 600 I bought it from an old man a month ago. He toold me it worked ok but..When i retrived it it´s looked with pw on power on.
    I contacted him so i could get the pw but it was his sons old pc and it been without batterys for 2-3 years and he didn´t know the pw.
    What can I do??????

  227. Comment by kappelmi:

    hello!
    thank you guys! you saved my life! and a lot of money. i have a T42, and i bought it with a password already in. the seller told me, it is not stolen, but he also dont knew it.
    i come out from less than 1$ in hungary, for the electronics. thank you!
    kappelmi

  228. Comment by Vinc:

    Hello, i have an Thinkpad R60 with Bios Password, i can use this procedure for it?
    Because this model on the guide isn’t mentioned.

    If it’s possible, What is eeproom chip to operate?

    thank you.

    Bye.

  229. Comment by Steve:

    So where do you get the C5V1 Zener diodes thats something you don’t get a radio shack.
    Thanks

    swacp645@yahoo.com

  230. Comment by Peter Hubber:

    I have a my ibm 600x apart and would like to know where the bios chip is on this machine. Under the area around the mouse pad these are 3 chips that could all be this 8 legged fuse! I do see the tpc8002 is one of these chips, is this the beast?

    Cheers, Pete

    Great work-by the way!

  231. Comment by Ram:

    Hi
    is there no any way o kracking this passord
    like any superpassword which can unlok all passwords

  232. Comment by Mush:

    hi there, i had power one password with supervisor password, i was trying this method for TP T21 but couldn’t sold the wires to eep rom, and i heated to sold enough on eep rom that one of sold was unsold, i thought i can’t do that, so i turn on the machine it says EATA reading error and it goes to BIOS without asking password, i disable all the password and i turned the machine off and i thought something wrong with EEP rom so i sold it again and then i trun it on and there was no EATA error but again asking for password i just hit enter and it says OK:D without even connecting or anything it’s done, i donno now how that’s happend:D

  233. Comment by Mush:

    i have TP 23 with BAD CRC 1 Eror, any suggestion how to fix that?

  234. Comment by SpawnyWhippet:

    My Thinkpad R30 is not locked, however I get the error ‘0189: Invalid RFID Configuration Information Area’. From some Google research it seems this could be due to a corrupt BIOS or CMOS. The laptop cannot be upgraded to later BIOS or booted, as you can only continue by pressing F1 or ESC. Both take you straight to the BIOS setup utility. I have tried every option in there but nothing allows me to flash the BIOS or continue booting. Is there anything here that can assist me to repair the laptop? IBM wanted 800 Euros to fix it, its only worth half that amount in good condition!

  235. Comment by Roger:

    I just found this site and read about Sonny’s problem with the ibm 600e cmos battery connector breaking off.

    I just had the same problem. I would like to replace the connector. Can a new connector be soldered on with out taking everything apart?

    Where Can I get a new connector.

    Roger

  236. Comment by John Hopf:

    Wow. What a fantastic page !

    I have been playing with a few 390X’s with problems - and one with a locked password chip. I was uncertain as which chip it was, but your page has given me some welcome guidance ! :-)
    I didn’t want to drop $25 on Ebay for a new chip when I have several other M/B’s here with other problems and clean chips! I just need to know which one is the culprit.

    I see an Atmel and a PIC, so I assume one of those must be it.

    Do you know which chip it is in the ThinkPad 390X?

    Thanks !

    John, from Newport, RI

  237. Comment by John Hopf:

    I think I found it !

    The Atmel 8 pin 2408CN SMD next to the USB connector.

    I’ll try replacing it.

    All the best, my friend :-)

  238. Comment by John Hopf:

    “I just had the same problem. I would like to replace the connector. Can a new connector be soldered on with out taking everything apart?

    Where Can I get a new connector. ”

    Hi,

    I get those kind of parts from DigiKey or Jameco.

    http://www.digikey.com/

    http://www.jameco.com/

  239. Comment by John Hopf:

    Yup, I found mine next to the USB connector - 390X , and swapped it from another M/B and fixed it ! :-)

    Lot’s of fun :-)

    #

    Thanks a lot guys! TP 390x had to take the computer completely apart and I found that chip in the corner of the motherboard by where you plug in the power cable. I found a repair guide to take it apart so I knew where every screw went at ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/09n8604.pdf. Thanks again!!
    # Comment by nblueman:

  240. Comment by John Hopf:

    The 390X Service Manual.

    Lots of fun !

    Enjoy, my friends :-)

    http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-4BYJF6

  241. Comment by Stan:

    I have an R40 TP. Downloaded from the TP the .bin file. When I I ran the IBM password program there was nothing but zeros in the entire memory address. Any idea what this could mean? Have done the downloading from the TP several times with the same result. Is it a dead r24rf08?

    Thanks for any help or suggestions

  242. Comment by X41:

    I tryed the procedure but id doesn’t work on my TP X41

  243. Comment by X41:

    I tryed the procedure but it doesn’t work on my TP X41

  244. Comment by Blaster:

    Hi , i got a tp a31 , looking for the proper way to dismantle the backplane ! There is any document so i can follow step by step !!!That will help me not broking it , thank’s !!!

    Mega !

  245. Comment by softpedix:

    @x41. It works, X41 has PCA 24S08. R24RF08 works perfect with this. try again

  246. Comment by jan:

    password: hi guys, can someone tell me where i can get the software IBMPASS v1.1
    the IBMPASS v2 does’nt seem to give me the decoding i want.

    jan.

  247. Comment by softpedix:

    In IBMpass click the AA button. The password is at 0×338-0×33E. If the password is not working then it is TCPA encryption.

  248. Comment by Andy:

    Hi,
    A friend tried to dump the bin file prior to giving it to me; except he used 22k resistors instead of the 2.2k. I redid the circuit and was able to dump the file. However I can see the factory data but at 0X330 and there is no pw. It’s all zero’s and beyond i’ve got hyroglphcs. Any assist will be greatly appreciated.

  249. Comment by softpedix:

    @Andy.
    If there is zeroes, the SVP is blank. You have either a POP stored in CMOS or a HD password -remove the drive

  250. Comment by jamie:

    hi can any1 tell me where to find the amtel chip for x41 please,,,,,, thanks

  251. Comment by X41:

    now i have the bin file but i can’t find the password HELP ME PLEASE

  252. Comment by X41:

    hi jamie it’s just nar the pcmcia on the backside of the mb

  253. Comment by kul ibo:

    Hi Guys there is 10 people asking how to recover password from T60 but no one answers to them. is it impossible or very hard? and please stop writting the http://www.allservice because there is notting about a T60 is written. So anyone one that can help? what about you admin huh?

  254. Comment by softpedix:

    T60 can be unlocked with PC8394 tools from allservice.ro only that the tools are not free. I know the guys there and they have this solution since last year avaialble.

    http://www.allservice.ro/forum/viewtopic.php?t=484&highlight=t60

    Or simply search the forum for T60 and you’ll have tons of answers. Are you blind?

  255. Comment by Guy StVal:

    HELP FOR THE T42 BIOS SVP RESSET.
    I know must people succeeded on removing the password from their TP T42 eeprom. I’m e-mail you because you may give me few tricks and help me fix what I’m doing wrong! I did set up everything but I’m not able to get the dump.bin file after I start the TP… F1 anf after it stop working, press enter.
    I don’t know if it’s my cmd that’s wrong
    C:/allservice/24fr08 dump.bin
    It’s is this that they put in the “run” area? Please help me if you can
    Also how will I know if the kit is working right?
    I’m not able to have any dump.bin file at all… I must be doing somethig wrong but I don’t know what!
    PLEASE HELP!
    STEPHEYOUM@YAHOO.FR

  256. Comment by kerrdog:

    Any comments?
    Have a t42 where a bios update was done without battery. T42 now veggie, can’t even get into bios. Is it possible to get another 24rfc8 from another junk t42 (bad motherboard) and swap. Or is it possible to complete bios update.
    Thx for any help, ideas, comments.

  257. Comment by Orlando Restrepo:

    I can see that all the information is very clear and seems to work for many IBM Thinkpad Laptops. I just have one question, when I press F1 my laptop doesn’t go into de Setup it just show me the blank Screen whith the lock and asking for the password.

    What I have to do?

    Thanks

  258. Comment by softpedix:

    To enter the SVP, which apparently you don’t have.

  259. Comment by captain:

    Does anyone have a working T22 bios dump they would be willing to send me. I have a 0175 error, and would like to know where the CRC check bits are so I can correct them. Friend of mine has a eeprom burner, so that should be fine to dump it back. Much appreciate it.

  260. Comment by John:

    Success!!! :-)

    I built the interface today and it all worked fine!

    Unfortunately, the first computer I screwed up - when desoldering the wire from the SDA on the 8 pin Atmel chip, I broke off the pin.

    Duh !

    So I will need a new chip for that one.

    The second one I was much more careful with and everthing worked perfectly.

    Get this ! the password for both the Power On AND the Hard Drive were both “1234″

    How original !

    ATM machines won’t even allow you to pick that number as a PIN.

    What idiots ! :-)

    Anyway, I am looking forward to finding more deals on Password Locked computers to fix and resell :-)

    Thanks again for a wonderful Web Site !

    John, from Newport, RI.

  261. Comment by John:

    Orlando, my 390X did the same thing - showed the lock when I tried to go into Setup.

    But following the procedure everything worked fine anyway !

  262. Comment by X41:

    now i have this error msg : “ERROR: Unable to open source file” does any body knows the solution ????????????????????????

  263. Comment by rbebout:

    I tried the proceedure on an R50e. Everything worked fine, but the translation of the dumped .bin file does not provide a usable password. Could it be TCPA encryption? If so, what would I have to do to save this computer from the dumpster?

  264. Comment by John:

    Do you see a text word at 0×330 ?

    Did you try hitting the button “AA On” at the top left of the screen ?

    I am not familiar with the R50e, so it might be something more complex that they have cooked up to try and keep us in the dark a little longer !

  265. Comment by softpedix:

    @X41: My friend you use a non working cracked W24RF08. This is happen when you search for crack instead of paying the authors.

  266. Comment by Scott,:

    Hello,
    Thank you very much for your info. It’s work for my T30. I can be able to get in to bios and disable the T30 passwork.
    Oh! one thing I want to mention here is after you have the DUMP. BIN file and loaded it to ibmpass . you have to press AA button on to top left of window from OFF to ON so you can view the password at line 0X330

  267. Comment by dafit:

    Thank you very much for your info. It’s work for my T30. I can be able to get in to bios and disable the T30 passwork.
    Oh! one thing I want to mention here is after you have the DUMP. BIN file and loaded it to ibmpass . you have to press AA button on to top left of window from OFF to ON so you can view the password at line 0X330

  268. Comment by bernard:

    Hi,

    Have tried the procedure on an 600x, but I got an error: EEPROM NOT AVAILABLE. Can you please help?

  269. Comment by fIXjACK:

    I spent 3 hours and 30 bucks workin on this, and all it says is Error No Eeprom or Bad circuit, I have done this 100% as described, all my components match what was described in the instructions and have checked my work several times. Never worked. Just pissed me off.

    Thanks a lot jerkoff.

  270. Comment by fIXjACK:

    now my laptop is dead, thats ok, IBM can fix it for me. Maybe now they will replace the mainboard and the damn password will be gone for good and I wont have to mess with idiotic shit like this.

  271. Comment by sikT42:

    can you please email me what the pasword is because i did it right and got teh circut to work but now i duno what the password is? please message me so i can send yu teh screen shot

  272. Comment by Glenn:

    Hello:
    I was following your instruction on navigating the folder where I installed the R24RF08 v2.0b and IBMpass lite to the hard drive (c drive). Then I type in r24rf08 dump.bin and setting up the wiring and connecting the ATMEL chip reader. When I go to my spare PC and hit enter on the command prompt. It will exit the r24rf08 program as stated in the instruction and the password won’t dump on the spare pc, what am I doing wrong? I also used the tester included with the r24rf08 software and all it does is alternate between 0 and 1 and says at the bottom of box Clock started…

    Am I doing something wrong? I have been trying to get this to work for weeks now I am ready to throw the TP out the window!!!

    Please help!!!

    Glenn

  273. Comment by bernard:

    Hi to those who successfully retreived their TP password using the procedure especially on 600X. Would you be kind enough to share the information on how you did it? You may email me directly at Bernard_david@hstx.com Appreciate your kind assistance on this..

    Many Thanks

  274. Comment by ViX:

    I found out why I got “Circuit not found or bus error!” .

    I actually didnot have password on my laptop x40 but on the recovery partition. Stupid me!

    Best,
    ViX

  275. Comment by softpedix:

    @Glenn

    My friend you may need to read this. Quoted from allservice forum, they made the software and method after all:

    “Pal, I understand your frustration, but is not my fault you missed the good old DOS times.

    I think I said this so many times, here we go again:

    A little DOS tutorial:
    For example you installed the software in “c:\allservice\24rf08″ folder (or directory).
    You have to launch it from a console window.
    Start>Run, type “cmd” or “command” and press OK to open this console window.
    You should see the system prompt:
    C:\bla_bla…bla\>
    Now to run the reader, type exaclty:
    cd c:\allservice\24rf08 - with space between cd and the rest.
    r24rf08 a.bin- a.bin passed as command line parameter -see?

    Of course, do this at the right time exactly as in the procedure. means to strike the Enter key. In the example above the binary will be stored in a file named “a.bin” which will be in the same folder with the reader, c:\allservice\24rf08″
    _________________

  276. Comment by Ben - R51:

    Worked like a charm on my R51. I ordered all my parts from mouser.com and got them within 2 days. Just a couple hints I would suggest, some might have been mentioned before…
    1.) File down your soldering tip if you need to and tin the wire you’ll be using, it helps. 2.) If you are having trouble with step 3 of “Dumping the password”, like I was - you might want to check out using test clips, I think I’ve heard them called gator clips too. It makes it easier than trying to move those carefully soldered SDA / SCL / GND leads around with the laptop on…
    3.) If you get the “EEPROM not found” error, check and re check (maybe resolder) your connections. I got this the first time, which could have been a soldering issue. Then tested continuity to make sure. I did however get the error again, switched out the Serial cable and got the EEPROM dump successfully.

    Oh and my ATMEL chip was exactly as stated in the tutorial, right under the WiFi card. Just had to remove the keyboard and bezel (thanks to IBM Maintenance Manual)

    Lastly, I know how frustrating this is, so if anyone needs pics of the reader, let me know (not pretty, but it works) bsmith55 at gmail dot com

  277. Comment by Samiullah:

    Hello to all,
    Dear all, plz send the dump bios for IBM Thinkpad A22m, coz I got the message, 0175 CRC Back post stop. I want to reprogram bIOS.
    Regards
    Samiullah
    khawajikzai1@yahoo.com

  278. Comment by fany.francis:

    Hello !! Please help me : I have an old TP 380Z. Can’t find any atmel called 24RF08 !!!!!! fany.francis@neuf.fr

  279. Comment by larry:

    Hi guys thanks for the great site!
    I am following your instructions to the letter and so far so good.I have an IBM R30 and from your site I now know where the little blighter is hiding!
    (underside of MB below PCMCIA card)….how do I get the back cover off the laptop to locate the chip without resorting to a hacksaw!
    Many thanks ..Larry

  280. Comment by Ron:

    I was wondering about the connecting serial cable. Is it a straight thru cable (pin 1 connects to pin 1, pin 2 to pin 2 and so forth), or is it a crossover cable(example: pin 1 to pin 4, pin 2 to pin 3 and so forth). If it is a crossover cable, what is there a schematic available.

  281. Comment by gollum:

    For the 600X you must remove the system board. Its on the back. Its located between the hole for the screw right to the accu-port and a chip with a white sticker on it.

    |—————–|
    | | …anyway I hope, I hope this will help someone searching…
    | | ….for the rest, see turtorial, have fun.
    —- |
    | |
    | |
    —- |
    | x |
    | |
    ——————–

  282. Comment by gollum:

    hmmm…this should look like a fliped E…

  283. Comment by Ben:

    @ Larry

    Hope you haven’t brought out the hacksaw yet - try this first!

    http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-39797

  284. Comment by agit:

    i have a problem i have a ibm t 60 and xp professinaol but i want change the bios bur i know not the supervisor passwort

    how can i reset it …

    kann ich es nicht einfach übergehen indem ich es löten ,, überbrücken oder so ,,,,

  285. Comment by agit:

    with out software i want soldering

  286. Comment by vic:

    Hi, I have a Thinkpad T23 that is locked…and i’m not good at this soldering, anyone in San Diego mind unlocking it for me? willing to pay. let me know, thank.

    Email: nyc2sd.max@gmail.com

  287. Comment by Ron:

    Well it works, got it done on a T23. The chip on the 23 is not shown in the origional instructions. Found a example of the chip in the document. It is the 14 pin chip on the T23. The serial cable needed is a straight pass thru cable. Pin 1 connects to Pin 1 and so forth.

    Thanks for the fix. Got a free pc out of the deal.

  288. Comment by Juandelacruz:

    Thanks for these valuable information.
    I have an X23. This is a Pentium 3 866 MHZ subnotebook which I found yesterday from our company’s disposal bin for electroninc equipment. It took me several hours last night just to locate the chip. The chip is on the bottom of the PCB, I have to completely dismantle everything. I will post the result and probably some pictures next week.

  289. Comment by leonardo villalobos:

    hi

    I did everything you said with my T23, I found something in the eeprom but when i tried it, it didn’t work at all… waht might be the cause?

    PLEASE HELP ME!!!!

  290. Comment by bernard:

    Hi,

    Have tested the continuity of my connection on the chip and its okay, but still I’m getting error: EEprom Not Available on my 600x. Any help on this?

    Thanks

  291. Comment by Juandelacruz:

    I finally read the passsword ! Everything worked fine. Here are some additional comments:
    1. Make sure that the soldering iron is clean and the tip is small. I used a weller soldering station which I can control the tempetature. 300°C is too cold, above 380°C may ruin the pcb. I usd about 360°C. Use magnifying lens to very your connection as there maybe hairline shorts. This is the most critical part of the work.
    2. I did not have 5.1 zener in my junkbox, I used 4.7 volts and it worked fine.
    3. The password will not be visible on location 300 at first, you have to convert the code by pressing the icon on the left sie of the menu.

    For anyone with x23 or similar notebook, I can send them the pictures on the location of the EEPROM and the serial interface that I made.

  292. Comment by softpedix:

    You should see this one. X20 series do not need to be dimantled, the eeprom SDA and SCL are available through the Docking port :)

    http://www.allservice.ro/forum/viewtopic.php?t=93&highlight=x20

  293. Comment by PiotrR:

    Hay. I’m useing IBM X30 and Ican’t find ATMEL 24… anywhere. Please Somebody Help me…………………….

  294. Comment by Juandelacruz:

    I am not sure about that. In the X23, the EEPROM is not near the docking port connector, it is near the memory expansion slot.
    My machine now is running with a new 80 GB disk and WinXP
    Thanks for the info anyway.

  295. Comment by gigi:

    Hello,

    I have a Thinkpad T43, this procedure working with my laptop?

    Tanks

  296. Comment by Servio:

    I have an IBM thinkpad R30, what is the worst thing that could happen tryin to remove the password?

  297. Comment by Jose:

    HI, I have read the comments And I can not find this chip on the thinkpad 600x ,actually I found quite a few chips with the 8 legs configuration non with the 24rf08 written on it if possible can some one post or send a picture my email
    jesusa72@hotmail.com

    Thanks Jose

  298. Comment by GeoffGng:

    TP 600
    Power on password ,IBM site shows 2 copper pads on Board ( near RAM )
    Power off , short reset contacts ,power back ON
    Didn’t work ( I ended up soldering a wire link ,to make sure)
    will the Atmel method fix this? [Power on pword ,not Supervisor]

  299. Comment by Larry Grehan:

    Hi I have a TP R30 TYPE 2656 and can only find the eeprom Atmel 93C46.I have followed all the usefull info on your great site regarding locations of the required chip 24RF08cm…..but to no avail.I have the TP stripped down compleately.I initially tried dumping from the Atmel 93C46 and it worked in that it read it and gave me all zeros.
    I have looked in every location mentioned on the site but to no avail.
    Can you help????

  300. Comment by larry:

    Hi if anybody has the location of the 24rf08 eeprom on a TP R30 could they let me know as I have looked everywhere with the unit stripped down.I found an Atmel 93c46 but do not think this holds thepassword. I would very much appreciate it ,thanks.(I have checked out all the locations mentioned on this site)
    My Email :grehanl@hotmail.com

  301. Comment by Juandelacruz:

    Hi Larry, i have an x23 and i found the eeprom under the board. Similarly on the early post there is a guy who also found the chip under the board, below is the message :

    Comment by Chris:

    Monday, December 11th 2006 at 11:31 am
    ok never mind
    found it..

    on the R30 it’s located on the underside of the board below pcmcia bay.

    Good luck

  302. Comment by Larry Grehan:

    Hi Juandelacruz thanks for reply. I will look again but as I have already done this, I have little faith in finding it there. I was not able to remove the back cover compleately and it might just be hiding behind some metal or other!
    One thing is for sure ..those guys in IBM sure know how to hide things.If I find it ..its off to the opticians for me!!

  303. Comment by madou:

    any one who live in manhattan, queens, bronx, brooklyn area
    and still having problem after the laptop is open contact me
    no shipping i will come to your place finish the job for you

  304. Comment by madou:

    any one who live in manhattan, queens, bronx, brooklyn area
    and still having problem after the laptop is open contact me
    no shipping i will come to your place finish the job for you
    manediop@yahoo.fr

  305. Comment by Toppo:

    Did it on an X23, and it worked like charm! Half of the chip was exposed under the DIMM cover - and luckily it was the right half. Got the “EEPROM not found” for quite a while before I realized that some Microsoft SW was keeping my COM1 reserved - I just didn’t notice that before I tried to run a serial port scanner.

    Thanks everyone - this is great stuff.. surefire way to earn a couple o guru points.. (c;

  306. Comment by fountain:

    Hay. I’m useing IBM X40 and Ican’t find ATMEL 24… anywhere. Please Somebody Help me………Please mail to me.

  307. Comment by fountain:

    Hay. I’m using IBM X40 and Ican’t find ATMEL 24…
    anywhere?
    Please mail to me.

    Thanks

    fountain

  308. Comment by fountain:

    microfountain@163.com

  309. Comment by Amar Philadelphia, USA:

    Great Job Guys. Outstanding instructions. Password recovered on the first shut.
    Again Many Thanks

  310. Comment by ilyesken:

    MERCI !!!!

  311. Comment by t_for_tom:

    Hello, I Followed the instructions from allservice but I get a dump.bin file with 128 k and IBMpass shows all 0’s. Someone mentioned a dos verson of ibmpass can read it. Where can I download a dos version? Any help would be appreciated. I’m so close but so far…

  312. Comment by DON DAVIS:

    DOE THIS WORK W/ THE R60 VERSION?
    WE HAVE HAD GREAT SUCCESS W/ THE R51 VERSION!
    AND WE CURRENTLY HAVE A FEW T22`S INCOMING TOO CLEAR.

  313. Comment by Keith:

    Hi I have a X60 - does this work for my Thinkpad ? I already took it apart hoping to just short the bios, but I cant find it ! Can someone help me PLEASE !

  314. Comment by lorenzo:

    R60, X60 works with PC8394 tools and IBMpass

  315. Comment by Keith:

    Thank you Lorenzo - I read some of the other posts, is there some where this software is avaliable for free ? Or something simmular ?

  316. Comment by Luke Skywalker:

    Thanks!!! I’m just another happy Thinkpad T41 owner with bad (human) memory.
    You’re method provided instantly result and gave me my supervisor password back. However, I didn’t solder wires to the atmel chip: I used 3 (old) tiny HP probes to clamp on the tiny leads. So so marks left!
    Many Thanks!
    Luke

  317. Comment by fany.francis:

    Hello everybody !
    Found the ATMEL on my TP 380Z and everything is soldered. But now when I power on the TP, I have error code 178 : EEPROM not functionnal.
    Any ideas ???
    Do I have to ground on the EEPROM ? I only ground on a mounting screw hole.
    Thanx

  318. Comment by Dex:

    Hello. I want to remove password from IBM TP 600. The instructions from start of this site will work? Sorry for my english, it’s not my national language.

  319. Comment by mohd sohail:

    HI, I want to remove supervisor password form my TP T42. I did the same wich u mention in the diagram. but when I run the command on spare PC its give me this error : “Circuit not found or bus error!” . In the begining when I Power ON my TP these two errors displayed:
    Error 0271 - eheck date and time setting
    Error 0176 - system security. The system has been tempered.

    plz help and advice me what to do now.

  320. Comment by mohd sohail:

    HI, I want to remove supervisor password form my TP T42. I did the same which u mention in the diagram. but when I run the command on spare PC its give me this error : “Circuit not found or bus error!” . In the begining when I Power ON my TP these two errors displayed:
    Error 0271 - eheck date and time setting
    Error 0176 - system security. The system has been tempered.

    plz help me and advice me what to do now.

  321. Comment by Glade:

    the chip in a tp600 is on the bottom of the board. lower right corner of the pci bus chip looking from the front… marked ATMEL846 24C01A SC27 B

  322. Comment by Dex:

    Thanks Glade for location of chip. Now I don’t know is this instructions on top of this site will work on TP 600. Mayby somebody removed password from TP 600 and can tell that this instruction work. If you want my mail is katran@wp.pl. Thanks for help.

  323. Comment by Keith:

    Does anyone have the diagram for the amtel chip inside thinkpad x60s
    The chip says AT97SC3203
    the chip has 28 pins

  324. Comment by sophia:

    Wow, thanks for the clear instruction! Works at first trial without any trouble. Did take some time to get wires to the EEPROM, afterwards, piece of cake. :) Thanks, it revives my T23!!!!

  325. Comment by bAZtARd:

    Thanx a lot for that tutorial!
    Worked absolutely fine for me and my T40!

  326. Comment by Munky:

    I had the 0199 error on a X30 I was given for free. It drove me nuts!

    I discovered that if you press then the button next to it in that order, the laptop will boot.

    Hope this helps!

    Munky

  327. Comment by gNo:

    I have tp A22e- I noticed its not listed in the models at top of page. Will this method work 4 my model? If so, where is this blasted atmel chip I’ve been reading about. A friend of the family gave me the computer and I’d like to get it running, but after getting it dismantled it’s not looking too good. Any help u can give would b greatly appreciated, but since the thing was free, I’m not going to get to upset if ur method is not possible on my model. I sure would look pretty cool if I can somehow get it unlocked and that’s what I’m all about. Thanks!

  328. Comment by kaspersk:

    ined help for unlock bios pasword

  329. Comment by kaspersk:

    for my hp pavilion ze 5400

  330. Comment by Bryan:

    Thinkpad A31, worked beautifully! I screwed up the wiring (wired it backwards because I didn’t read the diagram right) but once I got it sorted out it was quite smooth.

    My circuit looks like a gangly mess, but it did the job! Thanks a bunch!

  331. Comment by jojo:

    TP R40, I found the 24RF08 chip under the Harddrive

  332. Comment by raffi:

    anyone willing to sell me their working circuit?

  333. Comment by blaat:

    Thinkpad X31
    location of the Amtel is on the bottom side. Next to the intel chipset chip on the outer side of the pcb and mem slot. It’s U36. the other side of the pcb is the pcmcia slot.

    Must disassemble whole thinkpad :(

  334. Comment by Junglemike:

    Worked like a charm on A21M.
    If anybody needs any help with this model - contact me junglemike({[@]})gmail.com

  335. Comment by Jevgeny:

    Hello everybody, as i understood there is no possibility to get soft to to read PC8394 chip on IBM T60… Did anyone solve this problem? If yes can you share information where I could get this soft? I’m planing to use it only once for my laptop, and I don’t wanna pay 110$ cause for little more price i can get my laptop unlocked… :-( please help! my mail jevgenijo@gmail.com Thank you !!!

  336. Comment by Livi:

    Hi,
    If you think this is too much work for you, I can help you unlock your laptop I unlocked a lots o them. email for detailes I’m in Chicago area.
    livrom@yahoo.com

  337. Comment by Ghulam Mujtaba:

    dear

    i have confusion, Install the software.

    Connect the ATMEL chip reader to the spare PC

    1- software we have to install on spare pc, right?
    2- connect ATMEL Chip reader to spare pc? how?
    do u mean by db9 connector? how to connect with spare pc
    i am very confused kindly send mail at personal email

    regards

  338. Comment by khalid:

    Hello, I could´t find any Atmel chip in IBM 600X. (2645-4EG)
    Can someone help where it is, or is there any? Or is there some other type of chip?

  339. Comment by khalid:

    Hello, I could´t find any Atmel chip in IBM 600 (2645
    Can someone help where it is, or is there any? Or is there some other type of chip?

  340. Comment by stuart barnes:

    Hello
    I have a TP T21 and have followed your instructions to unlock the supervisor password. on pressing return I get a prompt saying ‘Eeprom not avaliable’ do you have any ideas what I am doing wrong.

    thanks stu.

  341. Comment by Groove80:

    hi everyone!

    Im going to give it a try, thanks so much for the Post, by the way..
    Where can i buy these “electronic componets?”
    How im supposed to ask, in the store for these wires things..?

    Have a Awesome DAY! = )

  342. Comment by Bios Password:

    Where is the PW chip located on the Lenovo T60 - if you know it plz paste a screenshot…?

  343. Comment by Lukato Moses:

    Thanks for the help you provide but the biggest problem I have is all the serial female 9pin have pin number 7 not in use. Infact it was left without a hole inside. I soldered the interface on the PC direct on the male serial port but it never worked. It always showed an error that the “circuit is not found or bus error”. My atmel is on IBM T20 located under the RAM cover. its a 14 pin chip. Also I cant identify the SDA and SDL pins of the chip because they are not marked. Please help cos I am sure have followed all instructions.
    Thanks

  344. Comment by stuart barnes:

    Hi
    In a previous post I asked for help when I received an error ‘Eeprom not avaliable’
    I built the electronics in a small plastic box and connected to my slave PC with an RS232 cable. When I checked the cable I found that an RS232 cable dosn’t have pin 4 connected. I made a simple cable with just pins 4,5,7,8 connected and it worked first time. I hope this may help someone.

    Cheers
    Stu.

  345. Comment by Carlos:

    Do I need a breadboard to build this circuit? I am a newbie at this stuff

  346. Comment by Carlos:

    1) Do I have to solder the diodes to the resistors and then solder the resistor to the cable?

    2) There is a blue line from pin 8, on the female connector connecting to one of the diodes? What does that blue line represent?

    3) When I insert the resistors into the female connector, the resistor is loose, is this suppose to be okay?

  347. Comment by Mike:

    Hi all,

    I created the reader circuit, but can’t locate the Atmel Chip on my X20. I have looked above and below the motherboard in every nook and cranny, any suggestions? Is this model to old to have the Atmel or am I just crazy?

    Any help would be appreciated.

    Mike

  348. Comment by Concunho:

    Hi guys,

    I’m about perform the procedures on this site, but cannot understand the wire diagram. Could someone kindly send me the pictures of connecting from the Atmel chip to the serial port and instruction for the password recovery software…

    many thanks,

    Concunho

  349. Comment by Concunho:

    btw, my email is HarryNguyen117(at)gmail.com

  350. Comment by Noureddine/morocco:

    goooooooooooood job; success to unlock my t40.
    big thanks man!

  351. Comment by Stan:

    First, I want to thank all the posties that helped me to reveal the PW from my TP 600.

    I tried it first with the PONYPROG2000, dumped the file, but the password wasn´t visible. Then I tried R24C01 and it worked the first time. Enclosed the steps I exactely performed.
    You have to completely disassemble the notebook and remove the MB to get access to the EEPROM. For the job you have to connect all required parts back to run the system, also BIOS battery, but you don´t need the HD.
    I changed the COM port settings of my working PC (Device MGR>Ports category>COM Port1>Port settings) to Baud rate: 115200; Data Bits:8; Parity: none; Stop bits: 1; Flow control: none
    For this type of EEPROM I learned that it is necessary to work with the driven-IC2cprog device. First trials with the simple one didn´t worked.

    Thinkpad 600 – guide for reading the Supervisor Password with R24C01:

    1. remove the mainboard (Hardware maintenance manual page 87)
    2. locate EEPROM 24C01A at the bottom of the motherboard, right hand side, close to the upper left corner of the big PCIBus-IC when the connector row is facing to you
    3. solder 3 wires to pin 4, 5 and 6 of 24C01A
    4. build schematic: driven-i2cprog.pdf
    5. connect driven-i2cprog to com port of working PC and check port settings
    6. install ponyprog2000 2.05a Beta (freeware from www)
    7. Select from menu “Device>I2C bus 8 bit eeprom>2401″.
    8. setup > Interface Setup: serial, SI Prog API, select com port
    9. In “Setup> Interface Setup” invert the D-in, D-out and SCLK.
    10. change PONYPROG2000.INI: modify the line: I2CBaseAddress=0xA0 to I2CBaseAddress=0xAE
    11. Save PONYPROG2000.INI
    12. Setup > calibrate > OK….
    13. connect AC adapter to the TP 600 mainboard (mainboard without any other boards but with BIOS battery attached)
    14. connect GND wire of driven-i2cprog to pin 4 of 24C01A (GND also can be connected to any GND pad of the mainboard)
    15. press power button of the TP 600 mainboard
    16. connect SDA to pin 5 and SCL to pin 6 of 24C01A
    17. read eeprom with ponyprog
    18. disconnect SDA and SCL wires
    19. switch off the mainboard
    20. disconnect GND wire
    21. store the bin-file
    22. install ibmpass2
    23. open stored bin file with ibmpass2
    24. at ibmpass press button “AA” – on
    25. View>Translation>Scancode
    26. For 24C01 eeproms the password is located at 0×38, 0×40 – read password starting at 0×38 – ending at ????
    27. note password, if password is not shown proceed with a.

    a. Install R24RF01
    b. press power button of the TP 600 mainboard
    lc connect SDA to pin 5 and SCL to pin 6 of 24C01A
    d. Run R24C01.exe
    e. Use command: r24c01 your.bin /x /d /i
    f. disconnect SDA and SCL wires
    g. switch off the mainboard
    h. disconnect GND wire
    i. open your.bin file with ibmpass2 (as above 23 ff)

    Hopefully this will help someone.

    Greets

    Stan

  352. Comment by faisal:

    got x60s , wana break its power on password, is there is any way to do it. asap

  353. Comment by Concunho:

    hello everyone,

    anyone knows the website with pictures of the soldering diagram from the Atmel chip to the serial port. I look at the above diagram but cannot understand it. I’m a newbie at this…any comments or suggestions is much appreciated…
    if you have pictures or something, please email me at harrynguyen117@gmail.com

    thanks a million.

  354. Comment by Glade:

    can the atmel chip be re programmed? I think I just killed mine by reversing the scl and sda leads. Now says error 178 and stops.

  355. Comment by JR:

    Hello everyone,

    I have a thinkpad t30 - eprom actmel 24rf08 with 4 pins.
    Now stops during boot with the message error 0175 bad crc1, I think that is because
    the contents of the actmel eprom is scrambled or something like that,
    so i have to replace it with a good one, so anyone that has the same model, please send me a dump of the eprom bin file.

    thanks to everyone for sharing Knowleges and experiences.

  356. Comment by chanavs:

    if anyone has any dump file of any laptop please send it to chanavs@yahoo.com Thanks a lot

  357. Comment by Concunho:

    hello guys,

    I have a Thinkpad T40 and need to retrieve the BIOS password. Can someone please send me pictures of the actual wiring of the diodes and resistors and how they are grounded. I am not very good in this kind of stuff.. especially reading a schemetics.

    email: harrynguyen117@gmail.com

    Thanks so much..

  358. Comment by Tahamoto:

    Can anyone send me a clean EEPROM dump from IBM ThinkPad T22?
    I have such a machine which hangs with “0175 CRC1 error” message.
    Thanks in advance.

    sv_sim@yahoo.com

  359. Comment by colleen:

    Ok,I know this most likely sounds a little dumb.But it dosent hurt to ask. Is there any way some one could simplify the steps for me .i was given a IBM think pad t4 but its locked .

  360. Comment by Poetic Ruins:

    hello folks, great site. this is really helping me out on a t41 that I was givin. now I have a question for you all that have done this.

    Q: is there anyway to do this without a breadboard? (kinda working on a budget here :( )
    I have all the correct parts I need 5.1v zener diode’s, 2.2k resistors and db-9 female.
    if it is posible can someone please post the diagram for me on the site? my old tech classes are abit rusty so the scematic is abit hard to fully undestand.

    thanks for the help.

  361. Comment by Loris:

    Hello People,
    Thanks at all for support.
    I’ve just tryed succesfully on a IBM G40 with IBMpass for Dos.

    Ciaoooooooooooo

  362. Comment by Poetic Ruins:

    ok, fixed all up, now all I need is the dump from a t41 with the SVP cleared. could someone please send me one or two, that would be great.
    PoeticRuins(at)gmail(dot)com

  363. Comment by P.K.PATNAIK:

    sir still we are in confusion with the procedure pls explain step by step procudure so that we can do it.

    Thanking you sir
    with best regards
    P.K.PATNAIK(TRC IN CHARGE)
    SILVERTOUCH TECHNOLOGIES LTD,
    NO.210, SHREEJI CHAMBER, B/H- CARGO MOTORS
    OFF- C.G ROAD
    AHMEDABAD, GUJRAT.

  364. Comment by Mahesh RAJA:

    Hi dudes ,
    I was so excited by seeing this site , I am having IBM X-21 model TP . I am unable to enter the TP as I dont have its supervisor Pass word and I have read all this article but unable to get in the software logic and using the other spare pc , Pl I would like to know +++++ details about the spare pc using and all about its easy ness .

    If any one is having same model and encountered the same sought of situation pls do me help me out , would be highly indebted for ur kind help ,
    Yours friendly
    Mahesh raja

  365. Comment by anderss:

    Yahoo!. My T60’s alive again. I gotta say for all of you, the T60 needs the new tools RPC8394 and WPC8394 from allservice.ro, at first I was looking for the 24RF08 but this model doesn;t have such an eeprom.
    Keep up the good work, allservice.ro!

  366. Comment by Lori:

    Hi All, I have a T60 with BIOS password. I found the ATMEL chip on the bottom of m/b close under the CPU. It has label 25010AN SU27 with 8 pins.
    Anybody experience in this model or could somebody can send me please a clean dump file? Also so you think by purchasing the PC8394 tools I will have a guaranteed success (by having some electronic experience of course :)?
    Thanks for any help provided!
    Lori

  367. Comment by Dande:

    Hi! Outstanding site mate, outstanding site! I’ve managed to unlock a T23 with your tutorial. With a friend (who has more experise in ironing less-than-millimeter pins) we’ve built the reader unit (the simple one), without a breadboard (using traditional switch, to control GND; and SCL, SDA separately). I wanted to make some photos of the process, but I forgot, but if you need, I can send a photo of the final reader unit (without the switches). The whole thing worked like a charm, found out the password, and the TB looks much better now, than in the trashbin. Keep up the good work!

  368. Comment by Joe Montego:

    What is the best way to reset the password on an IBM Thinkpad X41 with an Atmel AT97SC3201 28-pin chipset ?
    Your help in advance is greatly appreciated

  369. Comment by Joe Montego:

    What is the best way to reset the password on an IBM Thinkpad X41 with an Atmel AT97SC3201 28-pin chipset ?
    Your help in advance is greatly appreciated.

  370. Comment by Bill Choy:

    First of all I like to thank you for providing this wonderful site.
    The location for this ATMEL is for IBM (X40)
    The ATMEL 24RF08CM is at the back of the motherboard and is directly under the PCMCIA slot. This chip is cover by a black tape,
    1st go to Start>Run>cmd> and type in cd c:\ (This is for you to direct the folder to c drive).
    Following command is all you need to type in.
    C:\ALLservice\24RF08\r24rf08 dump.bin
    Just for your info.
    The first spare PC I connect didn’t work (Compaq Evo N610c). The 2nd spare PC (Toshiba 1860) work like a magic.

    Many thanks, manag to get the password using your technique.

    I have some picture taken showing the loaction of the ATEML on IBM X40, please tell me were can I email.

  371. Comment by Martha Fox:

    I have retreived a eeprom dump from a G40 motherboard using your info, but I am unable to decipher the password at 0×338 and 0×340 which is (17 14 32 - - - - 5D). Is this an encryption, or lack of suitable software? Thank you.

  372. Comment by Nick:

    First of all, thank you for providing this wonderful site.
    I have IBM TP R51-1830, i found the ATMEL 24RFC8 cn 0417 location and i did all but never received any dump.bin file in dir.
    could Help me what’s the problem or if anyone that has the same model (IBM TP R51) please send me a dump of the eprom bin file.

    Your help in advance is greatly appreciated

  373. Comment by Pablo Gonzalez:

    Hello,

    Thanks for the great solution that you have provided, i have followed all your instructions, how ever I have a dump.bin file that has memory address 0×330 encoded. Do you have a solution for this?

    Your help is very appreciated.

  374. Comment by Pablo Gonzalez:

    Hello,

    I found out how to translate the “encoded” password to “scancode” yet i cant seem to get a proper password from it.

    The password it dumps is “›Ûm ^Ì@”

    translation ” D fI”

    I have tried various combinations of this output but still have not had any luck.

    Thanks for the help.

  375. Comment by adelouane:

    i have sony vaio ar11m but with pass word the bios phoniex can you help me

  376. Comment by Martha Fox:

    All service provided me with the password from my EEPROM dump, and a revised version of the software that works with Windows ME. Thanks.

  377. Comment by Ryan DaCosta:

    Hi, I am planning to try this process. My knowledge is limited with electronics, so does it matter what type of wires you use. Also do you need an Ohmmeter? Next, how do the resistors, diodes and ground connect to the Serial Port 9 pin Female connection? If anyone can send me a picture that would be great. golroch@hotmail.com

    I found my R40 Amtel chip below the Harddisk, someone already posted it, should have done a search on the page, almost tore the whole laptop apart :-)

    Anyway if someone could reply to my question, that would be great.
    Thanks.

  378. Comment by Nick:

    First of all, thank you for providing this wonderful site.
    I have IBM TP R51-1830, i found the ATMEL 24RFC8 cn 0417 location and i did all but never received any dump.bin file in dir.
    could Help me what’s the problem or if anyone that has the same model (IBM TP R51) please send me a dump of the eprom bin file. nikiterani@usa.com

    Your help in advance is greatly appreciated

  379. Comment by yahmeen32:

    i could really use a full view picture of the reader cable assembled for reference

  380. Comment by yahmeen32:

    i also would like to help with joe orginize by model and step by step photo included

  381. Comment by Robbes:

    Hi guys!

    I have the IBM Thinkpad T43… How can i make this with the SVP??? I pay you!!!! please hep me… Give me an answer at my email accont….

    Robbes84@yahoo.de

    Please help me!!!!!!!!!!!!!!!!!

  382. Comment by yahmeen32:

    @Bill Choy

    photos for x40 chip location
    send photos to yahmeen32@yahoo.com

  383. Comment by Filipe:

    Hi ppl…
    I need some help, a very good help because I have a problem that aren’t in this posts so I requered ADIMS Help! I can read the Eprom and e see where is the passwrd place but the pass are spaces, or blanck spaces and I cant put pass on the TP! I trie lots of combinations but…nothing!

    ADIMS SOME HELP PLZ…
    sorry my bad Inglish…I’ll wait for a replay.

    filipe_fiambre_essm@msn.com

  384. Comment by Cristofer:

    poderiam me ajudar por favor em um think pad x31? e o mesmo procedimento acima? ou o esquema do cabo muda alguma coisa? desde ja agradeco!!

  385. Comment by Bizboy:

    Hallo everybody, i want to ask how can open bios pass for IBM Thinkpad T60?Thanks for help from now, im waiting pass bios IBM Thinkpad T60 mail me,thankz!!!

