Hacking IBM Thinkpad Bios Password
Loading ...
Loading ...
Lost your IBM ThinkPad Supervisor password? No problem, on this page i will show you how to recover your old password.
Although IBM claims their TP BIOS passwords are impossible to break, there is a easy and cheap way to fix this.
The stuff you need cost about 5 $ at your closest radio shack type of store. Also you need a spare PC with a serial port.
This article is based on a IBM ThinkPad T42. There are no guarantees and you might end up destroying your TP. So continue at your own risk. Other models this ought to work with are:
- 240, 240x
- 390E, 390x
- 570, 570E
- 600e, 600X
- 770Z
- A20m, A21e, A21m, a22m, A30p, A31, A31p
- G40, G41
- R30, R31, R32, R40, R50, R51
- Transnote, T20, T21, T22, T30, T40, T40p, T41, T42, T42p
- X20, X21, X22, X23, X24, X30, X31, X40, X41
The supervisor (SVP) password is stored in a chip called ATMEL 24RF08.It can not be reset by disconnecting the BIOS battery or shorting any jumper. It has to be read in order to deciffer the password. For this we need some kind of hardware so read on…
Soldering the ATMEL 24RF08 Chip reader
To read this chip we need to interface with it using a secondary computer and some simple electronics. You will need to purchase this:
- 2 x 2200 Ohm Resistors
- 2 x C5V1 Zener diodes (For example BZX55/C5V1 )
- Serial Port 9 pin Female
The serial port can be salvaged from any old PS2 type mouse. The zeners and resistors can be found in scrap electronics, but they are rather cheap so i would not bother. Solder them according to the image below. Leave the wires leading to SDA , SCL and GND. These will be connected to the TP later.
Here is a simplified schematic for those unfamilliar with the above symbols:
Locating the ATMEL chip
Usually the ATMEL chip is located somewhere below the touchpad. Start off by remving the keyboard and mousepad. This is done by unscrewing a couple of screws located under the TP. It is quite clearly illustrated on the bottom side of your ThinkPad.
Pull the TP keyboard up and let it rest against the screen. Pry off the touchpad part and fold it over where the keyboard used to be. Remove the WiFi card.
Under it all you should find a chip with something like this printed:
ATMEL
24RFC8
0446
Heres a closeup of the Atmel chip. Click to enlarge.
You can see the Atmel right under were the Wifi card used to sit:
Soldering the ThinkPad
Now this is the tricky part. You will have to solder 3 wires to the motherboard of your TP. Two wires to the ATMEL chip and one to ground. The ground is a piece of cake, just solder it anywhere you can find ground. The mounting screw holes on the motherboard is a good place. Solder 3 wires according to the image below:
As you can see, the SCL and SDA are located right next to eachother. It can be difficult to hold them in place while soldering. I have used some tape to hold them in place. The tape can be left there to minimze the risk of pulling off the soldered wires during the next steps.
Leave these wires unconnected and make them ready by peeling off the insulation. These will be connected to the reader ciruit later on. Make sure they can not reach ground or short circuit in any way.
Preparing the spare PC
You have made the hardware to read the chip, so now you need to supply the software. There is this great sofware made by http://www.allservice.ro/ that can be found here:
http://home.ripway.com/2005-7/365678/index.htm - Select R24RF08 v2.0b - Reader for ATMEL 24RF08 (Freeware)
While you are at it, download the Supervisor Password decoder IBM Pass 2.0 Lite found here:
http://home.ripway.com/2005-7/365678/index.htm
Also great software made available by http://www.allservice.ro/ .
Note:
Softpedix wrote that the download mirror has limited bandwidth. If you can’t download with the above, try these:
http://www.allservice.ro/forum/viewtopic.php?t=61 – Programmer
http://www.allservice.ro/forum/viewtopic.php?t=56 – IBMpass Lite
Install the software.
Connect the ATMEL chip reader to the spare PC.
Fire up a command promt(Start->run type cmd) and navigate to the folder where you installed R24RF08 v2.0b. Type in (don’t hit Enter):
r24rf08 dump.bin
Dumping the password
- Turn on your ThinkPad with all the wiring you just soldered.
- Press F1 during the startup to enter the BIOS.
- Wait untill all activity stops, blinking HDD leds and such.
- Connect the ATMEL Chip reader. GND first then the SDA and SCL.
- Now go to your spare PC and Hit enter on the command prompt.
Now there should be a file created in the same folder with the name dump.bin. Disconnect all the wiring off your TP and assemble it back together.