  386. Comment by Bizboy:

    so mail me: avtomat75@mail.ru

  387. Comment by Bizboy:

    Error 0271 - check date and time setting?????
    and asked pass,,,?

  388. Comment by rex:

    Hello,

    I have a Lenovo ThinkPad T60. I forgot the BIOS supervisor password and need to unlock it. I have already purchased the parts to build the interface to connect to the security chip. Can someone please send me a picture or tell me where the security chip is located in the T60 and what leads to connect? My email address is: psyhead[at]gmail[.]com

    Thanks, Re:x

  389. Comment by Benito:

    Hi Victor Voinea I try to Unlock an IBM Laptop R50 , But what I get as answere is not possible to read because the password is TCPA encrypted.

    I want to buy the other program like RCPA reset service
    W24RF08 license (eeprom writer)

    Is there an other way to buy the programs accept with a Credit card or Visa Master card

  390. Comment by Héctor:

    Hi, i have a thinkpad t22, and says crc1 error 0175, i know that this is the bios, but my question is… ¿does anybody have a bin working for that machine??, pleaseeeee, i really need that, if anybody has one, please contact me as ingersur.redes@gmail.com thanks already

  391. Comment by Sönke:

    I come from germany
    I have a T20 and i could read the eeprom, but the programm IBMpass2.1 doesn’t show me any supervisor password. What is wrong - I need help
    Thank you.

  392. Comment by Benito:

    Hi i try to Unlock an IBM Laptop R50 , But what I get as answere is not possible to read because the password is TCPA encrypted.

    I want to buy the other program like RCPA reset service
    W24RF08 license (eeprom writer)

    Is there an other way to buy the programs accept with a Credit card or Visa Master card

    Please contact me on me as bresida@yahoo.com

  393. Comment by Héctor:

    anybody has the rom, or bin of the thinkpad t22???, pleaseee send to meeee ingersur.redes@gmail.com

  394. Comment by Dexter0907:

    Thanks, is there ways like this for other brands.

    Regards Dexter

  395. Comment by anderss:

    @Benito

    But the other program and the reset service is provided by allservice.ro, go and ask there, not here….

  396. Comment by sh:

    Hello ,
    tray all your explanation but unfortunetly when start the software r24rf08 dump.bin I got the message eeprom does replay.
    I am using T60 with his docking station ( where we have serial port)
    at backup pc.( the T60 doesn’t have directly Serial port)
    Do you think this configaration can make this error message?
    Or do yo have one idea from where I maked e mistake ?
    Thanks a lot for your help
    steve

  397. Comment by Héctor:

    hi sh, do you have a bin for t22???, if you are please send to meee pleaseeeeeeeeeeeeeee, ingersur.redes@gmail.com
    or if you know a page or something too, thankssssssssss

  398. Comment by martin:

    DO it ITS 100% WORKING THANKSSSSSSSSSSS AAAAAAAAA LOOOOOOTTTTTTTTTTTT

  399. Comment by mark:

    I have a number of ibm/lenovo recovery disks if any one needs help with that.

    mark

  400. Comment by mike b:

    I have a TP t23 lock. Anyone in San Diego area or close to me willing to help me out? I’m willing to drive to your place as long as it’s not too far… Willing to compensate you for your time. Thanks please let me know.

    vixayb@gmail.com

  401. Comment by GEINER VOLCAN MORA:

    i have an T30 and i dont seem to find the atmel chip it may be named othervise any ideas where i can find it? and What’s up if a connect my computer and it can not create the file (data .bin file)?.

  402. Comment by Héctor:

    if anyone have the bin of a t22, t21, o t23, please send to meeeeeeeeeeee , ingersur.redes@gmail.com

  403. Comment by shath:

    ineed 2 cleer bios bassword in ibm laptop mod no r 40 e thanx

  404. Comment by Moimeme:

    Hi guys, can somebody tell me where is ths GND on the TP??
    I’m a newbies and i can’t locate the GND on the motherboard.
    Thanks

  405. Comment by Sönke:

    Hi, I need the pin for the t20, the dumb.bin does not include the password in line 0×330, there are some letters, but they aren’t accepted!!!!
    Help me please!!!

  406. Comment by Andy:

    Hi,
    I was able to dump the data from the R24 chip. However the data looks encrypted or just plain trash. Is there a way for me to re- write a password? Any help is greatly appreciated.

  407. Comment by yahmeen32:

    O.K I have X40 the 24RF08 chip is located on the underside of the motherboard below the PCMCIA slot. did not solder chip tried but could not get found something online to make easier (Pomona 5250) is a chip holder that give you more room less chance to damage chip but i used two sewing needles & a eraser head from pencil (to hold both needles at same time) everything else worked like a instructed had a blast. need help or photos e-mail

  408. Comment by yahmeen32:

    @ Andy click buttom just under tool bar it should say Aa off click to say on and click on view in toolbar goto translation click on alternate scancode R series

  409. Comment by Darrell:

    It worked! I (had) a locked R51 Thinkpad and this procedure worked perfectly. Only trick was converting the coding in the line where the password was to ascii (I think) and it was revealed! Luckily, I used the same password for both the BIOS and the HDD. Thanks!

  410. Comment by Sergey:

    Help!!! Pease, who, than will be able!!!… Has Lost the password on supervisor (SVP) IBM T60p. I well understand in computers and know that not all so simply. Here over and over again tried to raise this subjects, but as well as have not discussed. If, there is information send on mail admin@rd.com.ru Thanks!!!…

  411. Comment by Sergey:

    Help!!! Pease, who, than will be able!!!… Has Lost the password on supervisor (SVP) IBM T60p. I well understand in computers and know that not all so simply. Here over and over again tried to raise this subjects, but as well as have not discussed. If, there is information send on mail admin@rd.com.ru Thanks!!!…

  412. Comment by Moimeme:

    PLEASE GUYS, WHERE IS THE GNDDDDDDD
    PLEASE

  413. Comment by Jake:

    Need Help. OK so i have looked on many websites and have determined that there are not many answners about the T43. I cant seem to find the atmel chip on this unit. Does anyone know if the crack is possible with this unit. Or where i may find the chip. I have the main board out and have checked it top and bottom. I think that i am missing something> PLease help.. Thanks in advance.

  414. Comment by softpedix:

    There is a simple answer, RPC8394 and WPC8394 reader and writer for PC8394T-VJG used in T43.

  415. Comment by Jake:

    Ok got it. But do know where the chip is located on the mother board? I cant seem to find anything on the board that says Atmel. Any suggestions on the location of a picture of its location.

    Thanks again

  416. Comment by juganmagan:

    Hi,

    I used the same steps to unlock my T42P password but i am not able to see any password in dump.bin file.

    Pls help me in this regard.

    Thanks

  417. Comment by softpedix:

    Jake,

    What ATMEL? T43 has the Winbond PC8394!

  418. Comment by Jake:

    softpedix.

    I now understand that. Thanks. Where is the Winbond PC8394 located at on the board. Thanks In advance

  419. Comment by gomes:

    a friend gi-me a old t21 but he fargot the bios pass.
    here is the softwere to red the eprom , i cant find is it here
    tanks

  420. Comment by Dande:

    Hi again!
    Do you guys know, what kind of supervisor protection is in a TP 560Z? The same ATMEL chip, or other?
    Thank you!

  421. Comment by Martin:

    Hi Everyone,

    I have read the instructions and the diagram. I want to try for my T21 but I am not sure how and where will I connect to the spare PC. Should I connect the soldered serial port(female) to the male port on the spare PC?

    I would be so grateful for your reply.

    Martin

  422. Comment by Dande:

    That’s true … good luck!

  423. Comment by Moimeme:

    NEED HELP
    Hi guys, i’m trying to crack a password bios for a thinkpad t42, but i’m a newbie, can somedbody send me a photography with the place of the GND??
    my mail : lilimamacece@caramail.com
    Thanks

  424. Comment by Big Bird:

    Just did this on a T42 - everything works 100% !! :-)
    But remeber to press the A->a button (top left) in the “IBM Pass 2.0 Lite” app.
    On a T42 the ATMEL is under the wifi card (under the mousepad).

    To Moimeme: GND is everywhere! :-) I screwed the GND wire in under the shield for the DVD bay.

  425. Comment by Martin:

    I have T22, I went to radio shack today.. but could not find 2200 Ohm Resistors, instead found 2.2 Ohm (indcated on the diagram but requirement list). Even there are two options in 2.2 Ohm ie. 1/2 watt and 1/4 watt. I just bought as set of 2.2k Ohm (1/2 watt) and 220k Ohm (1/2 watt).. which one will be the right one? Any suggestion?

  426. Comment by Oblivious:

    Is there any way that i can clear the supervisor password on my ibm thinkpad 600 without soldering. Ive heard that you can use an eight pin test clip, but i am not sure of the details.. Can someone help me??

  427. Comment by softpedix:

    @Oblivious

    See what Ray Kawakami experienced with the 600:
    http://www.allservice.ro/forum/viewtopic.php?p=915#915
    No need to remove the board, anymore

  428. Comment by youssef haddad:

    thank you for this very good programmes and also good thanks for allservises website

  429. Comment by juan:

    hola si querian pregutar me da foto de disco rigido para ver manual

  430. Comment by Danda:

    Hallo.My friend bought Lap Top Lenovo T60.It is booting normally but when You want to enter bios it is asking for password.Wich kind of password is this,is it supervisor pass? I can work in Windows,I think even that I can reinstall it,because when I press F12 key it is offering me boot options.Only thing is that I canot acces bios.Is the procedure for removing that password the same that is offerd here or it is easer? Because I have had an Lap Top T30 wich hade this power on password.It was asking for password on power on.Can somebody help pls?

  431. Comment by Eric:

    Can you put this instruccions in spanish?, Thank you.

  432. Comment by Kamlesh:

    Please help , I am Also stuck up with the BIOS Password

  433. Comment by deepinder:

    i am having t22 laptop i couldnot find the bios please help me with steps
    thanks

  434. Comment by dan jensen:

    I succeeded in tapping the chip on my 390x, but the password is not revealed as in the tutorial. the characters on the line that is supposed to have the password are not discernable. any advice??

  435. Comment by steven:

    hi hope you can help i was given a tp 770 do you think this procedure will work on this model?it was free so nothing to worry about if it dos not work.

  436. Comment by Dande:

    I’ve found a 24C01 ic on the 560z located at the bottom side of the motherboard, between the Intel Flash and PLOW2 ics. I will post some photos, if wanted. So, i am going to break the little one in a couple of days, but, still have to solve some problems with it. Whish me luck :)

  437. Comment by joe:

    i don’t know how to hack my SPV password.

    please teach me how…

    hopefull……………………………

  438. Comment by Michael:

    I successfully retrieved my password using this technique, however, I now have EEPROM data errors.

    0187: EAIA data access error.
    and
    0191: System Security - Invalid remote change requested.

    I have been through the loop of pressing F1 to enter set-up.

    I think the EEPROM may not be soldered in correctly or I have damaged it. Any ideas?

    The thing I have noticed is that the SDA & SCL solder points on the circuit board do not seem to be connected to any circuit tracks. There are a couple of copper circles with holes through the board next to the SDA & SCL surface mount points. Should these be connected with solder. I tried that too but this time the laptop just bleeped at me, so I don’t think they should be.

    I appreciate any help anyone can give me.

    Many thanks!

  439. Comment by mdj:

    How much does a R40 pentium 4m costs?

  440. Comment by nada:

    When i try to enter to the bios utility it show an error to me something like it has been tampered or something like that, then it asks for the password

  441. Comment by Nathen:

    Look on ebay there are people that can help you, just search for IBM Password Removal, I have unlocked mine on ebay with a guy that has laptops 4 less from IL or something like that, I payd him to do it and I had my laptop back in less than a week in perfect working condition. I believe he can remove the password from any IBM model. I tried to unlock myself and I spent more time and money than my T43 is worth it, so I touth to give you guys a clue if you’ll be in trouble like me. You’ll spend more money than you’ll pay for the parts but if you think how much time you’ll spend reading all this forums and how to do it than you would reather go with someone that does this every day. If I would have found this info before I would have been less frustrated.

  442. Comment by master:

    hi!
    wer weiss welch E-prom hat T43, und wo ist.
    Danke.

  443. Comment by softpedix:

    @Nathen
    All the guys that claim to unlock newer IBM laptops are just using allservice software. This is available for everyone, the software is PC8394 programming tools, so don;t be silly.

  444. Comment by Francis:

    I have problem with T23… can any1 help me.. it d same the bios password prblem.. with the lock ICon on side.. .is it applicable this procedure to my TP T23?.. Can any have any idea.. I Really need Help..

  445. Comment by Francis:

    plz i really need help :((

  446. Comment by Jarak:

    Hi all!
    My father died and now i own his r52 can i do this tutorial or do i need this full package for money? actually i got no money:(

  447. Comment by erik:

    To fix a nonworking T21 my son bought a t21 motherboard at a local internetshop, RenS computer. The guy said it should be working. Starting up, hurray. Oh no, pass word asked… Shop owner asked for help: claimed ou own fault, could not get him to refund or give any other help. My opinion, he stole €60,- from my son for a unusable board. Pass the word: R&S computer in Holland can’t be trusted.

    Anyhow: your site did bring the solution. Build the electronics, resitors and zeners only, downloaded programs, soldered in and found the pasword. It realy works now.
    Thanks a lot

    Erik

  448. Comment by arie:

    IBM Thinkpad T40/p , T41/p , T42/p Password Security chip i cant find it on my r40 board can somone help me

  449. Comment by Francis:

    have problem with T23… can any1 help me.. it d same the bios password prblem.. with the lock ICon on side.. .is it applicable this procedure to my TP T23?.. Can any have any idea.. I Really need Help..

    need help….

  450. Comment by Francis:

    i have T23… with … a password luck too.. i need help..

    need help….

  451. Comment by GOMES:

    i have a t-21 look bios password , i pay a new eprom but were i can bay a new eprom in europe , or i sand the pc to unlook.

    thanks y need help , beacause my dogther lok-me the PC t-21

  452. Comment by Tom:

    Thanks Nathan you gave me the information I was looking for, I did not want to spend my time learning how to crack a password. I found the guy on ebay (ebay ID: less4laptops) and he unlocked my T30 for $25 + shipping, I’m glad I did not spend too much time searching for answers. I got my laptop back in 5 days. I’m really exited to have my laptop back :))

  453. Comment by Facu:

    I really appreciate if anyone can send me the bin of a t21.
    Please send it to fdocino@hotmail.com

    Thanks in advance

  454. Comment by tom brown:

    any1 know where i can download a service manual for the t22 from the internet? thanks!

  455. Comment by stebra:

    What really is the point in attempting to recover your own/lost password from an IBM thinkpad laptop computer ?
    Are all you people really going to go out and purchase little things called diodes and resisters etc. and then attempt fine soldering of wires to the 24RF08 chip on a motherboard. After, ofcourse you have spent lord-knows how long stripping it down !!
    I notice someone on this site has published a ‘photo showing you the 24RF08 chip. Small is’nt it ?!……….What he does not tell you is that this chip is also produced in the 14-pin package and is present in many models of thinkpad !!
    You will need some very fine soldering skills indeed to attach wires to THAT particular chip !! The chances are quite high that unless you have previous training in this field, you will scrap your laptop !!
    There really is no point in all this time and trouble when you can get it done properly for as little as £30 + postage now, on the Ebay.

  456. Comment by ninja69:

    Hi. Wondering if you have a procedure on how to recover a thinkpad A31 supervisor password?

  457. Comment by stebra:

    The A31 model contains the 14-pin vesion of the RF08 chip. Forget any procedure unless you are a time-served engineer !!
    Best bet is to go to ebay and search for user-pushkin1974, and then send your unit for a lousy £30 plus postage and get it done properly !!

  458. Comment by poe:

    poe

  459. Comment by softpedix:

    A31 is having the 8 pin chip! I guess you’re trying to advertise somebody who just takes money for an operations that it’s free basically. Mike, did you see this guy?

  460. Comment by softpedix:

    A31 - chip location, in rest is exactly as for T40-t42
    http://www.allservice.ro/forum/viewtopic.php?p=2747#2747

  461. Comment by rob:

    I am unable to find the eprom for the T43. Is it the 24c64rp? That is the only chip that I know is an eprom. I really need this, so who ever knows the location please email me. rsmith86@gmail.com

    Thanks

  462. Comment by user:

    i conneted everything like the diagram, and when i press enter i cant find the dump bin file ,how do i find or tell if and where the bin file has gone,can anyone help!!!

  463. Comment by rodney:

    I have tried both systems Zenor and IC (max232c) and with 1st (Zenor) I get no action from the computer,with max232c it say no eprom found anybody can Help
    Please..!!!!!Rodney.

  464. Comment by stebra:

    According to “softpedix”, this operation is ‘ basically free ‘, as he puts it !!
    So far you’ve spent time and money on components and soldering and you’ve still not sorted it out !!
    It should be mentioned here that a PROPER password removal is not performed by all this messing about with circuits, solder and bodged software, it’s done using the Antron test-head. This device is inserted into the cpu-socket and the cpu is then inserted into the head. The board is scanned and a complete schematic is drawn-up on a monitor in block-diagram form. Any firmware on ANY chip is then dumped to an editor for perusal by an engineer. That is why password removals are cheap nowadays as there is no soldering done during extraction. Only the 2-bit companies and tight-fisted cheapskates are fool-enough to risk their laptop(probably expensive) on dubious operations !!

  465. Comment by Micahael:

    I have a IBM Thinkpad T42p and i forgot my power on password can i overwrite it somehow without using like disks to clean it out. I need help. I cant figure it out and when i got to my bios its locked also. Can anyone help me?

  466. Comment by Michael:

    i dont want to take it apart though so is there a way to bypass it?

  467. Comment by Michael:

    Can anyone give me advice? Please?

  468. Comment by stebra:

    Wrong ’softpedix’. The only person who is blowing ‘hot-air’ as you call it, is YOU…..trying to get the chips off the the boards !!……my boy.
    I have just over 21 years experience in electronics engineering and microprocessor based systems. I rather think that it’s YOU that holds the title of ‘boy’ !!
    I know about the Antron test-head…………….Because it was ME who sold it to Pushkin for £7,500 smackers !!
    That’s how i know what i’m talking about.
    Most of the people on sites like this are dealing with stolen laptops anyhow. Let’s be honest……….What type of person forgets their password when they are typing it everyday in order to use their laptop ???
    Oh yes, almost forgot…………Does anyone know if this pedix-boy works for allservice ?………..He keeps mentioning their name all the time !!

  469. Comment by Martin:

    Hi,

    Anyone can direct me to locate ATMEL Chip on T22 board. I would be more grateful if you can show me with the picture. I checked the board carefully but couldn’t find any chip written ‘ATMEL’.

    Reply me at my email: martinralte1@yahoo.com OR in this page.

  470. Comment by Michael:

    no, its not that i stole it. i really have the worst memory in the world. Please help

  471. Comment by Francis:

    any1 .. can just answer my question is this procedure.. also applicable to T23? i Really Need the answer thankz. again..

  472. Comment by softpedix:

    @Stebra:
    If you read this forum “da capo”, I am sure you’ll notice that all the discutions here are about using allservice’s free software, so its normal for anyone to mention their contribution. I will repeat this word for you: “FREEWARE”, does this mean anything? Hello? So go anywhere else and sell your 7500 non-existent solution (very amusing after all, I laughed with tears, no offense, but was a good one..) and let us be.
    Oh, did I mentioned some idiots trying to make money.. I didn’t mean you. Do you feel offended? I know it hurts, but I can do anything for you, is the nature. So, if you didn’t come here to provide a free solution, then don’t come to sell your Pushin or Gorbatchev friend, because we simply don’t buy it. Got that?

    @Martin, Francis: T20-23 have a 14 pin eeprom, it’s near the memory SODIMM slots. Just remove the memory cover and you’ll find it in seconds.

  473. Comment by Francis:

    thankz MArtin.. its the simple chip right beside the memory right?

  474. Comment by Francis:

    i GOt.. but the problem now is where i should solder the 3wires …i mean the ground.. the 2 for the reader… am confuse.. itz for the 14pins atmel chpiz

  475. Comment by Martin:

    I did with T22. It has 14 pin..! It works very well. 8 and 14 circuit instuction is found in http://www.allservice.ro/forum/dl/simple-i2cprog.pdf.

    If any one like need helps email me at martinralte1@yahoo.com

    Thanks,

    Martinralte

  476. Comment by web lexikon:

    God damit, soon 500 comments!

  477. Comment by Dexter0907:

    Please… I have fujitsu siemens laptop, and locked bios too. Do anybody knows how can I do it on this way with FJS or to redirect me to some site? Thanks

  478. Comment by Captiant30:

    Help,
    where can I order the C5V1 Zener diodes. cant find it

    thanks

  479. Comment by marcellus hill:

    If you an 390e tp the chip is located in the the right hand corner right next to an compactior and surround by usb and power porte

  480. Comment by selaiman Fazli:

    hey, man i have also this supervice password thing.
    So i hope you could help me….:D
    I have a IBM Thinkpad R40e

    how can i open it…??

    hope u can help me…

  481. Comment by abi:

    hi mike, how about Thinkpad T60. pasword supervisor please. thank’s for your attention.

  482. Comment by ALF:

    HI IM TRYING TO CRACK A PASSWORD(BIOS) IN THIS WAY BUT ALL I GET IS A PROMPT THAT SAYS ..EEPROM UNAVALIBLE..
    WHAT THE HELL DOID I DO WRONG?PS I HAVE A A31P..PLEASE HELP

  483. Comment by Inzalinh:

    I need soft w24rf08 ( cracked)

  484. Comment by Wesley:

    I am trying to locate the Atmel 24R08 chip but cannot fint it on my Thinkpad R32. Only able to find the Atmel 93C46. Hope someone can help.

  485. Comment by Edgar:

    I have a T30, I obtained to execute the circuit, only that I do not obtain to descodification of password administration..$!!Ì… Somebody can help me?

  486. Comment by jean:

    I have doing all the plan, i runned Itester and all seem to be connected, but when i do the command to make the dump, it say eeprom not available.

  487. Comment by jean:

    NEVERMIND IT WORKED, I WAS ON VISTA THAT WHY , I TRYED IT WITH WIN XP CMD AND IT WORKED !!!!!!!!!! WOOOOOOOOOTTTTTTTTT

  488. Comment by Branko:

    It’s half past three in the morning, and I got pass!!!
    A friend of mine brought me a laptop (of questionable origin) to repair. Firstly, I soldered wires on wrong side and was afraid that the chip was burned. However, everything was ok, and I got password.

    Incredible

  489. Comment by eagle:

    i have t42p, i found the chip ,i solder the wires ,everything by the book ,i entered the command in the command prompt ,and it said that the circut not found or something like that , and than after few tries ,the notebook wont start ,what shoud i do ,is the motherboard gone dead, or just the eprom ,should ii must programed again
    please help me ……. if there anything to do with it

    thank u

  490. Comment by eagle:

    i also ran a file in C:\ALLservice\24RF08 directory called itester.exe and than i cancel it in the middle ,than the tp went dead
    maybe this is what cause me the problem
    please somebody help me ,please

  491. Comment by Yao:

    I have a ibm thinpad T22 mobo with FRU 12P3890.

    I can’t find he ATMEL chip.

    Any help ?

  492. Comment by Philippe Tuan:

    hi,

    I have a laptop IBM T 21, but I have a trouble with the AC adapter,, it does not work so I need a schematic diagram of this ac adapter. Can you help me>

    Thanks

  493. Comment by eagle:

    Can anyone send me a clean EEPROM dump from IBM ThinkPad T42p?

    can i program it back, cause the tp doesn’t show any screen when i turn it on, what should i do ? is it worth it ?

    please somebody hekp me

    eagle1234@walla.co.il

  494. Comment by Binarytechzone:

    Thanks! instructions couldn’t be simpler, used it to recover my T42 TP so problems, worked on first try. very well written!

  495. Comment by Eddie:

    need help

  496. Comment by Eddie WILSON:

    QUESTION 1
    Not IBM but second pc, when it asked me to fire up cmd on other pc-ok I did
    Then at that point what I see is C:\documents and settings\Eddie Wilson
    Where do I go from here? WHAT I DID WAS I tried to type cd\dir enter then cd\dirr24rf08 enter
    I don’t know can you give me the steps to navigate TO WHERE I NEED TO BE PLEASE
    Question 2
    On IBM T42P on start up I hit F1 and then it’s says enter bios THEN I get ERROR 0271: CHECK DATE AND TIME error 0176: SYSTEM SECURITY-THE SYSTEM HAS BEEN TAMPERED WITH. THEN I SEE A PICTURE OF A LOCK (WHAT DO I DO)
    LAST QUESTION
    TELL ME WHAT IM DOING WRONG. Okay ON SECONED PC I TRIED TO NAVIGATE TO WHERE FOLDER SUPPOSE TO BE AT, WITCH I DONT KNOW
    MY GUESS IS C:\ALLSERVICE\24RF08 - THEN I STOP AT THAT POINT. I THEN GO TO IBM AND TURN ON AND HIT F1 TO ENTER BIOS THEN I GET MY ERROR’S BUT I JUST WAIT TELL I SEE NOIGTHING BLINKING OR FLASHING PREETY MUCH I WAIT FOR A BLANK SCREEN THEN I CONNECT THE SERIAL PORT TO SECOND PC THEN I CONNECT SDA TOGETHER THEN I CONNECT THEN SCL, THEN I HIT ENTER ON IBM AND I GET NOITHING, CAN YOU HELP ME PLEASE
    THANK YOU

  497. Comment by Dennis c:

    No chip on IBM A21m

  498. Comment by Pete Daniels:

    So Do It Yourself:

    I was able to complete the task of unlocking my T30 by using your process however it went much easier
    than I planned or you described. After building the ckt and purchasing a USB to serial converter from radio shack and installing per the procedure the loaded down BIOS let me into Bios setup without extracting or using the software tools. I did try the exe apps but came back with some error referencing was nort able to detect data.(Perhaps the ckt was a white noise antenna which confused the Bios. At any rate I was able to assign a new hard drive password and delete the sys pass from my T30.

    Sincerely,

    pvincentdaniels@msn.com

  499. Comment by Edward:

    Is here anyone nowing something about de IBM THINKPAD type 2673?
    A can’t get into the bios in order to change the booting device from harddisk to cd-rom. Password needed.

    Thanks, Edward.

  500. Comment by Sue:

    Hi,

    My T20 thinkpad has come up with a stop post error 0175.

    I have read many articles some saying this is a password problem others say I have to replace the board, I am not sure which it is. I have made the reader but have not attempted to use it yet until I know if this is going to fix my problem.

    Could I please have a little help,

    It would be greatly appreciated.

    Regards,

    Sue

  501. Comment by Stu:

    Successfully read the chip and opened file in ibmpass but there are rows of f’s around rows 300 - 350 and nothing decodes for these rows. Does this mean it cant be unlocked?
    thanks for the great website.
    cheers
    Stu

  502. Comment by Petem:

    Anyone had the same problem i have..

    when dumping the chip all is ok ,i receive the 1024 bytes and when i open the file with ibmpass 2.1 lite i can see stuff like this at adress Ox227 :

    ThinkPad T42

    so i think that my read is ok,but at adress Ox330 the data i see is only dot and on the hex side i only see 00’s

    but i still cant come into my laptop,it all happen when i deceided to remove the password,so that my kids could use it after buying my new one….

    anyone can help??

  503. Comment by Jason:

    IBM Thinkpad R40. I have pictures if you want them of where the chip is that this site is refering to. Tim mentioned it’s location in the discussion area. Mike, e-mail me if you want these. They are a few meg in size. Probably under 3. The location is indeed below the hard drive and about 1″ over from the right front edge of the USB connection.

  504. Comment by Nicolas:

    Hi,

    to admin: thanks for these good informations…

    I have an IBM X30, and after I modified the PASSWORD (the ascii caracters was not readable…), at the 0×338adress and 0×340, the thinkpad tells me ERROR 0175: BAD CRC1.
    Whre could I find the checksum bytes in order to change them, or can someone send me a file of its EEPROM, in order to download it.

    Thanks

    Nicolas - malinerie@free.fr

  505. Comment by Stu:

    After getting a row of ‘f’s I went back and tried another dump and this time I got the password revealed at 0×330 as promised. Many thanks to your website.
    IBM T20 now back up and runnin’
    Stu

  506. Comment by Edward:

    How do I remove my password onder “leave a reply”?
    Can someone remove it, because I can’t.

  507. Comment by John:

    Hello,

    I was able to recover the supervisor password of a R50e laptop using this method.

    Thanks!

  508. Comment by NAthaniel:

    am tryin to do this on a t30 2366 and is not workin out all i get is a error code sayin circuit not found my chip looks backwards compared to the pics so which is the sda scl is there a way to tell like pin number need help soon before i pull out my hair

  509. Comment by kimbersm:

    @ Captiant30 …….

    I used the 1N4733A 1W Zener Diode (Catalog #: 276-565) from Radioshack, it worked for me.

  510. Comment by Sue:

    Hi,

    I posted a message on the 19th and forgot to give my email.

    Could someone please help me regarding T20.

    Regards, Sue

    the_pooks@hotmail.com

  511. Comment by Acki:

    Worked great, (T40) thanks!

  512. Comment by NAthaniel:

    still waitin for a response to my last post

  513. Comment by Fritz:

    Can I use an standard diode (ZD 5,1V) aswell?

  514. Comment by Champy-of-ivorycoast:

    suppervisor and HD password problem, i have a Thinkpad X31

    please help me, someone offer me this computer

  515. Comment by Champy-of-ivorycoast:

    suppervisor and HD password problem, i have a Thinkpad X31

    please help me, someone offer me this computer

    nestorgba@hotmail.fr

  516. Comment by dave999:

    well iam happy about the stuff you give foe free keep up the good work give knowledge and gain more iam also willing to help in any thing in your ordeal please mail me also i need schemetic diagrams of laptops p3 and p4 as new components are being manufactured adn put to use in laptops

  517. Comment by godfrey:

    Thanks for the info. It took a couple of hours to complete, but i was able to recover the password on my Thinkpad a22m. By the way, the factory supervisor password was “SUPPORT”.

  518. Comment by sulejman:

    ibm type 2652.
    salut.je arives pas trouves le eprom je ublies les codes je arives pas entre dans bios.merci

  519. Comment by Mrwillson:

    SOFTPEDIX I have a ibm thinkpad Z61t which boots straight to bios, can the above software/hardware crack work on this?
    gratefull for any info recieved

  520. Comment by Antonio:

    ciao,io ho un ibm tinkpad t20 che non funziona,mi mandi un link dove posso trovare come procedere per individuare il guasto ?,grazie

  521. Comment by softpedix:

    Mrwillson,

    No, the above software doesn’t work, you need PC8394 programming tools from allservice. The method is pretty much the same…

  522. Comment by NAthaniel:

    still no luck with my t30 2366 still says no curcuit found need help am goin nuts
    qpid315@hotmail.com
    aim lust8783

  523. Comment by waqas chuhan:

    what is the password set by ibm corporation (by default password)

  524. Comment by Chris:

    Great! Thank you so much for all the hard work to post a such great threat.

  525. Comment by Dai748:

    Hi
    Has any one retreived the bios password on a T60 succesfully??

  526. Comment by Alado:

    Can any body help me with the T60, where is the chip located. Is it the same circuit used?

  527. Comment by dan jensen:

    I got the dump from my 390x but it did not reveal the password.. line 330 read all o’s and line 340 read 58 c4 fa 0b 44 b4 fa 02. Above and below were all f’s. the far right column showed y’s with the umlaut sign over them. Does this make sense to anyone? It sounds like Stu (8-27-07 comments) succeeded by running the process again. Is it a common to need more than one attempt to get a successful read? thanks, dan

  528. Comment by RON:

    HOW DO I FIND OUT WHAT KIND OF THINK PAD I HAVE AND COULD U TELL ME HOW DO DO IT AGAIN AND,IS IT ANOTHER WAY

  529. Comment by bonestonne:

    i intend to use this method however i cannot locally find a pair of the Zener diodes.

    C5V1…nothing local..any suggestions as to where to look? what kind of scrap equipment would i find the proper ones in?

    i have a T22, original board croaked, bought one on ebay, locked BIOS…had it for a couple months sitting on the floor by my desk…would be helpful if you can help me!

    would you be willing to assemble one for a reasonable price + shipping to me?

    email’s best way to get me.

    thanks for the good walkthrough though, gives me hope for this T22. [2648-4EU]
    -bonestonne

  530. Comment by Garrett:

    I have a A20m but I cant find the atmel chip anywhere. I took off the keyboard and almost all the components but I don’t see it. Is it on the back? The Maintenance manual doesn’t tell you how to get to the other side of the motherboard. Does anyone know exactly where it is or have any pics? Thanks.

  531. Comment by STeve:

    I have T41 it has Power on password. Is it possible reset power on password as well.
    Please help me out. Thank you.

  532. Comment by gemma jamtin:

    hi, where do i find the amtel chip on my ibm r40 thinkpad , can anyone help me please.

  533. Comment by gemma jamtin:

    hi ,i found the amtel chip on my r40 but it has 24 pins , at97sc32012632510237 is the number on , is this the right chip , if so which is the scl and sda . thanks

  534. Comment by mikey:

    On a TP A31 I found the chip under the pcmcia slots. That tip about the AA button being on helps too. When you do try turning it on, I found I had to put some of the stuffing back in to get the BIOS screen up. I literally took every module off to find that 8 pin chip, I’m glad its still working after all that.

  535. Comment by Fritz:

    Don’t forget to activate the transcode button. I was wondering why I could not recognize the correct data ;) But then everything works fine. Thanks!

  536. Comment by JR:

    Hello everyone,

    I have a thinkpad t30 - eprom actmel 24rf08 with 8 pins.
    Now stops during boot with the message error 0175 bad crc1, I think that is because
    the contents of the actmel eprom is scrambled or something like that,
    so i have to replace it with a good one, so anyone that has the same model, please send me a dump of the eprom bin file.

    My e’mail jose.jabr@gmail.com

  537. Comment by papkis:

    what to do, when starting writing {System Security. Embedded Security hardware tamper detected. } code 0192

  538. Comment by Edward:

    Please, how do I remove my e-mail address onder “leave a reply”.
    Thanks, Edward.

  539. Comment by yasin yazıcı:

    hello my ıbm A31 loptop bios ım not bios clear pelase help me

  540. Comment by ept:

    Worked like a charm on an x30… only thing the walkthrough doesn’t list is that when reviewing the dump.bin in IBMpass, you need to click the A-A button to turn it to A-A On.

  541. Comment by Steve:

    Procedure worked fine on a TP 240x. The ATMEL chip is on the bottom of the motherboard. IBM has service manuals you can download at http://www-307.ibm.com/pc/support/site.wss/MIGR-4KLKLP.html that helps disassemble the laptop. Thanks for posting this information!

  542. Comment by telustech:

    I have a X60 with a 28 pin atmel,can this one be done?

  543. Comment by bryn powys:

    Well done to Victor who has saved lots of people money.
    I seem to have done something to my A31.
    Since i soldered the wires onto the amtel chip the screen will not work & no beeps. keyboard doesn’t work either.
    I thought I’d try & recover the password anyway & bingo like one of the previos posts the password is SUPPORT! (so the Amtel chip is still working)
    Any ideas on what I may have done?
    I removed both the battery pack & the CR2022 battery backup overnight - could this have caused it?

  544. Comment by Candlelit:

    Good work, this article!! I’ve done one thinkpad of my friend, even don’t know model:D If you do it exactly step by step it have to work. Thanks a lot for this.

  545. Comment by Fred:

    Help Please!!

    I built the simple circuit connected it to the Atmel 24rf08 chip on my Tnikpad T40. Ran everything just like it says and all I get is two different problems, at first got message that says eprom not available so I thought I soldered wrong on the eprom chip. Resoldeered then got error messages.

    error 0187 EAIA Data Access Error

    error 0191 Security System invalid remote change requested.

    which is followed by

    press to enter setup.

    When I attempt to run the r24rf08.exe program I still get the message of eprom not available.

    If someone could render assistance it would be greatly appreciated.

    Please send info to: fredengland53@msn.com.

    Thank you very much!

  546. Comment by Rafael:

    Hi
    i can’t find the chip on my laptop i took it appart and i don’t see any where it says U53 i have U3 U33 and if you wanna see a pic of the inside of my laptop so you could tel me where is locate it let me know, send me yr e-mail to ledesma45@hotmail.com

    Thanks

  547. Comment by Rafael:

    I forgot to mention that i have a IBM Thinkpad T60 and the start up password i don’t know it, have anybody had same problem that would like to share their password with me to see if it work for me.

    Thanks

    ledesma45@hotmail.com

  548. Comment by Aver:

    Help please …I don’t understand.What side of the db9 is in the schematics ? The back (where we should do the soldering) or the front one?

  549. Comment by Gaby:

    hello there
    for the one who was suffering from the null characters, from the bios, and also there was a guy told him that you dont have a psswork in your eeprom. okay the same happened with me and i got null character like rectangle %1,so at the same page i mean the ibmpass 2.1 lite at the upper left side you will fine two letter AA WITH AN arrow from above just push the bottin to on and it will change your null to real work i mean password. if it did not work go to view and you will see translation botton so put it on scancode and then pust the AA you will have the right answer, because first i got 1%1% and when i pust this thing it really work and i got DUNKIN as a password, and really i wana say thanks for the one who post this great information.

  550. Comment by happy:

    °celebration!°
    another t42 was saved today:)
    this was my uncles…
    for those with “eeprom not available” ->like another one mentioned before, look that no other program blocks the com. also your reader needs good connection! poor soldering of the resistors and zs make it real hard to get a good signal. crocodile clips for connection to the reader work quite nice. and try it several times…
    good luck

  551. Comment by Ian:

    I have an R40 and have just completed this. It does work though it is a bit tricky. To access the chip, remove the screen, keyboard and keyboard bezel. Take off the metal cover over the hard drive housing and also remove the hard drive. There is a thin sheet of black plastic that you need to wriggle under the hard drive housing to expose the chip. There are 2 8 pin chips and you need the one closer to the front of the laptop. The SDA connection is on the top right corner pin, the SCL on the pin to its immediate left and the ground to one of the large ground pads. The data is exactly where the instructions say it will be. In my case the password was EVHSBIO.

    Thanks for posting this info on your website and for providing the software.

  552. Comment by j.c.:

    ok i’m stuck what is the reader circuit that is meantioned here? and do u have to solder it or is there another way around it? tks.

  553. Comment by lillian:

    my brother gave me his old ibm thinkpad labtop he lost recovery disk where in rhode island can i buy a recovery disk hope you can help me thank lillian

  554. Comment by Rafael:

    Hi could anybody tell me where is the Eeprom on my thinkpad T60?
    i took everything apart trying to read all the chips and nothing.

    PLS helpppppppp!!!!!!!!!!!!!!!!!!!!!!!!!

    Thanks

  555. Comment by chaebaina:

    serial cod bios ibm thinpad seri 553846c/02/99

  556. Comment by baig:

    tag, ist mir bissel zu schwer, muss bei ebaygekaufte T41 HDD PW löschen, jemand aus DE(Berlin) der mir evtl helfen kann??Bt melden taqi74@yahoo.com

  557. Comment by kawo:

    hi, is the foto above on the top showing supervisor (SVP) password window or is this for Hard Disk password?? because on my t41 shows exactly the same symbol after starting the notebook, but if i remove HDD i can easy go into BIOS, and in there there isnt any supervisor (SVP) password been set, can any1 help me?? if i ll buy a new HDD the problem will remain there?? HELP ME HELP me SOS

  558. Comment by Fabio:

    Hi Guys!

    I’ve been trying to recover the supervisor password on a TP R50e and all I get is a Password I can’t use.

    Many of you are saying that this might be encrypted using TCPA. Have anyone found some way of decoding this?

    The password that came up is Fýgæ“[x (ASCII) or 46 fd 67 e6 93 5b 78 a0 (HEX).

    If someone knows how to decode this I’d appreciate very much indeed.

    Thanks!

  559. Comment by qonnor:

    i am working on a dell inspiron 700m and am having difficulty finding the serial eeprom chip. i have found a 93c46w6 chip and a atmel tiny12 chip the bios chip itself is a pmc pm40fl004T-33VC.can anyone help me? thank you

  560. Comment by John Makay:

    hello admin and all helper here
    i want first thank u all for sharing such usefull info

    i have a problem with an old TP 390E type2626 in supervisor passwd

    i see that am obliged to release a hardware for restore

    so if u can mail me with some good picts of soldering and making this kind of rs

    updater hw

    tnx in adavance

    sincerelly John

    best wishes

  561. Comment by elkhayame:

    thanks sow much for your help

  562. Comment by rplee:

    does anyone have any pictures of what this whole unit actually looks like when built? I have seen reference to other home built units but they all have many more components than I see here. Would love to build and use this if I can see or understand it’s construction better.

  563. Comment by murthy:

    i am getting error mesage eprom not found.
    some time i am getting bus not found.
    in my dump file also no data available

  564. Comment by julien:

    Hi there !

    First excuse me cause my problem is not a password problem, but I think this forum is the good place just to find the infos I need : my EEPROM is just dead on a Think Pad T22 - 2848, I mean the bios itself is corrupted, so I cannot boot on anything nor acess the bios at all. The post freezes on this message : 0175 bad CRC1 Stop Post Task. And there is no way to return to default values (I tried to replace or / and remove bios battery).

    My questions are : is it possible to remove the soldered eeprom, to re-program it elsewhere and then replace it on the mb ?? (friend of me have a machine to program eeproms) ? Or, if there’s is no jumpers to reset the cmos (is there not at all on this mb ?) would anybody knows another way to do that, for example in causing some short circuit ? The model of the eeprom is : ATMEL F 24F08CT 0119.

    I really hope there is an alternate solution for such a dammage, otherwise the mb is over for good. Thanks in advance !!

    Julien

  565. Comment by julien:

    I correct the infos : it’s an ATMEL F 24RF08CT (I had forgotten to type the R) well known as 24RF08, but this one has 7 pins on each size, wich are, critically, very smaller than the pictures in this tutorial. After new researches, I realy wonder if there is a way to REFLASH / replace / restore the bios with the hardware serial port method describer here.

    Julien

  566. Comment by dwayne crandall:

    well i have a t42 and i found the chip and all but and i saw the picture that was posted on your web site on what to do on my model but can you explane or send me a picture on how to hook up the spare computer to my chip. o and i have a atmelim thanks!

  567. Comment by slplsnphx:

    i have tp x41 which unfortunately has an atmel AT97SC23201 dhip, which has 28 pins, instead of just 8. here’s the pin diagram:

    http://www.atmel.com/atmel/acrobat/2015s.pdf

    as you can see, none of the pins are labeled “SDA” or “SCL”. so which pins would i solder to??

    or will the above mentioned method for the 8 pin atmel chips not work with the 28 pin chip that i’ve got??

    sixela918@hotmail.com

  568. Comment by ZerocooloreZ:

    HI! For all thoose with the funny CMOS batterie automatic draining syndrome.
    Please do yourself a favor and go to HOMEDEPOT and buy some plastic safe contact cleaner , and also a can of compressed air. Di assemble the laptop ( L3 all way ) and spray (soak) the board in the contact cleaner. After that use the compressed air especially around the QSOPS ( quad small outline packages ) and spray them with air until completely dry. Also make sure any CHIP does not have any cleaner under it. 99 out of 100 laptops it will remove and batterie draining, or onboard graphics problem.

    :) Any problems ? Fcm4400404 ( AT ) TECHIE (DOT) COM
    Frank
    313-5811313

  569. Comment by vMofa:

    brilliant! it’s working! my R40 is alive! thanx! it was an old password, but last letter was cutted off somehow! so i usually using 8-lenth, and after the “break” it was only SEVEN! anyway! that was very helpful! and working 100% with first atempt! CHEERS!

  570. Comment by vMofa:

    by the way, on R40 the ATMEL chip is located right under the HDD drive, 8-pin.
    good luck!

  571. Comment by CRISTIAN:

    Hello, i´m trying to make this circuit and the first problem that i have is when trying to read the memory says NO EEPROM available, it takes me a lot of time review the circuit and possible problems but i dont find it, if someone can help me thanks

  572. Comment by Boo:

    Works great.
    T30 chip is under the ramstick no need to take it apart.
    Usb to serial adapter is a no go

  573. Comment by LSV:

    Writing from my fixed T42. Soft and interface work great! Thanks!
    Some comments:
    At first I tried to run r24rf08 without connecting interface to the chip (wires SCL, SDA and GND not connected) and got error: “circuit is not found”. When I connected the wires to the chip got the same error. Checked the circuit - looked good. Next step I ran the reader program from another PC without connecting wires to the chip and got different error: “EEPROM is not available”. After connecting the interface to the chip I got the bin file with my password.
    So from my experience, if you keep getting “Circuit is not found” - try another PC with COM port. Double check your SCL, SDA, and GND connection if EEPROM is not available.
    Good luck!

  574. Comment by Steve G:

    Works!. Used on Thinkpad 240. Amtel chip is on the bottm of the motherboard. Requires removal of motherboard.

  575. Comment by keith:

    Will this work for a IBM thinkpad X41 Tablet series?? If the epprom chip is the same should this work?

  576. Comment by Curt:

    Hey, does anyone have a photo, or a general discription of where the chip is on an X60 tablet? If someone could e mail me a discription or a pic, it would help a lot. Thanks :D

    cr@ckthepla.net

  577. Comment by C DUBB:

    please help trying to find the ATMEL chip to recover T60 Password any pictures or info on where it is please.

  578. Comment by phorce:

    Worked on my X31 like a charm. Wonderful!

  579. Comment by Gerhard:

    Hi all
    I have a problem with my new Lenovo 3000 200N. I got a power-on-password. No idea why. I din’t put this password on the computer!!!! The Notebook is only 2 days old and I bought it new. Now I want to get something from IBM on guarantee …. no chance they told me it is necessary to replace the motherboard because that stupid power-on-password. I can’t believe that. Has someone an idea how I can remove the password? Often it is just necessary to remove the backup battery and not replacing the motherboard. Is there a easy way to delete the password? Unfortunaly the backup battery is located deep in the lenovo. I have to unscrew everything (including monitor and so on…).
    Thanks for comments
    Gerhard

  580. Comment by hoops 67:

    used to work on thinkpads and removed various models with forgotten POP’s

    fit new atmel chip

    used a special parallel port wrap plug to get past 175 bad crc errors, reflashed atmel inputting system board serial number eg(11S64f3402zj1226 37354p)22 digit serial number is on a barcode label on the motherboard, job done

  581. Comment by Imron:

    I need SDA (PIN Diagram) of Atmel Chip# 8356908 in IBM T60 Laptop
    please someone help me

  582. Comment by Wasiim:

    Hi all, i own a Lenovo T60 and the easiest way to remove the poweron password is to remove the cmos battery. Use the hardware manual on how to dissamble the laptop.
    Unplug it, disconnect the main battery and then take off the cmos battery. Leave the machine for a while and power on!!! Enjoy…

  583. Comment by Jinggo:

    Can anyone please show me the location on the system board where to find ATMEL on a Thinkpad 770ED…
    Thanks in advance…

  584. Comment by Jinggo:

    Can anyone please show me the location on the system board where to find ATMEL on a Thinkpad 770ED…
    Thanks in advance… email add: b34n_tut@yahoo.com

  585. Comment by MaxPower:

    Mil gracias, funciono todo perfecto, pude desbloquear mi t30 siguiendo las instrucciones.

    Santiago.
    Chile

  586. Comment by Jinggo:

    I found ATMEL 24C01A (8 PIN) on my TP 770ED and referred to schematic on c:\ALLservice\24RF08\rs232-I2C.sch - Sheet1, soldered a wire to PIN # 5 (tagged SDA) and Pin # 6 (tagged SCL). followed dumping procedure but got this error while dumping at the command prompt “ERROR: circuit not found or buerror”. Anyone .. Please advise… TP 770ED - my email is b34n_tut@yahoo.com
    Thanks in advance

  587. Comment by THE REEPER:

    I did this with my IBM ThinkPad A30. On this model the ATMEL 24RF08 chip is under the PCMCIA card slot. I found the chip but did not solder. These chips are microscopic and would be very hard to solder without professional tools. After putting on the magnifying glasses I took some very very thin wire and was able to wrap it around the pins on the chip. I then clear taped them tight to some plastic on the case so the would not pull loose or short out when I made my connections. Instructions worked fine and the R24RF08 v2.0b software pulled the dump file like it was supposed to. When I ran the IBM Pass 2.0 Lite software my dump file showed a lot of weird characters but no password on the line it should have been on. Then I found this post from earlier and it saved me. When using IBM Pass 2.0 Lite to see the correct characters the button AA in the upper left corner of IBM Pass 2.0 Lite must be on. When I did this the password appeared on memory address of 0×330. Hope this helps the ones that are afraid to put a soldering iron in their laptop.

    AS STATED BY THIS PERSON : IBM 390E TP : EARLIER IN THE POST
    I just found my password using the instructions in the first 6 to seven pages of this sight. If you are getting data and it dosn’t look right make sure to turn on the button AA in left corner. I’ve been working on this several days and poof there it was there are a lot of little details that you have to pay attention too. Finding chip can be the hardest. Good luck don’t give up it can be done.

  588. Comment by chris:

    i am trying to hack my ibm 600 Supervisor password i built the kit but can not get the 2 programs to read the chip and the ibm pass lite was wondering if anyone has them or were to get them tryed the links here will not let me download them
    e-mail to occchopper44705@neo.rr.com
    thanks
    chris

  589. Comment by stan:

    Check your zener diodes. I think they are supposed to go 1 way only.
    This repost might help too.

    Comment by Stan:
    Friday, May 4th 2007 at 7:46 am

    First, I want to thank all the posties that helped me to reveal the PW from my TP 600.

    I tried it first with the PONYPROG2000, dumped the file, but the password wasn´t visible. Then I tried R24C01 and it worked the first time. Enclosed the steps I exactely performed.
    You have to completely disassemble the notebook and remove the MB to get access to the EEPROM. For the job you have to connect all required parts back to run the system, also BIOS battery, but you don´t need the HD.
    I changed the COM port settings of my working PC (Device MGR>Ports category>COM Port1>Port settings) to Baud rate: 115200; Data Bits:8; Parity: none; Stop bits: 1; Flow control: none
    For this type of EEPROM I learned that it is necessary to work with the driven-IC2cprog device. First trials with the simple one didn´t worked.

    Thinkpad 600 – guide for reading the Supervisor Password with R24C01:

    1. remove the mainboard (Hardware maintenance manual page 87)
    2. locate EEPROM 24C01A at the bottom of the motherboard, right hand side, close to the upper left corner of the big PCIBus-IC when the connector row is facing to you
    3. solder 3 wires to pin 4, 5 and 6 of 24C01A
    4. build schematic: driven-i2cprog.pdf
    5. connect driven-i2cprog to com port of working PC and check port settings
    6. install ponyprog2000 2.05a Beta (freeware from www)
    7. Select from menu “Device>I2C bus 8 bit eeprom>2401″.
    8. setup > Interface Setup: serial, SI Prog API, select com port
    9. In “Setup> Interface Setup” invert the D-in, D-out and SCLK.
    10. change PONYPROG2000.INI: modify the line: I2CBaseAddress=0xA0 to I2CBaseAddress=0xAE
    11. Save PONYPROG2000.INI
    12. Setup > calibrate > OK….
    13. connect AC adapter to the TP 600 mainboard (mainboard without any other boards but with BIOS battery attached)
    14. connect GND wire of driven-i2cprog to pin 4 of 24C01A (GND also can be connected to any GND pad of the mainboard)
    15. press power button of the TP 600 mainboard
    16. connect SDA to pin 5 and SCL to pin 6 of 24C01A
    17. read eeprom with ponyprog
    18. disconnect SDA and SCL wires
    19. switch off the mainboard
    20. disconnect GND wire
    21. store the bin-file
    22. install ibmpass2
    23. open stored bin file with ibmpass2
    24. at ibmpass press button “AA” – on
    25. View>Translation>Scancode
    26. For 24C01 eeproms the password is located at 0×38, 0×40 – read password starting at 0×38 – ending at ????
    27. note password, if password is not shown proceed with a.

    a. Install R24RF01
    b. press power button of the TP 600 mainboard
    lc connect SDA to pin 5 and SCL to pin 6 of 24C01A
    d. Run R24C01.exe
    e. Use command: r24c01 your.bin /x /d /i
    f. disconnect SDA and SCL wires
    g. switch off the mainboard
    h. disconnect GND wire
    i. open your.bin file with ibmpass2 (as above 23 ff)

    Hopefully this will help someone.

    Greets

    Stan

  590. Comment by Adil EL HARAOUI:

    Hi, i need help if some one can !
    i have an IBM thinkpad R52, it is locked, i need to find THE BIOS PASSWORD , i have to finish my memory that i start it, and it steel in the hard drive !
    help me please , my e-mail is : adilelharaoui@hotmail.com
    thank you in advance !

  591. Comment by blinker2:

    What do I do if my pissed off brother has set the biometric print to his own, and I cant do a thing on the computer, not even press a single button. It seems the whole computer is locked up, but still starts up in windows to the login screen?

  592. Comment by sander:

    In place of soldering the wires you can also wrap a single copper wire around the mentioned pins on the atmel. It did work for me all the times and it leaves de MB unharmed. Only make sure that you have very steady hands, no coffee allowed!

    If you work very carefull you even maintaine the waranty!

  593. Comment by Nii:

    found the password when i clicked on translate, but when i typed it after packing my t42 i still have the same message asking for the password. can i have a program to re-write the information on the atmel chip?

    thanks
    Nii Kpakpa

  594. Comment by thecheese:

    There is a much simpler way to fix the password without desoldering the chip or using decoder software !

    connect two wires to a switch and connect to the sram chip at pin 4 (vss) and pin 5 (sda)

    make sure the switch is open and turn on the pc

    when the machine is booting press F1 for bios setup

    after a short while the password prompt will appear

    at this point close the switch and press ENTER

    (the bios will try to read the password from the sram but receive only 0’s (blank password))

    the bios setup will now appear

    open the switch again

    go to the password option and change to what ever you wish

    BTW if you are concerned about taking the sda pin to ground dont be, the sda pin of the sram and the mother board support driving the sda are both sink only outputs (ie pulled to ground) which has a few K pullup resistor to positive, connecting this to ground is perfectly fine as this is exactly how the system functions when outputing a logic 0

  595. Comment by father_fixit:

    Worked great on A22m. Chip is 14-pin on the underside of the board, very near the ram access cover. It can be seen from the access hole but don’t think you could attach to it without complete disassembly as i did. Here is a good diagram of the pinout for the chips http://www.passwordmethod.com/content/view/108/27/

  596. Comment by alidabiri:

    where’s ATMEL chip located on the a21m, please?
    thanks.

  597. Comment by Dino:

    This worked great on my T42, thanks! A tip for anyone getting the error “ERROR: EEPROM not available.”, try using another spare computer with a serial port as not all are supported.

  598. Comment by Darik:

    Tried on a TP R51 and it works great. Just make sure you push the “AA” button at the upper left of IBMPass 2.1 if you get weird symbols aftre dumping.

  599. Comment by hussain:

    hi i got thinkpad x60 the atmel is dirrent htne showing on picutre above

  600. Comment by James Cotton:

    I have a A20m thinkpad and want to reset the bios password. I saw your circuit and wondered if you had any for sale because I’m not too comfortable with setting the circuit up. Also when the bios password is reset can all the other passwords be reset thru the bios?

  601. Comment by hussain:

    can sum1 instruct mr how to find bois password for my thinkpad x60 i think its diffrent above picutre . also i has difreent atmel

  602. Comment by Dexter:

    I used the basic circuit as described. works great for the t42. thanks

  603. Comment by AndyChenoo:

    Don’t screw up your Thinkpad if you are not a good technician or have good soldering skills.
    We can do,
    IBM Thinkpad password removal, fast service. for T20, T30, T40, T41, T42, T43, T60.
    Service provided within Canada.
    Starts from $50,
    For T60, special price $199
    Tel: 001-416-518-6889

  604. Comment by gunnar:

    i give up… i spend the whole day and night with soldering this tiny wires - and i only get error-messages like:
    [code]
    24RF08 eeprom reader v2.0b - Win32 Console Version
    Copyright (C) Victor Voinea, ALLservice 2004-2005, http://www.allservice.ro

    —————————————————————-
    Initializing timer…6088 OK!
    ERROR: Eeprom not available!

    —————————————————————-
    Hit to exit…
    [/code]

    my tp is a t23 with 14pin atmel chip ‘24rf08ct’ version ‘0206′ using simple-ic.
    did i burn the chip? but it looks normal -how can i proof this?
    anyone here who had success with this chip?

    best wishes & thanks

    bluesmily (ät) gmx (dot) net

  605. Comment by gunnar:

    part2

    if i ‘block’ the correct working of this security-chip –>
    error-message like:
    187 eaia data access-error

    by pressing f1
    i could switch to bios…

  606. Comment by LEXMO:

    ThinkPad model R32 has not one but two ATMEL chips. The easiest to find the wrong one a 93c46 near the keyboard connector and close to the ATI video processor. Although a serial PROM it is not the one holding the password!

    The password PROM (24rf98c)is hidden under a clear plastic sheet underneath the hard drive holder frame on the top side of the main board. It is located just below the security chip socket and a little to the left. The printing on the chip is very difficult to see and finding the pin 1 dot is a very small dot. You have to remove the hard drive holder frame and the clear plastic sheet in order to view the 24rf08c chip.

    I wish I could attach a photo of the location that I have but the words above will have to do. eMail me and I will send a note with the photo.

  607. Comment by billyR:

    Thought it would be useful to share my experiance of carrying this out on a T42. firstly the interface it pretty easy to build, cost approx £3 for the parts including delivery. took about 30mins to make it and that including checking it twice to make sure I had everything perfect and i’ve not done any soldering for 15+years

    For soldering the 2 wires to the chip, you will need a VERY steady hand, good light and a very fine tip to your soldering iron. Don’t try this if you don’t have all of these. I also found it useful to have a solder sucker for removal of the wires after to you have finished and in fact the first time I soldered the wires on, the two pins became soldered together (you really do need a fine tip to that iron). The solder sucker was a saver and for £5 it really makes a mistake like this easy to fix plus you can remove the wires and leave a pretty neat job (I can’t tell anything was ever soldered to the chip).

    The software is easy to use and hey presto less than few seconds after obtaining the download from the Chip you can open the bin file with it and clear as anything the password is there as per the instructions. (Don’t forget to hit the button to convert the file once you have opened it)

  608. Comment by Drucius:

    This was awesome!!! Worked like a champ, once I connected all the wires correctly! (Had left the #8 wire off the db9 connector and it didn’t work, go figure)
    Anyway, thanks for all the help and support.
    Had a T42 that one of our disgruntled employees set a bios password for and I could not even re-format it.
    This opened it right up!
    Thanks again
    Drucius

  609. Comment by Chicago Service:

    If you find it hard to do it yourself we will do it for you. We’re based in Chicago area. Email us at we servechicago@gmail.com. We unlock all Thinkpad models. You can drop it in or mail it in.

  610. Comment by Chicago Service:

    THe email did not post right. It’s weservechicago@gmail.com

  611. Comment by Chicago Service:

    Once again, all the credit for whatever we do goes to Victor from allservice.ro who wrote all the programs, designed the interface and helped us a lot along the way. So if you use our services or if you do it yourself please take couple minutes to send your thanks to the genius behind all this. Thanks Victor!

  612. Comment by THE REEPER:

    Unlocked my A30. Then tried a Thinkpad R40 and got “eprom not available” .
    The problem was somewhere between the 1st laptop and 2nd I shorted out 1 of the zener diodes on my chip reader tool. Installed a new one and all is well. It must have touched something on the board by accident. I also used the super thin wire on this one so no soldering was needed.

  613. Comment by aliver:

    may i juz ask, where exaclty at the pc part will connect the Atmel chip reader?

    thanks

  614. Comment by abhishek kumar jha:

    i have ibm r56 model of laptop . i had forget my power on pasword i am unable to open the laptop . computer asked power on pasword is any prosedure to crack the pasword ? somebodies say for replacing motherbord. so help me pleeeeeeeeeee i hope so.

  615. Comment by Wojtek:

    Does anybody know where I could get the required Zener diodes in Montreal, Canada?

    I went to two different The Source (ex Radio Shack) stores around where I live and the only thing I was able to find was the 2.2K ohm resistors. No 5.1 diodes, and no zener at all.

    I also tried home-depot and rene-depot but no luck there as well.

    Any help greatly appreciated, thank you.

  616. Comment by kaspersk:

    how a can write eeprom for my t42
    please any one can
    help
    me

  617. Comment by THE REEPER:

    I kept getting the “Eeprom not found” message on a Think Pad R40 I was working on at least 50 times with no dump. I had rechecked the wires on my homemade chip reader a hundred times. Just for the fun of it I unplugged the CMOS battery and left it unplugged.
    I then hooked up my reader again and low and behold I got my dump.bin. After getting the dump.bin and password I hooked the CMOS battery back up and reassembled the laptop. Hope this helps a few of you.

    PS: All Radio Shacks usually carry the Zener Diodes. They only carry 2 kinds , a 5.1 and a 12 volt. They are in the steel drawers by the resistors.

  618. Comment by Hoai Nguyen:

    I forgot BIOS password of my laptop - IBM Thinkpad T22.
    And I hacked this BIOS password by using this shematic and program.

    Thanks for usefull supports!

  619. Comment by Wojtek:

    I found the electronics store paradise.
    Addison Electronics in Montreal. A supermarket of parts :)

    So I got the stuff I needed, created the circuit but I get the Eeprom not found error.

    Here’s a picture of my setup:
    http://www.alaxa.net/24RF08.jpg

    That black thing I use is a chip socket. I attached the 2 cables to the 2 pins i crooked a bit to match the Amtel. No luck :(

    Tried removing the cmos as Reeper suggested, but same.

    Anyone would know why it’s not working?
    itester works. Both values change from 0/1

  620. Comment by JJW:

    Worked on my T30 like a charm.

    Atmel chip was under the #2 ram chip.

    I took some shortcuts that worked without soldering. I used some 30 awg wire wrap wire and hooked it around the pin of the Atmel chip. Gently pull it tight for a good connection. Keep it in place using some electrical tape. Worked for me but be careful the wires have a good connection and do not short out on anything.

    I could not find the diode listed above but the 1N4733A 5.1V Zener Diode (radio shack # 276-565) worked. The specs are close.

    The password did not show up in the defaulted startup of IBMPASS 2.1 Lite. I pressed the AA button ( translation) just under file menu bar and the password was there.

    Thanks to ADMIN and all the user comments for making this work the first time!

  621. Comment by Ross:

    This works like a charm. Just follow the instruction to the letter and you cant go wrong! Thanks so much!

  622. Comment by Ross:

    I have 4 readers to buy if anybody is interested. Email me ross@challinor.fsbusiness.co.uk

  623. Comment by Tareq:

    Hi Guys,
    I followed the instruction everything step went well except on Dos i received the error message “Eeprom is not available”. IBM Thinkpad R32 for same ATMEL 24RF08 as mentioned on instruction.

    You can easily reach me at Yemking@gmail.com your help and coorespondance is highly appreciated.

  624. Comment by Toby A:

    Please send me the dump for Thinkpad A22m
    or where can I download it?
    Thanks..

  625. Comment by Toby A:

    My address: tobyinbox@gmail.com

  626. Comment by JD:

    Can anyone tell me where the ATMEL chip is located on the g40?
    thanks

  627. Comment by manju:

    i am doing mcse 2003 certification
    i want do download recent latest dumps from testking.com
    so how to download using hack
    please help me and
    thank you

  628. Comment by Bjarke:

    Thanks for the great guide worked fine on my TP R30.

  629. Comment by jawal37:

    i have ibm t60 passworf bio can helpe me plz

  630. Comment by Alex:

    I am stuck with my T60 which has a problem with the security chip.
    The computer freeze at the when windows tries to check the security chip and I cannot bypass the problem from BIOS because apparently there is a supervisor password set (which I don’t know because did not set!)

    I guess IBM will charge me the substitution of the MB… so I followed your nice forum.

    I am trying to understand why for T40 (and many other models) software and instructions are free, but for the T60 I should spend around $ 100 or more.
    I understand the chip is different, but …

    thank you!

  631. Comment by PAUL ROSS:

    Is there anyone on this thread that could sort this error 0175 out for me , i’m a welder and electronics are a bit beyond me , on reading this forum you sound like you all know what you are talking about , i would rather give some money to a sodoityourselfer as apposed to taking it to pcworld (spit) , i’m in Northumberland , UK

  632. Comment by carl nelson:

    hey can you help me? tried this on a thinkpad t42 and iam obviously not understanding the proper way to operate the programs. i cannot find a file called “dumpbin” to load into the passcode program.

    i tries start then run. found the proper program and hit ok. i then got the black cmd prompt screen. what do you do then?

    when i hit enter it shuts off??

    am i doing something wrong??

    pls help anyone

  633. Comment by Tahir Khan:

    sir i have a HP Compaq nc8430 Laptop. One day my friend come to my home and started using my laptop. During using he set a bios password in laptop. after some days when i check my laptop setup it ask setup password. My friend also forgot the password. I remove the comos battery but not reset the password. Please help me to solve this problum. i shall be very thankfull to you.

  634. Comment by techfart:

    Thanks to all who have contributed to this site. I have a T40 that I got on eBay. The laptop works well, but the Supervisor pw was set. The seller did not know what it was. I wanted to load XP on it, but the boot order was set to HD first. Your site saved the day. Here are a few tips that helped me on the way.
    1. The parts and pictures to build the reader were right on.
    2. I don’t like to solder, so the comment about Micro Grabbers caught my eye.
    I created my own Micro hooks from some fine wire and used them to carefully hook onto the legs of the eeprom. This worked for me, no soldering needed.
    3. Once I connected everything up and followed the instructions to the letter, I got the EEPROM not Available issue. I read through more comments until I noted that someone indicated that not all computers will work as expected with the reader. I then tried another laptop as the reading PC and it worked first time.
    4. I got the dump file and opened it as instructed. I went to the location in the file and there were a bunch of weird characters. Things I could not type into the password field. More reading of comments showed that there is a button in the password decoder that needs to be pushed. The button looks like a A=A at the top left of the interface screen. One click on that button and the password was reveiled.
    5. I downloaded the reader and the password decoder. Look inside these zip files for more detailed info. This may help those with other models of IBM laptops identify the type of EEPROM that stores the Supervisor password.
    Good luck to all. Thanks again to all who have generously contributed their time and talents.

  635. Comment by Paul:

    Have tried in vain to solder with very fine tipped iron to the sda and sdl connections on my T23. The T23 has the 14 pin Atmel chip as you may know. Its damned difficult but will keep trying or have a go at the 30 swg idea wrapped round legs. Has anyone tried the switch and pin4 vss sram chip and pin 5 sda idea, sounds easier.
    Anyone that could help me locate the sram chip pin 4? Bit of a novice at this i am afraid although have basic soldering skills etc.

  636. Comment by MARK:

    hey can you help me? ware is the Atmel chip on the IBM T60?

  637. Comment by saifuljulio:

    i need the file W24rf08 with the crack. Bcoz i hav no credit card to buy the licence to allservice. Its cheap enaugh, but hard for me to pay as i have no card.
    So, i need help to u anybody who have the crack or serial key ???
    Or where can i find it ?
    Help me pls…

    thx.

  638. Comment by jaffa:

    Why don’t you ask allservice, you imbecil?

  639. Comment by andre:

    I Have an X60 IBM ,forgot my password,what can i do??

  640. Comment by zooloo@libero.it:

    I did it! it is a tp 570E. The most difficult thing was disassembling the machine
    The chip is really small! It has 14 pins, not 8; I found the right pins on ATMEL site, they are 8 (SDA) and 10 (SCL); soldering not easy, very very tiny, especially on 10 that is between two others. Then everything worked. While deciphering the file I had to click on the “translate” button in order to see letters and not hyerogliphics, but I had the password displayed clearly
    thanks!

  641. Comment by Chavers:

    Worked like a charm. Now I need to get my hard disk password and reset that. Thanks to the original poster and solution.

  642. Comment by Jose:

    I understand the soldering, But. the spare PC (my Desktop) downloaded the software, & install all ok. Were and how do I conect my T41P to my desktop, that is the part I dont understand. Where is the serial port 9 female connected to besides the SCL & SDA and gnd. Please advise

  643. Comment by Oneill:

    What about the T61 ?
    Anybody have a solution to unlock the BIOS ?
    Thks

  644. Comment by uri:

    first lots of thank to VICTOR and his team !!
    and thanks to the nice ppl in this forum who share their problems, solutions and tips.
    i have t20 which now works charmly. the 24rf chip has 14 pin, about 4.5 mm long, and is located just underneath the outer memory stik. i tried to solder the pins, but no luck, and got the 0187 error, which also means that the pins are not correctly soldered to the motherboard, i fixed this problem. And now the tip: i used 2 sewing needles, (soldered to the wires) and just hold them with my fingers atached to the SDA & SCA pins, GND wire was connected to one of the motherboard screws.

  645. Comment by Jim Jones:

    Thanks so much for this post. I did this yesterday on a T42P that I bought on Ebay and it worked like a champ.

  646. Comment by Jay:

    I guess somehow I corupted my T30 eeprom and getting 0175 error. PLZ if someone have a dump file of any T30 email me, that helps me to rewrite a new one or reprogram it. if you think you can rescue my T30 with your eeprom dump file please email me at “jay_toudeshki@yahoo.com”
    Thanks in advance. —Jay.

  647. Comment by Ross:

    I have 3 readers left for sale, if any body is having a hard time gettin theirs working!

    email ross@challinor.fsbusiness.co.uk

  648. Comment by Ross:

    ! have a t30 eeprom dump available on my website http://www.theshinyshop.com under items.

  649. Comment by Guido:

    Hello,

    I’m having problems with W24RF08 programmer. I have this error msg:
    ERROR: Unable to open sorce file!
    I was typing: w24rf08 guido.bin /e, w24rf08 guido.bin /i, w24rf08 /p /e. etc.
    I was trying with diferent ways and I created before guido.bin in the same directory using r24rf08. I read this file before with ibmpass21 and my password is 00000006, but i only can type 7 spaces in my laptop ( IBM TP T22 ). Then I supouse that i have to program the IC AMTEL with diferent password or at list reset the existing one.
    If any body know what i’m doing wrong, please let me know. Sorry, Cuban with only one year in US. guidoedt@yahoo.es

  650. Comment by joey:

    The program you refer here is a cracked good for nothing version of W24RF08. I suggest you to pay the author for all the hard work, instead of trying to steal, buddy. And you have guts to ask for help…

  651. Comment by Sue:

    Hi Guys, Thanks for the very informative site. I am in the process of dismantling my T60 to find the security chip but i have come to a dead end. I cant find the chip anywhere on the board and the only place that is left is on the back of the system board. But i really dont want to completely dismantle my laptop unless im sure it is there. Does anyone know where the secuirty chip is on a T60?
    I forgot the supervisor password i set on the BIOS only. This was not a real bother because i could operate my laptop wit h no problems as the password only protected the BIOS section. Until one day i decided to put a password on the whole system so that people cant boot my computer. Then i realised that i cant do that because i dont have the BIOS password. A search on google revealed that a software called cmospwd can read or clear BIOS passwords. I tried to read it but it gave me something like !$12ABC which i was unable to enter in the password prompt. I then foolishly tried the clear password option which it said that the BIOS password has been successfuly cleared. When i restarted my computer, i typed F1 thinking that there shouldnt be anymore password, but it gave me a “checksum CRC error” and shortly later the password prompt came up. I restarted again wanting to go into windows and try the cmospwd program again but there with horror i found a password prompt requesting a password. So now i cant even enter the system!! The CRC error only happened once and now my computer is locked as if someone put a password on the system without my permission.

    Would the above procedure work for me? I really need to access my computer. Any help would be greatly appreciated!

    Sue

  652. Comment by Jason:

    I accomplished each step that the directions instructed.
    when i type r24rf08 dump.bin into the cmd it says:

    C:\Documents and Settings\Owner>r24rf08 dump.bin
    ‘r24rf08′ is not recognized as an internal or external command,
    operable program or batch file.

    C:\Documents and Settings\Owner>

    I have no idea what to do from here can some one help me?

  653. Comment by Jason:

    I finally figured out how to download the dump file, but there is nothing in the 0×330 line
    how do i fix this?

  654. Comment by joey:

    @Sue
    Your laptop can be repaired only with PC8394 programming tools from allservice.ro
    Put it back, it doesn’t need to be opened. The goto http://www.allservice.ro/forum/viewtopic.php?p=1061#1061 and buyt the full kit, with the CRC repair included. You should receive the kit and instructions. Or..pay $200 bucks to repair it locally…they all use allservice software, anyway.

  655. Comment by Jo Mamma:

    @ Sue,

    I think the security chip for the T60 is on the back of the motherboard. I had to completely disassemble the sucker to find it. The tip-off is that it is marked “U53″ on the board, exactly the same as the T42.

    JM

  656. Comment by Ro:

    I succesfully got the dump from my TP r50e .
    I got something in the 0×330 line and tried all translation but the password is not right .
    I tried to get the dump from different operating systems .

    Any Clues ??

    Thanks in advance

    Ro

  657. Comment by Tom:

    Thanks a lot for this guide, it worked on a thinkpad T20 with the 14 pin chip! The Chip here is locatet under the RAM Cover. The SDA is on pin 8 and SCL is on pin 10.

    Here you can find the datasheet:

    (8 pin Version)
    http://www.atmel.com/dyn/resources/prod_documents/DOC1072.PDF

    (14 pin Version)
    http://www.adapt-plus.com/pdf/tssop_dip/140805tss.pdf

  658. Comment by Dhananjay:

    Hi All Friends in the IT Line.
    This process is VERY GOOD FOR REMOVING BIOS PASSW-
    if you have not access this HARDWAR THEN YOU ALSO CONT ME.
    I THINK I M TRYING MY LB.

    GO TO THIS PROCESS

    “COPY FROM SOME FRNDS REPLY”
    1. 1. remove the mainboard (Hardware maintenance manual page 87)
    2. locate EEPROM 24C01A at the bottom of the motherboard, right hand side, close to the upper left corner of the big PCIBus-IC when the connector row is facing to you
    3. solder 3 wires to pin 4, 5 and 6 of 24C01A
    4. build schematic: driven-i2cprog.pdf
    5. connect driven-i2cprog to com port of working PC and check port settings
    6. install ponyprog2000 2.05a Beta (freeware from www)
    7. Select from menu “Device>I2C bus 8 bit eeprom>2401″.
    8. setup > Interface Setup: serial, SI Prog API, select com port
    9. In “Setup> Interface Setup” invert the D-in, D-out and SCLK.
    10. change PONYPROG2000.INI: modify the line: I2CBaseAddress=0xA0 to I2CBaseAddress=0xAE
    11. Save PONYPROG2000.INI
    12. Setup > calibrate > OK….
    13. connect AC adapter to the TP 600 mainboard (mainboard without any other boards but with BIOS battery attached)
    14. connect GND wire of driven-i2cprog to pin 4 of 24C01A (GND also can be connected to any GND pad of the mainboard)
    15. press power button of the TP 600 mainboard
    16. connect SDA to pin 5 and SCL to pin 6 of 24C01A
    17. read eeprom with ponyprog
    18. disconnect SDA and SCL wires
    19. switch off the mainboard
    20. disconnect GND wire
    21. store the bin-file
    22. install ibmpass2
    23. open stored bin file with ibmpass2
    24. at ibmpass press button “AA” – on
    25. View>Translation>Scancode
    26. For 24C01 eeproms the password is located at 0×38, 0×40 – read password starting at 0×38 – ending at ????
    27. note password, if password is not shown proceed with a.

    a. Install R24RF01
    b. press power button of the TP 600 mainboard
    lc connect SDA to pin 5 and SCL to pin 6 of 24C01A
    d. Run R24C01.exe
    e. Use command: r24c01 your.bin /x /d /i
    f. disconnect SDA and SCL wires
    g. switch off the mainboard
    h. disconnect GND wire
    i. open your.bin file with ibmpass2 (as above 23 ff)

    IF UR NOT ABLE TO CRACK THEN CONTACT MY EMAIL ID:
    lovever_bboy@yahoo.co.in
    or call me ;- 9853482334
    INDIA.

  659. Comment by Eric P:

    It worked with my R50e laptop!

    Thanks so much to the author, this has been quite an active DIY article. Started in 10/2006 and still going strong.

    If anyone needs additional help for their r50e, I would be glad to assist.

    my email is drerock at gmail dot com

    I made the circuit required for the reader, and could probably send it to someone if they need. I had never soldered anything before, and the gun I had was a big ol’ thing, so I managed to get it to work with some of the smallest clips I could find at radioshack. I had 2 serial ports on my computer, and the first one I tried didn’t work.

    Good luck to anyone else to tries this, it felt so good to get past that stupid bios lock icon.

  660. Comment by Denis:

    Hi, i have a problem whith my thinkPad r40, the bios pass was changed by himself. Enother problem is that the laptop has no com port’s, only USB, 1394 and for printer…. What can i do?

  661. Comment by Gbs:

    HELLO,

    I have a X31 type 2673.
    Just want to recover the supervisor pass.

    BUT,
    The ship is an “ATMEL 422 93C46 SI27A”, 8 pins.

    My 3 questions are :

    Do i have to use the same reader as for ATMEL 24RF08 ?
    same ” simplified schematic ”
    How do i recognized the slc and sda on the ship ?

    Thanks a lot.

    Gbs

  662. Comment by nikolay:

    hi all.i bought thinkpad t22 and there is a powered on password.i read a lot of in the web about programing security chip but any information is little about my experience.i couldn’t found security chip on motherboard.can someone send me picture or tell where exactly are placed that security chip.
    thanks of all answered me.

  663. Comment by alvarado70:

    Thanks a lot for this guide, I cant seem to get mine to work I tried it on TP T40, and a T41P, the dump file works fine but when I check the address 0×340 for the T40 it shows ff1 it dows not work as a password and the T41P shows 21 it does not work either thanx in advance if anybody know if I’m doing somethong wrong.

  664. Comment by rchoi999:

    Thanks for this guide. I just follow the guide on TP X30 and everything works fine. Find the password @0×330 and use it to enter the bios without any problem.

    Thanks again for the infomation to crack the bios password.

  665. Comment by rida:

    Hi for all ,
    Any one can unlock my Lenovo Duo centrino T60???

    Please make offer by e-mail :

    rsoudane@gmail.com

  666. Comment by crack:

    For anybody who needs w24rf08.exe, here is the full version for free! Use this to fix CRC, CRC1, and CRC2 errors! All you need to do is rewrite the Atmel with a good .bin file.

    Multiple links in case they go down:

    http://www.mediafire.com/?9k3mo1z9nxs

    http://www.sendspace.com/file/mi6oub

    http://www.badongo.com/file/7289886

    http://www.uploading.com/files/JIHWTPQ7/24rf08c_tools_141_w24rf08_r24rf08.zip.html

  667. Comment by das:

    Hi, thanks to the poster for the guide. I have a T42 and have followed the steps closely. I managed to dump the password ok but I cannot see the password when i scroll down to address 0×330 using the IBMPass software.
    Can i send my dump file to anyone with experience that can help me or can you please send me some advice.
    Is it possible that the dump file can be created without including the password in it???
    Thanks in advance.

  668. Comment by crack:

    Hit the Off/On button to the top left in IBMPass.

  669. Comment by Zany:

    Dear Guys,
    Please help me in the case of T61 lenovo, widescreen model. Is there a solution for it? I have checked with IBM service center, and they asked me to replace the mother board. Please help me … if you guys can ….please let me know if its possible or not…… thanks

  670. Comment by Zany:

    Sorry guys, the problem is that i have set a supervisor password, and it doesnt work at all.

  671. Comment by Greg:

    Hi, does this method work on R60? I can’t locate eprom chip. Stripped completely TP, took out motherboard, but still can’t find it. Can anybody help with location of this chip if it exists? many thanks.

  672. Comment by Donald:

    I just want to say how wonderful this site is!!!!!! I had all but lost hope with my T42. IBM had told me $175 to remove a supervisor password, they then came back and said $475. I was not gong to pay that much for a laptop that I had only given $50 for in the first place. Using your instructions, (after a little trouble with the programing) it worked liked a charm. Thank you guys so much for your time and effort in the making of this page. Keep up the good work and I will be referring anyone who has problems to you.

  673. Comment by michael:

    I wonder how many of these T60 laptops are stolen…

  674. Comment by Chris:

    Thank you for the help this site provides, I am trying to recover a t30 I was successful in retrieving the password from the dump.bin file by following all the instructions to the letter. However now my computer hangs during startup with the error 0175: bad CRC1, stop post task.

    As best as I can tell, a few people have had this same problem but I can’t seem to find instructions on how to get past this error. In searching the web I am directed to replacing the motherboard (I would like to avoid this). Is there anyone who experienced this error and has instructions to correct it?

    Thanks in advance.

  675. Comment by Burp:

    Grazie, grazie molte per le informazioni che mi hanno permesso di trovare la password (SVP) del mio IBM ThinkPad A21e CXG 2628.
    Thanks a lot

  676. Comment by zaneer:

    Dear Guys,
    Please help me in the case of T61 lenovo, widescreen model. Is there a solution for it? I have checked with IBM service center, and they asked me to replace the mother board. Please help me … if you guys can ….please let me know if its possible or not…… thanks

  677. Comment by Dheenadayalan:

    Any one can find r52 Laptop bios ic please kindley send details
    sdheenadayalan@gmail.com

  678. Comment by Youhow:

    This is really awesome. I successfully revealed my T41 supervisor password. I did this exactly as the instruction, except I used two 4.3V Zeners since I don’t have 5.1V type in hand. Only r24rf08_setup.zip and setup_ibmpass21.zip were needed. I didn’t use w24rf08_setup.zip which is not free. I have a very old PC coming with RS232 port, and this PC is even running Windows 95. The r24rf08 is running well on the PC, but it can’t run setup_ibmpass21.msi. I use anther PC with WinXP to run IBMpass 2.1 Lite and it decoded the bin file amazingly. Thanks to this great stuff in sodoityourself.com and allservice.ro.

  679. Comment by Costa Rica:

    I located the eeprom ATMEL 24RF08 on my ThinkPad R40 2722-CU3. It is on the motherboard under the hard drive (U18) caddy, adjacent to the USB port. It is a two colored chip (black with a red stripe).

  680. Comment by Philipp:

    Hello
    there is an other way, to hack the IBM Bios Password. I made a documentation and ziiped it with all the things you use. (Programs, Schematics, Documentation) and uploaded it. http://rapidshare.com/files/86727521/Hack_ThinkPad_A20m_BIOS_Password.zip.html

    I hope, this is helpful. Enjoy it.

  681. Comment by Larry:

    Does anyone has the eeprom dump for thinkpad T21? Thanks!

  682. Comment by Jan:

    Hi guys,

    you’re great. With the knowhow from your page i could get my t22 back to life. I had some problems, especialy because the T22 has the 14 pin atmel chip directly under the ram cover(this i found out after the complete disassembling of my thinkpad) and later i forgot to scwitch on the AA decode switch in ibmpass 2.1 lite, but finally everything work and i could kill this damn biospassword.

    Thanks a lot to you gyus and keep going.

  683. Comment by bobb:

    aye i got a kind of big prob here i try to read from a a22 tp and i just get the message saying eeprom not found or cannot find circuit or bus i triple checked my soldering everything seems just fine then my wiring once again it’s ok but still get the same error. i already did it in a t20 tp with the same wiring and stuff do i need to use the max232 driven eeprom schema? help plzzzz

  684. Comment by Solder Tech 1:

    I find this post to the fastest and safest way to get ANY of your PCs running. You can also purchase a AVR/Atmel programmer for about 20 US dollars. You can build one for about 5 dollars. Using an ISO7816 device with dip switches is safe as you dont need to power on the laptop and risk damage. Here is a Copy/Paste of the post again ::::

    Comment by justsomewellerdude:

    Sunday, February 18th 2007 at 7:32 pm
    sorry for poor spelling.

    1. Get ISO
    2. Open ISO
    3. Remove Atmel chip from your IBM
    4 Solder in your IBM Atmel
    5 with seperate PC download from IBM the correct flash for your unit.
    6 with seperate PC download the XPAtmel 2.0 program found all over net
    7 open XpAtmel2.0
    8 choose the file and click download

    *note*

    make sure your file is in the same folder as XP Atmel
    if your ISO has dip switches you use either 1&5 on or 1&6 on to program.

    9. Then re-solder in your Atmel into the Thinkpad

    *you now also have most current flash file (BIOS) for that unit.

    Enjoy.

  685. Comment by Das:

    Hi, thanks to the poster for the guide. I have a T42 and have followed the steps closely. I managed to dump the password ok but I cannot see the password when i scroll down to address 0×330 using the IBMPass software.
    Can i send my dump file to anyone with experience that can help me or can you please send me some advice.
    Is it possible that the dump file can be created without including the password in it???
    Thanks in advance.

    PS: Thanks user ‘crack’ but i already tried restarting the T42.

  686. Comment by jack:

    WONDERFULL….. it’s works perfectly….. thanks a lot!!!!!. In my country, IBM says “give me US$D 1.800 plus taxes to change your motherboard….. the new mac air is only for USD$ 1.700.. IBM must crazy with this prices….

    Regards….
    Jack

  687. Comment by Irfan:

    i have problem finding the password chip for tp570 kindly send me the details of chip.Also the details of pins to which i have to connect the circut made as given.will the same softwares work with tp570.please please please

  688. Comment by Harry:

    Does anyone have a working dump of a TP A31? If so, e-mail me at powerhouseharry@triad.rr.com. Thanks

  689. Comment by Julio P:

    I am unable to find the eprom for the T43. Is it the 24c64wp? I really need this, so who ever knows the location please email me. slevos@gmail.com Please help me i´m in chihuahua mexico

    No puedo encontrar la memoria eeprom para mi laptop T43, alguien que me pueda ayudar decirme donde esta, en unas paginas dicen que es PC8394 y lo unico que encontre parecido al que dicen aqui es el 24c64wp? si es ese o favor de indicarme cual es?

  690. Comment by Catalin:

    Hellow everybody.
    I read the article and I tryied to do it alone, and I succeded in recovering the password exactly how the article describes but the password does not match.Anyone has this problem too ?My IBM is a T42 model.
    help please.
    thank you.

  691. Comment by Mighty:

    Hello,

    i have readen everyting i could find about this subject and built the interface for Atmel chip. Works fine on TP 600x and now only thing im missing is correct dump file for it. Does anybody have the dump file for 600x to correct the crc error?

    Thanks in advance, my email is mslovic@gmail.com

  692. Comment by Ziggy:

    WOOHOO! Thankyou for this info. Was given T21 that was locked, thanks to this info it’s now working again… Cheers!

  693. Comment by peter:

    hi i have a imb tp t60 can anyone tel me where the svp chip is ive striped the laptop ive found a atmel chip in the same location as other u53 its a atmel 618 25010AN SU27 is this the right chip ? if not can someone please tell me thanks

  694. Comment by bobb:

    hey i’m currently working to get the algorythm for encodage of password used by ibm. heard that when u call them u just have to tell them the s/n under ur tp then they give u a pass for ur bios. if ne1 feels concern about it or have info to share contact me at kranium45@hotmail.com

  695. Comment by Anonymous1:

    The only carbon-film resistors i can find are 2.2-k ohm ! they come in 1/8 watt, 1/4 and 1/2 … is this the right kind? and what wattage should i use if so? thanks email me jfallon@knology.net

  696. Comment by das:

    Hi all,
    Catalin, I am having similar problems, did u get a result yet? Please email me at das_bade@yahoo.co.uk

    Thanks to the poster for the guide. I managed to dump the password ok which created a 1kb dump.bin file but when i scroll down to address 0×330 using the IBMPass software, IT IS BLANK. I have tried with the translation off and on.