Decoding the Supervisor Password
On your Spare PC start the program IBM Pass 2.0 Lite. Load the file you just created (dump.bin). Navigate with the scroll list to the memory address of 0×330. Tada! It should look something like this:
Tuesday, October 10th 2006 at 6:44 pm
Very well written. I would only mention that the download mirror has limited bandwith. The following links are from the http://www.allservice.ro:
http://www.allservice.ro/forum/viewtopic.php?t=61 –programmer
http://www.allservice.ro/forum/viewtopic.php?t=56 –IBMpass Lite
Tuesday, October 10th 2006 at 9:15 pm
Hacking IBM Thinkpad Bios Password…
This dude solderes some wires to the laptop to retrieve a password stored in a chip….
Tuesday, October 10th 2006 at 9:55 pm
Wish there were a way for the T60p
Wednesday, October 11th 2006 at 12:34 am
“Wish there were a way for the T60p ”
Have you checked what kind of chips there are on the motherboard?
Friday, October 13th 2006 at 6:32 am
There is a solution for T60! Didn’t you see the download page?
It points to this:
http://www.serviceforum.lx.ro/viewtopic.php?p=1061#1061
Monday, October 16th 2006 at 6:55 pm
I was really happy when I found your page about hacking ibm-bios password. But when I start doing this, I found hard to recognize this ATMEL, 24RFC8, 0446!! Is atmel on the top of the cpu? Cause there is writen TPC8002, 2C as on many other chips!! and not 24RFC8!! but it has 8 leads! Please help me! Have a nice day, Jernej
Tuesday, October 17th 2006 at 12:34 am
Jernej, you need to find a chip has written Atmel , 24RFC8 written on it. Check above, ive added a couple more images with closeups.
The atmel is located under the CPU looking chip.
Wednesday, October 18th 2006 at 12:28 am
I am doing this for my R40, i found that the amtel chip is actually underneath the motherbaord, between the hard drive and the bottom of the motherboard. i had to completely dissasemble my TP as far as i could go to get at it.
ill let you know how it goes.
Wednesday, October 18th 2006 at 1:21 pm
Tim, maybe you could post a pic of the location of the chip? Then i could include it in the post so others can find it.
Friday, October 20th 2006 at 1:59 pm
Digg this story at digg:
http://digg.com/security/Hacking_ibm_thinkpad_bios_password
Saturday, October 28th 2006 at 4:53 pm
Hi there is realy good what you did, i start doing but get to a stage were i found the the eprom is difrent the only atmel the board got is 16contacts not 8. and the numbers on it are ATMEL / 24RF08CT / 9952. Do you know in what contacts shoud i weld the wires, do the software work the same way??????
Thanks
Nuno
Monday, October 30th 2006 at 12:43 am
Hi Nuno!
Are you sure your 24RF08 has got 16 pins? There is one with 14 pins. however, allservice has got this schematic for the wiring.
Also, what model is your TP?
Thursday, November 2nd 2006 at 8:50 am
I searched for the Atmel chip on the MB of a TP A21m. Found a 14 pin chip underneath the MB near the memory slots. Again, had to disassemble the whole thing to get at it so I guess I’ll have to run the wires out of the case to get it running again. I hope this is the one I need. It is marked ATMEL F 24RF08CT 0042. I will try using the diagram from allservice and hope that I get the right pins connected. I did take a couple of photos showing the chip and it’s location but I’m not sure how to post them.
Saturday, November 4th 2006 at 1:05 pm
hey.
is there any way that I can read the bios password, while im in windows??
i want to update my bios but it requires password, and I dont remeber it?
By the way, its a ibm r51 i’m talking about.
Sunday, November 5th 2006 at 1:48 pm
Hi, i have an old tp570, but not the supervisor password.
i have found the chips Atmel (8 pins like the T42) near the bottom-left corner.
I was done all step by step, and now i have my 1024kb dump.
But the password don’t appear at the address 0×0330. Only Null bytes.
Any help, please ?
PS great this page, thanks.
Sunday, November 5th 2006 at 4:47 pm
According to allservice.ro, The SVP is not set. You have to reset only the power on password, by removing the RTC battery.
Sunday, November 5th 2006 at 10:02 pm
>> Hi, i have an old tp570, but not the supervisor password.
>> I have found the chips Atmel (8 pins like the T42) near the bottom-left corner.
>> I was done all step by step, and now i have my 1024 bytes dump.
>> But the password don’t appear at the address 0×0330. Only Null bytes.
Using IBMpass’s DOS version, the password appear ! Thanks !
Note the password is store with Qwerty english keyboard character set.
Great thanks !
Monday, November 6th 2006 at 11:40 am
Thankyou very much for all of this.
I have an A22M with CRC ERROR (lovly message) because I loose all the information in the eeprom
so it will be great if you find for me the .bin file for the 24rf08 from any ather A22M laptop
even with wrong information .
sorry for my bad English
GREAT THANKS .