    Can i send my dump file to anyone with experience that can help me

    Thanks in advance.
    DAS_BADE@YAHOO.CO.UK

  697. Comment by DeepFreeze:

    I tried this on a T30. I made the device followed step by step after several times loading
    to my .bin file it loaded 128byte file via the shell. Used V21Lite to extract data
    but received only 0s on 12 lines. No luck after several tries. Unhooked home-made reader device and upon rebooting password lock is gone but now I receive a error code 0176 CRC
    error on system freeze. I see now someone posted that the COM plug diagram is from the back side not the front so my home-made device was wired wrong. If you mess up the first time apparently there is no way to go back on the T30. The eprom is now blank and I don’t think there is a way to add data back to the erased EPROM chip. I see you can
    buy a new chip and solder them yourself on the MB if you search on google for one.
    For those that say they built this setup found the EPROM and did it in five minutes must be suppermen cause it took me many-many hours.

    DeepFreeze

  698. Comment by DeepFreeze:

    CRC1 error fix???
    I see after reading some posts that there is a way to fix the CRC1 error but has anyone tried this with success? If so let me know OK. All the links to the so called utility have been removed due to copy right infringement it says. Does someone have a legit site/link to this utility?

    Thanks, DeepFreeze

  699. Comment by GNA:

    hi. my thinkpad is A23 and ATMEL 24rf08ct on it have 14 pin ! which pins must be scl,sda ?

  700. Comment by Amanda:

    Hi,
    Does anyone have a w24rf08 program? the links that crack gave does not have that files anymore.

    Thanks.

    PS. you can mail me the program if you have to onehotamanda (at sign) hotmail (dot) com

  701. Comment by Ralph:

    All good for T41, thanks for the site especially the photos, makes a heap of difference to the allservice forum site.
    thanks

  702. Comment by haister2k:

    Works perfectly. Just a note: you don’t really have to solder anything to the eeprom. Here’s what I did:

    1 - Assembled the reader with extended GND, SDA, and SCL leads
    2 - Prepared the 2nd computer (installing the R24RF08 and IBMPass Lite software)
    3 - Hooked the reader up to the 2nd computer
    4 - Turn on the 1st laptop aand press F1 to get to the password prompt
    5 - On the 2nd computer, go to the command prompt and CD into the directory where r24rf08.exe is
    6 - Connect the GND to a metal part on the laptop
    7 - Using both hands connect the SDA first and then the SCL
    8 - Have another person type r24rf08 dump.bin and press enter on the 2nd computer
    9 - It’s safe to unhook the reader
    10 - Start IBMPass Lite and open the dump.bin file
    11 - Click the translate button to ON
    12 - Look for the password

    NOTE: This will not work with a USB to serial converter. It must be hooked up directly to an actual serial port set to COM1.

    Thanks all.

  703. Comment by Darklord:

    Worked fine, i had no 5V1 diodes and used 4V7 ones.
    Thanks.

  704. Comment by Shady:

    Hey, I have an IBM Thinkpad T41 type 2373. I succeeded in finding the ATMEL 24rf08 on my laptop. I was asking whether the electronic stuff is necessary, can’t I just plug it in the seria lport and start things up.
    PLEASE SOMEONE ENLIGHTEN ME.
    MY EMAIL: hell-raiserx@hotmail.com

    thanks in advance

  705. Comment by instarx:

    Haven’t seen X21 laptops mentioned here. I found my X21’s ATMEL chip buried deep on the back of the MB. It is centered on the back of the MB board about half an inch from the rear edge. You have to remove the MB to get to it. You have to practically dissassemble the entire PC. Luckily that isn’t really hard and IBM has thoughtfully posted all their Service Manuals at this site with graphic instructions.

    ftp://ftp.software.ibm.com/pc/pccbbs/mobiles_pdf/24p2975.pdf

    Have not tried to recover the password yet, I have to get the electronics.but I will post results when I do

  706. Comment by ArmandoCPS:

    3 month to find this page only to find out that the password was ( pass ) what is with this Admin’s today I fell so stupid. on to my next stupid problem now my T42 have a HDD Password and it is not “Pass” please help me…

  707. Comment by dare:

    I have just unlocked my T60 using the reader software from allservice.ro.
    It includes a really easy manual and the allservice.ro support is great.
    If somebody cannot solder the interface and/or fulfill the task of unlocking feel free to contact me. I would do it. I would not betray allservice.ro so costs would be $45 or $100 (depends on security options) for allserivce.ro plus shipping to germany and additional EUR 50 for my work.
    Germany residents can get the whole package for EUR 100,-.
    Interfaces for EUR 30,-.
    Simply help for free.

    Greets dare_@gmx.de

  708. Comment by peter:

    hi has anyone had any luck with the T60 ive searched everywhere and cant find anything ive found this [url=http://img409.imageshack.us/my.php?image=48108068vg2.jpg][img=http://img409.imageshack.us/img409/8427/48108068vg2.th.jpg][/url] just need the software to dump the eeprom thanks

  709. Comment by peter:

    this one

  710. Comment by peter:

    [URL=http://imageshack.us][IMG]http://img409.imageshack.us/img409/8427/48108068vg2.jpg[/IMG][/URL]

  711. Comment by russ:

    I follow the directions and when I hit the enter key on the PC I get no dump.bin file stored, any thoughts, I have checked and rechecked all connections.

    Thanks.

  712. Comment by joey:

    T61 use P24S08 (24RF08 clone) and can be done using the free R24RF08 tool form allservice. Stop spamming here buster.
    See http://www.allservice.ro/forum/viewtopic.php?t=779

  713. Comment by Sick-Neard:

    IBM G40
    I Replaced CPU Fan And Lost Date & Time And Had Never Needed Admin Password in Pass But it Was Need To Set Time & Date Before i Could Boot to Any Drive .
    Followed This How-To Cost About $2.00 US Parts From Radio Shack .
    ## Worked First Time Like A Charm ##
    Thanks Alot for this How-To

  714. Comment by Oppaunke:

    Thinpad R30: The R24RF08 is indeed located at the underside of the board near the edge of the PCB. It is hidden behind a black adhesive tape, why I first didn’t detect it.

    Another mistake I made was not to insert any RAM modules. Without RAM there is no proper POST and the PWD won’t be revealed while reading it with the dumper-program.

    One should not forget to set the software IBMpass 2.0 properly. Under menu VIEW/TRANSLATION one has to set it to “Alternate Scancode (R Series)”.

  715. Comment by Nadia:

    Hello,
    i have a Thinpkad A20M, last week i substituted the bios battery because it was finished, After this operation when i start up my PC it required a POWER-ON password. The strange is that i haven’t filled any password before and i do not know which is the value to be filled. I have already try to remove again all battery (PC and BIOS) for many times but the password still required.
    Have anyone suggestion? Can i use above procedure? if yes in which row i can found the value of this password?
    Thank you in advance for your help !

  716. Comment by Vallors:

    Hi, i’m trying to restore a T21 that have “0175 Bad CRC1, stop POST task”, i found AMTEL 24RF08CT EPROM, …. anyone can send me a clear dump .bin file? pls send to vallors [AT] inwind [dot] it
    thanks a lot!

  717. Comment by stinkepad:

    BTW: those last numbers (e.g. 0042) is just the date when the chip was produced (YYWW).. meaning 0042 is week 42, year 2000.. its unimportant to search for it ;)

  718. Comment by Khamex:

    hi.All
    Can you help me, i want to know locating
    IC Atmel 24RF08 in Motherboard IBM X41? can you show me
    or sent Picture Motherboard IBM X41 Large Size,
    because i cant find in my MB X41

    thanks for your kind


    Warm regards,
    khamex

  719. Comment by Khamex:

    hi.All
    Can you help me, i want to know locating
    IC Atmel 24RF08 in Motherboard IBM X41? can you show me
    or sent Picture Motherboard IBM X41 Large Size,
    because i cant find in my MB X41

    i want to reply at khamex@plasa.com

    thanks for your kind


    Warm regards,
    khamex

  720. Comment by Khamex:

    hi.All
    Can you help me, i want to know locating
    IC Atmel 24RF08 in Motherboard IBM X41? can you show me
    or sent Picture Motherboard IBM X41 Large Size,
    because i cant find in my MB X41

    i want to reply at : nkhamex@plasa.com

    thanks for your kind


    Warm regards,
    khamex

  721. Comment by LEO:

    Hi all,
    will this work for a Thinkpad T60?

    Anyone can help me!

    Thanks,

    Leo

  722. Comment by wherewillwhy:

    haha my girlfriend and i both have lenovo r60 core duo anyways i was arguing one day with my lovely ladie and i threw it at my dresser ! when i booted it up again the ibm tpm bios support had lost the finger print files and allowed me to set new ones…..hum sometthing to think about !

  723. Comment by Chris:

    This is just a little warning about ALLService and their staff. (a little long, sorry)

    I have been using my laptop but it does have a supervisor password set that just annoying, if nothing else. I was interested in their service for my T60 to remove the password as I heard they could do it. They, for the most part only take moneybooker payments, but, will take others like western Union. I sent them a letter trying to explain that here in the US we get scams all the time in emails that say “buy this cheap and send us money Western Union”.

    My letter:

    Hello again, well, I would like to order your service, but, I am a little hesitant. You are in Romania and request a wire transfer, I guess you do not have paypal? I feel a little unsure as I have no protection if this does not work. I am not saying this is a scam, Trust me, I am NOT a jerk , but, how do I know this will work? I have NO job and I do not wish to lose $45 if this is a scam. You will probably say “trust me”. I wish you used ebay and took paypal because then I could show you from my Ebay record of 140 buys, that I am a man of my word, because, I would ask if you would be interested in helping me with the password first, and then if successful, I would pay. If I was making 60,000 a year, I probably would not care at all either way.

    Okay, it’s a little whiney, but, no way is it derogatory, or, offensive. I was merely stating that if they could give me some reassurance, I would be more than happy to pay them or do whatever they wished. It was a proverbial stretched out hand for help, a faith of good will.

    This is their letter back to me:

    Are you a joker? Or I guess I am having a good time.

    Excuse me, but I am really bussy.

    I then said:
    No, I am serious. How do I know I will not be robbed/money stolen? I do not know you, and, you are in Romania! There are 100’s of scams in America that say “send money by western union”, to take money from Americans. How do I know you are NOT the same? Where is MY “guarantee”, if this does not work, I get my money back? With a company like “paypal”, I have help. If I send money by Western Union, I have NO help if you are not honest.

    (Actually, paypal will not even help since it is virtual goods, so beware that fact also.)

    There letter back to me:

    Mr Bond, (funny name, cause that Jan Fleming’s character is brit and you are just a redneck),

    We do our business via Moneybookers on a daily basis, WU is just an option. We accept PayPal as well, but PP is also the easiest way to obtain free software, used by con artists, and is the worst selling instrument for small software companies like ours.
    I could accept PayPal, however, but after your last emails I just realized you are simply an idiot.
    We do not sell to this kind of people, because to gurantee the success, a certain IQ level is needed, you know.

    Victor Voinea

    (there is also a guy named Bob who is just as bad, if he even really exists)

    Now, I am here to say that I don’t know if their service works or not, but, it is obvious they do not care too much about others. I just want all to be forewarned that if you absolutely need their service and want to take a chance, I wish you luck. They are not concerned about you!! Here is something directly from their site:

    “We do not accept PayPal, as this company lacks in any minimal seller protection. We do our business through MoneyBookers or bank or at elast Western Union, etc.”

    Yet, when I ask about MY guarantee, I am an “idiot”? What the………?????

    WOW! We need customer service like that in America! Apparently it’s a Romanian trait as they seem to be the most hated people in Europe, from what I have read last three days
    while I was trying to find some Romanian words. I, personally, judge people as a one on one basis, but, they put that theory to rest for me. People are people, but, between all of the stories I have heard, people I have met (as I have dated a Romanian girl) and especially Europe, its true, they are not so good people. Then again, look up Vlad Dracula the impaler, bad bad baaad man, lol.

    As far as I am concerned, as soon as I find out how they do it, I will share it free with the world and put an end to their abusive hostage holding attitudes. I will be more than happy to show them what kind of idiot I am.

    All I need now is the PC8394 data sheet and I am 1 step from closing this deal. Being unemployed it’s a little hard, but, if I have to buy the data sheet, I will. As soon as I know where the SDL pins are, dump the file, I just need to run the hash programs and it’s done. You ALL will know then how to take care of this locked problem.

    When they see this, they will surely start to act nice to everyone and try to give you a warm fuzzy feeling. Let it be shown here, that what you see from their personality isn’t real. I bet people will even get on here to defend them. It will be either the people from ALLservice, or, others that bent to their requests. It’s also funny that they try to look like they are doing the world a favor by explaining how to unlock the T40’s. The reason they did that was because the Japanese/Chinese found a way and was sharing it with the world. Guess they wanted to look like the hero. I wonder what excuse THEY will have and post, as they know I am now spreading the word about them. In all fairness too, let it be known that I DID give them a good piece of my mind, but, it was after the fact that it was clear how rude they were to me. I think people should be treated better, no matter who they are, unless they are in fact a-holas.

    If you want to know more about this company, please feel free to contact me. Everywhere I go, I am going to try to have it where I am notified when someone posts to my story, so, you will be seeing a lot of me. “I” will give you the full story, or what you would like to know about them about them if you want to hear it, but, hopefully you see them through this warning for who they are.

    Well, good luck with them if you go that route, I have to go take them down ;)

    Chris

  724. Comment by joey:

    @chris,

    You sound really like an idiot, if you ask me. When you want something from somebody, you don’t start saying: Hey, give me that you stupid Romanian or French or Italian. Or: You want to steal American’s money! How stupid are you, they have the right to call you that, baby.

    Victor is the most supportive man I have ever know, I really like that man and he really helped a lot of people, just see the last news about T61 and X61 on their website:
    http://www.allservice.ro/forum/viewtopic.php?p=3521#3521

  725. Comment by baomobile:

    Hi Chris!
    You are really wrong think about Victor and his staff for sure.Try to understand him by visit his forum read,read and read more post about how great him did/do to help alot of people even without money(in some case) I was his client when got t60 BIOS locked.I didn’t know well about PC even type command how to dump the bin from eeprom t60,but he help me by remotely step by step.He spended more than 3hous to teach me,he like the Coach.About spend your time to bring good person down??? All none stupid people will think what about you.For the method payment any person in any Country have they own polici.When you sock some one they will sock you back that is normal
    my 2cents
    baomobile

  726. Comment by goma:

    Oh, please!..”..customer service like that in America!” Another american moron.. try PayPal customer service, mate.

    Good job, allservice!

  727. Comment by Dan Voican:

    Dear Chris,
    Please excuse my boldness but I have to agree with Victor. You are an idiot. And not only that you are a loser. That is a big inconvenient. We have a president that is an idiot but he gets around just because he is not a loser. By a loser I mean a person who is afraid to take charge of his own action and life. A loser…Chris is a person who always finds a fault in something and is making up excuses for idiotical behavior. I’ve known Victor for years and he is on the top of my list as regards of integrity, brains and moral conduct. You are just the opposite, And you have the f.. nerve to doubt him. He has helped thousands of people and he is the person who when he first started did not even want to charge for his software. He wanted to give it away. If it weren’t for morons like you I would have agreed with him. But since LOSERS like you were born on this awsome planet of ours he has to charge money. And if I were him I would have 2 prices. One for regular people and a triple one for Losers. Sorry Chris. I know is going to be hard to read this ( or if I know losers you will go in denial from the first sentence) but please take it as an advise. Life is to short to be afraid and by being a loser you’re making it worthless. Please make some changes. You can start by apologizing to Victor.
    Thank guys!

  728. Comment by Jack:

    T42

    I have the reader ready, but when i turn on the computer and click on f1 the computer tries to go to the bios but then I get error 0271 Please Check date and time settings and then goes to the black screen with the lock on it.

    Any ideas how to avoid this?

    thanks

  729. Comment by Austin:

    Just a FYI this same process will work with some sony Vio’s as well as many Toshiba and DELL. The location where the password is stored is different but with a good eye you can locate it easily. There was a guy charging something close to 20.00us for this service but he did provide a schematic to use with a bread board. Made it a lot easier.

  730. Comment by goma:

    Sony Vaio are almost all using 24C02 eeproms, You may simply use PonyProg with the circuit explained here, or better use ALLservice’s R24C02 made specially for VAIO eeproms. IBMpass can reveal the passoword as well.

  731. Comment by khamex:

    can you help me ?

    my TP X41 forgot password. i will try ic eeprom with hack bios in SoDoItYourself.com. but the result in command prom are . its not availble eeprom?

    and my tp before startup i press F1, in screen

    error
    0187 : EAIA data access error

    error
    0191 system security-invalid remote change rquest

    pls help me…. , give me info or solution about it

    thanks and appreciate for you.

    warm regard
    Gamblez Wong

  732. Comment by Cody:

    Hi i have a IBM thinkpad T43. I found an Atmel chip back by the modem. It reads 24c64an. What i would like to know is will the software for the 24RF08 work with this Atmel? Also are the pinouts the same for both?

    Thanks

  733. Comment by Jack:

    Hi, for those wondering if the service offered for cracking the BIOS password is real and if it’s worth the money etc, I have used (or tried using) both of the main Thinkpad BIOS password cracking sites when my Thinkpad locked up … Victor in Romania http://www.allservice.ro and Joe in Australia http://www.ja.axxs.net/unlock/ I found both to be legitimate, helpful, and to offer a very good chance of cracking the password. Now, if you have an older Thinkpad with Atmel 24RF08 then try going with Victor because his software for that is free. For newer laptops, consider both. Both require you to dismantle the computer, build the reader (Victor also has the option to buy a ready-made reader), and work with their software to crack the password. Both say that getting the parts and building the reader is easy … well, yes and no, because finding some of the parts may be harder than either realises, so if you press ahead you may have to source parts at two or even three suppliers which means cost may be slightly higher than anticipated. Now, if you don’t think you can build your own reader or can’t be bothered doing so, go with Victor because he offers a ready-made reader (on top of which, fair enough, you also have to pay for the service of reading the BIOS password). If you think you can build your own reader, both offer a good service. Personally, though, I would go with Joe because 1) he’s cheaper, AND if your password has stronger protection and needs to be erased that’s included in the price whereas for Victor’s it is an extra charge; and 2) Joe has a very good step-by-step guide (photographs) of each stage of building the reader and using it, whereas Victor (who I tried using first) provides an electronics diagram that unless you have experience might as well be in Swahili and while he can point you towards a picture of a built reader it’s not quite complete (for example, no indication of where to insert battery wires) so in the end, frustrated, I gave up and went with Joe. I did find Victor helpful every time I asked a question, but he just couldn’t understand why I couldn’t understand the diagram. Joe is much better for novices like me. That said, it’s your choice so rest assured that both are legitimate, and you won’t be ripped off … and while you might damage your laptop, this seems harder to do than both advise (if I didn’t damage it, it must be hard to do so!) and you might as well try because the laptop’s as good as dead if you can’t unblock the BIOS password. I hope this advice helps people.

  734. Comment by Jeremy:

    I bought an R51 used and it had the Supervisor password set. I followed these instructions and was able to ‘crack’ it.

    Here are couple of tips that may help…

    I didn’t solder the wires to the chip. I carefully used two wires bound together with shrink tubing with the ends barely poking out the end. Then when it was time to ‘connect’ them, I held them on the chip and had someone else hit ‘enter’ on the tech computer at the appropriate time. Worked flawlessly the first time.

    Others have mentioned this… but when using the decoding software (ibmpass) don’t forget to hit the on/off button toward the upper left to reveal the password.

    Once my password was ‘revealed’ it still didn’t work. Come to find out my Thinkpad had both the Supervisor password and the Hard Drive passwords set - AND they were different. I had to pop the hard drive out so the supervisor password prompt would come up. Then I was able to get into the bios and reset the supervisor password to ‘nothing’…

    I have not been able to unlock the hard drive. Everything I have read so far indicates I will need to replace it. The important thing is that I was able to get the computer unlocked.

    Thanks to Everyone who contributed to this post. It was very helpful.

  735. Comment by goma:

    Jcck, the main difference is that allservice’s software give you the possiblity of an unlimited use and do yourself the whole job, if you are a professional you’re looking for that for sure. You buy once and use forever. Joe is asking you for each removal, is not cheap as you said, is only an impression, Besides, he’s asking money even for the old 24RF08 laptops…

  736. Comment by chris:

    To those that called me an idiot, I laugh at you and shake my head in disbelief.

    1) If I said I can make you a million dollars if you send me $100, would you do it?

    2) You have no problem sending money to a website that could easily be made up?

    2) So, you will send me money without asking what kind of guarantee I would offer you?

    Please, send me your $100 and I will make you rich, I promise…………………. you idiots!

    And who are you people? How do I know you don’t work for Victor? When I FIRST talked to Victor, I has the most positive thoughts of him. I try to explain to him that IF he was legit, I had the utmost respect for him. I also tried to explain why I was hesitant to send money to someone I don’t know. Imagine my shock when he said back to me that I was an idiot!? What if I called DELL and asked them, like all Americans do, to help with the password and they just called us all idiots? You think for a MINUTE that DELL would still be in business?? I will use HP, COMPAQ or any other US based company that is big and serious about doing business. If ANY of them called me an idiot in an email, their job would probably end right there. No matter how stupid the question or comment is, oh great Victor should have been polite about it.

    I NEVER said to him he WAS a fraud/fake. I never said anything bad to him. He just thinks he is the greatest person and all others are below him, it shows. Dont be mad at me! If there was something, somewhere or someone reputable that could vouch for him, I would not send him an email and ask. All these sites he is on do not mean anything as ANYONE could say “oh, it works”. Honestly, I hope he IS honest, but, to not have any credible sites, and, just give him my money, you have to be kidding me. “I” have an ebay account that SHOWS I am credible, where is there’s? I am offering my credentials, why not them? I need a little more proof, and I called him/asked him on it, politely as I could. Only scammers get angry and upset when you do that………idiots!!!

  737. Comment by chris:

    Oh, one more thing to the people that called me an idiot. You can call me what you want, I am fine with that. To say I “may” be wrong, I would totally respect that, I might even say i could be wrong, but, to call me a loser and idiot it shows me who has a 3rd grade education level. I see you are also no better than Victor and if you were trying to stand up for him, you just brought him down even farther. You sound just like him, are you him!?

    Does not matter, I am not here to throw words back and forth. I am just here to show all sides of Victor the great….or not so great in a social invironment anyways.

  738. Comment by anthony:

    I have a TP A21M and have not been able to locate the Amtel 24RFC8 or 24RF08CT 0042 chips. its tore down completely. If anyone has a component number on the board or a picture, anything would be really appreciated

  739. Comment by Abdul Majeed Tahir:

    I need schematec for reader writer 24FR08CT
    please send me the compleate diagram for interface

  740. Comment by Jack:

    Goma, good point. I agree, Victor has advantages too. For more experienced and more regular users of the services, Victor may well offer a better choice for them. But for people like me who are intelligent but nonetheless novices at electonics, only ever going to try unlocking one computer, and coming onto this site with very basic questions, they just want to know: are these guys legit, is the reader easy to build, and will the services deliver? For those people with limited experience willing to try building a reader for one-off use, Joe’s instructions are simply much easier to understand and the service is cheaper for them. (If Victor made his instructions easier to follow, this comment would no longer necessarily apply.) If, on the other hand, they don’t think they can build a reader for one-off use, or can’t be bothered, I made the point that Victor does offer a ready-made reader that would be great for them.

  741. Comment by Abdul Majeed Tahir:

    I read so many comments but i need read/write 24FR08 through USB /serial port
    i have seen a adoptor on net by rebios .net
    i need schematic for this device
    i think it is very esy to use because there is no soldring etc.
    if any body have this schematic please i will thanksfull for schematic of this device
    Thankyou

  742. Comment by Abdul Majeed Tahir:

    I read so many comments but i need read/write 24FR08 through USB /serial port
    i have seen a adoptor on net by rebios .net
    i need schematic for this device
    i think it is very esy to use because there is no soldring etc.
    if any body have this schematic please i will thanksfull for schematic of this device
    Thankyou

  743. Comment by Costa Rica:

    Today I fix it my second ThinkPad R40, thank you all for your post help a lot. Procedure clear and efficient. See you

  744. Comment by Luis:

    help::::::::
    x60 lenovo
    please! pass bios
    no port 9 pin, my port is of 15 pin
    ¿? help: please::

  745. Comment by jake:

    HELP, I just spent $100 on a thinkpad 390E on ebay and it has a power on password set, i cant get into bios or into windows, i have no idea what the password could be, any ideas? will the method listed here work???

  746. Comment by Mike:

    Yes, it will work. 390E has 24RF08, the procedure is the same. See also the allservice.ro/forum, I think they have the 390 pictures somewhere

  747. Comment by Jed:

    Forgotten Power-on password
    If the Power-on password is forgotten

    and the Supervisor password is known,

    simply go into the ThinkPad BIOS setup

    utility and reset the Power-on password,

    otherwise try the following:
    Turn off the computer.
    Remove the battery pack.
    Remove the backup battery. This is

    located under the battery.
    Turn on the computer and wait until the

    POST ends. After the POST ends, the

    password prompt does not appear. The POP

    has been removed.
    Reinstall the backup battery and the

    battery pack.
    Note: Some ThinkPad systems have the

    ability to reset the Power-on passwords

    in the ThinkPad BIOS setup utility if a

    Supervisor password has been set.

  748. Comment by Frank Watts:

    Can anyone tell me where the atml chip is on a IBM T30 Thinkpad?

  749. Comment by Raven Delarge:

    Reading Eeprom >>>
    Done.

    LapTop unlocked.
    Thanks. :]

  750. Comment by Franco:

    Can anyone tell me where is the chip on Thinkpad A21M?
    Thanks

  751. Comment by fabian Limones huante:

    Tengo una thinkpad T42, segui los pasos y a la primera no aparecio el password, pero despues de cerrar y abrir la aplicacion con la opcion “AA => OFF”, el password aparecio.
    era uno de los mios pero solo los 7 primeros digitos fueron capturados por el Bios, por eso nunca habia podido acceder.

    MUCHAS GRACIAS.

  752. Comment by Franco:

    i found the chip. now everythings work fine.
    Thanx

  753. Comment by David:

    Hello.
    I’ve a TP A30 with a CRC1 error. I need a valid dump for this model. Does someone have a valid dump for this model? My mail ***86@hotmail.fr replace *** by davidp.
    Thank you.

  754. Comment by ali:

    chris,
    you really are an idiot. i know victor for a few months. he’s the most supportive person that i have ever seen. he helps anybody he can. how you ended up like this, is your own darned fault. victor is a man of integrity. i am living proof of that.

  755. Comment by Klaus:

    i have got an T42 with BIOS Password set. The User forgot this Password. i build this little Interface and readed out the bin file succesfully. Unfortunately the IBMPass Tool coud not encrypt the file to display an useful password. Can you help me please? Can i send you the file per mail and you try to encrypt the valid Password.

    Best Regards Klaus

  756. Comment by Jeppo:

    I just bought an used IBM ThinkPad T22. I took it apart to clean it. Now when i try to boot it, it wants a password :/ I’m now sure if it’s the supervisor password or another password. Please help me!

  757. Comment by anthony:

    Help please..anyone. can anyone tell me where the chip is on the A21M? the location or component number

  758. Comment by Theoxy:

    hey thanks guys. i connected every thing as specified above but wen I run the dump file it keeps telling me “circuit not found” can someone help me out?

  759. Comment by julian:

    Hi, i have the dump file when i open the file and turn on “AA” button in the line 0×330 says ” A A” (wihtout “) y put this in the password but dont work. can any help me? sorry abaut my engish,,, thanks

  760. Comment by jake:

    hey i asked you guys bout 2 weeks ago about the poweron password on a tp 390e, ok its a little icon with a computerand a masterlock, taking the batteryout does not do any thing, do i have to use the method described here??, please i need all the help i can get!, thankz

  761. Comment by psyber7:

    EEPROM Not Available !! Important, read me if you get this message!!

    After messing around with this all day, and checking all my connections about a 100x, I finally narrowed it down to being a COM port issue. Under WIN XP I ran MSCONFIG and disabled ALL ’startup items’ AND ’services’, restarted and VOILLA!!! It worked!! Thanks to this forum and all users who posted threads, Information is KING!

    EEPROM Not Available !! Important, read me if you get this message!!

  762. Comment by psyber7:

    Also, another handy tip:

    Instead of soldering or wrapping to the EEPROM pins, I had soldered my wires to tack needles (you know the ones with the little beads on the end of them used for clothing.
    I guess you could also use sewing needles, but I like the beads on the end of it…it made for easier handling.)
    This allowed me to connect the SCL and SDA wires to the EEPROM pins without risk of shorting/damaging the ATMEL….the only problem I ran into using this method was…that I needed another hand to press the ‘enter’ key ;-)

    Thanks & Good Luck to future IBM BIOS password hackers!

  763. Comment by psyber7:

    FYI: My Supervisors password turned out to be 966399 on an TP A30. If you have this model you may want to try-it-out for sh*ts and giggles, before attempting the hack. I don’t know if each TP has a unique password based on serial number or if they break ‘em down into batches. i.e. (1000-5000) will have this password, (5001-10000) will have another pw, and etcetera.

  764. Comment by netbox:

    Hello to all!
    Can anyone send me a .bin of IBM Thinkpad T23?
    Pleaseeeeee.. send it to my e-add:

    yethoo at yahoo dot com
    Thanks in advance!
    Great site too, a lot of people revived their TP, hope mine too :(
    Please send me a .bin of T32.. Thank you very much!

  765. Comment by netbox:

    Hello to all!
    Can anyone send me a .bin of IBM Thinkpad T23?
    Pleaseeeeee.. send it to my e-add:

    yethoo at yahoo dot com

    Thanks in advance!
    Great site too, a lot of people revived their TP, hope mine too :(
    Please send me a .bin of T32.. Thank you very much!

  766. Comment by Alvaro Colom:

    I run this line:
    r24rf08 exam.bin

    After that it shows me the next message:
    Initialazing time… 19848 OK
    ERROR: Eeprom not available!
    Hit (Enter) to exit….

    Can you help whit this?

  767. Comment by drdopazo:

    hi boys! well, sorry for my bad english, but im from argentina, a spanish country… jaja, i just write for thank you for this tutorial. I had a death T21, because at the supervisor password that make impossible boot to windows or enter to setup. But all that it was finished by the siprog and the utilities of software. it was really hard to sold the wires of the eeprom, because it was one of that contains 14 wires… but, with a lot of pacience y careful, i made it! the fucking password is, was… 2001EGP
    I said was, because i already disable that option in the setup menu…
    Once again, thank you very much! all the technics here in my town wasn’t know how to fix it, so i had to take it in my hands…
    i will recomend this method to everybody!
    bye bye, and thanks again!

  768. Comment by John Krause:

    I have an IBM T42P, which we attached to 2 - 2200 ohm resistors & 2 zeners. etc to a serial port.
    It works! I got a DUMP.BIN of 1024 bytes, but the file has nothing at location 330 hex.
    I made several copies of the dump.bin file dump1.bin, etc… all are the same…
    Help me with this passowrd please?
    How might I send you one of these dump.bin files for examination?

  769. Comment by simo:

    merci

  770. Comment by Sumi:

    This is great info, I was successful on the first attempt at dumping the eeprom on my T23.
    What happened in my case is that one day I turned on the thinkpad and it beeped and said error 271 check date and time or something along those lines. Then it went to the password screen and it would not accept my password. I tried everything like removing the battery and then finally found out about IBM’s stupid security chip. I’m glad I didn’t have to strip down the laptop as the eeprom was just under neath the ram cover. Some useful tips if you have to do this: Use a solid conductor wire such as wire wrap wire as it is a very fine gauge. You dont have to solder GND wire directly to the chip, just find a common ground point. You can use your DMM to verify this. A repair shop quoted me $200 CAN to recover the password!

  771. Comment by horst:

    maybe a different question than usual: after updating the bios of my T61 i got confronted with a bios password promt on the next boot. but i never set a password. i’m not sure if the upgrade just went wrong, but as i still see the lenovo logo followed by the password prompt and got no errors during update i guess it has worked.

    so now i wonder if lenovo made a mistake and delivered a bios that has a default password set. can i use the tools from above as well to reveal the password if i only have the bios update files? i don’t see a bin file in there, but i guess somewhere in those files like $01AF000.FL1 it has to be, right? did anyone ever play around with those original files instead of the dumped bin file?

    any help appreciated.

  772. Comment by Aurora900:

    Method confirmed to work with R50e. I successfully retrieved the password out of one. To anyone who says they couldn’t find the password in the dump file: You have to click the translation button labeled AA. Also make sure you have “Scancode” selected in the translation options.

  773. Comment by Don:

    Just used the circuit and the two programs to convert my BIOS password locked T21 from a container of spare parts to a working laptop. Thanks so much for the assistance and advice on this site. I did not even have to solder wires to the EPROM. I used someone’s suggestion about holding probes against the two pins. I used the needle probes from my multimeter and someone else ran the programs on my desktop. Worked perfectly first time. Parts cost: AUD2.70! Way less than a used motherboard, let alone a new one. You made my day guys!

  774. Comment by Stu:

    I successfully hacked the password on a R30 but there is a space as the second character and when I type a space the laptop just beeps, so I cant enter it correctly. Does anyone have a solution for this
    Thanx

  775. Comment by Patrick Brok:

    Hello i have a IBM T43 thinkpad! ..

    Can anyone Email me exactly how to found out my bios password?

    BIG thx in advance..

  776. Comment by Saifuljulio:

    Hello … SDIY…..
    haha.. i already do repairing any problem related to IBM password removal. I got it only from the awesome tutorials of this site. Thanks…
    I have built the interface hadrdare by myself and it always works well.

  777. Comment by ibm repair:

    wondering if you would be able to show a picture close-up of the reader with everything put together i am terrible at schematics but if i had a picture of what wire went where and what it looked like when it was built i am pretty sure i can build it thanks so much for your help.

  778. Comment by hman:

    awesome!! the a20m i worked on had the 14 pin chip. the system had to be disassembled entirely to get to the security chip under the mobo - the chip was located on the right side (if the mobo is out and flipped over) about 2/3rds of the way up.

    what had happened, a supervisor password was on the machine, then it was left off for a year - so the machine was dead - as no one remembered the supervisor password, it couldnt even boot. with a few hours of work from complete disassembly to reassembly (2 times, it didnt work first time, so i double checked the work), it went comparibly smooth, and i can now re-use the celeron 500 mhz for a friend. please note - if you dont know electronics or have a steady hand, i do NOT recommend doing this repair. as i have both, it was not an issue.

  779. Comment by Brayan Atavia:

    es que tengo una thinkpad t30 y no me acuerdo de el password de bios que puedo hacer

  780. Comment by David M:

    Thanks, you saved my A31.

    I did not solder the wires, but merely attached the GND wire with a screw and held the SDA and SLA onto the chip by hand. Steady as she goes !

    Also, I had to toggle the display in the IBMPASS program so I could read the plain text, not the encoded characters.

  781. Comment by Koolmees:

    I tried it on a TP 390X and it worked first time.
    The Atmel chip is located at the back left of the laptop. It was a bit tricky getting a soldering iron to attach the wires, but not impossible.
    Thank you !

    PS the schematic should mention that SDA is on pin 5 and SLA is on pin 6

  782. Comment by El Professor:

    I found a way to reset the bios password for an IBM Thinkpad T42. By opening up the computer to find the ATMEL 24RF08 chip. Before turning on the computer short circuit the two lower left pins with any metal object that you can find(e.g. screwdriver) then turn on the computer. When the boot up screen comes up, press F1. When you see the small lock, simply press Enter and it will give you an error message then ask you to press F1 to enter the Setup. You are now on the Setup Menu (remember that you are still short circuiting the two lower left pins). Go to the Password section and you will see that the Supervisor Password is Enabled, since you are logged in as Supervisor by pressing the up or down keys you will see that it becomes Disabled. Once you see that it is disabled select it and it will ask you for a new password. At this moment remove the object that is causing the short circuit and type in a new password( e.g. 1), save and exit.
    Now turn on the computer as you always do and when you see the boot up screen, again press the F1 button. It will ask you for a password but now you know it, because you set it. At this point now you can go into the password and have it disabled so you won’t go through all of this mess again.
    Tell me if it worked with you… danielfixespcs@gmail.com

  783. Comment by don:

    That will give a nice EAIA error and the Southbridge io ports will be damaged. I found this to be the idiots “method”, even for Dell. “Tel me if it worked for you…” nice, why don’t you cool your brain elsewhere?

  784. Comment by don:

    That will give a nice EAIA error and the Southbridge io ports will be damaged. I found this to be the idiots “method”, even for Dell. “Tel me if it worked for you…” nice, why don’t you cool your brain somewhere else?

  785. Comment by El Professor:

    Call it whatever you want, Mr. Idiots method. All I am saying is that this is what I did and it worked for me. Everything still works fine, you can still set up a new Supervisor Password if you want. I just thought that if someone had a problem like mine this might help. “Si no vete a lamber gansitos!”

  786. Comment by chris:

    Thanks for the info El Professor. Well, just let it be known thats an option with dangers inherited. Wonder if its safe to do with a resistor……hmmm…

  787. Comment by Sergio Paulo:

    Hola a todos, solo para saludarlos y comentarles como fue que pude quitar la contraseña de encendido a una laptop IBM Thinkpad 380XD. La cual trae un chip EPROM (ATMEL, 24C01A, SC27).

    La contraseña no me permitia entrar al BIOS cuando oprimia F1, porque lo primero que hacía es pedirme la contraseña.

    Pues bien, hice el armado del circuito que en esta página se publica, bajé los programas soldé los cables al chip eprom y corri el proceso de lectura de chip desde otra PC. Pues nada que lo leía porque mandaba el error “EPROM not available”. Como a muchos otros en este foro.

    Esta laptop antes de pedir la contraseña, ponía los siguientes números: 161, 163 y 158, luego pide la contraseña.

    Decidí que iva a conectar el cable serial justo después que apareciera el 161, y asi lo hice. Pero hó sopresa, ya no continuó el 163, si no que apareció el 188 en tres ocaciones y luego el 163 y me mando a una ventana donde me pedia pusiera la fecha y la hora.

    Después de eso de ponerle la fecha y hora se apago la pantalla y aparecio ventana de IBM y la cantidad de memoria instalada pero tardaba en mostrar algo mas y le quité el cable serial, y que entra al windows.

    Reinicié y todo bien, pero apagué y volvi a prender y que me vuelve a pedir contraseña, pero como ya sabia como “brincarme o resetear” el chip lo volví a hacer pero ahora antes de que entrara al Windows oprimí F1 y entró al BIOS entonces voy al apartado de contraseña y para sorpresa mía ninguna contraseña estaba puesta ni administrador ni encendido y de disco duro. Mas sin embargo seguía pidiendo contraseña al encender sin ser ni aceptar ninguna. Entonces opté por ponerle contraseña al encendido y de administrador que de forma automatica se le puedo al disco duro.

    Apago la Laptop, vuelvo a prender y me pide contraseña le pongo la de administrador y nada le pongo la de encendido y de OK. Y yo dije pues ahi quedó.

    Voy a poner unas imagenes como referencia.

    Cabe mencionar que con este método no usé para nada ningún programa porque los que aqui en el manual se mencionan no me funcionó.

    mas informacion a mi mail seronoser@itelcel.com

    Disculpen mi pobre inglés ya que mi idioma es el español

    Saludos desde México

  788. Comment by Sergio Paulo:

    Hello to all, only to greet them and to comment on them as it was that I could take the password of ignition from a laptop IBM Thinkpad 380XD. Which{who} brings a chip EPROM (ATMEL, 24C01A, SC27).

    The password was not allowing me to enter the BIOS when it was oppressing F1, because the first thing that it was doing is to ask me for the password.

    Well, I did armed{assembled} with the circuit that on this page is published, lowered the programs welded the cables to the chip eprom and covered the process of reading of chip from another PC. Since{so} not at all that was reading it because it was ordering the error “ EPROM not available ”. Like{as} to many{many people; a lot of} others in this forum.

    Before asking for the password, this laptop was putting the following numbers: 161, 163 and 158, then asks for the password.

    I decided that iva after the serial just cable connected later that was appearing 161, and like that I did it. But hó sopresa, already it did not continue 163, if not that appeared 188 in three occasions and then 163 and I get about to a window where he{she} was asking me was putting the date and the hour.

    After that thing about putting the date and hour I go out the screen and there appeared window of IBM and the quantity of installed memory but it was late in showing something more and I took the serial cable from him, and that enters the windows.

    I began again and all good, but I extinguished and took again and that asks me for password again, but like{as} already wise as{like} “ me skipping or resetear ” the chip I did again but now before it was entering the Windows I oppressed F1 and it entered the BIOS then I go to the paragraph of password and for my surprise any password not even manager was put not burning and of hard disk. More nevertheless he{she} kept on asking for password on having lit without being do not even do not even to accept none. Then I chose to put password to the ignition and of manager that automatically I him{her; you} can to the hard disk.

    I turn off the Laptop, take again and he{she} asks me that I put password that of manager and nothing I put that of ignition and of OK. And I said since there it stayed.

    I am going to put a few images as{like} reference.

    It is necessary to mention that with this method I did not use for anything any program because those who here in the manual are mentioned it me did not work.

    more information to my mail seronoser@itelcel.com

    Forgive my poor english

    Greetings from Mexico

  789. Comment by Hartmut Gerlach:

    Hallo,
    I need help.
    All what is written belongs to the 24RF08CT with 8 legs. But my chip has 14 legs.Who can help me? It is for an IBM 600X.
    A lot of thanks
    Hartmut Gerlach

  790. Comment by No1uno3:

    Hello

    I have 2 - T40 Thinkpads. Number One has the dreaded “Black Screen” crash problem, due to a known issue with bad solder connections on the Graphics Processor Unit (GPU). This would require a solder reflow to fix, and is a pretty much hopless cause. I have another T40 that is perfect, except for having a password locked bios.

    Question is - Can I just switch Atmel password chips? Put the one from the t40 with bad gpu, into locked t40. Or is there more to it than that?

    Any info would be appreciated…!!

  791. Comment by Aries:

    Pls Help My
    Tp23 stop post and msg
    017 : bad crc stop post task

  792. Comment by Aries:

    Hallo,
    I need help.
    All what is written belongs to the 24RF08 4 14 legs.Who can help me? It is for an IBM t24
    A lot of thanks
    Aries

  793. Comment by Momaster:

    Dear
    I have a problem with a IBM TP R40 that appears when lighting the 0187: EAIA data access error, and it is begun after several intents of out and ignition is able to enter, if somebody had some solution to this problem I would thank them to him. I didn’t make anything of removing him the countersign the error she/he appeared alone.

    Greetings and Thanks

  794. Comment by Momaster:

    Dear
    I would thank any help to solve this error 0187: EAIA data access error of IBM Thinkpad R40, pleas send me answer mauriciooliva@msn.com

  795. Comment by Ronald Fogle:

    Hello,
    Bought a IBM G40 from a fellow that had tore into it to try and bypass the password.
    He gave up and I tried your method, and lo and behold, now the laptop does not have a password.
    Thanks for the info, I will keep my little contraption just in case I run onto another good buy with
    a bios password laptop.
    RHF

  796. Comment by Sam:

    Hi,

    I am going to be following this procedure to hotwirring the computer to find the password, only thing is i dont clearly understand of what the images show, as i am not sure of where the ground is on the computer, can you please show me some sort of an image that will clearly display where the wires must go, i have already found where the chip is (AMTEL, 24RFC8, 0446), but i do not know where the third wire goes, as well as i do not know the exact equipment i should be using (such as the wireles not resitors etc), and i do not know how exactly the wire should be placed (e.g. on a board, etc), clear images of all posible shots to show the exact places and how to do this would be great, such as step by step images. Please email me at samjohny666@hotmail.com to let me know how i am exactly meant to do this and where i can buy the eqiupment.

    Thanks!

  797. Comment by browland:

    I have reviewed all the data regarding the hardware build. I have not located the WATT requirement for the Zener or Resistors. I believe a 1/4 watt will work well for each. However not sure.

    Thank you

  798. Comment by madison:

    my stinkpad r40 seems to have a bad starter for the backlight seen it flicker… once. so i flailed it apart, completely.now i have a quandry,disconned thebatt w/ heatshrink on it BAM three strikes ur out i.e. no clue what im doing, obvly. im getting a “beep beep” after the TPibm power up then yeah,whatever itll collect dust just like everything else i try to do PEACE!!!

  799. Comment by janko_wodnik:

    My X41 (type 2526-Y77) has got P24S08 EEPROM chip located on downside of motherboard. P24S08 is a clone of famous ATMEL 24RFC8 password chip.

  800. Comment by Browland:

    I have attempted to pull password from chip. I have created the hardware and have tested with meter to ensure correct. everytime I attempt to create the .bin file, I receive an the follwing error C:\ALLservice\24RF08>r24rf08.exe burkhart1.bin
    24RF08 eeprom reader v2.0b - Win32 Console Version
    Copyright (C) Victor Voinea, ALLservice 2004-2005, http://www.allservice.ro

    —————————————————————-
    Initializing timer…23704 OK!
    ERROR: Circuit not found or bus error!

    This is an X40 with 24rf08 chip. Any help would be appreciated.

  801. Comment by dali:

    Hi,
    I initialised the TPM on my nc8430.
    After rebooting the password I entered didn’t work.
    I tried hundreds of key-combinations but withouth success.
    The hp-service told me (after about 2 hours of conversation and useless talk) that it was impossible to help me and I needed to replace the mainboard.
    Does anybody know any way to reset the tpm chip?
    Or is there anyway to remove that chip from my board?
    i tray everything 3 month long , but no result .
    i find only after long ahour internet surfing the security chip Infineon SLB 9635 TT 1.2
    slb9635tt12
    please help

    I am completely despaired,

  802. Comment by Claude El Helou:

    Hi, thanks for this informations…..I have a T30, I have read the eprom and put it in a bin file and i used IBMpass 2.1 Lite to decode the file and between the row 330 and 340 I found the password that is repeated in the 2 lines but not recognized (& . . . . . . J ) = 26 12 12 00 00 00 00 4a.
    can u help me?

  803. Comment by cybaer:

    work this instruktion for the r52???

  804. Comment by Patrick:

    Hello,
    i have an old Thinkpad 760ED with Bios Password and HDD-Password,
    Where can i find the bios-chip or what can i do?

    please help me, thx

  805. Comment by don:

    @Claude El Helou

    In IBMpass click the A_A button and you’ll have a surprise :)

    @cybaer
    No. R52 requires the other software, RPC8394

  806. Comment by Claude EL HELOU:

    Hi don, I click A_A button and i have the surprise :)
    so thank u very much…….

  807. Comment by D:

    Hi,

    Thank you very much!!! Everything worked like a charm on my R50e. The EEPROM is located exactly where described (below CPU).

    The instructions are easy to follow.

    Great work.

    Thank you

    D

  808. Comment by Mike:

    Hi,
    Thanks for this tuto. It’s a great work.It works for me on an X61.

    But I wonder if it’s not possible to do this by a software way…

    On lenovo site you can dl a soft to manage bios setup including secure parts to copy on many many other laptops. It’s SRCMOS.EXE. As they say if you have a supervisor password, this one is copied at the same time. When doing backup of a supervisor passworded bios config, the exe can ask you this password. It prooves the soft can read the supervisor password…

    I’m not skill in ASM to disassemble this exe, but if one cant do it. It should be a better way to recover the supervisor password!

    Thanks to consider it !

    PS : Please, excuse my bad english…

  809. Comment by Ivan (david_tutasia):

    Good, very good.I have note AMD 64_x2 2.4Ghz/Hdd-320/4gb/GeForce 1280Mb turbocashe/
    on my comp Fifa2008 game very stupids .i have VistA(fuck) Please help me(david_tutasia@yahoo.com) Ukraine
    Congratulations all vs Euro 2008 & Euro football2012 in Ukraine .Go to Ukraine.
    Thank.

  810. Comment by Ivan (david_tutasia):

    im sorry my bad english & please help me I very like game EA sports Fifa2008 but i play in PES08 (japan fuck) now.

  811. Comment by BigDickChuck69:

    I don’t know why you guys have to go through all this. about twelve hours ago, i disabled the password on a T30 by removing the cmos battery, then booting the laptop while plugged into the power adapter only.

  812. Comment by Riek:

    I have a Compaq nc8430 mobile pc can some one help me to get my Bios password HP tel me i must buy a new motheroard ? please help
    Riek

  813. Comment by Riek:

    Is it the same as IBM ?

  814. Comment by Gio:

    THINKPAD R52 HELP!!! How come nobody has any info about them :S… IBM ThinkPad r52 it doesn’t even have an atmel chip. I dissasembled the whole thing, looked everywhere and nothing :(… WHERE’S VICTOR? HEY VICTOR!!! HELP!!.. I won’t call you an idiot I promise… Joe?.. where are you guys.. this junk doesn’t have an atmel chip ;( I’ll give a kiss if you help me out… it won’t matter if you don’t brush your teeth… *wait a minute but i don’t like men.. :S… ok I can try it, just help me out guys ok?. I’ll be hopping for your reply. Geez I even borrowed my old friend joe his mouse and took it apart to build the chip dumper,.. uh.. he doesn’t know yet but I think he won’t mind… as long as he doesn’t find out :P hehehe. please just a little help :(..

  815. Comment by SAM:

    Hey, great site. I took my tpT21 apart as far as it would go…….. then read the rest of the posts…….. seems i didn’t need to do this!!!

    WHY DOES IBM MAKE IT SO HARD TO DO SOMETHING ILLEGAL??????

  816. Comment by gopi:

    hi !
    I have R61 i have the same problem..,
    i opened my tp but i am not able to find out ATMEL 24RFC8 password chip.

    could any one help me for this model…R61….
    as one comment saying the p24508 chis is also the ATMEL 24RFC8.shall i go head with that…

  817. Comment by Gio:

    THINKPAD R52 HELP!!! why nobody wants to help unlock my junk :(.. come on guys.. I need it for school :( .. and ibm want’s to charge me 800dls to unlock it + tax. + california tax + fedex :(.. and I have to prove that is mine.. hard thing since I got in a thrift store :(.. they say the receit from the store is not proof. WHAT IF I TAKE OFF ALL THE CHIPS.. AND INSTALL CHEETOS INSTEAD :p HEHEHEH.. OK JUST KIDDING BUT COME ON GUYS.. HELP!!! :(.

  818. Comment by WB:

    Hello:

    I went to buy the resistors & Diodes and the I was told I need to know voltage for resistors and the IN number for diodes.

    Could you please help.

    Thanks

  819. Comment by don:

    @Gio

    Contact allservice on their forum or at their support - at -allservice.ro for the PC8794 tools.

  820. Comment by bihola:

    hi !
    I have R61 i have the same problem..,
    i opened my tp but i am not able to find out ATMEL 24RFC8 password chip.

    could any one help me for this model…R61….
    as one comment saying the p24508 chis is also the ATMEL 24RFC8.shall i go head with that…

    on your board you can find this SST25VF016B password chip

  821. Comment by Sony74:

    I have R61,

    I can’t locate the eeprom location? please help with photos?

  822. Comment by John Krause:

    Finally! That T42P unlocked clean, per the Admin’s instructions:

    1.) Password is NOT set, if no 330H password.

    2.) PC logo=PC pw or Cylinder logo=HD pw

    3.) Drain the CMOS by unplugging the cmos battery.
    Then SHORT the pins it plugs into to drain it, or it never discharges cmos!
    My PC Came right up, afterward without pw anymore.

    4.) Then HD Lock Cylinder Logo appeared! Tried LowLevel Format to remove HD pw. No luck,
    Bad HD after testing with PC Check 6.05 Fixed by replacing HD with a spare HD.
    Runs like a real fast charm… Many Thanks to Mr. Admin!!!

  823. Comment by Nigel Battersby:

    I have a Lenovo X61s, the onlt ATMEL chip i can find is multi pin package marked AT97SC3203

    The problem that i have is that the battery backup was removed on this machine and no one knows the administrator password and the bios and power up password has been set :-(

    Is this machine scrap?

  824. Comment by Kamran:

    Hi,
    Thanks for great material by admin. I apriciate his afforts. My laptop IBM a22m shows HD Lock Cylinder when i power on or even i press F1 to open bios setup.
    I have a question that can we reset hard disk password with supervisor password. I search about it on net that it is not possible to remove haddrive password, it must be replaced. is there no way to reset hardrive password. Can i use the above mentioned procedure to get HD password ?

  825. Comment by jmhx2:

    Thanks for the information. It worked like a charm on a A31.
    8 pin chip under PCMCIA, upper right hand of M/B
    Slip ups that may benefit someone:
    “Circuit not found” Make sure your serial port is enabled in the reading machine. DOH!
    “eprom not available” Make sure you have grounded pin5 from serial cable to the circuit. (same ground in PC chassis.

    Thanks again, got a usable machine instead of ebay parts!

  826. Comment by Gio:

    I’m still stuck with my THINKPAD R52, i tried several time to look for a chip somehow similar to the atmel, but i found none. not even under the motherboard. does anybody knows anything about it?.

  827. Comment by patt:

    may i have the tuto in french please
    thank’s aot

  828. Comment by diana:

    Hi, I´ve the dump file, but i still don´t know my password. There is an sign whitch i can not recognize. Can You help me PLEASE???

  829. Comment by gio:

    I’m still wating… help!. :(

  830. Comment by Thanh Tung:

    I’ll test it later, thanks alot for the great topic you ware posted!

  831. Comment by Edwin:

    It worked great on my t23. But if you don’t know you got to push AA in IBMpass 2.1, you will not see the password.

  832. Comment by dantes:

    IBM tech my ass, you’re using allservice’s software and hardware :)

  833. Comment by gio:

    hahahha.. good one dantes :P. . . I still need help with my r52 :(.

  834. Comment by gio:

    but i think im going to get andy’s service to unlock my r52 :(…. running out of options.

  835. Comment by Buba:

    hello, I have the same problem as everyone tells me to connect “ERROR: EEPROM NOT avaiable” rather than finding solutions, if someone knows that it can be please contact me my e-mail is dj.lucasmontana @ live.com thank you very much

  836. Comment by Darren & Jo:

    I have a t40 password recovery method worked first time thanks.

  837. Comment by dantes:

    Gio, ask allservice, the software will only cost you $45 is not passphrased, and forget about these pussies

  838. Comment by sebse:

    I have a ThinPad R60. I know the security password exactly, but somehow the message security password retry limit exeeded appears and I cannot accessdie BIOS Software. What to do if I know the pasword but cannot start BIOS?

    Thanks

  839. Comment by Norbert Maier:

    Hello.

    Does anyone have a EEPROM dump for TP T21? Please send it to boeserbengel@hotmail.com

    Thanks.

  840. Comment by adonx:

    Thanks, it worked on my t40.

  841. Comment by Sergey:

    Hello all!
    I’m trying to fun with my T60 with forgooten password. Does anybody has an experience doind this with T60? Should i do it or it is better not to try and leave it..?

  842. Comment by dantes:

    I’ve done the T60, it requires a bit of expertise but allservice’s help&support was great.
    http://www.allservice.ro/forum/viewtopic.php?t=952

    These are the tools, I bought only the software, nut anyway should you have problems making it, the circuit is available from allservice as well.
    http://www.allservice.ro/forum/viewtopic.php?p=1061#1061

  843. Comment by Desperate:

    Hello,

    I just read-out the chip succesfully but I ended up at with the following string as password (which I don’t know which keys correspondent with the keyboard).

    31 24 17 31 0B 25 00 CD

    31 = 1
    24 = $
    17 = ETB ??
    31 = 1
    0B = VT ??
    25 = %
    00 = ?
    CD = ?

    Any help much appriciated.

    Regards,

    Clueless

  844. Comment by Unfixed:

    Hi,
    a little confused about the diodes.
    I can’t seem to find anything on the” “2 x C5V1 Zener diodes ”
    Looked on radio shack and i’ve only found 1N4733A and 1N4742A.
    I’m thinking the 1N4733A is what i need, but any help would be most appreciated. Oh and thanks OP for the information.
    TIA!

  845. Comment by starprowler:

    It worked like a charm on my T30! Neat!

    @Unfixed:
    The diodes are plain 5.1Volt Zener diodes. Ask for these at RadioShack or any such electronics store.

    @Desperate/Clueless:
    You might need to change the translation in IBM Pass 2.1 Lite. Try one of them You can find it under View->Translation.

  846. Comment by dantes:

    @Desperate

    Its “njinok”, baby

  847. Comment by jules:

    Excellent site,- have a A22m,- locked when the internal button cell went flat and the time/date is lost. Changed out the Amtel chip (14leg) with a new one but this just makes a CRC error as the bios knows the chip isnt right,- DONT bother swapping the chip. Just follow the instructions on this site carefully,- took me 2 hours in all. on the A22m the amtel chip is hard to find, its on the underside of the mainboard close to where the hardisk fits in. the ENTIRE laptop must be stripped to get at it,- then assembled carefully with the 3 wires coming out of the harddisk bay (leave the disk out) I have emailed the pics of the chip and its connection to this site and hopefully they’ll put them up. Thanks to everyone involved here including ALLSERVICE for the eeprom reader etc,- you are doing a good job for the environment,- without this site this laptop would now be in a landfill site…what a waste!! jules.

  848. Comment by bihola:

    if somebody need thise programm PC8394T programming tools free I will send.I have no crack.
    envarkaraev@gmail.com

  849. Comment by Frank:

    can someone please send me a picture of the actual wiring of the diodes and resistors and how they are grounded (i am not very good in this kind of stuff.. especially reading a schemetics)
    thank you

  850. Comment by Frank:

    Has anybody already tried this on an X40 resp. can tell me where the Atmel Chip is placed on the board? I searched for it but didn’t find it.

    Another question. Im not quite fit about this whole Resistor-stuff. There are many different types of 2,2kOhm resistors. Which ones do I have to buy?

    Thanks
    Uli

  851. Comment by Darik:

    Tried on a TP R51 and it works great. Just make sure you push the “AA” button at the upper left of IBMPass 2.1 if you get weird symbols aftre dumping.

  852. Comment by yahmeen:

    i could really use a full view picture of the reader cable assembled for reference

  853. Comment by Orlando:

    I can see that all the information is very clear and seems to work for many IBM Thinkpad Laptops. I just have one question, when I press F1 my laptop doesn’t go into de Setup it just show me the blank Screen whith the lock and asking for the password.

    What I have to do?

    Thanks

  854. Comment by Stu:

    Just used the circuit and the two programs to convert my BIOS password locked T21 from a container of spare parts to a working laptop. Thanks so much for the assistance and advice on this site. I did not even have to solder wires to the EPROM. I used someone’s suggestion about holding probes against the two pins. I used the needle probes from my multimeter and someone else ran the programs on my desktop. Worked perfectly first time. Parts cost: AUD2.70! Way less than a used motherboard, let alone a new one. You made my day guys!

  855. Comment by gio:

    well it seems that nobody had ever had a r52 thinkpad. and I’m not willing to pay 250 just for some software, … built the reader but, this junk doesn’t have an atmel chip… must be something diferent. anyway, with those 250, I’d just add another 100 and get me a brand new computer. thanks guys, you’ve been really helpful,… at least trying to sell me those things heheheh. peace out.

    Gio.

  856. Comment by sid:

    hey guyz,,,can you guys tell me if there is a way to find out the bios/supervisor password through windows,,.
    my t21 lets me enter into windows, but not into bios due to the password.
    so i am hoping and wondering if there is any way that i can find out/reset/delete the bios/ supervisor password from inside the windows by running some sort of program or some command or something.

    any help is appreciated.

    thanks all and thanks for putting up this site with this info.

  857. Comment by Stu:

    @Gio
    I know the software is $45 (full kit is $100) at allservice and R52 has PC8394 not the Atlem, I unlocked mine and took me 2 hours to complete the interface.

  858. Comment by sid:

    hey guz im trying real hard to get this to work, but having no luck, so if any of you can help me out a lil bit.

    i am havin two problems..
    one…i am not sure how exactly to connect the diodes and resisters in what order, so if someone has a picture of model they made, that would solve most my problem..
    so can SOMEONE PLEASE PROVIDE ME WITH A PICTURE OF HOW THE WIRES ARE CONNCETED WITH THE DIODES AND RESISTORS..PLZ THX

    2ND problem is that after i connect all the wires (maybe its rong design, maybe not) i open up the r24fr08 reader, a window opens but i don;t know what to do after that, it just tells me to press enter to exit.

    help me out guyz plz..thx.

    router124@Hotmail.com
    email me whatever u can. actual design pics. thx again.

  859. Comment by sid:

    how do i get the dump file..help me out fellas

  860. Comment by Ahmed:

    Boys and Girls ..

    Here is the lo-down on the T60, just to stop all the wishy woshy on this thread. This is in two parts:

    PART 1: Hardware:

    1. PC8394 is not a chip. This happens to be the name of the tools from allserviceswhatchimmycallit from Romania. By the way, well done to them .. great guys, and I personally think that Romanian techs are bright and very intelligent people [ IMHO ] and no, I am not Romanian, nor married to one :)

    2. The T60 does NOT use an AT24RFC08 chip; It instead uses a TPM (Trusted Platform Module), again made by - you guessed it - Atmel. The Chip designation is AT25C010AN. In general, what is on the market as a replacement for the chip today is AT25C010A, which is the same chip, same spec, just a new numbering convention from Atmel. Phew !

    3. The AT25C010A[N] chip, akin with all 25Cxxx series chip, is NOT I2C compatible, nor does it use the I2C protocol -> therefore, the reader herein will NOT work, so stop looking for equivalent pin outs on where to hookup the reader. The TPM [ aka AT25C010AN in this case] is an SPI chip. I am therefore (very) doubtful that someone has actually read the contents of the 25C010AN chip on the T60, but that’s my suspicious nature.

    4. There is a way to read and program this chip with an SPI reader, which is what the two sites - Romanian and Aussie - are selling. Buy it, or get your own SPI programming device, or even wait for me to get a moment from this damn hektic life, and I’ll post a reader design on this thread.

    PART 2: Software:

    Here is where it gets interersting. Again, well done to both the Aussies and the Romanians for there software, but don’t take this as an endorsment: I have used niether.

    You will need to:

    1. Read the chip content
    2. Find the password
    3. Reset, or decode it.

    I am currently working on a T60 motherboard, and have a completely unlocked T60 at my disposal too.

    If you need your T60 decoded, simply ask me for a replacement chip. I’ll post you a pre-programmed one if you are competent soldering it. Alternatively, for the same money, I’ll send you a clear dump for your chip that will clear the password.

    I’ll e-mail you the software to read your chip and the dump to clear it.

    Either way, the cost is $130.00 + shipping for the chip. If it’s the software path you want to go, then all I need of you is your $130, clear into my PayPal account. Costs are not negotiable. Other models quoted individually.

    I am reachable on worldentropy@yahoo.co.uk should you wish to correspond.

    Thanks,

    Ahmed.

  861. Comment by Darik:

    Tried it on a TP R51 and it works great. Just make sure you push the “AA” button at the upper left of IBMPass 2.1 if you get weird symbols aftre dumping.

  862. Comment by Darik:

    Ahmed buddy, I can unlock T60s and i know what chip is it. I admit we got allservice’s solution. But I gotta tell you, wtf are you talking about? IMFAO! :)

  863. Comment by gio:

    gee.. ok let me see.. I paid 100dls for mi r52. and this guy wants 130 for his little tricky software…. MMM… let me think about it, since I got me the new hp entertainment system with 4gb of memory…MMM NAAA.. you put your little dongle and software wherever it fits you better. there are many others, who like me, don’t mind sharing their skills. I thought this whole site was of helping people out that’s the “SO DO IT YOURSELF” not a free market for some rippers or scavengers. anyway thank all of you guys who helped me an others… for that R52.. well looks good as a door stop hehehehe :P.

  864. Comment by Dunga:

    Thank you very much. I unlocked the bios password from my deceased cousin’s T42.
    I use the circuit board to make easier for the connections..
    Thank you again!!!
    –Dunga :-)

  865. Comment by Anthony:

    Thank you for the excellent instructions! It’s kind of you to go to so much effort to help people with the same problem.

    I’m pondering buying a Thinkpad model T22 and the seller does not know the password. The only part I didn’t see in your directions was how do you connect the little gadget to the working computer? Do you connect the spare serial port to the serial port on the working computer?

    And would you please type Thinkpad? Seeing TP over and over again is a distraction, and it means toilet paper.

    Thank you for your help :)

  866. Comment by Frank:

    Hi guys, great job! I find out the password for the T22. The ATMEL chip is a 14 pins type and is located direct under the RAM. The machine musn’t disassembled. Works very well.
    For german passwort’s you have to know, that the “y” is a “z” because of the german keyboard design.
    Thanks Frank

  867. Comment by darius:

    hi,
    I have a T61, I have read the eprom p24s08 and put it in a bin file and i used IBMpass 2.1 Lite to decode the file and between the row 330 and 340 I found the password that is repeated in the 2 lines but not recognized =b1 e6 0d e4 cc 2c 95 8f (AA button on).
    Thanks in Advance,darius.

  868. Comment by Hacking IBM Thinkpad Bios Password « matamu adalah jendelamu:

    [...] link:http://sodoityourself.com/hacking-ibm-thinkpad-bios-password [...]

  869. Comment by Ford:

    hi. I am a hacker. I can get you an aol,yahoo,myspace,facebook,gmail…etc password. I do charge a fee to get a password though. Once i do get password i’ll show you proof i have it. Are you interested? E-mail me at Fordf202006@yahoo.com

  870. Comment by Walt:

    NO SOLDERING OPTION

    I just recovered the password on my T23 and found a way to avoid soldering to those tiny pins on the Atmel chip.

    There are some test pads in the vicinity of the chip so I did some probing with an Ohmeter to find out if there are any useful connections. There is a row of small circles that runs parallel to the back edge of the computer. The circle at the end nearest pin 8 (SDA) has continuity with that pin. The circle about 2 locations toward the center of the computer with a little white line has continuity with pin 10 (SCL).

    The holes in these pads are so small that 30 gauge wire is the largest that will fit. I used 30 gauge wire wrap for the connections. In fact, when you cut the end of the wire it will usually deform a little and I had to file the end with a nail file to make it fit in the hole. The connections are suprisingly secure with only friction to hold them. When I tore the rig down it took a good bit of force to pull the wires out of the holes.

    Hope this is useful to someone.

  871. Comment by Bobby:

    The guys trying to get $130,= for the trick are way beyond the limits of reason. You can buy a replacement systemboard / motherboard for that price on well-known auction sites.

  872. Comment by Dick Sniffer:

    Can someone help me find my password to Windows98? I have many text files that contain passwords to previous levels in Zelda. Help! Please sen me email to “dicksniffer@turdlicker.com”

  873. Comment by john savage:

    Anyone care to share PC8394T programming tools? I just bought this replacement board for my r52 type 1849 and supervisory password is enabled. so, for me to spend the $110 to fix this is unreasonable. Also, which pins do i solder the wires to with the pc8394t? please email me at: laptopprogram@yahoo.com

  874. Comment by Reflected_God:

    Works perfectly in my T40 IBM Thinkpad laptop. Now is unlocked.

    THANKS :D

  875. Comment by rohit soni:

    hey dude i cannot get password from r30.i hav found the atmel 93c46,i have made circuit shown and connected it. but the dos program started says eeprom not found.plz plz plz help me .i cannot install windows in it.setup hangs with a blue screen.so i hav to configure bios

  876. Comment by Jesal Pancholi:

    Sir,
    I have IBM2628 Laptop with password locked….I have used this password hacking procedure. but the dos prompt replies “Eeprom not available” and then after my laptop doesn’t work…there is something wrong with the EEPROM. It has ATMEL 24RF08CT 14 pin eeprom. The laptop now just power on but not displays IBM logo or anything else…It has been gone in dead condition…Please some body suggest me what to do now…I have stand alone universal programmer..can somebody send me the EEPROM bin file. so that i can reload it in my eprom…or somebody suggest me how to ON my laptop again in proper working condition….I will very thankful to you….

  877. Comment by Darryl:

    Thanks for the info!! I have a T30 Thinkpad and the ATMEL 24RF08CN chip was under the memory chip. I build the reader and use the Allservice program and it show the password just fine. It took a long time to find the ATMEL chip but once I found it all went well. The Allservice site had great documentation on the different types of chip and what pins did what. Thanks again for now I have a working system.

  878. Comment by Any way to install Ubuntu on a 2nd hand locked out laptop?:

    [...] If it’s a Thinkpad and BIOS password then you will have to invest in some serious kit to extract the password as they encode them on a separate chip. I have a second user Thinkpad with some BIOS options unavailable (virtualisation for one) and have looked into this quite a bit. Here is a link to the kind of thing you need to be looking into. Hacking IBM Thinkpad Bios Password : SoDoItYourself.com Not for the faint of heart. [...]

  879. Comment by Stephen Trotsky:

    I’ve found better HI-FI pictures of someone who follow this tutorial, the article is on spanish and english, I’ve found useful his how to.

    compunauta dot com/forums/linux/gus/otros/eca.ibm.thinkpad.bios.recovery.html

    Quite nice another happy user :) thanks a lot this really works!!! Ibm Thinkpad T42.

  880. Comment by Pradeep:

    how can i Unlock by Bios Password for IBM T60 any help me Friends
    Shall I Work Out This Problem Please Help me

  881. Comment by riri:

    error not 45$ but 35$

  882. Comment by Bandi Lorand:

    Hi, I have a system password on my Thinkpad R60e, and I don`t know how to remove it .The method shown above is for every other thinkpad model exept mine:(.Can anyone help me with that???

  883. Comment by day:

    Hello. I do not see a clear explanation on how to unlock a t43. What exactly am I looking for in the motherboard? I do not see anything resembling anything close to what you guys are saying is ‘right there’…please help.

  884. Comment by Darik:

    T43 has PC8394, the big 100 pin or so chip. You may need to buy PC8394 tools from allservice.ro, at least the reader. And it has unlimited use and work for all the other models like T60 and R60 too.
    I used it a few times afterwards to unlock my friends machines, best solution for IBM and best support ever!

    http://www.allservice.ro/forum/viewtopic.php?p=1061#1061

  885. Comment by csaba:

    HI all, i dont find anywhere the IBMpass DOS version cause it seems the lite doesnt able to write to me the good pwd, so if somebody knows where i find lps wirte me or send me in mail…thanks for all.

  886. Comment by ali dabiri:

    t60 uses 8394 chip.

  887. Comment by Rehmo:

    Hi,

    I have here R50e does anyone here find were that little thing? What will be the risk of doing this instruction in a wrong term?

    Thank you.

  888. Comment by IBM NUTZ2:

    Excellent job on this project!
    I have recovered 4 passwords from T30’s & R40’s so far!
    But, I have another T30 that won’t give it up! The dump.bin file has the info from the T30 chip, but line 0×330 is blank on the output! The rest of the line is a “0’s”. The timer ran correctly and the file DID download to dump. Watched it go….it just is blank!
    The BIOS Password Prompt still comes up on boot. Line 0×340 has a readout of ” 8. 8. 6″.
    I have tried it 3 times and every try comes out with exactly the same dump.bin read.

    Sure would appreciate a direction on this one!
    Thanks,
    IBM NUTZ2

  889. Comment by ali dabiri:

    IBM nutz2
    that means it’s a power-on password. it has happened to me too.

    alex,

  890. Comment by IBM NUTZ2:

    Thanks Alex.
    What can we do about that? Guess I need to research a POP solution for my IBM’s?
    IBM NUTZ2

  891. Comment by IBM NUTZ2:

    Alex;
    I’m a duh on the POP! POP is controlled by the CMOS bat. I forgot before I remembered!

    IBM NUTZ2

  892. Comment by Jerry:

    Hey there- great website ! Just wondering if theyres any hope for an IBM Thinkpad 380 ED with the Bios password problem. Any thoughts would be great.

  893. Comment by can it be done on 560x?:

    Any one know of this will work on a 560X?

  894. Comment by bihola:

    One more time. if somebody need thise programm PC8394T programming tools free I will send.I have no crack.
    envarkaraev@gmail.com

  895. Comment by AlexWV:

    bihola,
    just the program pc8394t by itself, will not work without registry entries.
    cheers.

  896. Comment by Dande:

    Hi! Outstanding site mate, outstanding site! I’ve managed to unlock a T23 with your tutorial. With a friend (who has more experise in ironing less-than-millimeter pins) we’ve built the reader unit (the simple one), without a breadboard (using traditional switch, to control GND; and SCL, SDA separately). I wanted to make some photos of the process, but I forgot, but if you need, I can send a photo of the final reader unit (without the switches). The whole thing worked like a charm, found out the password, and the TB looks much better now, than in the trashbin. Keep up the good work!

  897. Comment by DanielK:

    Hi Everyone,

    I did this for a friends T40 and was able to read the eeprom perfectly.

    I get the file and go to the memory address 330 - and its Blank no password is shown.

    All the other information including hte serial number model number etc is visible, but no password. Has anyone else experienced this and know how to fix it?

    Thanks

  898. Comment by Frank:

    hi all.. can some one tell me if the sketch of the 9 pin female is the back or the front that we see. and also where do you solder the ground.
    thank you

  899. Comment by walter:

    Besten Reichel,

    Ihre T60 is nicht in die Liste oben fuer diesen Methoden. Aber diese Artikeln ist von

    http://www.allservice.ro/forum/viewtopic.php?p=1061#1061

    Newer T43/T43p and R52 don’t use 24RF08 but PC8394T-VJG TPM chip.
    PC8394 Tools are needed to read this chip .
    T60/T60p, R60 and Z60 support is included in PC8394 Tools now.

    Dieses is ein kompletes Methode und Sie brauchen nichts zu bilden.
    Es kost ungefaehr 100 Euro .

    Toi toi toi

    Gruesse von Land zu Land

    Walter.

  900. Comment by Loris:

    Hello People,
    Thanks at all for support.
    I’ve just tryed succesfully on a IBM G40 with IBMpass for Dos.

    Ciaoooooooooooo

  901. Comment by MArtin:

    I did with T22. It has 14 pin..! It works very well. 8 and 14 circuit instuction is found in http://www.allservice.ro/forum/dl/simple-i2cprog.pdf.

  902. Comment by alex:

    danielk,
    your laptop has a pass phrase. it has to be read using “driven interface” tool. you can check more info on this site: http://www.password-removal.com
    or email me alidabir1@dishmail.net
    cheers

  903. Comment by alex:

    danielk,
    if the password is blank, then it’s the power-on password. just unplug the cmos battery (the round yellow battery) under the palm rest for a few minutes, then plug it back in, and the password will be gone.
    cheers.

  904. Comment by ZaEsteves:

    Thanks for this link,

    About 10 years ago I was used to unlock téléphone by changing an Eprom adress
    Since then I completed abandoned electronics.

    A few days ago I started again and …. what a pleasure.

    Even if I had some difficulties…
    - soldering the eprom (Yes…I’m living in France and there’s no SOICs here… just in the states…)
    - My serial door was KO…

    I tried with another computer and “tata” it worked.

    Thank’s for this page

    ZaEsteves
    Viva o Benfica

  905. Comment by Cedric:

    Hi ! Thank you for your process, it’s very clear and helpfully.
    I found my lost password on my T40 pretty easily.
    The only things maybe you need to mentionned it’s when you read the dump file, don’t forget to click on the button “enable/disable translation” and then you can see the password in the line 0×330.

    Thanks again !
    Cedric for FRANCE

  906. Comment by Vince:

    I’ve got a present a thinkpad t43 with locked svp,
    I removed the batteries and so on.
    I tried “the hacking page” and stripped the thinkpad, but I didn’t found any atmel chip.
    May help me somebody, pictures of the t43 are available.
    I don’t know what I should do now…

    (sorry for the German-English)

  907. Comment by IBM NUTZ2:

    Where can the supervisor (SVP) password chip called ATMEL 24RF08 be found in an IBM T60? Under keyboard?
    Any help in finding it would be appreciated!
    Thanks,

    Trying to save us whom forgot our SVP Password!

  908. Comment by Irakli:

    im nide opene bios t43p

  909. Comment by gilles:

    bonjour a tous, tout d’abord je parle mal anglais mille excuses, problem pasword IBM R40 type 2683 ,le petit cadenas ,donc j’ai fait le montage pour lire ATMEL 24RF08 ,mais je n’ai pas de port serie RS232 sur my portable just USB ,je ne sait comment faire pour faire communiquer les deux PC ,help me please ,contact other by oovoo ,vingtdieux or MSN messenger patacc@msn.com, merci de votre aide ,cordialement Gilles

  910. Comment by IBM NUTZ2:

    To Admin & ER & W Hacking Team;
    After being successful several times on password retrieval, I am not getting “error: eeprom not available” message constantly! I have rung out the connections on the serial cable and bread board. It has not changed from the first success. Any idea’s?
    Thanks!
    IB IBMNUTZ2

  911. Comment by IBM NUTZ2:

    alex;
    thank you! I see that now.
    Am still getting error eeprom not available message constantly. just tried on a R30. Same message. I have double checked every component for positive contact on the bread board. it still rings out correct. I just checked the 2.2 resistors = 2.2. Checked the diods….they are not leaking. the wiring exactly matches the schematic. it worked a couple weeks ago and now on a T23 & an R30, each has an error. could the 24rf08 be damaged on both? they do not appear to have been soldered/worked on before.

    IB IBMNUTZ2

  912. Comment by mamun:

    sir, i have an ibm thinkpad T20 laptop.when i power on this thinkpad than i see erore 0175 code or some tine it dose not open or power on.please tell me how could i repiar thise my self . thanks.mamun

  913. Comment by Alben:

    This website is wonderful! I have a R50 that had a bad video chip that completely quit working about a year ago. New motherboards were extremely expensive, so I just shelved the laptop until I could find a cheap motherboard. As it turns out a cheap motherboard was finally available on eBay last week, so I purchased it. Little did I know, or the seller know, that the motherboard was password protected. BUMMER. So after a lot of web searching, I stumbled on this website.

    I spent my time and carefully built the circuit as shown at the top of this blog. I was able to get the entire circuit in the D-Sub plastic shell. I carefully planned the layout of the components and slipped heat shrink on the leads to insure shorting would not happen.

    Everything went as planned and I recovered the password to the R50. Interesting enough, the password was very generic. It was “IBMBIOS”.

    Kudos to the author of DoItYourself.com!

  914. Comment by Tony:

    Hi,

    Thank you for the great site. Question: what do I do with the 9 pin female. Where do I connect it or what should the other side of the 9 pin female be and to where to connect it to?

    Thanx a million

  915. Comment by Paul:

    Thanks very much - T22 - chip was right where several appends described it would be. Didn’t even have to remove the case - IMPORTANT - Note comments about the ON/OFF Translate Button in the upper Left hand position just above the HEX display. I thought I had a bunch of unprintable characters until I reread the comments above and tried the button and VOILA - the PW appeared. Right where it was supposed to be. Thanks again for a great piece of work!

  916. Comment by alexwv:

    IBMNUTZ2
    when you get “error - eprom not available”, it can mean:
    either the contacts are not connected right, the ground is not connected right, or the eprom chip has been re-soldered incorrectly, or the circuit is not right. re-check connections. you’re saying this used to work before, and now it’s not working?

  917. Comment by IBM NUTZ2:

    Thanks for your response!
    Yes, it worked on 4 machines. These last two are in error.
    I’m using the same ground clamp (rung out to bread board ground) on the large hex screws on the LPT1 Port. I have NOT removed/replaced any chips. And the ground from the ‘patient’ machine rings out to the main computer with the program, running XP Pro.
    They were contacted right out of the case. I was sure to identify the ‘dimple’ on the chip at leg 1. I just can’t figure out what has gone wrong at this point. I have no more machines to eperiment with unless I purposely password a BIOS and try to retrieve it (just thought of that).
    IBM NUTZ2

  918. Comment by test:

    bring it to IBM if still under warranty

  919. Comment by Dave:

    Hi all,
    First off i’d like to thank this site and everyone here for their impressive efforts and information. My friend has asked for help with a TP390 2626 laptop with reference to him not knowing the supervisor password. I’ve completely stripped the laptop and i have the mainboard completely out. I can’t find a chip with ATMEL written on it anywhere on the board. and i mean i have looked everywhere. What i did find though is an 8 legged chip near the power and usb sockets with 24C03 written on it. I’ve researched this chip using a few sites and the pinouts are the same as the 24RFC8 chip. I’ve downloaded the software as suggested in the tutorial and I’m going to build the tool to extract the password.
    i’ll let you all know how i get on.

  920. Comment by Chairul:

    for lenovo thinkpad t61 is still good working? if it yes, i will to try. but thats not ok, i wont to try. thanks for every body with your attention

  921. Comment by MarioWolf:

    Hi, IBM T23, There is a password on my wife’s hard drive and she forgot it.. I asked IBM for help and all they said was change the hard drive.. I did and it works fine.. IS there a way I can retrieve the info in the drive? Will this setup help me remove the password on the old hard drive?

  922. Comment by IBM NUTZ2:

    Hi MarioWolf:
    Had the same issue. set the password protected HD up as SLAVE and accessed it from the new setup. Got the files back. You willnot be able to remove the password using this proceedure.

  923. Comment by marek:

    Brilliant! it really works! I’ve checked on IBM r51.
    Thanks a lot!

  924. Comment by philman:

    This really was brilliant! Worked on the first shot on my t23. Just remember to press the aa button.

  925. Comment by Dale:

    Huge thanks!
    I had initally problems, but then I realized that I used 2.2 MEGA ohm resistors. Stupid me. After changing to 2.2Kohms it worked on my first try. I didn’t solder anything to the ATMEL chip, just pressed the resistor wires against the pins on the chip. So it’s certainly doable. Now my T40 BIOS is unlocked :)

  926. Comment by ThinkPad T30 Supervisor Password Recovery:

    [...] Following instructions posted here: http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/, I plan on doing just that. I have lots of spare wiring lying about and actually have all the needed parts except for the zener-diodes. [...]

  927. Comment by Pedro:

    Does anyone tried the Atmel solution on a Thinkpad X61?

    Please let me know.

    Thanks - Pedro

  928. Comment by Hopser:

    Hi there,
    first of all great work and great manual!!
    I felt really confident with these instructions, so I began to disassemble my T30 (Type 2367-gg2). Unfortunately, after disassembling quit everything except the PC Card Slot, I couldn’t find any ATMEL 24RF08 but “only” an ATMEL 234 93C46 SC27 which resides between the backup battery’s plug and the HDD.
    So do I have to search any further, e.g. on the mainboard’s bottom side, or should I try to read the ATMEL 93C46 after reading its datasheet on my own?
    It would be really wonderful, if I could work again with my old buddy :)

    Thanks in advance and much respect for your work!!

    Regards
    Ronny

  929. Comment by IBM NUTZ2:

    Hi Ronny;
    It’s under the front memory stick/slot. Just remove the memory cover and remove the memory stick, if it’ there. No further disassembly required!

  930. Comment by Pedro:

    THANK YOU Alex for your reply.

  931. Comment by phillyb:

    heres the easyest way ever to reset the bios passwords with no need for the chip reader!

    Just touch the sdl and sda posts together with a paper clip or something just keep contact and turn on the pc with them touching hit F1 to enter bios it should show a security error but it lets you in the bios. keep contact on the sdl and sda and go to security-passwords-administrator password hit enter when it asks for you to enter a password remove the paper clip from the posts and enter your password and hit enter it will say password saved.
    use something youll remember for the password.
    you should disable the rest of the passwords and hit F10 to save and exit.
    and thats all you have to do ps i used a copper wire for better contact you no need for sauder.

  932. Comment by wvboy:

    Has anyone had luck with a R52? I have found some sites that state that they can do this, but I would prefer not to get ripped off. Has anyone purchased the kit from AllService? Is the physical interface be the same (just different software and attach points) as the one described above? Do I need to buy the writer software as well as the reader?

  933. Comment by carlos:

    Hey I need help, I have a IBM think pat x41, and the circuit is done, but at this writing Chit atmel:

    “ATMEL 608
    24C64AN
    A SU27 ”

    Let me know if this is because the chip onto the board does not say: U53 but said: U65
    I need help please …

  934. Comment by carlos:

    my Mail is charls15@hotmail.com

  935. Comment by Axel:

    Worked for me on an A30p. The chip is under the pc card slot on that model. Quite a bit of disassembly was required to find it. I soldered the wires to the chip and a ground pad and ran them out through the pc card slot. I then reassembled the thing and hooked the wires up to the interface which Iplugged into and old win98 laptop. Dumped the chip extracted the password and I was in. All in all it was very simple to do.

    Many thanks.

  936. Comment by Sly_Fox:

    My spare computer dose not have a serial 9 port on it,Is there anyway to wire the ATMEL through a USB port?Thank you.

  937. Comment by karl:

    final fix for the ibm reset

    bull malarky,

    just short the pins 3 and 6 as you boot it will clear as you hit escape,
    it will jump right into bios settings,

    remove the batteries and run on ac while doing this.

    this fix has been verified by me just now..

    nice lot of hacking though but a real over kill ,
    nice pics too.
    what is pin 3 and 6 , count down from the top left 123, continue at bottom and count up 56 ,

    1 8
    2 7
    3 ——–6
    4 5

    http://sodoityourself.com/wp-content/uploads/2006/10/locating_atmel.jpg

    just like the dells , same jump for them too.

  938. Comment by Dave:

    Hi all again. Do i have to refit the entire laptop to extract the password ? its awkward as the wires are not soldering to the chip but i do have an 8 pin soic plug that i can have connected.

    Ive buit the tool and get a timer ok message but when the software goes to read the chip it says error eeprom not found.

    Any help is appreciated.
    Thanks
    Dave

  939. Comment by alex:

    karl,
    bull malarky.
    that doesn’t work. do not fool people. YOU NEED TO READ THE CHIP. GOT IT?

  940. Comment by erlis:

    great!!!!!!!!!!!!!!!!!!!!!!!!
    IT WORKS FINE.
    tested on IBM T30.
    thx!

  941. Comment by Justin:

    Is there a way to do this on a gateway2000 laptop with a HDD password? If I put in another hard disk drive it locks it out; apparently it’s tied to the original drives serial number.

    FYI, the rss 2.0 (comments) feed is messed up in your wordpress installation. It should be http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/feed/ and not http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/SoDoItYourself.com

  942. Comment by Pete:

    I followed the instructions to the letter for my T40. Everything happens as expected but Passlite tells me the line at 0×330 is “&/”. I tried this for the password but it doesn’t work. Any ideas?

  943. Comment by Pete:

    Nevermind I didn’t hit the translate on/off button. It now works - brilliant! :-)

  944. Comment by Dima:

    Good JOB !!! THANK YOU YOU HAVE SAVED ME. 100% Working

  945. Comment by mitty:

    help plz i have ibm A31 and i cant find bios chip (atmel)…..where is it ? plz help !

  946. Comment by Jeff:

    I need a link to the exact product (Resistors and Zenor Diodes) that you bought. They need to be in USA company

    booman360ster@gmail.com

  947. Comment by dilip:

    can i replace amtel R40 thinkpad with other amtel from R40 THINK PAD. i have 2 r40 laptops ,one of my r40 is dead, other one with supervisor pasword problem.

    thanks
    dilip

  948. Comment by Prima Eka Komunika:

    Help Please, any software reset the bios to simple operation

  949. Comment by Panagiotis:

    I take (from Thinkpad T41) at the 0×330 the Hex numbers:
    c0 74 27 96 1d 8f c3 0a
    but I cannot read the password.
    I only read spaces and ; 9
    Can anybody help me?
    I can only suspect my Greek Windows XP on the spare PC.
    I also had read the password from an A31 that it was only numbers so I do not think that I do any mistake now.