Monday, November 6th 2006 at 4:41 pm
I haven’t seen another post in reference to the T21 model, so I guess I’m the first in to try finding the elusive chip. I’m thinking mine must be bottom side like the R40, since I have a complete view of the top with no luck finding it yet.
Anyone else with a T21 done this yet?
Joe
Tuesday, November 7th 2006 at 3:31 am
To everyone following this post!
If you manage to find the ATMEL chip on your TP please email me with pictures of the location so i can put them here for others!
Mail me with your TP Model and a picture with the chip circled in.
Also i would like one original pic(without the chip circled in)!
Mail me at pekka ( atsign ) brevk (dot) org .
Thank you!
Tuesday, November 7th 2006 at 7:23 pm
Way too easy on a T21.
So much for “security”…
Wednesday, November 8th 2006 at 3:28 am
can someone please send me a picture of the actual wiring of the diodes and resistors and how they are grounded (i am not very good in this kind of stuff.. especially reading a schemetics)
thank you
Thursday, November 9th 2006 at 1:21 am
hello there.i built the system. i fould out that the simbol on my screen is a little computer and the command prompt says “Eeprom not available”
can somebody tell me how to get this thing going.
Thursday, November 9th 2006 at 4:36 am
hi all.. can some one tell me if the sketch of the 9 pin female is the back or the front that we see. and also where do you solder the ground.
thank you
Thursday, November 9th 2006 at 8:54 am
The wiring is(DB9 / Technican PC side):
5 - GND
The ground on the ThinkPad side can usually be just about anywhere. For example one of the mounting screw holes.
Thursday, November 9th 2006 at 5:09 pm
Hi, I have a Thinkpad Tp42p and my son put in a password which I forgot. I did all the procedures, and yes I managed to download the dump file, but, on line 330 does not reaveal my password. Please help
Thursday, November 9th 2006 at 6:48 pm
Hello.
I have read this over and over and i still can’t find where you have to ground the Zener diodes and serial port.
The one in the portable is clear.
The ground of the serial port is going on ground of the extra pc ore also to the portabel ?
Thursday, November 9th 2006 at 7:02 pm
Ground is common on the Thinkpad AND the technican PC
Just wire all grounds together:
Ground on the Technican PC DB9 is pin 5.
Ground on the ThinkPad can be any of the mounting screw holes (or pin 4 on 24rf08 with 8 leads / pin 6 on 24rf08 with 14 leads)
Ground on the diodes should be wired to Ground on the DB9 and Thinkpad ground.
DO NOT ATTACH IF NOT GROUNDED PROPERLY!
Thursday, November 9th 2006 at 10:08 pm
Fiezel:
I’m at work and using the T21 I unlocked, so I don’t havce access to the IBMPass program.
I had the same thing happen to me, but I fould that there was a button on the left just above the data from the .bin file that said “somethinorother” OFF. Clicking it got rid of the heiroglyphics and the rows of periods after the memory dump lines. It also magically made the password “Q21WSD” appear following line 0×330.
I hope this helps.
Joe
Thursday, November 9th 2006 at 10:45 pm
Is there any way you could provide more pictures of how the wiring setup is done? I’ve been through electronics classes but it’s been a while, and i just want to make sure i get this right. If you could provide any more information on this i would greatly appreciate it. Thanks.
Friday, November 10th 2006 at 12:03 am
hi all.. Can someone PLEASE help me.. I have taken my TP T21 apart and CANNOT find the Atmel chip can someone tell me where it coul be?
Thank you
Friday, November 10th 2006 at 2:45 pm
Frank:
Put your T21 back together. Turn it over. Remove the RAM access door. Viola! a 14 pin AMTEL chip conveniently hidden under RAM slot 1(closest to the outer edge of the laptop).
ADMIN:
What are the possibilities of setting up different “folders” for specific models? I’m willing to help if I can.
Joe
Friday, November 10th 2006 at 4:06 pm
Joe, i have mailed you.
Sunday, November 12th 2006 at 1:02 pm
Thank you verry verry much.
Thinkpad is up and running again.
Monday, November 13th 2006 at 6:26 am
hello admin.
this is the great thing you guys are doing and i really appreciate it. As my request for bios password for my Ibm TP 40 is been knocked back by IBM saying that it is impossible to recover the passwor and the only option i am left with is either buy another m/b from them that itself is the cost of laptop or dump it in the rubbish bin. but i refused to both the offers. so while surfing i accidently found your site through google. its pretty explanatory on how to do the wiring and other stuff.
anyway my question is regarding the ATMEL chip thats found under the WiFi card. i have done it all dissemble the laptop as i have gone thro this procedure before few times. i did find the chip as shown in the diagram with all the circuits and numbers whatever shown in the photo in the website. but only problem is that its number is different than written above. its written as ATMEL 24RF08 and some other numbers instead of ATMEL 24RFC8 0446. Still got the 8 pins as shown in the diagram and curcuits. looks exactly the same except above numbers. just wanna make sure it works even the numbers are different.