  950. Comment by Panagiotis:

    mitty,
    The Atmel chip in A31 is under the pcmcia adapter near to the upper left corner.
    I have read the password but now the laptop is closed and I have not any photo to send.

  951. Comment by jorge:

    hello ok how can i get the C5V1 Zener diodes a guy tell me to use 1v diode and 2 of 2v diode can i do that ?

    i did what the guy say and it dont connected to my pc can someone help ………..plz

    jorge

  952. Comment by Martin:

    Hi everyone, I was using this method on R30, everything is fine..expect that I cannot put the mess read via ibmpass from eeprom as a password. The pass should be stored at 0×338 - 0×33e : in the non-translated mode I have here these numbers: 61 25 5d 5d 3d 01 ff.. what is the pass? Thanks!

  953. Comment by helpPleaseFrance:

    Mot de passe Portable IBM 600E (2645) ATMEL 24CO1A

    Bonsoir,

    J’ai fait le montage du site sodoityourself.com avec le logiciel r24rf08 mais je n’ai toujours pas réussi à trouver le mot de passe du bios de la carte mère, Erreurs de lecture de l’Eprom et/ou Eprom HS ou la carte mère ? Et quand j’arrive a lire soit disant quelque chose, je n’ai que des zéros dans mon fichier *.bin (Lecture avec IBMpass v2.1 Lite).

    Petites questions :

    Sur L’eprom, j’ai le VCC à 3.2v, au lieu 5v, est-ce normal ? Idem pour le SDA ? Sinon j’ai aucunes activités quand j’allume le portable jusqu’au fameux mot de passe (Apres les erreurs 161 et 163 de la pile CMOS).

    En faisant Itester j’ai ceci en sortie du port série avec le montage :

    Grd et SDA = 4.3v
    Grd SCL : 4.5v

    Voilà, je n’ai pas trouvé de forum en Français pour ce genre de manipulations, je précise aussi que le portable n’est pas volé, c’est juste pour approfondir mes connaissances en informatique, en vous remerciant d’avance !

    Portable password IBM 600E (2645) ATMEL 24CO1A

    Good evening,

    I made the assembly of the site sodoityourself.com with the software r24rf08 but I still did not succeed in finding the password of the bios of the mother chart, Misreadings of Eprom and/or Eprom HS or the mother chart? And when I arrive has to read is saying something, I have only of the zeros in my file * .bin (Reading with IBMpass v2.1 Lite).

    Small questions:

    On the eprom, I the VCC with 3.2v, the 5v place, is this has normal? Idem for the SDA? If not I have aucunes activities when I light the portable until the famous password (After errors 161 and 163 of pile CMOS).

    By making Itester I have this at exit of the port series with the assembly:

    Grd and SDA = 4.3v
    Grd SCL: 4.5v

    Here, I did not find a French forum for this kind of handling, I also specify that the portable is not stolen, it is right to look further into my knowledge in data processing, by thanking you in advance!

  954. Comment by loudcrow:

    Can ibm thinkpad x60s be recoverd? I got an ATMEL 25010AN-SU27 chip. Can u use the same program ibm lite and writter to read this chip. Thanks

  955. Comment by LiredinSun:

    Finally located the amtel chip on the X41.

    its located on the rear of the motherboard in the right hand side between the USB port and the Docking station, its referanced as U65 and is marked 24C64AN

  956. Comment by provokator:

    Just recovered ibm t40. worked just like promised. God dam boy! Any way my eyes aren’t what they used to be. It was a hard soldering session and double checkin a lot ;)

    -provo

  957. Comment by alexwv:

    martin,
    when you flip the AA switch on and off, if you don’t see the password in 0×338 then it means that the password is TPM locked. and it has to be read using a different device, not siprog. email me: alidabiri1@dishmail.net

  958. Comment by alexwv:

    Panagiotis,
    this means that the password is TPM locked. and it has to be read using a different device, not siprog. email me: alidabiri1@dishmail.net

  959. Comment by loudcrow:

    alexwv thanks for the link. I will try it very soon and post some results.Thanks bro!

  960. Comment by Ninjasuperk:

    Thanks man! It worked really well!
    The Hardest part is founding the ATMEL CI in the board
    I recover yhe pass from a Thinkpad A31 and the Atmel chip is in the upper part between the modem port and the S-Video out.

    Thanks again!!!

  961. Comment by apple6266:

    what is the chip called for ibm tp r60. where do i find it on the motherboard. which program(s)do I use to extract a dump file. what is the procedure. can u give me a schematic for the hardware required

  962. Comment by Zevs85:

    Is someone tried to reset Security Chip on Lenovo (i have R61i). Thanks!

  963. Comment by JJ:

    OMFG.. This actually worked! I was skeptical, but i was sucessfull in getting my svp password XYZ5678

    Only problem that I had was because I didn’t push the pins all the way through on my female serial port. Kept on getting eeprom not found. fixed the plug and it worked like a charm!

    thanks!!!!!!!!!!!!!!!!!!!!!!!!!!!

  964. Comment by JJ:

    OMFG.. This actually worked! I was skeptical, but i was sucessfull in getting my svp password XYZ5678

    Only problem that I had was because I didn’t push the pins all the way through on my female serial port. Kept on getting eeprom not found. fixed the plug and it worked like a charm!

    thanks!!!!!!!!!!!!!!!!!!!!!!!!!!!

    btw, i have a t42

  965. Comment by karkus:

    Ok not to be like a dumbass or anything but i need some help.i need a picture of the reader if anyone has one I’m much more of a visual person. what im saying is i can make the device im sure but i need a few pics to make sure its right.I have a thinkpad 600e so if anyone can show me what pins on the eeprom i need to solder to exactlythat would be great. Please help

  966. Comment by Bihola:

    what is the chip called for ibm tp r60. where do i find it on the motherboard. which program(s)do I use to extract a dump file. what is the procedure. can u give me a schematic for the hardware required

    chip is atmil 83569

  967. Comment by Bihola:

    for thinkpad r60 . atmel 8356908 …tmp1-33 …tmp2-34

  968. Comment by Robert:

    Are there standard SPV Passwords used in the BIOS ?

    Post your Passwords to see if there are similarities. Maybe folks could go this route vs having to build a device ?

    I saw one Password already…

    - XYZ5678

  969. Comment by Persh:

    Thnx, for manual.

    This really work! I’m unlock my IBM X40! Thats really simple.

    Russia, Moscow.

  970. Comment by my570:

    hai,help me my com IBM 570,i can’t open my password,already forget,help me to cancel my password?

  971. Comment by Al Hartman:

    Can someone post where the 600e chip is located?

  972. Comment by Ben:

    So not only are you soldering wires to a chip on a laptop, but a chip under the CPU? You sir, are a maniac.

  973. Comment by JAN VELICE:

    briliant i did it it works thanks and i used 2000ohm resistors was an r51 think pad good work men

  974. Comment by martin:

    hi
    i have a t23 tp with a unknown power on password can some one tell me how to get around this
    thanks

    martin

  975. Comment by martin:

    can you also tell me the pin configuration on a 14 pinatmel chip

    thanks
    martin

  976. Comment by EF:

    Works like a charme ;)) Gathered my T30 pwd in a matter of a few minutes. Don’t forget to click on the “Enable/Disable translation” in the IBMPass app, otherwise you’re looking at the encrypted pwd!

    Thanks for the effort!

  977. Comment by IBM T40 BIOS password (SVP) resetten | hilpers:

    [...] Re: IBM T40 BIOS password (SVP) resetten Sabayon User wrote: > Volgens de service-manual van IBM moet je het moederboard vervangen > indien je het BIOS wachtwoord niet meer weet: > > Attention: If the SVP has been forgotten and cannot be > made available to the servicer, there is no service > procedure to reset the password. The system board must > be replaced for a scheduled fee. > > Dat kan toch niet waar zijn? > > Wat is gebeurd: backup batterij is leeg waardoor het systeem om een BIOS > wachtwoord vraagt omdat de datum en tijd ingesteld moeten worden. > > Met geen mogelijkheid meer aan de praat te krijgen. Is toch te > belachelijk voor woorden. > > Apparaat is een krijgertje van een vorige werkgever die ik er niet mee > lastig kan en wil vallen. > Dat wordt waarschijnlijk knutselen: http://sodoityourself.com/hacking-ib…bios-password/ [...]

  978. Comment by Nii Amon:

    Thanks alot for all the tit-bits. I just hope i will be able to fix mine.

  979. Comment by Long Nguyen:

    Thanks very much.

  980. Comment by nabil:

    Hi all,
    Any advise how to unlock a T61p with nxp p24s08 TPM ?

  981. Comment by Laptop IBM i haslo w biose | hilpers:

    [...] interfejsik do zdumpowania pliku z hasem plus programik do jego zdekodowania. Instrukcje s tu: http://sodoityourself.com/hacking-ib…bios-password/ ps. w sieci mona kupi gotowe zestawy (interfejs plus oprogramowanie). Kosztuj w granicach 40-50 [...]

  982. Comment by ibm bios | hilpers:

    [...] kun je het password uitlezen. Als je zelf geen knutselaar bent, misschien een handig neefje ? :) http://sodoityourself.com/hacking-ib…bios-password/ [...]

  983. Comment by ibm bios | hilpers:

    [...] kun je het password uitlezen. Als je zelf geen knutselaar bent, misschien een handig neefje ? :) http://sodoityourself.com/hacking-ib…bios-password/ [...]

  984. Comment by Larsijj:

    I am going to try it on a t60 it’s the only way i think…

  985. Comment by naief:

    hey guys, whats the easiest and cheapest way to remove/recover bios password for the T60? can i make the reader/writer or are there people that offer this service for cheap? like on ebay?

  986. Comment by IBM user:

    have anyone try it on a thinkpad r61…and can i use this method to get my SVP back ? let me know pls…

  987. Comment by Ahmad Amr:

    Easy :S ??!! You think those are easy steps??!!

  988. Comment by Don Jones:

    Mike,

    I have a DELL INSPIRON 8500 that has either a motherboard password or a power on password — I’m not sure about the difference. When you power it up alll o fthe lights come on like normal and then you get a screen that asks for a password before you can even geet into the bios setup menue.

    2 questions.

    1. Do any o fhtose “100% gauranteed” Password recovery/hacking CDs/dowmnloads really work for this situation?

    2. Will your EEPROM reader technique work for the DELL INSPIRON 8500 and if so wher can I get the detailed kind of instructions that you have for the IBM TP?

    Thank you very much. DELL is worse than NO help on this. They have the information on the original owner but refuse to contact her to verify if the computer is stolen or not and will not reset the password without that information. Unfortunately, the computer was given to my son by an instruuctor at WSU who bought it at some kind of sale at WSU and we can’t track the ownership back any farther than that.

    Thank you for your work. You are taking worthless junk and making it into usable computers again.

    Don Jones

  989. Comment by AMEN:

    HEY!
    I AM JUST WINDERING IF THIS MEMETHID CAN WORK ON t61? PLZ LET ME KNOW….THNKS

  990. Comment by AMEN:

    ITS A IBM THINKPAD T61!

  991. Comment by Ford:

    Hi. I am a hacker. I can get you a password (aol, myspace, facebook, msn/hotmail,yahoo..etc). I do charge money to get a password. Once i get the password i’ll show you proof i have it. Are you interested? please email me at fordf202006@yahoo.com

    **I CANNOT RECOVER A LOST/STOLEN/FORGOTTEN PASSWORD**

  992. Comment by doman:

    Bios and poweron password is the same thing. This is used to access the bios to start the computer. The password recovery CD’s that you see on Ebay and other places work great for password removal of HDD or user passwords, but are useless to recover or remove a Bios password. Nice try tho. FOFL.

  993. Comment by Amen:

    alexwv,
    thnx for the help. but i really don’t want to send out my laptop, i got personal data in there. If you any other way please let me know! i would really appreciate that. ( T61-POP)…………… thnnx 4 the help

  994. Comment by Michael:

    I’m getting an error from the app. Says Circuit not found or bus error. I’ve checked on the connections on the circuit itself and they are good. I’m getting this error message connected to the Amtel Chip and disconnected.
    I’ve never tested this serial port before though. Any what this error means?

  995. Comment by pierpaolo:

    Prima di tutto grazie al sito sono riuscito a levare la password a un ibm t20 ,la procedura dei fili saldati e la stessa ,pero’ non riuscivo a leggere l’eprom con il programma Reader for ATMEL 24RF08 allora dato che anni indietro mi divertivo a clonare le carte di tele+ e sky ecc,avevo una serie di software per leggere e scrivere epron ,prova e riprova finalmente con PONIPROG 2000 VERSIONE 2.07 BETA e stata letta in un secondo poi riportata in chiaro con IBM Pass 2.0 Lite spero di essere stato utile mi dispiace ma parlo solo italiano .
    Un Saluto a tutto il forum Pierpaolo

  996. Comment by jean:

    Any advice on tp w700 supervisor pw recovery? Thanks.

  997. Comment by miko:

    I have a T30, the dump.bin file has the info from the T30 chip, but line 0×330 is blank on the output! The rest of the line is a “0’s”. Tested and ran several time and same result.
    The BIOS Password Prompt still comes up on boot. Remove BIOS battery and tried again and still 0×330 is blank………would appreciate a direction on this one

  998. Comment by miko:

    I have a T30, the dump.bin file has the info from the T30 chip, but line 0×330 is blank on the output! The rest of the line is a “0’s”. Tested and ran several time and same result.
    The BIOS Password Prompt still comes up on boot. Remove BIOS battery and tried again and still 0×330 is blank………would appreciate a direction on this one…..

  999. Comment by Victor:

    Just further to that, I might add that I was running the capture and analysis software in Linux under Wine. Installs and works without a hitch!

  1000. Comment by cleaver:

    Karl gets reamed for saying this, but if you have a CRC:0175 error,
    his method fixed my old A21E . The Amtel chip is under the hard drive,
    and you have to strip the laptop down completely to find it.
    Solder or attach wires onto pins 3 and 6 as karl described!
    Let them hang out the hard drive bay,when you re-assemble.
    You need the floppy drive installed, and the current BIOS diskette.
    Full battery, and AC adapter,just for the bios update…
    Press power button, wait for video. NOW, short/touch the wires together.
    Press the ESC key . Next, press the F12 key ,when the menu comes up,
    select the top choice -removable device.
    Ignore any Hard disk not found warnings before or after this point!
    Let the BIOS diskette run, leaving the wires touching/shorting…
    Even if you had the latest BIOS , it will still run the update,for some reason.
    Let it run, says computer will reboot. But mine never did.After 5 minutes,
    I shut it off, after saying my last goodbye(just in case..) .
    It came back on, WITHOUT the CRC: 0175 error !
    Could not believe it ,so turned it off, and back on. The A21E is ready for
    action again ! Thank you Karl !!!!!!

    Comment by karl:
    Wednesday, November 12th 2008 at 5:05 pm

    final fix for the ibm reset

    bull malarky,

    just short the pins 3 and 6 as you boot it will clear as you hit escape,
    it will jump right into bios settings,

    remove the batteries and run on ac while doing this.

    this fix has been verified by me just now..

    nice lot of hacking though but a real over kill ,
    nice pics too.
    what is pin 3 and 6 , count down from the top left 123, continue at bottom and count up 56 ,

    1 8
    2 7
    3 ——–6
    4 5

    http://sodoityourself.com/wp-content/uploads/2006/10/locating_atmel.jpg

    just like the dells , same jump for them too.

  1001. Comment by motorola_otaku:

    Hi, just wanted to let everyone know that this will work on a Thinkpad A22m. Like some of the others, it uses a 14-pin Atmel 24RF08 that is located on the bottom of the motherboard just up from the RAM slots, and it cannot be accessed without completely disassembling the computer. The pinout for the 14-pin chip is located here:
    http://hey-tech0.tripod.com/
    http://img6.imageshack.us/img6/9214/pinoutjt2.gif

    I also had to substitute 2K resistors and 1/4W 5.1V zener diodes, and they worked just fine. I recommend building the “reader” circuitry into a DB9 hood with the connector to keep everything secure.

  1002. Comment by gavrussa:

    can anyone tell me where the bios chip is located at on a r60 .
    thanks in advance

  1003. Comment by Marko:

    My IC 24rf08 (from ThinkPad T42) eeprom is burnt, and i find another from other TP but i need dump for my ThinkPad. Is anyone have dump for T42. My Mail: emajl_adresa@hotmail.com

  1004. Comment by Andrey:

    Hi 2 all,
    Is anyone have clear dump for T61, my emal address is andryuha82@inbox.ru
    Thanks in advance.

  1005. Comment by George:

    I’m looking for a procedure to bypass the power on password on an IBM thinkpad 2652. Can you give me the steps to locate an execute the necessary method? Thanks.

  1006. Comment by Nikoko lemagnifique:

    J’ai un IBM Thinkpad X40 dont le Bios étais verrouillé
    J’ai suivi tous les instructions du debut de la page
    Et ça marche parfaitement.
    Merci beaucoup.Merci Merci Merci!

  1007. Comment by Daljit:

    Dear friend, I have thinkpad T23 with the same problem, The EPROM Atmel chip is 14 pins. Will this method work with my laptop to recover the password? If Yes then How? please advice, I’ll be grateful.

    regards,

    Daljit

  1008. Comment by karim:

    i want password bios t 60

  1009. Comment by Sathyananda:

    Dear friends I have r50e laptop,with the password problem,The chip is 24rf08,I tried to read it using my universal programmer (superproLx)I was able to read 25%(upto 0X00E0) the hex(bin) file goes like this.

    :200000008008070D0902400004607000821000010E040C010220C0757000004830482A20A2
    :200020007575454500000000003C48302D550000000000000000000000000000000000E82E
    :20004000AD000000000000000148594D443233324D36343644362D4A20202041410435FF31
    :20006000FF0855000000000000000000000000414934384E31313232322D30332000000038
    :20008000000000000000000000000000000000000000000000000000000000000000000060
    :2000A000000000000000000000000000000000000000000000000000000000000000000040
    :2000C000000000000000000000000000000000000000000000000000000000000000000020
    :2000E000000000000000000000000000000000000000000000000000000000000000000000
    :20010000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
    :20012000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDF
    :20014000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBF
    :20016000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9F
    :20018000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7F
    :2001A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5F
    :2001C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3F
    :2001E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1F
    :20020000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE
    :20022000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDE
    :20024000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBE
    :20026000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9E
    :20028000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7E
    :2002A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5E
    :2002C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3E
    :2002E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1E
    :20030000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD
    :20032000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDD
    :20034000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBD
    :20036000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9D
    :20038000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7D
    :2003A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D
    :2003C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D
    :2003E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1D
    :00000001FF
    please guide me how to read password location i.e 0X330,if any body having bin file for the same mdel it will be a gr8 help to me,I will just try to program it on the other empty chip and solder it on the board .please guide me what to do next
    regards
    Sathyananda

  1010. Comment by larry:

    can i pay someone to do this. if you can or know someone who can please email me at leisselarry@sbcglobal.net

  1011. Comment by Lex:

    Hi,

    I get something else.

    0×330 000000000000000 cd3696deec330343 ” ,2f
    0×340 cd3696deec330343 88c6fa0383c2fa02 ” ,2f 2 l

    a litle bit strange for a password because you can’t type a ” in the password.

    anyone???

  1012. Comment by Bill:

    Where did you purchase the 2 C5V1 Zener diodes from? And if I cant find them, is there any others I could use? Please email me back ASAP at wbill510@yahoo.com Thanks!

  1013. Comment by Jack:

    Great post. It is very useful for my IBM T40. Do it work in Thinkpad T61?

  1014. Comment by TOPSAT:

    Hello, don’t worry is possible Crack the password in bios and in hard disk, write me at topsat_ar@yahoo.com.ar I tell you how do it

  1015. Comment by Sebastian:

    Hi!!
    I’m Sebastian. I’m From Argentina
    I’ve got a X60 but it has not the at24RF08 chip or may be I donot know how to find it inside. It could be hidden ? other vise, I found other chip (at25010 su27) inside, and I need if you can help me to guess the bios password because I saw in this eeprom datasheet and it has not the same definitions like in the pin.
    I could buy the pc8394 tools if you explain me and give me waranty.
    thanks

  1016. Comment by Lady J:

    I have tp r-51 I’m trying to builded it myself. Can you send a diagram of this device explaining the size of all 3 wires. This is what I have so far. I solder the zener diodes tip on, two different spots on the ground wire. After that, I solder one of the tip of zener diode to the tip of 2.2k ohm resistor- then stuck the other end into # 4 hole of the serial port 9 pin female. then I did the same to the other and stuck that 2.2k ohm into hole # 7 is that correct so far. Please helf with the rest of info on building the reader . If you can send a pic I will be very happy. Thank you

  1017. Comment by Lady J:

    please send me a pic because I only have two pins coming out of the serial port 9 female

  1018. Comment by I_BUYL_APTOPS AT YAHOO.COM::

    If someone has a problem to recover password on IBM DELL HP TOSHIBA FUJITSU SONY ASUS COMPAQ VAIO and other laptops , email me , I may help . You have to include make model service tag etc…, as much information as you can.Emails like “can you recover my laptop” without full additional information will not be answered .If your email gets into my spam box - you are out of luck .I may also buy your locked laptop if price is right.

  1019. Comment by jason:

    hi i have tp t60 I have 2 errors message when I press the thinkpad blue button during the startup to enter the BIOS. i cant rember the password some1 said take the battry out so i did now i get this messge
    Error 0271 - check date and time setting
    Error 0176 - System sercurity. The system has been tempered with.

    can any1 help please please

  1020. Comment by emiliano:

    Hello,
    Has any one retreived the bios password on a X60s succesfully??????
    How read AT97SC3203 ???????

  1021. Comment by emiliano:

    IBM lenovo X60s , IBM lenovo X60s , IBM lenovo X60s , IBM lenovo X60s ,

    I successfuly unlock them ,I successfuly unlock them ,I successfuly unlock them

    contact :
    id. yahoo messenger : emilianovich1

  1022. Comment by emiliano:

    Deparolari, deblocari orice model de laptop .

    Cateva exemple :

    IBM
    -240, 240X,390E, 390X,570, 570E,600e, 600X,770Z
    -A20m, A21e, A21m, a22m, A30, A30p, A31, A31p
    -G40, G41
    -R30, R31, R32, R40, R51,R52,R60,R60i,R60e,R61
    -T20, T21, T22, T23, T30, T40, T40p, T41, T41p, T42, T42p,T43/p,T60/p,T61,
    -X20, X21, X22, X23, X24, X30, X31, X40, X41,X41t,X60,X60s,X61,X61s,X200
    -Z60 series, Z61 series

    DELL
    SONY
    HP
    ACER
    LG
    COMPAQ
    TOSHIBA

    contact:
    tel: 0721.594.260
    id. yahoo messenger: emilianovich1
    mail : emilianovich1@yahoo.com

  1023. Comment by Shack:

    Incredible site! Was able to build the circuit and nab the password off a T21. Thanks so much for taking the time and providing such excellent information and diagrams. I simply used a couple push pins for the two chip connections and a alligator clip for the gnd. Took about 3 tries to get a good connection holding the pins in place while my trusty assistant depressed the ENTER key for me. Thanks again!

  1024. Comment by Tom:

    I have a problem

    I have a T42 , i Have read correctly the eprom

    But i don’t know the keyboard of this laptop and i don’t know how to digit the password !

    My password seems to have special character that i don’t know how to digit

    Their HEX are :

    22 - 24 - 05 - 22 - 2C - 19 - 2E - 20

  1025. Comment by lacstor:

    Thanks to this hack, I was able to recover the bios password of my R50.

    However before being able to do so, I encountered several problems as what the others had. For the benefit of the others, I like to share my experience.

    My spare PC have two serial ports. When connected on the first serial port, I get the message “Eeprom not available”. Transferring the connection on the 2nd port, I get “Circuit not found or bus error”.

    I tried disconnecting the CMOS battery and main battery for several minutes and re-attach again. Now I had a bigger problem. Before I can see the bios settings but is not able to change the settings because of the password requirement. Now after starting up my TP, I receive an “Error 0271 - check date and time setting” message. Worst thing, my TP won’t start at all. I cannot access the bios and the OS won’t load also. Without the bios password, my TP is now good as dead!

    Still hoping for the best, I tried to check the step-by-step guide on how to do the hack. I found out that I had a reversed connection on the pin assignment on the 9-pin serial connector. The diagram shown in this site is the actual view at the back of the connector. I mistakenly soldered the circuit parts and wires thinking that the view is from the front part of the female connector.

    After doing some rewiring, everything worked like a charm.
    On my first try, I recovered the password!

    Thanks for everything!

  1026. Comment by Peter Pan:

    Dudes, just locate the system battery on the motherboard and yank it for 30 seconds, that’s all… so much for ibm security :)

  1027. Comment by emiliano:

    I successfuly unlock any model laptop, any password and give some examples .Have priority clients from Romania .Will give below the list of laptops that unlock successfully .More details you can provide the mail or yahoo messenger .
    contact:
    id. yahoo messenger: emilianovich1
    mail : emilianovich1@yahoo.com

    IBM
    -240, 240X,390E, 390X,570, 570E,600e, 600X,770Z
    -A20m, A21e, A21m, a22m, A30, A30p, A31, A31p
    -G40, G41
    -R30, R31, R32, R40, R51,R52,R60,R60i,R60e,R61
    -T20, T21, T22, T23, T30, T40, T40p, T41, T41p, T42, T42p,T43/p,T60/p,T61,
    -X20, X21, X22, X23, X24, X30, X31, X40, X41,X41t,X60,X60s,X61,X61s,X200
    -Z60 series, Z61 series

    DELL
    SONY
    HP
    ACER
    LG
    COMPAQ
    TOSHIBA

  1028. Comment by Tang dynasty:

    Ibm Laptop. Forgot the Bios password. if anyone can help ? HELP .. HELP..
    Dont buy IBM laptops ….

  1029. Comment by marko erdmann:

    I’ve got it !!!
    For me, it was really an adventure, but finally I hacked my TP A21e.
    Thanx a lot for this description !!!!

    marko

  1030. Comment by Flye:

    Thank you SO much. I wired the circuit with parts from Radio Shack…followed connection instructions, used the software! Worked like a charm. Now I have a great Thinkpad R51, that I had pretty much written off and was getting ready to sell for parts! Great Job! Thanks again!!!!

  1031. Comment by Ectara Sayja:

    I was wondering about your diagrams. I understand the chip is different(a 25L1605), but the legs are the same ordering as per the datasheet. I have a pack of 2200 Ohm resistors, and a pack of Zener Diodes, 5.1V, IN4733A from Radioshack. I also have a female serial head for connecting to my computer, so by your guide I am set. My only question is before I solder it all together, and code a reader for the T60, will this method theoretically work for me? Once I get it all said and done, I will gladly provide you with pictures and the steps I took.

  1032. Comment by Ectara Sayja:

    If anyone has any advice on my T60 issue above, feel free to email me at ectara_sayja[at]yahoo[dot]com.

  1033. Comment by Ectara Sayja:

    Also, I do not wish to do business with allservice.ro or password-removal. I am not interested in purchasing software. If you want to screw your fellow users by charging them for their ignorance or bad luck, go ahead. I’d much rather code one myself. All I need is some help with the theory and a push in the right direction.

  1034. Comment by fredy:

    THANKS A LOT for this site!!!
    I can solve the problem. :))

    T30 motherboard (from ebay)
    (Chip: 24RF08CN, 4pin: http://www.atmel.com/atmel/acrobat/doc1072.pdf)

    After message “Eeprom not available” (it do not work on some WinXP (Pro) - however…)
    I use an other OS(XP)-installation (or use an other computer!)
    Check connection of COM with “R24RF08/itester.exe” !!!

    The password stand in bin-file (1024 byte) at 0×338-0×33E and 0×340-0×346
    If you can not read/type password e.g. “Ž{–i-:Jc” or e.g. (HEX-CODE) “01 … 05 32 12 03″
    use in IBMpass (2.1) [worked in ubuntu/wine - fine!] the button “AA” (On) to read.

    good luck!

  1035. Comment by alexwv:

    peter pan,
    that’s baloney. you have three types of passwords:
    1) power-on password (PWP) - this can be removed by taking the battery out.
    2) supervisor password (SVP) - this requires reading the password from the chip.
    3) hard drive password (HDP) - the password is stored in the firmware area of the hard drive. requires special device to read the firmware area.
    you don’t seem to know what you’re talking about. you just got lucky and encountered a power-on password which went away by removing the battery. try putting a supervisor password in the BIOS and see if you can remove it by taking the battery out.
    http://www.password-removal.com

  1036. Comment by sembolist:

    thanks a lot…

    i have bin file… but, i can’t read password.

    my password: »Üö×]:§

    hex: bb dc f6 d7 5d 02 3a a7

    what can i do?

    thanks…

  1037. Comment by Hargyo:

    wow..thx..i ve tried this and it is really work. nice article . thank you verymuch

  1038. Comment by Hargyo:

    wow. i have tried this. and it s really work!!! nice article ! thank you dude!

  1039. Comment by jawad azeem:

    hi i do this for T20 , 21 , 23 , R40 it is some time work some time not work and i also have HP NC6220 with bios power on password is there any body knows how to unlock the password kindly help me im waiting for your replay if you know any way email me at jawad@jysourcing.com

  1040. Comment by hichem:

    hi,can help me ihave notebook toshiba can unlock it please…..
    think you

  1041. Comment by Lucky:

    Great site, I have R61 followed the direction and end up with the hex which I can’t read
    hex:- a7 e5 ae a4 ea b0 92 b4
    string:- §å®¤ê°�´

    Any help much appriciated

    Thanks

  1042. Comment by zyb:

    alexwv:

    I have a power-on pw problem, my T42 has been laying aside for about a year now without battery and backup battery. Pw is still there, so it doesn’t always help to remove batteries. I will now try this method and see if I can recover that darn password which I never set.

    Cause this method should also recover power-on pw right?

  1043. Comment by Tommy:

    I was given a T23 last week with a BIOS password in place that no one could remember what the password was. I came across this site while searching for a fix as pulling batter did not reset the password (as decribed above). I went to the local radio shack and bought all the parts listed (among a few other additions) and built the jig. To my amazement the process worked on the first try. Thank you for the info.

    Not sure if anyone thought of doing this but i put in dip switches on the board so that i could solder the leeds to the TP and turn them on one at a time in stead of soldering them while the unit was on. worked like a charm… i will try and attache a picture if i can.

  1044. Comment by zyb:

    Anyone know if its possible to use either 4,7V or 5,6V zeners? I got both but not 5,1V of course…

  1045. Comment by Computer Assistance - NECO Forums:

    [...] it still didn’t work. It’s probably easier to just get a new mobo for it. the site I read from was Hacking IBM Thinkpad Bios Password : SoDoItYourself.com goodluck.. __________________ Cammed, bolted, sprayed, lowered.. and still soooo slow… My [...]

  1046. Comment by ANIBAL:

    T30 UNLOCKED O.K.

    A LOT OF THANKS

  1047. Comment by haroon:

    thank you very much ….. 100% get correct password

    thanks ahain

    haroon alam

  1048. Comment by JustKids:

    Great thread wish this was around when I needed it 5 years ago but oh well. Any how dug up my old eeprom chip out of my R40 and used a Dataman Programer model 48pro to read it and see if I could find the old password that was on here when I bough thte laptop from a pawn shop. and NOPE that layout is right and Im shure it is there but the password is not realy right (its device control hex codes “$13 $1E $2E $1F $12 $13 $2F $2D” which aint no ASCII chars. The app that “decrypts” the pass word is a simple hex editor is all like “WinHex”.

    As for the if one wants to know if they found the right chip take the Chip ID number and download the data sheet and see if it is in fact a EEPROM chip. It is possible that some may use a 16 leged EEPROM but most I suspect are going to be 8 leg life the one mentioned. Also if you cant figure out what the pass word is you could allways enter a new password in the location of 0×33a and 0×340 and see if that does the trick for you allthough before writting anything to the chip I would definatly make shure you make a back up image of what was there first. Im shure some one would be willing to remove thier password from the thier chip and upload an image some where for any one who just wants to clear thiers off of thier eeprom.

    Just food for thought alot of things are not as complicated as one thinks. The data is not “encrypted” persay on the eeprom only written in hex code which translates to alot of common keys is the ASCII format.

    PS my R40’s chip had a green paint dot on it and was in the lower left corner under alot of crap top side of the mobo.

  1049. Comment by JustKids:

    Oh forget some of that above LOL freddy was right over looked this point lol

    “Comment by fredy:

    Monday, April 6th 2009 at 3:17 am
    THANKS A LOT for this site!!!
    I can solve the problem. :))

    T30 motherboard (from ebay)
    (Chip: 24RF08CN, 4pin: http://www.atmel.com/atmel/acrobat/doc1072.pdf)

    After message “Eeprom not available” (it do not work on some WinXP (Pro) - however…)
    I use an other OS(XP)-installation (or use an other computer!)
    Check connection of COM with “R24RF08/itester.exe” !!!

    The password stand in bin-file (1024 byte) at 0×338-0×33E and 0×340-0×346
    If you can not read/type password e.g. “Ž{–i-:Jc” or e.g. (HEX-CODE) “01 … 05 32 12 03″
    use in IBMpass (2.1) [worked in ubuntu/wine - fine!] the button “AA” (On) to read.

    good luck!”

    THANK YOU!! pass was RACSERV

  1050. Comment by alexwv:

    sembolist, send me your bin file i can read it.
    my email is alidabiri1@dishmail.net

  1051. Comment by alexwv:

    R60, T60, Z60, X60, T43…. and later models can not be read with this device. it needs another device to read it. to get more info, visit:
    http://www.password-removal.com

  1052. Comment by Marushka:

    HELLO TO EVERYONE !
    I am trying to get a solution for my laptop. Right now i have my laptop on guarantee service, they call me to replace my motherboard and asking me TO PAY $600- FOR THE PART NOT LABOR, because my laptop is locked with a UNKNOWN BIOS PASSWORD. This Bios Password was created by a Password Genius of Sportmau, because I have accessed my BIOS but I cannot change, because of a password, that never set. All my passwords worked except that one, i decided to use a Password genius, but then CMOs/BIOs cleared and When I started up my computer, appeared LOCK asking for a Password, I used my Fingerprint and worked but asked me for the password too. I tried my passwords like always and not worked. Until now the warranty technician called me and explained me that IBM, solution is to replace motherboard, what i have to do ? please If someone has passed this situation please email me. my laptop is X60 IBM lenovo Tablet

  1053. Comment by Bill Henry:

    I have a G40 IBM thinkpad. I went to Radio Shack and bought all the items
    listed, soldered all of them on a breadboard and then I pulled my G40 apart to find out that the motherboard does not have a 24RF08 or anything that looks like it. Has anyone else foung the memory chip? I have pictures of the motherboard that I can e-mail. Help!

  1054. Comment by Bill HENRY:

    Error on last statment. I do have 3 each 8 legs chips. They are label PU2, PU3 and PU4 on the motherboard. PU4 sits by itself under the mouse pad where PU2 and PU3 sits close together. The chips have the numbers SC 2.5
    1565IS
    0406. Any help?
    Thanks, Bill.

  1055. Comment by Alice:

    try this:
    http://blogs.ibibo.com/reset-windows-password

  1056. Comment by Bill Henry:

    I don’t think you are not seeing the problem I cannot boot the computer. All that comes up is the super’s password. Password on post. I cannot get past this password, that is why I took my computer apart. Thanks for your reply.

  1057. Comment by Stan:

    Update….

    I managed to download Philipp’s message after all.

    Thanks….

    Stan

  1058. Comment by chris:

    Hi
    Found this site recently after having a clearout of old laptops.
    The IBM Thinkpad A20m needed the svp which i had forgotten
    Downloaded the 2 software programmes and made the simple circuit
    using 2 zeners & resistors. Note a20m has 14pin 24rf08
    Problem 1 Using a laptop with windows xp pro I could not get the r24rf08 programme to work .
    Solution found old version of windows (win98) programme worked OK
    I created file called dump.bin using edit command in DOS

    This is format I used C:\allservice\24rf08\r24rf08 dump.bin (note the space before dump important)
    When this programme has run just type dump.bin and decode line300 using IBM passlite2.1
    Another comment which I discovered was that the reading computer had 2 comm ports
    I had plugged into comm2 by mistake and got error message saying no eprom so use comms port 1 only

  1059. Comment by johnv:

    Take my advice and don’t remove the CMOS battery. I had a functional Thinkpad x61 but I didn’t know what the supervisor password was and I needed to chance one of the advance settings. BIG MISTAKE! Now it is nothing better than a door stop: It has a power on password set which I don’t know. I can’t do anything with it, not even get into the bios. I’ve located the chip but it is a 28 pin chip and as far as I can tell, it is very difficult to solder such tiny wires. But that is pointless, as I don’t even know which wires to solder. Everything here is geared towards the 8 pin chip. Turns out even if I find out which wires to solder and dump the bin, the rom may be protected by tcpa and it won’t work anyway. Don’t take the battery out on the x61.

  1060. Comment by Alain:

    Hi,
    I trie to downmoad http://www.allservice.ro/forum/viewtopic.php?t=61 – Programmer
    Antivirus Bitdefender detect a Trojan.Generic.488794 in it !!!
    Can somebody tell me if I can continue without AV ! I trie severals mirror sites and it’ the same …
    Thanks a lot for suggestions.
    Alain

  1061. Comment by Alain:

    Hi,
    My spare pc don’t have serial port !!
    May I use an USB to RS232 PORT SERIE ADAPTATER CABLE ??
    Have somebody experience this?
    Thanks in advance to everybody.

    Alain

  1062. Comment by SGI2005:

    You just helped me plz if you have a IBM thinkpad R52

    I see my bios of error mesages for the date and time

    more and he asks me a password before they start

    I tried several methods but still the same prb

    I test 9pin with r24rf08 and w24rf08 + IBMpass Lite2 but nothing

    After several searches for R52 there are test point 1tmp and 2tmp called for the circuit bios PC8394T

    did not found plz help me for th position for this tow test point for this bios and reseting the pass

    thank you

  1063. Comment by Alain:

    Thanks a lot for this site!!!
    I recover my password !!
    On a T30 with the 24RF08 behind the memory !
    I think I will now remember my password !!
    If somebody needs my little reader circuit, let me know !
    Thanks again and again.

    Alain

  1064. Comment by Anthony:

    Can somebody help me please? Built & rebuilt the circuit 3 times now (first circuit experience), plugged it all in & all I can get is “Circuit not found or bus error” I am trying this on an X41 tablet & have 3 of them to do!! I had to take the machine apart because the Atmel is on the underside of the motherboard & below the access hatch for memory etc. If anybody has any suggestions i would be very grateful. Many thanks.

  1065. Comment by Sunil Bansal:

    Hi all,

    An excellent thread with outstanding contributions.

    However, I could not implement the suggestions, largely due to my own fault. I tried to solder a wire to the EEPROM chip which is a difficult job in any case. I did not have a low wattage pointed tip solder. Ended up shorting two small components close to the chip. When I tried to rectify, the components themselves came off the motherboard and stuck to the solder iron. Could not solder them back to their place and lost them. Even then, I tried to solder a wire to pin 5 of the chip. It could be done, but soon the copper strip holding the pin of the IC to the motherboard came off.

    From my experience, the lessons are:

    1. Never attempt to solder anything to motherboard unless you have a proper soldering tool.

    2. It is much batter to locate the EEPROM IC and make it accessible to your view even when the laptop has been assembled. In my case (Thinkpad 600), it could be easily done by drilling a small hole (about 1 cm dia) in the bottom cover of the laptop, when the motherboard was out. Thereafter one can temporarily connect the pins of the IC to outside circuit with the help of two probes (similar to one found in common multimeters or any hard wire will do) without soldering any wire to the motherboard.

    3. The best would probably to follow the method of Mr. thecheese given above. It needs no components and no software downloading. (I am assuming that it works, I have not tested it). If his solution is applied, one just need to hold a probe on pin 5 of The IC and short it to the earth of the motherboard (say on the outer metal of the USB port) for a second when the password is being asked by the Thinkpad and press enter and then disconnect the pin 5 from the earth. For this work, best would be to drill a small hole in the cabinet of the Thinkpad instead of trying to solder a wire to the chip.

    Cheers
    Sunil Bansal

  1066. Comment by Torkel Bjørnson:

    Mr. thecheese method did not work on a X61s.

    The problem is that if you enter a blank password, you will get access to the BIOS with very limited permissions, and therefor can’t change the supervisor password.

    If empty passwords had been allowed, I think it should have worked. At least the method seems sound enough.

  1067. Comment by MisterMike:

    Does anyone know where the ATMEL 24RF08 chip is located on the IBM TransNote (Type 2675)? It doesn’t appear to be under the keyboard or anywhere else I can see.

    TIA,

    MisterMike

  1068. Comment by J.S:

    Missing IBM ThinkPad A22m bioss chip?? Where chip is located on motherboard? I remove many IBM laptop model password using chipreader. This A22m model is new to me
    Jouni

  1069. Comment by joaquim:

    oi tudo bom tive um pouco de dificuldade com o dos mas consegui brigadao

  1070. Comment by Paul:

    could you pls. provide me more pictures of how the wiring setup is done? I’m not so goog in electronics, I just want to make sure i get this right. i would greatly appreciate your effort if you could provide me more information on this interface.
    Thanks from Germany.
    Paul

  1071. Comment by Austin:

    Dear friend I has an laptop Lenovo IBM ThinkPad model 2686DGU, year 2003, I got problem is I couldn’t remember the power on power password or ( IBM ThinkPad Supervisor password ) the power is on but the screen is lock-up doesn’t let me see anything during the syytem booting up. I looked at the picture that you’re posting on the top of this page, that is same problem I have been had

    could you pls. provide me more pictures of how the wiring also how to connnect to 2nd computer and the setup is done? I’m not good in electronics, I just want to make sure that i get it right set up and right HW connection. i would greatly appreciate your effort, I do need more detail, please give me more information on this issue.
    Thanks for your time.
    Austin.

  1072. Comment by alexwv:

    thecheese,
    i don’t think you know what you’re talking about. your suggestions are misleading at best and downright ignorance at worst.
    your method DOES NOT WORK - period.

  1073. Comment by Martin:

    The only software and method that works for T43, T60 and the others is from allservice.ro. They made the software and tools, is amazing how everybody come here, instead of their forums.
    Everyone is using that software, all websites that offer unlock service for IBMs are using Victor’s software found here:
    http://www.allservice.ro/forum/viewtopic.php?t=61

    We’ve bought it for our company (in Germany) and already done 30+ TPs like a charm. They offer the best support I’ve seen so far and deserve it.

  1074. Comment by Angelz:

    Hi all!

    I have Thinkpad R60e with unknown pop/supervisor password. I disassembled it and found on motherboard ATMEL 8356908 chip. If I understand right, I need for password recovering PC8394 Tools 1.0d full package or enough with only RPC8394 1.0 TPM reader?

  1075. Comment by SOHAIL:

    Hi , I have IBM TP R50e. When I power on the machine i got Error code 0187 and 0191, any one please help me what should i do to remove these codes.

    Pleeeeeeeeeeeeeeeas

  1076. Comment by Wildbynature:

    trying to retrieve BIOS PW on a R51 TP. Hooked everything up and got the EEPROM error and now after checking the connections I am getting the Circuit not found error. I think I am regressing in the process. Please, help me. email me at mr Underscore Wilde2003 at yahoo. thanks

  1077. Comment by AnonUser2123:

    IBMPass/ IBM Pass its called can be found here:

    http://www.allservice.ro/store/utils/index.htm

  1078. Comment by George Cervantes:

    Can anyone please confirm whether this will work on a t60p?

  1079. Comment by Kevin Hall:

    I have the IBM T30. Made up the chip reader using the 2 resistors, 2 diodes and 9 pin female serial port. Solder 2 wires; 1 to the SCL and 1 to the SDA on the ATMEL chip and a wire to the groud on the motherboard of the T30. Then on the spare computer, i turned it on, i downloaded the reader, and installed it. I put the chip reader in place, went to start, run, my computer, all services, R24RF08 file, and open the R24F08 V2.OB and click ok. typed in R24RF08 dump.bin (in the black box), went back to the T30, turned on the power, press F1, to enter Bios. when all lights stop, i hooked up the ground, the SDA, and then the SCL. Went back to the spare computer and hit enter. The black box goes away but no dump file is created. Please help!. Thanks.

  1080. Comment by Scott:

    My laptop was a freebie from a Freecycle group. Never needed the BIOS until later when I found the SVP. This article was very useful in turning my boat anchor back into a laptop. Thought I would leave my comments. First time I tried this, didn’t work. I kept getting the bus error or chip not found error. Here is what I learned.
    1. Use the lowest voltage resistors you can find. I used 1/8 watt to finally work.
    2. Make sure that when you build your RS232, push the pins all the way down in the holder. I don’t think I had mine all the way the first time.
    3. Unless you are an electronics god, I wouldn’t try the soldering. I found another article where when it came time to read the chip, one person held the contacts on the chip while the other operated the software. It only takes a few seconds to read the chip so the soldering seems a bit overkill to me, you just have to be super careful.
    4. when I first loaded the dump.bin file in the file reader, the output was garbage. Then I noticed a little button up top which said “Enable/Disable translation”. Like magic, the password was before my eyes. If the software gives you garbage, keep playing with the settings, it is in there.

  1081. Comment by stanley:

    i have ibm thikpad z61t , cmos password is lock , i havd located the atmel chip near by expansion slot . the chip is 28 pin with the eprom code at97sc3203 . somebody can help me to unlock the password .

  1082. Comment by Ectara Sayja:

    No one wants to go to allservice.ro because no one wants to pay to fix their or other’s mistakes. I’d rather build the circuit myself and use my own serial dump program that I wrote in C to do it, rather than have someone else profit from my misfortune. I received little help, and a massive amount of advertising telling me to pay someone to do it for me. No, thank you. It seems as if I and others on this site are largely on our own, even in the age of public domain.

  1083. Comment by Antonio:

    Beautiful! Thank you sir I just unlocked a laptop a friend gave me because he thought it was trash.

    Here are my notes:
    - I had a model T40 with the same chip in the tutorial
    - I got away with using some diodes I had sitting around (1N4002)
    - Check the pinouts on your DB9 (RS232) connector!!!
    Mine were actually numbered backwards (instead of 5-1, 1-5 etc.)
    - My serial cable was also numbered in reverse order too, however once I switched the
    wires it worked perfectly.
    - My password was gibberish until I clicked that button on the top left in the IBM
    password program.

  1084. Comment by langosh:

    Hello sir,
    you are my hero! I have just restored forgotten password on X31. I simply followed all steps mentioned in your tutorial and it works! Thank you very much…

  1085. Comment by Sathyananda:

    Dear friends I have r50e laptop,with the password problem,The chip is 24rf08,I tried to read it using my universal programmer (superproLx)I was able to read 25%(upto 0X00E0) the hex(bin) file goes like this.

    :200000008008070D0902400004607000821000010E040C010220C0757000004830482A20A2
    :200020007575454500000000003C48302D550000000000000000000000000000000000E82E
    :20004000AD000000000000000148594D443233324D36343644362D4A20202041410435FF31
    :20006000FF0855000000000000000000000000414934384E31313232322D30332000000038
    :20008000000000000000000000000000000000000000000000000000000000000000000060
    :2000A000000000000000000000000000000000000000000000000000000000000000000040
    :2000C000000000000000000000000000000000000000000000000000000000000000000020
    :2000E000000000000000000000000000000000000000000000000000000000000000000000
    :20010000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
    :20012000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDF
    :20014000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBF
    :20016000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9F
    :20018000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7F
    :2001A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5F
    :2001C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3F
    :2001E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1F
    :20020000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE
    :20022000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDE
    :20024000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBE
    :20026000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9E
    :20028000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7E
    :2002A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5E
    :2002C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3E
    :2002E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1E
    :20030000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD
    :20032000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDD
    :20034000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBD
    :20036000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9D
    :20038000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7D
    :2003A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D
    :2003C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D
    :2003E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1D
    :00000001FF
    please guide me how to read password location i.e 0X330,any body have bin file for the same ??please mail me (thejananta@yahoo.com),I will just try to program it on the other empty chip and solder it on the board .please guide me what to do next
    Thanks in advance
    regards
    Sathyananda

  1086. Comment by moch dofir:

    my t21’s 24RF08 is broke by reveres polarity
    i have a new one 24rf08 ….but i dont heve dump.bin file
    have any one upload fdump.bin?????

  1087. Comment by guenther:

    Hi all, I located the eeprom on the bottom side of a lenovo T61.
    P24S08 NXP (read out with:r24rf08)
    Made the electronics connections, read out eeprom, this is dump.bin at location
    0×338 6A:76:72:DB:D5:05:D4:85
    0×340 6A:76:72 :DB:D5:05:D4: C2

    means: jvr??(F1)??

    Any ideas?
    THX for help

  1088. Comment by david:

    Hi.. anyone in Toronto who has done a T30/t40 sucessful?

  1089. Comment by Richard:

    Hi,
    I tried this on a T42 and x330 memory is all “ff”.
    I’m needing to recover the “Access IBM” password, is the password this process is suppose to recover the one I need?
    I press the “Access IBM” at power-on, it prompts for the power-on password (which I know, [but the dump.bin file doesn't show this password as I expected it to]). The IBM Rescue and Recovery screen loads and a prompt appears for a password (an input box titled “IBM Verify Password”), this is the password I do not know, I need it to reinstall the prebuilt software back to factory. Has anyone got any ideas with this?
    Thanks for any help you can provide.

  1090. Comment by Richard:

    Ok, I have tried again running the dump at the power-on password (I was originally running it at the “Rescue and Recovery” passowrd prompt). The x330 dump is…
    “00 00 00 00 00 00 00 00 2f f9 28 96 40 fa cc 96″ which gives a translation of ” V ‘ f “. Any ideas where I am going wrong?
    Thanks again

  1091. Comment by Larry:

    Did I read correctly?

    You first turn on the password protected machine, THEN while the machine is on, solder the wires to the SDA and SCL pins on the Amtel chip?

  1092. Comment by Hacking Ibm Thinkpad Bios Password:

    [...] Does anyone of you uses IBM?? In this case this might come handy…Have fun… Hacking IBM Thinkpad Bios Password : SoDoItYourself.com [...]

  1093. Comment by alexwv:

    larry,
    DO NOT SOLDER anything on the password-protected machine while it is ON.

  1094. Comment by ndu:

    HAS ANYONE SUCCESSFULLY DID R40?

  1095. Comment by ndu:

    HAS ANYONE SUCCESSFULLY DONE THE IBM R40 HACKING GUYS?
    I AM ABOUT TO DO ONE , BUT HAVENT YET OBTAINED THE ENTIRE
    HARTDWARE LIKE DIODES AND RESISTOR.

    nduduzo.mkhize@kznhealth.gov.za

  1096. Comment by jw:

    Thanks. Worked perfectly.

  1097. Comment by D:

    This does work on an IBM R40. ATMEL chip is under the thin plastic where the hard drive was. It might help to include a diagram of the wiring needed, or show a breadboard picture or show the diagram visually, especially what the wires look like all soldered together. All in all I spent less than 5 bucks for the resistors and zeners. It worked on the first try and I thank you for this information. Let’s all do more publishing of solutions and tips and tricks for these kind of problems. Maybe we can help each other instead of having someone tell us we need to buy another motherboard,,,well I found help here, and I am grateful. THANKS!

  1098. Comment by Demolished Man:

    Thank you for this. It worked first time for me on an X31. I had trouble finding the 24rf08 on the X31 but thanks to an earlier comment I tracked it down. No electonic experience. Great fun.

  1099. Comment by HAMZA HB:

    For 24CF08CT the SOLUTION IS HERE

    http://monitor.net.ru/forum/files/24rf08ct_172.jpg

  1100. Comment by HAMZA HB:

    Not 24CF08CR but 24RF08CT , (IBM THINKPAD T23 Localized under the Rame Module Near The Speaker)

    For 24RF08CT the SOLUTION IS HERE

    http://monitor.net.ru/forum/files/24rf08ct_172.jpg

  1101. Comment by mike:

    well can you telll me if i changing this bios chip with new one it’s gone solved or not
    thank you

  1102. Comment by mike:

    sorry this is the right email

  1103. Comment by Maxd:

    Hi everybody
    i have to say Thank you for all the information.
    it was really helpfull

    thanks

    regards
    Maxd.

  1104. Comment by omid:

    Hi,

    I have Thinkpad x41 tablet model 1869-CSU.
    I want to know place of Atmel IC in X41 tablet mainboard.
    Thanks

    Regards,
    Omid

  1105. Comment by alexwv:

    quenther,
    that means that the password is encrypted. it needs to be decrypted. for password help visit: http://www.password-removal.com

  1106. Comment by wirezap:

    0X330 is blank but the T20 still ask for a password?

  1107. Comment by maaz:

    Hi,
    i want to remove password from my ibm t60. i read all procedure that’s great. only 1 thing which i want to confirm before going to do this that shall solder the wire direct serial port to atml or not. because i saw some of friend in this site showing some white color board on where he solder resistor and wires.what’s that board?

  1108. Comment by Andy:

    Hi,
    the procedure worked perfectly on a TP X41, thank you and AllSoftware.ro for the software: You’re great!
    One hour of work and 5 USD of materials!
    The chip on my X41 is underneath the m/board just oppsite side of the PCMCIA slot.
    The chip is a Philips PCA24S08, SCL and SDA pins are the 2 most right on the side of the “P24S08″ label (as well as for the atmel chip).
    I didn’t risk to solter the chip, instead I connected the end of the wires of the interface to two pins (GND connected somwhere in the m/b) and while the program was running I kept the pins connetted to the chip manually. It worked.

  1109. Comment by Lappi neu aufsetzen (Brainstorming) - Seite 2:

    [...] so Hacking IBM Thinkpad Bios Password : SoDoItYourself.com __________________ Frei ist, wer in Ketten tanzen kann. Das Leben ist ein Heidenspa, fr [...]

  1110. Comment by zizou:

    Hi,

    Thanks a lot ! it wooooorks :-)

  1111. Comment by tubimusic99:

    Hello everybody ! I have a Thinkpad r500… with svp…can somebody help me to were in atmel chip….and this chip reader is good for my Thinkpad r500. PLEASE !!!!!!

  1112. Comment by Rick:

    Could you post a pic of the completed adapter. I think I understand the schematic,, but would like to see a final project.

  1113. Comment by Takuya:

    Hy guys, i got my thinkpad z60 back and forgot my supervisor password
    I still got access with fingerprint but not more :(
    Do i need to open my laptop for reading with the RPC8394 tool?

  1114. Comment by Sergey:

    PS/2 mouse does not have DB9 connector. Serial one have.

  1115. Comment by brainstorm:

    Funny, I did more or less the same with an HP notebook… unfortunately hackaday did not like the history :_/

    http://blogs.nopcode.org/brainstorm/2006/08/25/omnibook-xe3-resetting-a-bios-password-the-hardware-way/

  1116. Comment by Steal the administrator password from an EEPROM | Diy all the Way:

    [...] Did you forget your hardware-based password and now you’re locked out? If it’s an IBM ThinkPad you may be in luck but it involves a bit more than just removing the backup battery. SoDoItYourself has an article detailing the retrieval of password data from an EEPROM. [...]

  1117. Comment by Tweets that mention » Hacking IBM Thinkpad Bios Password : SoDoItYourself.com -- Topsy.com:

    [...] This post was mentioned on Twitter by Tonimir Kisasondi and Saint Crusader. Saint Crusader said: RT @mobilebomb: hacking ThinkPad BIOS EEPROM password http://bit.ly/2HKrf2 >> thinkpad คือคอมในดวงใจเสมอ [...]

  1118. Comment by Stuart Baird:

    Dear Sir,

    We are direct providers of Fresh Cut BG, SBLC and MTN which are specifically for lease, our bank instrument can be engage in PPP Trading, Discounting, signature project(s) such as Aviation, Agriculture, Petroleum, Telecommunication, construction of Dams, Bridges, Real Estate and all kind of projects. We do not have any broker chain in our offer or get involved in chauffer driven offers. We deliver with time and precision as sethforth in the agreement. Our terms and Conditions are reasonable, below is our instrument description.

    DESCRIPTION OF INSTRUMENTS:
    1. Instrument: Bank Guarantee (BG/SBLC) (Appendix A)
    2. Total Face Value: Eur 10M MIN and Eur 5B MAX (Five Billion USD).
    3. Issuing Bank: HSBC, London or Deutsche Bank Frankfurt or any Top 25 WEB
    4. Age: One Year, One Day
    5. Leasing Price: 6% of Face Value plus 2% commission fees to brokers.
    6. Delivery: SWIFT TO SWIFT.
    7. Payment: MT-103.
    8. Hard Copy: Bonded Courier within 7 banking days.

    All relevant business information will be provided upon request.

    If Interested kindly contact me via Email:~ stuartbaird090@aol.com

  1119. Comment by Kevin:

    I seem to be having a problem at this point…..
    “Fire up a command promt(Start->run type cmd) and navigate to the folder where you installed R24RF08 v2.0b. Type in (don’t hit Enter):

    r24rf08 dump.bin”

    …. I installed the programs but it seem impossible to “navigate to the folder” can someone help me with this? If I try and run it from the windows folder it doesn’t seem to work.

  1120. Comment by wen:

    Is the 24c64wp clip the bios IC?I fail to update the bios of my acer aspire 2920,and my laptop can’t open now,I don’t know witch IC on the motherboard is the bios IC? Does anyone can tell me?thank you!

  1121. Comment by wendy:

    Is the 24c64wp clip the bios IC?I fail to update the bios of my acer aspire 2920,and my laptop can’t open now,I don’t know witch IC on the motherboard is the bios IC? Does anyone can tell me?thank you!

  1122. Comment by mike:

    Wow, it worked perfectly. But at first my password looked like random ASCII characters on my thinkpad a21e in IBM Pass 2.0 Lite. I thought that it was TCPA encrypted, but saw that the a21e doesn’t use TCPA. I took me a while but I found out that the AA button must absolutly be ON for the a21e.

  1123. Comment by killallone:

    hola
    gracias a ustedes y a un error logre desbloquear la ibm t400
    el chip de seguridad integrado es el p24s08
    la solucion a el problema de la clave o pass es mas sencilla de lo que creen
    1:soldar un cable a cada una de las patas 5-6
    2:armar el ordenador y tener listos los cables con las puntas peladas
    3:precionar power y en ese momento unir el cable 5 y 6 en corto circuito solo 4 segundos y separar
    (veras que la maquina no enciende pero las luces si)
    4:apagar y volver a encender realizando el corto entre el 5 y 6 ya cuando esta encendiendo(3 seg +-)
    (aparecera un error y intentara repararce el cmos por conexion remota)
    5:apagar y ya veras que te dejara entrar en el bios pero no podras realizarcambios
    6:la patita numero 3 del p24s08 se conecta pormedio de unos microcapacitores de ceramica con una lupa veras que tiene una pista de la medida de un pelo bueno entre el primer capacitor y la pata 3 corta con un cuter (cuidado de no cortar otra cosa )ya esta.el chip esta desactivado y el bios reseteado.
    pd:yo lorealice al corte al soldar un cable en la pata 3 y corte la pista sin querer y mira esta es la solucion ,por mas que tus hijos quieran no permitirte el acceso ya no podran bloquearla con este procedimiento.
    al encenderla podras entrar al bios y realizar cambios y no te pedira la clave
    suerte

  1124. Comment by David:

    Thanks to Victor at AllService for his help in unlocking my X61. A fast service with all completed from initial enquiry to unlock taking less than 2 hours :)

    http://www.allservice.ro/forum/viewtopic.php?t=61

    For a thinkpad with TCPA encryption this is the only way to proceed. You will need to have basic soldering skills. If you have a helper to enter the command on the technician’s PC, you will not need to solder onto the mobo of the X61. The biggest advantage is that you do not need to ship your laptop anywhere - all required components to build the interface are available in any electronics store and the software/files are available via email.

  1125. Comment by Sebastian:

    Hi,
    I have a Lenovo T500, I took it apart to find the atmel but instead the atmel, which is missing (I did find the U53 location, but it’s empty) I did find another flash Winbond 25X64VFIG 16 pins located very close to the missing one, I find out it is a serial flash but it has a huge capacity 64MB !
    On the other side of the main board I did find a NXP made 24s08 which is probably the same like the Atmel 24rf08 one you described, this is located close to the DVDrom connector.
    Please let me know if there is anything that can be done ?
    Thanks a lot

  1126. Comment by killallone:

    Comment by Sebastian:
    On the other side of the main board I did find a NXP made 24s08 which is probably the

    traductor google

    hi
    thank you and error managed to unlock the T400 ibm
    integrated security chip is p24s08 = Atmel 24rf08 8 pin
    the solution to the problem of password or pass is more simple than you think
    1: solder a wire to each of 5.6 feet
    2: assemble the computer and be ready cables with bare tips
    3: Precionar power and then connect the cable 5 and 6 shorted and only 4 seconds separating
    (you will see that the machine will not start but lights if)
    4: off and relight the near by between 5 and 6 and when it’s on (3 sec + -)
    (see an error and tried the cmos by repararce remote connection)
    5: off and it really let you enter the bios but you can not realizarcambios
    6: the number 3 p24s08 paw connects microcapacitores adaptive behavior of a ceramic with a magnifying glass to really have a clue of the extent of a good hair between the first capacitor and the leg 3 intersects with a cutter (careful not to cut anything ) and esta.el chip is disabled and reset the bios.
    pd: I lorealice cut the solder to the leg 3 and accidentally cut the track and watch this is the solution for your kids but do not want to let you access and can not block with this procedure.
    to turn it on you can enter the bios and make changes and do not ask for the key
    lucky

    el chip esta serca del conector del cdrom parte posterior

  1127. Comment by Michael:

    Hi,

    my T23 was the last PC running M$ - does there exist an equivalent to “IBM Pass 2.0 Lite” under debian ?

    Thanks a lot,
    Merci bien,
    Jupp

  1128. Comment by Bob:

    Wildbynature: I successfully used this circuit to read out the atmel chip on a couple of r51s. so if you’re getting an error there’s probably a problem with your circuit: wrong components, miswiring, something. Or you’ve caused some damage to the laptop in the process of soldering. I didn’t solder, I hand held the wires to the chip wile a friend ran the program.

    The ibm passlite program did not correctly decode the bin file, though. I found another program on line that would do it: cmospwd 5,0. It displays several possible decodings of the file, using different algorithms. The second one displayed showed the right password.

  1129. Comment by Bruce:

    Hello..Very nice setup on how to fix the bios lockup… anyone know were this ATMEL chip is located on a Thinkpad A20p been unable to find it….??????? HELP….

  1130. Comment by killallone:

    Hello..Very nice setup on how to fix the bios lockup… anyone know were this ATMEL chip is located on a Thinkpad A20p been unable to find it….??????? HELP….

    magnifying glass and patience.
    ■ ThinkPad 570E
    ■ ThinkPad 600E, 600X
    ■ ThinkPad 770X, 770Z
    ■ ThinkPad 240
    ■ ThinkPad X20
    ■ probably more
    External sources
    ■ ATMEL
    ■ ATMEL - Direct link Direct AT24RF08C
    ■ ATMEL - Direct link to AT24C08 Direct
    ■ ATMEL - AT24RF08C product page
    ■ ATMEL - AT24C08 product page
    and p24s08 T400
    buscar

  1131. Comment by Michel:

    regardez ici :
    http://www.passwordmethod.com/images/EEPROM/ibm_a20p.gif

  1132. Comment by jhone:

    A. By Using the Motherboard Jumper:

    In most motherboards CMOS battery is soldered, which makes it difficult to remove the battery. In this case we use another method.

    Almost all motherboards contain a jumper that can clear all CMOS settings along with the BIOS password. The location of this jumper varies depending upon the motherboard brand. You should read your motherboard manual to check its location. If you don’t have the manual then look for the jumpers near the CMOS battery. Most of the manufacturer label the jumper as CLR, CLEAR, CLEAR CMOS, etc.

    When you find the jumper, look carefully. There will be 3 pins and the jumper will be joining the center pin to either left or right pin. What you need to do, is remove the jumper and join the center pin to the opposite pin. e.g. if the jumper joins center pin to left pin, then remove it and join center pin to right pin. Now wait for a few seconds and then again remove the jumper and join the center pin to left pin.

    Make sure to turn the PC off before opening the cabinet and resetting the jumper.

    B. By Using Software:

    I have found that BIOS/CMOS Password Recovery Tool is the most effective.:
    BIOS/CMOS Password Recovery Tool is a program that works instantly to remove any lost or forgotten BIOS/CMOS password. Simply boot your PC to DOS and execute the program, and get access to forgotten BIOS/CMOS passwords in just seconds

    BIOS/CMOS Password Recovery Tool Service: http://www.biospasswordrecovery.com/

  1133. Comment by Chris:

    Hi I know there is a SOLDERLESS way of hacking the IBM PASSWORD. I know this because I know someone doing it and other companies only charge $25 to do it so they are not going to take your laptop apart (A20M, A21M, A22M, A23M) and fix it for $25. I am pretty sure its using a device through the parallel port and decoding the output again as before. It works on A20M, A21M, A22M, A23M, A30, A31, T20, T21, T22, T23, T30 probably other models too. If anyone finds out how please post it! EVERYONE WILL LOVE YOU FOR IT!

  1134. Comment by KsH:

    oh my god ;) it`s work!! i have IBM A31 .. and the password i can read! this is very good tutorial!
    thx!

  1135. Comment by Bill Schwenke:

    That’s great, and similar to what I suspected, but I own an Acer Aspire 4710, Euro model, made in 2007. The BIOS is locked and it absolutely won’t clear by easier methods, also removed all parts from the casing, no visible clues. What software or device can I use? Acer wants $100 USD to correct problem.

  1136. Comment by CMOS password problem: Toshiba Laptop - WCCFtech.com | Forum:

    [...] Although THIS is not for a toshiba, it might give u an idea [...]

  1137. Comment by graziano61:

    Hi, on my R61 reading NXP P24S08 :

    0X330 : 00 00 00 00 00 00 00 00 4e 2d 73 8e 81 b7 96 f4
    0X340 : 4e 2d 73 8e 81 b7 96 f4 88 c6 fa 03 83 c2 fa 02

    after press ( AA ) button result is : +X

    Why not decoding password ???
    also used patcher !! same result !!

    HELPME,HELPME

    Best Regards

  1138. Comment by Riz:

    is this will work in IBM Thinkpad R52 and will you discrived it in more detail step by step with photograph.

  1139. Comment by Riz:

    i have IBM THinkpad R52,n i m getting same type of screen as my brother do something and dont know wht he has done. I m getting the lock at screen when i m starting my laptop same as u given the pic, the solution u have given will work in IBM Thinkpad R52 and will you discribed it in more detail step by step with photograph. and is any other trick which is easier then this.. i think it is an superior password.

  1140. Comment by alexwv:

    Riz,
    thinkpad R52 does not use Atmel 24rf08 chip. it uses a different kind of chip that can not be read by the simple device.

  1141. Comment by alexwv:

    Chris,
    sure, there’s a way to read the password using serial port. but, you have to have access to THE CHIP (Atmel 24rf08). you need two laptops: the locked laptop and a technician’s pc. an electronic device is connected to the Atmel chip that plugs into the serial port of the technician’s pc. the password is read and then decoded. in case of A20, A21, A22, A23, A30, A31 the laptop must be opened. on 20 series, the chip is at the bottom of the motherboard. on 30 series, the chip under the keyboard. for T20, T21, T22, T23, T30, the chip is easily accessible and the pc does not need to be taken apart. but, you still need an extra laptop to READ the locked laptop’s chip.

  1142. Comment by Libor:

    It works like a charm, thank you very much :-) We were stuck because we didn’t use ground cable and dumping application couldn’t read chip memory. The best DIY we ever did.

  1143. Comment by Fahad:

    how can i remove BIOS password in Lenova x61 tablet laptop. I have forgotten my password.
    please mail me at fahad.ahmad@langleyacademy.org

    thanks.

  1144. Comment by pickabone:

    Holy boy! It worked. I’d never held a soldering iron before in my life, and this hack worked. Major major major props to the author. I’ve just salvaged a dead brick and turned it back into a working rig.

  1145. Comment by Bruce:

    Hi folks thank you for the help out their on this IBM A20p Thinkpad..I found it finely … The Bios chip for this laptop is Located on the bottom side of the board right under the PCMCIA Slot U55 chip Number 24RF08C ATMEL….

  1146. Comment by Mike:

    This worked great on A IMB T40) used RadioShack Part # 276-565 Item # 1N4733A 5.1 ZENER dIODES 2 IN THE PACK FOR $1.30 US AND TWO 2.2K RESITORS AS SPECIFIED and a old serial port cord mapped out the pins with ohm meter to the colors and worked like a charm

    To access the eprom chip download the service manual from IBM it tells just what screws to take out be carefull they are differant lengths involved you take out the ketboard very easy to do and the touchpad holder also very easy and the eprom is just the same place as in the pictures above it is on the left be carefull to make sure you get the SCL and SDA correct on your wires i soderd wires to the eprom and a copper place just above the chipset up and to the right for the ground then hoocked the wires to the ends of the resitors wires turned on the laptop and pc then hooked the serial cable into the pc the software will install to a directory of its on on the root of your main drive mine was
    C:\Allservice

    when you go to the command prompt you will (ExAMPLE. winxp ) be in C:\documents and setting\yourname> if you type SPACE cd.. and hit enter it takes you back one directory so if you do it again space cd.. enter you will be in C:\

    this makes it easer to get to the directory you whant

    then type cd (hit spacebar once) allservice and hit enter and it should read c:\Allservice
    then type cd (hit spacebar once) 24RF08 and hit enter and it should read c:\allservice\24rf08
    then type r24rf08 dump.bin and it should look like this then

    c:\Allservice\24rf08\r24rf08 dump.bin

    now when your ready hit the enter key it should now read the eprom chip and make a file called dump.eprom in c:\allservice\24rf08 directory on your harddrive if you have the IBMpass.2.1 installed just double klick the eprom looking icon and the program IBMpass.2.1 will automaticly launch read the password and wala your done

    Thanks the software provided buy allsevice (I.E. R24RF08 v2.0b ) shows the same diagram for the programer in the pdf files that are included with the software just incase you lose the site addy i want to thank the provider of this information for your posting this on this site you are the bomb:)

    IBM shoud be ashamed of itself for telling people to trash there laptops and or buy a new motherboard when this method is a easy as it is

  1147. Comment by Mike:

    last post was supposed to be a IBM T40) sorz about the typo

  1148. Comment by Mike:

    Well Tony Nice there is some good info in your post and some advertising going on allso about some software here!
    But in the case of my IBM T40 this is the ONLY methoud that will work so dont you people out there get suckerd into thinking that a peice of software as in tonys advertisement above would work in the case of these certain IBM laptops at wich the passsword is writen to the eprom just like a bios flash or firmware flash is wrote to a chip in your cd/dvd/ drives and so on the info stays on the chip reguardless of any a/c or battery conection kinda like writitng to a cd or floppy drive or even your hard drive it stays put even after being removed from a eletrical connction

    Use this methoud for your pasword recovery on your IBMs with the eprom chip and you cant go wrong! because it is the only thing that will work! Period!!

  1149. Comment by oiBOY333:

    Hi, I have a TP x60 and I was wondering if this will work for me. And if it will work, dose anyone know where I would find the chip I’m looking for? Thanks to everyone that share’s their information. Without you many people would have expensive paper weights and no computer!

  1150. Comment by Johnny Roberts:

    Thank you so much for this. I am by no means a skilled IT person and have never even opened up a laptop before but your instructions were so clear and simple to follow that even I had little difficulty in locating the password. Yes, the soldering was a bit of a challenge (requiring a steady had and the help of a magnifying glass but I did succeed. You’ve made my day. Thanks a lot.

  1151. Comment by Ajith:

    I have an IBM TPD R60 which i forgot the SVP password. Now i am unable to use the TPD. I checked the motherboard for the ATMEL chip and was able to find one, its no. is AT97SC3203. I think this is the one which has the SVP stored. Could anyone please guide me how to solder the wires to this chip and a circuit diagram for reading the EEPROM details. Thanks in advance.

  1152. Comment by Szabi:

    Hi.

    I have also a problem with a T43. I fount the PC8394T-VJG but i don’t know where to connect the eeprom programing interface. Where are the TPM1 and TPM2 points on the PC8394T-VJG.

    If somebody can help me my e-mail adres is: szabi_biro_83@yahoo.com

  1153. Comment by stevo07:

    Please HELP.
    Shall I problem with LENOVO R61 type 8918.Eeprom P24S08 filling eats 0×330 :66 ad 11 07 f2 c4 21 ac following a reversed in IBMpass 2.1 Lite eats passport:,>72 Q> Please may me this translated right ? Thanks.

  1154. Comment by stevo07:

    email:07stevo07@zoznam.sk
    Please Help.Thanks.

  1155. Comment by MIKAEL974:

    Hello,i have T60 and my motherboard is FRU41W1360 i have not located ic security where is this please?or i oblige buy tools victor thanks you very much!!!help help me

  1156. Comment by remus:

    Hello everybody
    IBM T40, I have 2 errors message when I press on F1 during the startup to enter the BIOS.
    Error 0271 - check date and time setting
    Error 0176 - System sercurity. The system has been tempered with.

    1-Is it a problem?

    2- I connected everything like the diagram, and when i press enter i cant find the dump bin file ,how do i find or tell if and where the bin file has gone,can anyone help!!!

    3-It is possible use an USB to RS232 PORT SERIE ADAPTATER CABLE ??
    Have somebody experience this?

    If somebody can help me my
    Thanks in advance to everybody.

  1157. Comment by Joshua M. Biscarra:

    Dear author,

    My spare computer has no serial port. I bought a USB-to-serial port. The problem is that it is a male serial port. Will this still be alright?

  1158. Comment by Joshua M. Biscarra:

    To whom it may concern:

    My spare computer has no serial port. I bought a USB-to-serial port. The problem is that it is a male serial port. Will this still be alright?

  1159. Comment by astro:

    there are some key generators which you can use to bypass the BIOS password of various other vendors:
    http://dogber1.blogspot.com/2009/05/table-of-reverse-engineered-bios.html

  1160. Comment by Jose Rosa:

    hey there just curious im about to perform the hack on my own but was wondering cani use my usb serial cable on my laptop?? i think so but just curious….. thanks anyway

  1161. Comment by Felipe Valdivia:

    one has to have a real steady hand to solder on the ic pins. but once you have it done, it worked me at first try.

    nice one.
    thanks

    Felipe

  1162. Comment by Joe:

    Any way to get a better picture of how the seriel connecter,resistor and zener diod are put together?
    Thanks

  1163. Comment by Felipe Valdivia:

    the serial connector on the schematic is shown from the back of the connector.
    i tossed away my protoboard as it had very unreliable connections. maybe it was worn off.
    so i picked up a piece of stripboard and mounted the circuit there. soldered the wires coming from the inside of the notebook to the stripboard and fired up the system. when it was prompting to enter the password i connected the serial port (already soldered to the circuit, to the notebook)to the computer, not the wires individually, then i started the dump on the command prompt and ot worked at the first try.
    it read a 1024 dump.bin file, i openned with the IBM pass lite app, and at first didnt recognize anything as a password on 0×330, but, i TURNED TRANSLATION ON and it appeared a 0710 code as password. that was it.
    excelent method.
    thank you very much

  1164. Comment by Joe:

    What A great sight! I am almost there. I have made the chip reader and found the security chip on my TP R40,its the black and green colored one. I am not sure where to connect the red (sda) and green(scl) wires and ground to the chip. If anyone can supply info or better yet a picture it would be greatly appreciated.
    Thanks

  1165. Comment by Peter:

    Hallo Ihr netten,

    ich habe be ebay vor kurzen ein IBM ThinkPad 204x Notebook Typ 2609 ersteigert, leider fährt der Rechner das XP Betriebssystem nicht hoch, Schlosssymbol wird angezeigt, er verlangt nach ein code 7 Stellig, ich kann nichts machen Wer kann mir schnellstens helfen! Wer hat einen passenden code für mich Phonix Bios 4.0 Release 6.0. Kann damit irgendeiner etwas anfangen!!! Vielen Dank für eure Hilfe Peter

  1166. Comment by MIKAEL974:

    JUST THANKS VICTOR IS BOSSMAN THANKS

  1167. Comment by Joe:

    Can anyone please supply a picture of the connections to the eeprom on a TP R40. Also do they need to be soldered or can I have someone hold them on the eeprom. I have all the hardware and still cannot get results.

    Pleease any help greatly appreciated

  1168. Comment by Freddy:

    Hey did any of you guys think to a socket somewhere on the back to save opening the laptop for future convienance?

    I just took the three soldered wires and soldered them to a miniture plug and taped it and fed the wires to the mem slot area,so if it happens again? alls I do is open the mem cover and plug it into the gizzmo reader.

    IBM A30,the chip is under the PCMCIA rack slot. :-)

  1169. Comment by Freddy:

    Atmel Chip at the bottom of this page in PDF format.

    http://www.datasheetcatalog.com/datasheets_pdf/A/T/2/4/AT24RF08.shtml

  1170. Comment by JasonP:

    I just followed all the instructions and it worked first time.

    THANK YOU VERY, VERY MUCH!!!

    How did you ever manage to work that out? Very impressive.

  1171. Comment by freddy:

    I’ve noticed that some of you guys get the error…”Eprom not found” or words to that effct?

    I had this also and switched to another computer and everything went fine,found the password and poked it in…this worked.

    I’m assuming on my other computer that there was a conflict on my COM ports? and this is why I was getting the error of”Eprom not found”.

  1172. Comment by brian:

    how do i use the software i got everything wired up i have a r40 when i type in r24rf08 bump.bin in the dos promt i hook up all wires and i get nothing no file made

  1173. Comment by Almads:

    Is there a posable that u can install your operating system even due you are incounter of this problem, ibm thinkpad superior password crc error… i need some detail on how to survive this problem i do not know what are the posable solutions for this problem…

  1174. Comment by Danny McGowen:

    I have a Lenovo G530 444624U that has a HDD password lock before post. I have the bios password. My question is will this process work on this 2008 machine? I tried taking the 250gig HD out and tried reading it however it will not run it is locked down. Any ideas? Thank you in advance.

  1175. Comment by eddy:

    hello i ve not serial port on my pc.
    -It is possible use an USB to RS232 PORT SERIE ADAPTATER CABLE ??
    Have somebody experience this?

    i have a 1024 dump.bin file, i openned with the IBM pass lite but didn t recognize anything?

    please help

  1176. Comment by IBM X31 Bioskennwort - WinBoard - Die Windows Community:

    [...] einfach: http://sodoityourself.com/hacking-ib…bios-password/ Ne sry glaube kaum dass da ein Master existiert…wre ja auch dmlich… __________________ [...]

  1177. Comment by Robert:

    I successfully dump the contents of the chip. But, when I view the contents the password it
    appears to be a combination of conrtol characters. The Hex Values are in 0×330 are as follows.
    22 18 03 1f 88 04 26 02
    The ascii portion (if it were readable looks like this)

    . . . . . . . . ” . . . ^ . & .

    can anyone help me with this? is there a way to write a password to the chip so it
    can be typed in on the keyboard?

    Thanks

  1178. Comment by PaulBG:

    As the code is on the Atmel 24RF08 chip, would it be possible to replace this with one of another board? I have my old R50e motherboard which I know has no password set

  1179. Comment by IBM ThinkPad T400 BIOS Supervisor Password Problem. - Raymond.CC Forum:

    [...] you have to short a chip, however i don’t know if this method will work on ibms ,take alook at this http://sodoityourself.com/hacking-ib…bios-password/ __________________ if in doubt ,google [...]

  1180. Comment by PaulBG:

    The guys are right about the 24RF08 chip on the R50e it IS where the password is stored. I have been very lucky MANY THANKS YOU GUYS I changed the above chip from an old motherboard and SUCCESS! I came up with a simple tool for de-soldering the chip without damage will post it at: http://www.paulbg.com/soldertip.html ASAP.

  1181. Comment by JohnBDJ:

    Is there an easier way to do this when one hasn’t got an RS-232 port?

  1182. Comment by shuber fernandez:

    funciona para la t30 y donde encuentro el chip en este modelo

  1183. Comment by shuber fernandez:

    donde se encuntra esl chip en la t30

  1184. Comment by CRUZER:

    HI

    I MADE THE CIRCUIT AS GUIDED FOR MY T61 TP, BUT WHEN I RUN THE DUMP COMMAND IT SAYS BUS ERROR, WHAT IS WRONG COULD ANY ONY ONE TELL ME THAT, I HAVE CONNECTED THE WIRES ON SERIAL PORT AS PER THE DIAGRAM, CONNECTED THE ZENER DIODE GROUND + THE PIN MARKED NUMBER 1 ON THE SERIAL PORT TO THE OUTER STEEL BODY OF THE SERIAL PORT. AND THE GROUND ON THE EPROM IS CONNECTED TO THE SCREW SURFACE ON THE PCI BOARD OF LAPTOP FRO WHERE IT IS THEN CONNECTED TO THE GROUND OF THE ZENER DIODE CIRCUIT WE MADE. ANY THING WRON I HAVE DONE I HAVE TRIED A LOT OF TIME BUT IT SAY THE SAME BUS ERROR. PLEASE HELP DUMMY HERE. THANKX

  1185. Comment by Phil Gibson:

    Hello! I built the hardware and tested all connections. Loaded the software on technician laptop. Tripple checked the connections on both ends of the board. All seemed to go fine, however upon press ing enter to iniate the dump the IBM Pass 2.0 Lite came up on it’s own with x0x and a blinking cursor. I waited to see if anything developed but no luck. I went into the directory and found dump.bin had zero bytes of data. Connections on the chip are perfect (done under 10x magnification with soldering station). I pulled the cmos battery, and main battery for 24 hr. however got same result again. The laptop is a Thinkpad T42 with the exact layout as you describe. I am baffled as to what I am doing wrong. I would appreciate any help you can give me. Many have used your system successfuly so I must have done something wrong. Phil

  1186. Comment by Steve No.:

    Props to you’re tutorial, but this is definitely not for electronic newbies.

    Can’t you post more pictures and better instructions to the Soldering the ATMEL 24RF08 Chip reader steps?

    What the hell is a chip reader? Or any picture about where the wires you soldered to the AMTEL chip ends up going into? For ex. the serial port and how everything is just put together in the end.

    People who say this are easy obv. have engineering background or are just pure genius.

  1187. Comment by Picard:

    Hi, I was a bit rough with the soldering and broke one leg off and it can’t be resoldered, can you think of any way out of the dilemma??

  1188. Comment by Gopi Batra:

    Hi
    Thanks a lot!!! It took some hard work but I managed to make my lappy IBM R40e work. Thanks again.

  1189. Comment by Gopi Batra:

    I were able to make it work first time. If someone is not able 2 do it then pls read instructions very carefully at least thrice. Its not very difficult all u need is patience and be very careful while making circuit with 2 z diodes and 2 resistors. Ensure that the connections r as directed otherwise u might harm u lappy. Double check every thing. Remember that u need 2 different software one is to read the eeprom and other ibmpass lite to reveal the password from the .bin file created through the first software both available free of cost on 1 website. Thanks. Gopi Batra Delhi

  1190. Comment by Venkatesh:

    I need clear suggestion / move for the issue of Bios Password Lost in Laptop….

  1191. Comment by WesKM:

    Worked! Created the circuit and read the Atmel 24R0CN033N found below the cpu under WIFI card of my T41 Laptop. Thask excellant toutorial. Will send some pics I took of the Atmel Chip, Wires soldered to it, and of my Reader.

  1192. Comment by Kortes:

    I had a thought or two before starting this project. I had in my hands a Classic Thinkpad X40 recycled from a corporate.
    After purhcasing needed zeneds and diods, i spend a while with this, but it was a great fun!
    Especially when the eeprom was on the “dark” side of the MB. And the DB9 shematics were otherwayround. Newertheless I got a working X40.

    It´s a thrill to learn something new!

  1193. Comment by cylon:

    Hello i have a T400 , anyone now what chip use the bios?

  1194. Comment by spainfer:

    Thanks a lot for this tutorial. It worked over my T40 thinkpad. By the way, if you search for the datasheet of theAtmel chipyou’ll discover the GND of itself. I used that point for ground and it worked fine

  1195. Comment by jimates:

    I purchased twelve A21m two years ago from a local college. Not all of them had passwords in them. I figured it didn’t matter because there was nothing in the Bios that needed changing.

    They all worked great until the cmos battery died in the five that did have passwords. The bios is locked so I can’t get in to reset the date and time for it to complete the boot.
    I do not want to take all five of these apart as it seems the A21m has the chip on the bottom of the MB.

    Any suggestions. I tried a utility last year when the first one died but had no luck.
    email me jimates at thejmart dot com.

  1196. Comment by Feroz:

    I was able to get my supervisor password for IBM T60 make just on first try. My friend Hassan from Bangladesh, Lakshmipur, had purchased this IBM from a second hald laptop dealer after month it got locked when he opned the laptop to change the ram, since he did not know the actual password he went to the same dealer and had tried in so many places, not even a single laptop repair shop was left unturned, they all demanded USD 50 or 100 to clear the supervisor password but, after few days they will call and tell “Sorry boss” you can take your laptop back. He even took the laptop to the Lenovo IBM workshop, they informed him that they will check and call, after two days they called and asked to pay USD700 and replace the MB as nothing can be done to clear the supervisor password they told that it is a MISSION IMPOSSIBLE.

    THANKS TO THIS SITE AND THE ADMIN the instructions given is excellent and very clear. If someone is not able to do it then please read instructions very carefully at least thrice. Its not very difficult all you need is patience and be very careful while making circuit with 2 z diodes and 2 resistors. Ensure that the connections are as directed otherwise you might harm the laptop. Double check every thing. Remember that you need 2 different software one is to read the eeprom and other ibmpass lite to reveal the password from the .bin file created through the first software both available free of cost on this site.

  1197. Comment by John:

    Dear helper - silly question, but I have a T30, that is erroring with the 4 beep codes for the security chip problem - can this be resolved by reloading the eeprom f/w?
    If so, can it be done with thissoftware if I make the gadget?

    Many Thanks

    John

  1198. Comment by Dan:

    Hi Guys

    I have a client that has a t42 and it looks like im gonna have to do this for him.

    my question is, i see in the diagrams that it is connected with cables and not direct the diods and resistors. what cable was used? ad can it be done directly to the diodes and resistors? would be great to get a pic of how they actualy connect to the rs232 aswell.

    Thanks

    dan

  1199. Comment by Dan:

    Also does anyone know what will happen if it is done without diodes and resistors?

    Dan

  1200. Comment by KWEB:

    Sorry for my poor english …
    I’ve got a chinese X61 with qwerty keyboard, everythink worked well, but when i try to convert the HEX value, it give me this at line 330 :«k£0qIÜ (with a space before )
    and with AA on, the equivalent is ” B 9 ” (with 4 spaces before)
    Question : is it because the password had been registered with a chinese keyboard ?
    Is there any possibility to convert this Hex value, to send it logging on a qwerty KB ?

    too hard for me, please help … thank you very much

    From Paris, France Really Sorry for my english

  1201. Comment by nino:

    Hi,

    I have same problem of my T400!
    The value at 0×330 lines is 6′ (with space line before).

    please help.

  1202. Comment by Paul:

    Thanks for this. I have just made this and successfully recovered a password for TP R40. It only cost me AU$15 for all the parts, which saves getting another motherboard.

    To KWEB & nino,
    Just make sure that the translation if “OFF”, I had that problem until I realised that the translation was on.

  1203. Comment by KWEB:

    Allways same problem with X61 from China :

    0×330 -> 00 00 00 00 00 00 00 00 - 8f ab 6b a3 30 71 49 dc

    That mean in scancode mode i obtain this result :

    Off: «k£0qIÜ
    On: B 9

    Question : Is it possible to enter ”Ü” with a qwerty KB ? and is it normal to choose translation OFF ?

  1204. Comment by KWEB:

    other question, is it possible to modify the .bin deleting the password and replacing by “00″ hex value at line 0×330 and 0×340 ?

  1205. Comment by wenwez:

    i use ibm r50e.now i have problem to acces window becouse my notebook need security password.i dont know that.its hapen since my ibm battery damage and i always turn off my notebook without shut down.what i do,i just switch off the power supply.now after a few day when i turn on my notebook yhe lock icon come out and i have to fill the password to open the security cord.

    really really need your help.pls

  1206. Comment by Jens:

    Hello,
    Thanks for the helpful Information.
    I have an Ibm Thinkcentre here and the bios is locked i can not save any settings because someone tried to update the bios an the Pc wont boot.
    I have found the security chip its an 33-4c-S2AE and i found a Datasheet too.

    http://pdf1.alldatasheet.com/datasheet-pdf/view/170451/SST/SST25LF040A-33-4C-S2AE.html

    Can someone please tell me if the software works for this chip too and is the wire the same?
    many thanks

  1207. Comment by IBM T30 BIOS password « ramblings:

    [...] had to change the planar (the notebook equivalent of the motherboard.) Followed the instructions on SoDoItYourself and constructed a serial port interface, downloaded the software and I was very quickly able to get [...]

  1208. Comment by Ricardo:

    This does work! I just tried it on my R40 & T20 and got the password like a charm follow instructions exact and you will have the password in no time! (I used all parts exactly)

  1209. Comment by Jacko:

    I can’t believe it. This actually worked for me. I was somewhat skeptical, but patience, patience, patience. Some observations:

    * I had a Thinkpad 600e I bought off eBay that reported the 161, 168 error codes in BIOS and with the flying ‘duck’.
    * Hitting Enter at the first BIOS prompt for a supervisor pwd results in OK, but it is not (OK). You can’t get past the flying duck without a supervisor password.
    * The security IC was a 14-pin 24RF08CT installed under the CPU module.
    * I had to get a very fine soldering tip PTJ7 (0.01″) for my Weller Soldering Pencil (TC201).
    * It was very tricky to get the (30 gauge) wires soldered on the pins as the pins are VERY close together (0.2″) on the 14-pin IC (I’m sure this task would be easier with the 8-pin 24RFC08 IC.)
    * I have a very strong magnifying glass and strong light to inspect my soldering prior to power-up.
    * I hard-wired the power directly to the IC as well so I didn’t have to reassemble the laptop.
    * I kept coming back to search the discussion forum comments and someone, somewhere ran into the same hurdles I did, but the answers to the comments worked for me to.

    Great job! Thank you so much to providing this level of detail. It took me about 3 weeks elapsed time, but I am one happy camper!

    Jacko

  1210. Comment by coxi:

    hello.does anybody know if this solution works for asus x50gl notebook?i forgot my supervisor password. i went to a service with the laptop and they somehow managed to make it boot.now it’s working but i can’t acces bios to change settings and the system time resets on every reboot.

  1211. Comment by Alafranga:

    Hello everyone!
    Firstly thanks for your guide! I have a problem with my T500 that hasn’t been solved:
    At first I could boot the machine but could not do any advanced changes in the bios.
    After calling Lenovo support they advised to remove the time-date battery and insert it again. After this it completely locked up. Previously I saw in the bios that the supervisor password was set but encryption was disabled. All other password were disabled as well.

    Now with your guide I assembled this reader and read succesfully the chip. After analyzing with ibmpass I see only zero’s at 0×330.

    Is it required to enter the bios that the password will show up?

    What to do with completely locked-up machines?

    Greetings and thanks in advance.

  1212. Comment by bob:

    @ coxi
    you need to use a software like KillCMOS, it s the best way to clean your CMOS.

  1213. Comment by eduardo:

    For R32 searchers, I found the little sucker, it is an 8 pins chip located very very hidden nearby the left side of the cmos battery or to the right side of the pcmcia slot

  1214. Comment by eduardo:

    For all who got the 0271 error check date and time settings, it means the date or time are out of range (range valid is 1991 to 2099). This occurs when the cmos battery is completely discharged. Replace the cmos battery and try the procedure again. For replacing the cmos battery use any of lithium 3V battery (probably you need to soldering the + - outs into the mainboard connector)

  1215. Comment by links2007:

    when i solder the wires in place, my tp T40 dosent display, en when i remove the connevtion from the chip, it displays to the password screen, is their sm thing wrong, am sure i Did it by the book… any one knows of a way around this?

  1216. Comment by Simon Williams:

    Thanks very much for this. Worked great for my old T20.

    Issues I encountered:
    1. The chip in the T20 is the 14 pin version, and is under the RAM cover.
    2. “Eeprom not available”- poor connection to the chip, or no ground (what I thought was ground turned out not to be).
    3. To get the password to show in the IBMPass program, you have to click the A->A button in the top left.

    Thanks!
    Simon

  1217. Comment by saam:

    hello
    i have x40
    i have done every thing
    dirgram is good
    but its giveing the error
    168:0
    170:128
    and then it says done
    when i go to the directory there is a file created name 02.ob
    i open it in ibmpass softwre
    but there is nouthing read able…dose anybody help me what should i do next
    i have connected correct atmcl

  1218. Comment by saam:

    saam again
    i done every thing , but it dose not read the password…..it says
    wÿ

  1219. Comment by Al:

    Hi,

    I’m interested in trying this.

    Does it work for the standard power-on password ? or just for the supervisor one ?
    (or does it reveal both)

    Would this work if you had a power-on password set, but not a supervisor one ?

    Also, do you need to fully enter the bios screen before running this (or is being at the password prompt enough ?)

    Thanks

  1220. Comment by mike:

    believe it or not i was able to erase the password on the ibm r40, when i was soldering SDL and SDA i put too much solder and fused both pins together, then i turned on the pc, and dead, nothing,, then i cleaned the mess i created and turned on the laptop, and went to the bios and boom! password gone!!

    try it for yourselves!

  1221. Comment by klok:

    i removed the power up password on IBM TP R40 not by using this method but by putting one dipswitch on the motherboard to down position. i then entered bios and set power up password to none. power down dipswitch back to up position

  1222. Comment by KG:

    I followed the instructions here and successfully created the dump file from the ATMEL chip on a X23. When I went in to IBMPass and read it, it was gibberish. After enabling translation, the characters at 0×330 were readable. The only problem is that what appears is “9-QQ” (without the quotes). When I tried to type this in to the X23, it would not accept the “-”. So it seems special characters aren’t allowed for the password, yet there it is, in the dump file, at the right location. Any ideas?

  1223. Comment by KG:

    Update to my last post: This time, I disconnected the CMOS battery prior to start up and left it disconnected. I started up the system, hit F1, waited and then did the dump. This time, at 0×330, was a different set of characters. I typed this in and it worked! So if you are having success getting the dump, but the data you find(after clicking the translation enable button in IBMpass) doesn’t work as a password, try unhooking the CMOS battery.

  1224. Comment by Angel:

    Hi I have a lenovo thinkpad R500 and I get the lock and can not remember the password this can be done to my notebook too.
    regards

  1225. Comment by ikorangedane:

    This worked great on my T42, thanks!
    If you have problems w/ “EEPROM NOT AVAILABLE”
    - don’t panic, check your connections with the diagram to make sure it correct
    - and make sure resistors/diodes is correct

    If you cannot read a dump.bin file
    - try to switch button “AA on/off” at top on IBMpass 2.0 Lite program

    brgrds.
    ikorangedane
    golden host, cv.
    jakarta-palembang
    indonesia

  1226. Comment by Steve:

    How do I do this procedure for an X41 Think Pad? The ATMEL chip is not the same as in the original post. Thanks

  1227. Comment by Angel:

    Hi I have a ThinkPad R500 and find the bios chip to unlock my notebook someone knows where you are.
    regards

  1228. Comment by Bill:

    I made the chip reader and I have connected the chip reader to my spare PC. I have tried everything I could to get program to dump. Still nothing. I have run the test and found that the SDL and the SCL keeps going in and out after the clock started. Could use some help. Thanks, Bill.

  1229. Comment by fons:

    Hi, great post m8.

    I want to recover my bios pw from a x30.But where can i find the bios chip on the mobo?

    Thanks anyway

  1230. Comment by Hexafoot:

    Work like a charm… THANKS

  1231. Comment by Hacking IBM Thinkpad Bios Password | Multanstore Blog:

    [...] stuff you need cost about 5 $ at your closest radio shack type of store. Also you need a spare PC with a serial [...]

  1232. Comment by Wow:

    AWESOME!!! Worked like a charm.

  1233. Comment by [Vând] Laptop IBM Thinkpad A22p - Computer Games Forum:

    [...] (daca o ai pe aceasta poti intra in BIOS si scoti orice alta parola) se poate recupera si asa: http://sodoityourself.com/hacking-ib…bios-password/ am verificat (pe un R51) si merge [...]

  1234. Comment by derraji:

    عندي حاسوب محمول من نوع (IBM ( type 2645
    أبحث عن bios password
    est ce qu’il ya quelqu’un qui peut me donner la solution merci

  1235. Comment by ranjeetrija:

    I have ibm thinkpad A31 laptop, i open my laptop but i didn’t find atmel 24rfc8 eprom ic for reset bios password in this model which nember is the eprom ic anybody tell me please……………

  1236. Comment by Cameron Morgan:

    I need help, because I have an IBM Thinkpad and everytime I turn it on, it has a hand with an X across it, a lock on it and 3 X’s. I’m trying to figure out the default password for my R51 Thinkpad the 2888 series.

  1237. Comment by Angel:

    hi anyone knows how to do for a blocked R500 lenovo supervisor password.
    regards

  1238. Comment by junkgood:

    hi there, i got problem with my t43..
    i forgot the password..,i have no idea to follow your method because everythings difference..actually this is my first time facing problem like this..hope u can help and guide me the way to solve my problem…your cooperation are highly appreciated

  1239. Comment by Adam:

    I tried to dismantle a TP T61p but could not find the ATMEL chip, and ended up busting the display somehow. I don’t know what exactly happened but the screen seems to be getting power but remains blank, the usual ThinkPad logo no longer shows up. Did I fry the video card in the process? Or is it just a connection that went loose? I have no idea!… Any suggestions?

  1240. Comment by vaska:

    firstly sorry for my English. secondly hello.
    I have an IBM t41 worked up a month ago, I installed and reinstalled windows 3 times in two years (since I bought). started to reboot and tried to reinstall the OS and the next second to display error and it asks password. I followed the steps described by you and show my f 0 * 330 2. I tried but … Please help me.
    Basil yours.

  1241. Comment by John BOB:

    Hello people!

    A question,

    IBM T22 900Mhz 256ram
    R30 1000Mhz 128ram

    Can anyone tell me which is the one to keep and which to get rid off?

    T22 is faster and plays video better but it’s case is weak and has cracked on right side.
    R30 seems significantly slower with videos, very stop start not sure if just because of 1/2ram, but is very good structurally.

    Thanks!

  1242. Comment by vaska:

    hello.
    I have an IBM t41 worked up a month ago, I installed and reinstalled windows 3 times in two years (since I bought). started to reboot and tried to reinstall the OS and the next second to display error and it asks password. I followed the steps described by you and show my 0 * 330 f 2. I tried but … Please help me.
    Basil yours.

    I need help

  1243. Comment by Jack:

    Hi Guys,
    Do You know if this procedure will work with Thinkpad X301 ??
    Does anybody solve problem with x301 password ?

  1244. Comment by vasile:

    hello.
    I have an IBM t41 worked up a month ago, I installed and reinstalled windows 3 times in two years (since I bought). started to reboot and tried to reinstall the OS and the next second to display error and it asks password. I followed the steps described by you and show my 0 * 330 f 2. I tried but … Please help me.

  1245. Comment by Stilicho:

    Hi all

    I need to know if there is someone in the Toronto (Canada) area that might have a Key Finder rady to work that would be willing to give a hand for a T22.

    Preference would be given to someone with the Key Maker 9A USB as it seems a lot easier to use.

    I live downtown, close to the City Hall and I have severe travel restrictions so please let me also know your whereabouts to see if I can reach you or you can meet me in the City core.

    Please let me know.
    All the best

  1246. Comment by luis:

    i can´t use dos , so I´ve typed cmd … then comes dos …

    c:\documents and settings\pc1>

    what shall I do next to find the files installed ?

    Don`t know type dos …

    someone could please help me …

  1247. Comment by SUPPADUPPA:

    Hello can someone tell me how to write to the chip with this circuit because all i keep getting is error at line…errors

    Any help would be great

    Thanks

  1248. Comment by Thinkpad not booting due to hard drive password - Portable Devices:

    [...] unless you have a high level of computer hardware knowledge and ability. The instructions are at; http://sodoityourself.com/hacking-ib…bios-password/ , otherwise take it to an IBM repair facility and have them do it for [...]

  1249. Comment by Kaliber69:

    Hi on my Chip is: ATMEL 24RF08CN and the number 0350.Can i read the SVP?

  1250. Comment by Simeon:

    Hi!

    I have T30 (secure chip?) and it ask Password when try to bios or normal start. I have readed Atmel and I find password but it wont work when I try to input it in field? Do I need to write something back to Atmel also (remove password in hexbumb?) Please help.

  1251. Comment by Simba:

    MINE WAS DAVID!!! T27 Try that first.. the T27 is at the memory bottom leg is one and skip one leg and the other is right above.. I used a pic programmer I had for reading Xbox eeprom..not even sure the value,… experiment.. If it say error reverse the 2.. ground can go anywhere

  1252. Comment by Antje:

    May sound silly but how is it possible that so many people wind up with TPs of which they don’t have the Supervisor password.
    If it is your employer’s TP you are likely not to know the password and if you buy it used and it is without password it is likely stolen. IBM better updates the technology to put the serial memory in the PCB itself or a UART part such that is has no RxTx lines on the outside.

  1253. Comment by Miki:

    trying this method I’ve broken one leg of 24rf08
    And now I bought new 24rf08 and now I need a dump to put it

    Do any of you have to dump my laptop

    IBM R50e

    Type 1834-EG1
    S / N 99-VXWK6 05/04

    Please !

  1254. Comment by Trajko1984:

    Yes and i need the dump for

    R50e

    Please give me

    Just send me the file dump.bin for my R50e

    Dump.bin can be with password but i will find password with IBM Pass Lite 2.0

  1255. Comment by Adrian:

    okay guys i found i new way to reset the pass with only a screwdriver …

    will try to make a site with a tutorial to reset the tmp chip .. i think it works on every ibm notebook

    here is a picture from an IBM X41 tablet i reseted the pass today

    http://ug1.kw.cx/ug/0257/1549/123784929_full,r,470×470.jpg

    you have to put the screwdriver between the 2 pins to contact them .. and now power on ya machine and go to the bios … you will receive a message with an security chip error or something like that
    this chip was on the bottom of the mainboard … i think the T Notebooks (T40 , 42 , 43 , R50, R51 have the chip under the touchpad

    will share this here for ya guys
    i trade with used computers so you have to try many thigs to delete passwords ^^

    The same way to delet passwords on DELL (D610, D600, and many more)

    greetz Adrian

  1256. Comment by romano from Italy:

    thankyou… it work fine for me…. my notebook is reborn!!!

  1257. Comment by albert:

    hi guys,
    I understand all the schematics. My problem is how can i connect it to a spare pc.
    As i understand it, it will connect using the Serial Port 9 pin Female. But how can i connect it with those connections at the other end. i actually have 2 female serial port, one is mouse adapter and the other one is d sub connector. I just cannot figure out how to connect it to the spare pc. Somebody help me please.

    TY
    albert

  1258. Comment by Jennifer:

    Can this be done if the thinkpad does not have its ddr memory inserted?

  1259. Comment by Adrian:

    i think x41 tablet hast onboard memory

  1260. Comment by Alex:

    Albert, you have to cut Serial cable. Strip the rubber coating to expose thin wires. You have to test which ones are # 4, 5, 7, 8 and solder them to the breadboard according to schematic. The female serial plug goes in second computer.

    good luck.

  1261. Comment by Hi:

    Hi all

    i have this error 0271 check Date and time setting IBM thinpad BIOS password. i got a solution over the internet but please if yo cam give me another idea i will be grateful

  1262. Comment by laptop battery:

    it’s very helpful to me, I have a x60 laptop and meet the same trouble.

  1263. Comment by vgp-bps9:

    May sound silly but how is it possible that so many people wind up with TPs of which they don’t have the Supervisor password.

  1264. Comment by limo in dc:

    yea sounds prety gud..thx

  1265. Comment by reginald:

    i can’t break the password on IBM A30 laptop
    i want u to send the process in my email :rooboy2009@yahoo.com

  1266. Comment by Hassan:

    Hello Dear…………….

    I have Think-pad R31 It has supervisor password that i forgot I tried to clear CMOS/BIOS by short circuit with jumper but still it ask me every time to change date and time and not booting. I am really exhausted. Please help me.

    jimdanial007@yahoo.com
    Hassan

  1267. Comment by Mada:

    I have R32 IBM think pad but the supervisor password is blocked and I have went to IBM service to check it but can’t help. Could you please guide me how to reset the password? Thanks

  1268. Comment by jc:

    i used a gateway restore cd, i bought ten ibm thinkpad r40’s i read i would have to gointo repair and i didnt have a ibm windows xp restore so i put in the gateway restore cd i didnt even have to goto repair just put it in went right to windows xp i changed the password like wow because i had been trying all day to bypass everything i read didnt work got lucky i guess it sure saved me alot of trouble

  1269. Comment by frog:

    The simple machine worked very fine for me. Thanks

  1270. Comment by magneticblue:

    will this software “rf2408.exe” recognize the connection of “USB to COM port cable”? i dont have any com port in my spare laptop.. i also managed to remove the battery of T42 but nothing happens, still asked for bios password., help and thanks in advance.

  1271. Comment by Tomasas:

    Thank you! I restored my T23. Great work, it is very useful.

  1272. Comment by Imran Ali:

    i have already thissolution with w24rf08 registered.
    now i need for latest solution for ibm centrino .core duo . core 2 duo
    if you r have any latest solution then plz mail me.

  1273. Comment by Jason:

    Will you know the way to hack W510 BIOS SUPOR passwords?

    cheers

  1274. Comment by magneticblue:

    my IBM T42 bios password has been decoded,.. thanks a lot to the author.. even 4.5 volts zener diode still works. but my HDD password is not same to BIOS password. bad luck! have any of you guys know how to decode password from HDD? it would be a great help. it is difficult to buy 2.5 IDE HDD right now, most of them already use SATA cable.

  1275. Comment by Michael:

    Has anybody done this with a X60 Tablet (or a regular X60)? If so, maybe we can get in touch!

  1276. Comment by gs:

    I request Ur service / advice/help for remove supervisory password of my laptop. Ican pay pl contct me on the Mobile or leave Ur Mobile No by email. So that Ican call You for discuss the issue

    gs

  1277. Comment by Dave:

    I tried on my T30 but the tp.bin file is only 128 Bytes as opposed to 1KB. Is this expected? If so, which characters are the password?

  1278. Comment by ogpaomar:

    jala con madre muy recomendable gracias te debo como 250$$$ o sea la mitad de lo que voy a cobrar jejejejej

  1279. Comment by Rene:

    Anyone out there that can help me with SVP i dont now anything about teknic
    so it must be some password ore a way to get the old one out of the bios Ore the Power on PW I tryed to remove the back up bat it dint help
    thanks
    zagget@gmail.com

  1280. Comment by Get past admin password:

    [...] sorry i found the website but its for IBM http://sodoityourself.com/hacking-ib…bios-password/ i also found this dunno it that helps http://www.go4expert.com/forums/showthread.php?t=114 if the [...]

  1281. Comment by Hans Kuiper:

    HI Victor,

    Excellent service!

    Trying to recover my T40 bios password but faced problems……

    I did build your circuit corectly but had to connect it via the printer port of my Technican PC a T42 which has no COM1 connector. Is this a problem?

    Anyhow it keeps saying: circuit not found / bus error

    The SDA/SCL output remains on 1.08/1.75 Volts despite clock switching with ITESTER. Is the COM1/printer converter the cause? Should I use a desktop as master PC?

    many thanks

    Hans / the Netherlands

  1282. Comment by alireza H:

    I have Think-pad R51 1830 BMG
    Thanks a lot for this. Worked great for my old T51.

    I made an electronic circuit on breadboard and connected it to com1 to another pc.
    My svp was “CO2X077″ .
    if you have any question , i will be happy to answer .

  1283. Comment by Tariq:

    please tell me how to reset my IBM THINKPAD A30 Password please help

  1284. Comment by Dieygo:

    Nice article and i can see many people got help.

    <<>> Actually i didn’t, it was my father

    i need to unlock IBM thinkpad Z60m

  1285. Comment by Dieygo:

    DON’T BUY IBM LAPTOPS

  1286. Comment by Praveen:

    i made the max232interface but showing eprom not available, pls help
    mine is R51, i crosschecked the ic and connections all seems perfect
    plx help is there any comport settings to check?

  1287. Comment by hamlet:

    Thanks for the hack info.

    Got problem like EEPROM not found, because I connect SDL SCA before turned on the laptop.
    So I cut the cables, and re-connect it when laptop is ready.

    1. Turn on your ThinkPad with all the wiring you just soldered.
    (wires, only wires. Dont connect directly using the wires from your schematic)
    2. Press F1 during the startup to enter the BIOS.
    3. Wait untill all activity stops, blinking HDD leds and such.
    4. Connect the ATMEL Chip reader. GND first then the SDA and SCL. (connect the wires in order)
    5. Now go to your spare PC and Hit enter on the command prompt.

  1288. Comment by GEE:

    HI IT WORKS WITH R51. THANKS A LOT :) :)

  1289. Comment by Siavash:

    millions of thanks, it works perfectly :) T41

  1290. Comment by Christopher:

    Does anyone know if this works for the T61p? My ATMEL chip reads

    AT97SC3203
    1.2.0.09
    7F0208
    0746 X PH

    The chip has 28 points. Please help

  1291. Comment by Clifford:

    I have an IBM thinkpad R51 that i haven’t use in a very long time i forgot the bioss password. can anyone tell me how to access my old password or disable it?

  1292. Comment by mismoman:

    can the “BUSTED” ATMEL 24RF08 Chip be replaced?

    hello everybody i have this problem with my IBM R50e. my tech friend tried to revive my beloved R50e…we have seen this forum” Hacking IBM Thinkpad Bios Password” and did follow everything…. but it seems that the so called ATMEL 24RF08 Chip was accidentally short circuited… and when he booted it up again…. it just beeped several times and no more display came out…. can somebody help me with this please… thanks and mMerry XMAS to all.

  1293. Comment by Muff:

    It worked for me - i managed to read it from an old ibm a21p ;-)

  1294. Comment by Daniel:

    My x200 got busted cause i flashed the Bios without removing the SVP and now i looks like it gots into a TCPA lock :(

    Is there a way to rewrite the Bios properly?

    Thanks Daniel

  1295. Comment by Le Chameau:

    Here’s a way to reset the BIOS SPV password for an IBM Thinkpad T30. NO NEED FOR ALL THAT WELDING AND ELECTRONIC CIRCUITRY STUFF! KEEP IT SIMPLE! Thanks to the message from El Professor on May 4th, 2008, on this thread, for sparking the idea, further confirmed by Adrian on July 22, 2010.
    Open up the computer to find the 8-pin ATMEL 24RF08 chip. On the T30, it is under the memory slot closest to the edge of the computer, towards the left.
    Before turning on the computer, short-circuit pins 3 and 4 with any metal object. On the T30, with the memory slots close to you and the display hinge away from you, these pins are the two top-right on the chip. I used an open paper clip, insulated at one end just so I would not touch the metal during the procedure.
    Turn on the computer.
    When the boot screen comes up, press F1.
    When you see the small lock, simply press Enter. (Apparently, you may have to repeat pressing F1 and Enter once more - I did not have to).
    You are now on the Setup Menu (remember that you are still short-circuiting pins 3 and 4).
    Go to the Password section. If you see that the Supervisor Password is Enabled, press the up or down keys until you see that it becomes Disabled (I did not have to do this as it was already marked Disabled).
    Once you see that it is disabled, select it and it will ask you for a new password.
    At this moment, remove the object that is causing the short-circuit, type in a new password (e.g. 123456) and retype it in the confirmation field.
    Save and exit. You have now reset the password to whatever value you entered.
    The computer will reboot.
    At this point, you may wish to return to the BIOS and disable the SPV password if you don’t care to have a password set.
    I do not know if it is possible to simplify this procedure and simply disable the password and not set a new one. I did not try that. But this procedure sure beats dumping memory. :-)

  1296. Comment by Joe:

    Hi, I just built a simple programmer, and run r24rf08, I get a file, r40dump.bin in my computer,
    but when I run IBMPASS, I found the all data are Zreo in the file. Could you tell me how to solve this problem? I also have 2 errors message when I press on F1 during the startup to enter the BIOS.

    Error 0271 - check date and time setting
    Error 0176 - System sercurity.

    can you please help me?

  1297. Comment by Christian:

    Hello,

    The description and also the little programmes are great. I opend a old T42 and T21. Thank you very much, because they can now further used and go not to the electronic trash. Good for the enviroment :)
    Now some help for the others.
    14 Pin Chip is Pin 6 ground and 8 SDA / 10 SCL to connect the self build interface. !Difficult to solder! The 8 Pin Version is Easy to solder on the contacts.

    Second result. Please mention in the Guide that you have to press the Translation function in the ibmpass program to see the password. (It is the AA function on top of the results)

    Any way a great help that you offer
    Thank you very much

    Chris

  1298. Comment by Abbas Ali:

    if any like i have bios master password
    can email me his detialz on my email address … i will provide him bios master password
    “a_a_lovly@hotmail.com”

  1299. Comment by Denys Martin:

    Hi friends!, I am from Argentina and I want to take the password of my notebook IBM T43. Would you like to help me please¿?. Thanks. My e-mail is elkartuxeneize@live.com.ar

  1300. Comment by Juan Alberto:

    From Mexico.. It worked like a charm. I love you man, thank you!!

  1301. Comment by ThePatV:

    To Le Chameau:
    I really want to try this your way. I don’t quite understand the shorting out you are doing though. Did you use 2 separate paper clips, one for each pin, making sure the other end of the clips don’t touch any other metal? I’ve done something similar on a toshiba but was suppose to touch metal, shorting it out. Or are you using one paperclip touching the two pins to each other?

  1302. Comment by nce12gh:

    lenovo t400 flash pinouts please….

  1303. Comment by Thomas:

    Hey, could someone tell me what’s the password in this picture? I did everything step by step and this is what I got and I’m not so sure if I did right.

    http://imageshost.co.uk/show.php/1816_untitled.JPG.html

    Please help.

  1304. Comment by Thomas:

    Me again. If anyone know how to decode the data in the pictures I uploaded please send me an email: tdcharming@yahoo.com.
    thanks.

  1305. Comment by shahid:

    ibm t43 bios passworr

  1306. Comment by abe:

    in the diagram the blue line that goes in the serial port in the 8 slot what wire iss that? can some one please clarify.

  1307. Comment by mao ning:

    I did all the steps for my T42 Thinkpad. And it gave me the password of “fL”, small f and big L. But when I used this password to enter BIOS setup, it never recognise it as right password. Can any one tell me what this reason is?

    Thanks!

  1308. Comment by baltazar:

    My bin file is epmty all zero Please help

  1309. Comment by Greg:

    Hello All,

    I have a locked ThinkPad x300 that my friend sent me. Has anyone tried this with a model as new as the x300?

    After searching around it seems like they might have switched to a different type of chip? A SuperIO.

    I will be looking into this more soon, and will post what I find out, but if anyone has any pointers, please let me know.

    Greg

  1310. Comment by Jake:

    Hey all

    DONT SEND UR LAPTOP TO ANYONE U DONT KNOW.

    They just want to steal it…. u will never see it again.

    And by the way, Dont try to solder in your laptop if u havent done it before…u will be sorry.

  1311. Comment by Thomas:

    Hi everyone.

    Thanks so much for this site. I’m trying very hard to decipher my T60 SVP, but I’m not very good with schematics, and I don’t really understand the schematics for the interface of the PC8394T.
    Can anyone help me with this, and maybe draw a simplified version like in this DIY??

    Thank you so much in advance..

  1312. Comment by billy:

    i need help to hack my t30… im try the diagram in the site and i dont know what worng…
    answer my to this mail and ill semd you the pics of my bios and my wirng…
    thanks,
    billy

  1313. Comment by Ron:

    Worked great on my t22. Thanks to all.

  1314. Comment by Fred:

    I’m in the process of unlocking my X40 laptop. I found the chip on the bottom side of the mainboard, by the PCMCIA cage. There was also another 2 Atmel chips, one on the bottom and another one at the top of the mainboard. This one is labeled ATMEL AT97SC3201. Some digging on that reference showed that this is the actual BIOS chip, where the BIOS program is installed, but the actual password is stored in the ATMEL R24F08, both of them work in conjunction. To solder the wires, I used small wires and before soldering them, I dipped them in FLUX, also put a tiny bit of FLUX on the legs of the atmel chip to be soldered. Once fluxed, I dipped the wires on melted solder and this “tinned” the wires, making them a lot easier to work with. The tinned wire was then put in position and one touch with the solder iron did a neat connection to the corresponding leg of the atmel chip. I’m now waiting for the resistors and diodes to arrive in order to put together the rest of the asembly. My advise to anyone doing this is to TIN THE WIRES BEFORE ATTEMPTING TO SOLDER.

  1315. Comment by dfrecarey:

    Many Thanks it works at my tp21

  1316. Comment by Bri:

    SPV password recovered. Awesome set of instructions!

    In my case, I didnt’t solder onto the EEPROM, but instead held the wiring in place with thin masking tape. Using a magnifying glass, was able to press the wires to the EEPROM connections to make good contact.

    Didn’t solder the earth either, with a good length of stripped wire wrapped aroung the harddrive chassis.

    When at the SPV password prompt, then hit the enter key on the PC running the reader software.

    In the IBMPass app. Ensure to click ‘AA on’ (top left of App window) to change the format to readable text.

    Many thanks & all the best.

  1317. Comment by akon 1er:

    hello I would like that to help me get a universal code for my IBM T20 my bios is locked. thank you in advance

  1318. Comment by Thomas:

    Has anyone hacked the T60 SPV? I’m still trying to understand the schematics for the interface of the PC8394T, but I’m not that experienced with this kind of diagram.
    If anyone has hacked the T60 using the PC8394T interface, could I possibly get a picture of your interface? Just to help me understand the schematics..

    Thank you in advance

  1319. Comment by Ganesh:

    Hi thankyou for the person who have provided this solution, Great you are the best*
    I challenged to my friend that this password will be easily removed by removing the CMOS battery i told and taken this Laptop IBM Thinkpad 570E to my home, i strugled to remove the password, then i found this solution and did the same procedure and worked for 2 dys and finally did the same and got the password and it working
    icoudent believe that i can do this this

    Thankyou for the solution Dude

  1320. Comment by joe:

    Anybody out there? I split my 240x and on the underside of the motherboard see a AMTEL F 24rfdcn .0007 Is that the right chip, I don’t see any other AMTEL’s.. And I have Radio shack IN4733A 5.1v ZENER Diodes, 5.1v , 49 mA, max pwr disp 1.0W….
    is that a suitible sub.
    Can’t wait to try to put this together with leads hanging out from bottom of M.B. Should be fun…
    J

  1321. Comment by joe:

    Make that a ATMEL F 24RFD8 CN .0007

  1322. Comment by IBM LENOVO T61:

    I CANT FIND THE ATMEL CHIP WITH THIS 24RF08,THE ONE I SAW IS ATMEL AT97SC3203, AND ITS THE ONLY ATMEL CHIP ON MY LAPTOP,I HAVE RIPPED THE BOARD APART, AND THERE IS NO OTHER CHIP, EXCEPT THIS ONE I SAW ABOVE. pls i need help seriously bcos my laptop is locked and i really need to unlock it.anyone with useful help pls mail me,at kelvinking4life@yahoo.com

  1323. Comment by Mike:

    I was also told that you can remove the chip and let sit for 5 min. then re install and this would clear password. Might try this later let you know how it went.

  1324. Comment by Cokes:

    Yo, un humilde chilenito logre leer la EPROM de mi Lenovo T60 y desencriptar la SUPERVISOR PASSWORD.

    Saludos de desde Chile, y gracias por el manual que me ayudo de mucho

  1325. Comment by ahmed:

    hello can i ask you for my lenovo t410i
    i wont to restore my old bios password or read

  1326. Comment by ahmed:

    hello can i ask you for my lenovo t410i
    i wont to restore my old bios password or read it’s eprom
    thank you for all

  1327. Comment by Abe:

    Hi, I have the TP A20M. need help to unlock my computer. appeaser@mail.com. Thanks.

  1328. Comment by flavio:

    boa noite!!! a placa do meu noot é diferente da mesma á cima , por favor como faço p/ desbloquea-lo obg e fica com Deus

  1329. Comment by Mike:

    Just unlocked my X32! Took me a while because I soldered the 9pin connector incorrectly (as stated in the feedback before). Therefore, watch out - the schematics can be a little missleading if you dont check and compare the numbers on the connectors with the wires you are soldering!
    If it works, it works like a charm! Perfect! Thank you!

  1330. Comment by Mouradisback:

    Thank you very mutch … worked as a charm for me !!

  1331. Comment by Hendra:

    I was really happy when I found your page about hacking ibm-bios password. But when I start doing this, i can’t find ATMEL 24RFC8 0446 at my notebook TP T410s, can you help me.. Thanks before. Hendra

  1332. Comment by Alexander Wetzel:

    Password recover and change or remove unknown or forgotten Passwords for ThinkPad™
    Repair of CRC Errors for ThinkPad™
    I can clear your Supervisor Password even if TPM has been enabled (all ThinkPad models except SL400 and SL500 series).

    Mail me at aw@edv-wetzel.de to get instructions.

  1333. Comment by farooq:

    helo dear this was a big effort i appreciate but i need solution for lenove R60. if u can please help or suggest.
    thanx

  1334. Comment by Mat:

    Hi. I can’t finf any atmel chip on my board. I found 3 PIC 3253Q (16 leads).
    Please help.

  1335. Comment by Daniel:

    Thanks to this site I managed to get an old T23 working.
    I got my 13 year old son to make the circuit and it worked first time.
    The only issue I had was that the password contained a letter O and a numeric 0 (zero).
    In the password they looked like identical characters. The letter O was code 0b. The numeric 0 (zero) was 11.
    Thanks.

  1336. Comment by Dilshan:

    Hi - can I replace the atmel chip from another R50e board that doesn’t have a password?

  1337. Comment by Deggy:

    Dear Daniel can you please tell me what the password is for your T23. Thanks.

  1338. Comment by Alex:

    Thank you it work like charm in a G40, In a G40 the ATMEL chip is underneath have to remove the motherboard from the case. I use different diode Zener i used the 1N4733.

  1339. Comment by Alun Msyk:

    plese can u help will this work on the SL510 LENOVO THINKPAD

  1340. Comment by Haalbir:

    Hi,
    It is impressive job…can i do it for my thinpad t410

  1341. Comment by Afo:

    Can anyone help decode the password from this (everything inside the inverted commas)?
    “9 *1+ ,” (nine,space,space,star,one,plus,space,comma). I got the dump successfully, if I’m correct thinking it is HEX code then the values from 0×338 (and repeated in 0×340) are: 0a 87 b1 37 4f 4e 73 33.

    Would appreciate if someone can help. I have done this for another laptop in the past but this time it isn’t so simple it seems!

  1342. Comment by Guillaume:

    Bonjour, je n’ai pas de prise db9 sur mon ordinateur comment puis-je relier le montage fais sur mon r51? est-il possible de le faire par prise usb? merc

  1343. Comment by TSHIBAMBA:

    j’ai un problemesur mon ordinateur IBM R32 serie, dont un message me demande de regler avant tout la date et l’heure avant son oureture, que faire à propos?

  1344. Comment by TSHIBAMBA:

    code 0271 incinnu, d’où la machine ne s’ouvre pas, Marque IBM R32 serie

  1345. Comment by Daniel:

    hey folks
    i just used the solution from Le Chameau with a T42r
    i had to do it 2-3 times and then the password was disabled.
    by the way the ATMEL 24RF08 chip is under the wlan card. pin 3 and 4 are at the bottom left.

    here is the post from Le Chameau again:

    Here’s a way to reset the BIOS SPV password for an IBM Thinkpad T30. NO NEED FOR ALL THAT WELDING AND ELECTRONIC CIRCUITRY STUFF! KEEP IT SIMPLE! Thanks to the message from El Professor on May 4th, 2008, on this thread, for sparking the idea, further confirmed by Adrian on July 22, 2010.
    Open up the computer to find the 8-pin ATMEL 24RF08 chip. On the T30, it is under the memory slot closest to the edge of the computer, towards the left.
    Before turning on the computer, short-circuit pins 3 and 4 with any metal object. On the T30, with the memory slots close to you and the display hinge away from you, these pins are the two top-right on the chip. I used an open paper clip, insulated at one end just so I would not touch the metal during the procedure.
    Turn on the computer.
    When the boot screen comes up, press F1.
    When you see the small lock, simply press Enter. (Apparently, you may have to repeat pressing F1 and Enter once more - I did not have to).
    You are now on the Setup Menu (remember that you are still short-circuiting pins 3 and 4).
    Go to the Password section. If you see that the Supervisor Password is Enabled, press the up or down keys until you see that it becomes Disabled (I did not have to do this as it was already marked Disabled).
    Once you see that it is disabled, select it and it will ask you for a new password.
    At this moment, remove the object that is causing the short-circuit, type in a new password (e.g. 123456) and retype it in the confirmation field.
    Save and exit. You have now reset the password to whatever value you entered.
    The computer will reboot.
    At this point, you may wish to return to the BIOS and disable the SPV password if you don’t care to have a password set.
    I do not know if it is possible to simplify this procedure and simply disable the password and not set a new one. I did not try that. But this procedure sure beats dumping memory. :-)

  1346. Comment by Luis Miguel:

    hi i need to know which is the voltage that manages not to burn anything thanks.

  1347. Comment by Amish:

    Hi
    I have T23 IBM Think pad
    Will it work on it?

  1348. Comment by Ahmed:

    Hello:
    I have 2 errors message when I press on F1 during the startup to enter the BIOS.
    Error 0271 - check date and time setting
    Error 0176 - System sercurity. The system has been tempered with.
    and i put out the battary of bios to empty th charge but same messege comming need password
    pls what is password no. ?
    tnx

  1349. Comment by Juna1103:

    I have a Question, in the simple schematic in between the two resistors, there’s a blue line going into the 8 pin hole. What is that another wire? is it a copper wire? also is the GRN is that a copper wire as well?

  1350. Comment by IELTS:

    j’ai un problemesur mon ordinateur IBM R32 serie, dont un message me demande de regler avant tout la date et l’heure avant son oureture, que faire à propos?

  1351. Comment by Josh Smith:

    Hi there
    I have Lenovo R61i, and I set up bios password for it, but when I did turn back to default setup it keep asking me password, I try to find bios chip in its motherboard but I could not find it,
    Can you help me please?

  1352. Comment by christian from Italy!:

    Hello everybody! I followed yuor suggestions here and there and All of You gave me a very very useful HELP!
    I’ve been asked from a very kind friend of mine to reset to zero his laptop fron his former company but…it was locked and super-locked also with safeguard 4.01..This is about my experience with an IBM X41 2525-63G hacking (if I can say so…).Well, I started with a simple removal of the hard drive (a 60 Gb travelstar) because it was partitioned and only 20 gb where left to user and 40 for the company stuff..I connected it to a portable hdd box and I managed to cancel the hidden partition of 40gb in order to format all the available space in one single 60gb..to do it I tryed partition magic 8 but it was too complicated..(and not free..) so I used the software available under Win7that in English should be something like system tools or administration tools..work was done in less than 10 minutes..Second part was tuff.My BIOS was under fingerprint secure and/or under password and no way to access the bios config to install OS by USB or external CD.Thank to “El Professor” I managed to open the X41..Not an easy game..U must be very carefull and gentle (I have available some pic’s at cbern@libero.it).U must unscrew all the screws in the bottom in order to remove keyboard upper frame an after also the mother board itself.The reason is that on thi PC the famous ATMEL etc..is not him but its name (thanks to janko_wodnik..)is P24S08 and is on the lower face of the m.b..Than I choose to perform the procedure with the scredriver (a small one..)and I managed to find a fakir position to be able to keep with one hand the screwdriver into position and with the other switch on the pc, pressing F1 at startup, entering the bios, make the selections inside the menu etc…But in the end, when I saw my password working I felt like a God!!!After that was very simple to put everything together with all the screws in the right holes (Ibm uses the same kind of screws and there are only 3 kind of them,1kind in the botton and 2 inside the pc and so is very eeasy to remember their positions), the thin cables in the right places..then the KB and the screws in the back…At last I find out that the X41 is capable to support Win7 and all the drivers are available (more or less easily..U have to choose the right one expecially for the Wlan..).Thanks again to all of You..and if U need help just write me cbern@libero.it

  1353. Comment by mahesh:

    Hi is there anyone from Mumbai who can provide me circuit or the password recovery help. I need it urgently. My laptop IBM R50 suddenly start to ask password after RAM upgrade. Please reply me at mahesh_jog@rediffmail.

    Thanks in advance.

  1354. Comment by Luis Sanchez / LIMA - Peru:

    24RF08 on R30. It´s just 01cm. to the left from the white Memory Slot. You must discover a black tape. If you want, I can send you photos.

  1355. Comment by Luis Sanchez / LIMA - Peru:

    My R30 is model 2656. The ATMEl 24RF08 is to the right if you see the White Memory Slot, under a black tape.

  1356. Comment by Josh smith:

    Hi everyone
    how can I findThe ATMEl 24RF08 BOIS chips on Lenovo R61i? Please
    cheers

  1357. Comment by djusee:

    Hello. Is there a similar solution from HP Compaq 8510p?
    Thanks

  1358. Comment by Michael:

    Anybody ever tried it with a dockign station as a second computer? I want to unlock a X32 with the help of a X31 with dock but it doesnt work? The circuit works, tried it last time, but had a regular PC as second PC. Do you think its a problem with the power? Can I hook up a battery to the circuit somehow?
    Michael

  1359. Comment by putra:

    I have serious problem here.. i am using new TP E420 with toshiba hdd.
    Few days ago I set up user and master hd password from bios, but after it was saved I can’t use that same password when I start the laptop. I can’t even enter bios because it will ask the hd password first unless I remove the hdd. Without the hdd, the hd password option in bios is invisible. I’m stuck. Any solution to this? Thanks

  1360. Comment by dean:

    hello every body am here to save all of u from this stress. there is a easy way to unlock ibm.
    first solder a wire and grounds on the ibm motherboard.
    next turn on the laptop wait 54 seconds then use the grounds and toucher the slc on the 24rf08 chip.
    u have to do it like 10 times or more but it will work trust me i pull 8 by my self i figures it out. sometimes the laptop will freez wen u touch the ground on the slc but thats ok just restart thinkpad and do same procedure again

  1361. Comment by dean:

    turn on the laptop press f1 wait 54 seconds as it will change to other super visor password screen to eneter bios u touch the ground on te slc before that screens come on.

  1362. Comment by Nick:

    Please help!!

    I managed to read the EEPROM on X61s but the value at line 0×330 is ËJz±ÚôÎ

    I have pressed the AA button and altered the translation but I am unable to find a password that I can enter on the keyboard, any ideas. I think that the password maybe encrypted.