I have IBM TP 40 [(2373PM1) is the model no.] with 1.3 Ghz and 32 MB Video and 768 RAM with 14.1″ screen. any help will be appreciated. and once again keep up the good work.
Regards
funkyboyoz
Monday, November 13th 2006 at 2:44 pm
funkyboyoz , those last numbers are probably just the batch number of the chip.
You´ ve found the right one. As long as it says Atmel 24RF08.
Wednesday, November 15th 2006 at 6:05 pm
Hi,
I have a TP R30. Looking for the atmel chip. all i have found is a atmel 93c46
Is this it? it is also a 8 pin. if not please let me know were to find this little sucker
Friday, November 17th 2006 at 12:10 am
i have a thinkpad R60 and its dssassembled the only amtel chip i can find has this number
Amtel at97sc3203 1.2.8.05 ***** ***** and its a 28 pin chip.
and its located under the pci xpress expansion slot. any help would be greatly appreciated.
can post pics if needed please someone help me!!!
Mike
Friday, November 17th 2006 at 12:42 am
i found a diagram of the 28 lead chip if that helps located here >>>>>> http://www.atmel.com/dyn/resources/prod_documents/doc5010.pdf
hope that helps.
Friday, November 17th 2006 at 4:23 pm
Admin- Will this work or is it needed with the older 760xl series?
Thanks!
Saturday, November 18th 2006 at 9:02 pm
I have a ThinkPad 600X. I opened the laptop but did not find any of the chips you mentioned. Instead I find TPC8002(8 legs).
Please tell me what should I do.
Monday, November 20th 2006 at 6:03 am
Hello:
I was following your instruction on navigating the folder where I installed the R24RF08 v2.0b and IBMpass lite to the hard drive (c drive). Then I type in r24rf08 dump.bin and setting up the wiring and connecting the ATMEL chip reader. When I go to my spare PC and hit enter on the command prompt. It will exit the r24rf08 program as stated in the instruction and the password won’t dump on the dump bin that I created. Can you tell me what do I do wrong? Looking forward for your reply.
Regards,
John
Monday, November 20th 2006 at 8:03 am
Hello:
I have 2 errors message when I press on F1 during the startup to enter the BIOS.
Error 0271 - check date and time setting
Error 0176 - System sercurity. The system has been tempered with.
Is it a problem?
Tuesday, November 21st 2006 at 9:17 am
Hi,
I have found the ATMEL chip on the motherboard and been able to find the supervisor password following your instructions. Thank you very much for the information you provided here.
Santonu
Wednesday, November 22nd 2006 at 3:52 am
Hello, thanks for these guide. I have an R50e notebook and Ive managed to find a atmel chip that seems the one on you are talking about, but im not shure if these procedures will work couse the numbrer is slightly diferent. The one Ive found is an
Atmel
24rf08 CN
0536
Do you think these guide will work for my chip?(it has 8pins and is located just there). finally another question, what if the password is also on the HD? couse i have read that there are 3 types of password SVC, POP, and HD password. It seems that my notebook has HD password and POP or SVC password couse even if I remove the HD there still is a password on boot (before booting) so I cant acess windows or any OS
well if anyone could give me a had my mail is ramironospam&argentina.com
(remove nospam to e-mail me, that is done to prevent automated bots finding my real mail)
Wednesday, November 22nd 2006 at 7:17 pm
i have an T30 and i dont seem to find the atmel chip it may be named othervise any ideas where i can find it?
Thursday, November 23rd 2006 at 5:49 pm
ibm thinkpad T42
i have read the bin file but whene i open it with pass tool password is encoded how to decode it ?
Friday, November 24th 2006 at 12:30 am
I was able to find the password using the dump bin but as soon as I entered onto the laptop, there was a OK signal but eventually denial it ? Why is it that way? What do I do wrong? Looking forward for suggestion.
Thanks,
John
Saturday, November 25th 2006 at 4:22 am
Hi there i am also looking for a picture on how you connect the diodes to the seriel port and how you ground the 2 zener diodes too i have over 10 laptops with the bios password,so i will post back if i have any differeiculties with them.if some1 can email me on be great
Many Thanks
Angel
Saturday, November 25th 2006 at 7:37 pm
Hi i have got a tp 390x but unabell to find the the ATMEL 24RFC8 CHIP . Can anbody please help
Saturday, November 25th 2006 at 7:43 pm
Hi i have got a tp 390x but unable to find the Atmel chip. Can anbody please help
Monday, November 27th 2006 at 1:06 pm
Hi,
The way your explained here, is the only way I found until now. I could buy a new Atmel chip, too. would you prefer this??
Because, I don’t think, that I will find the atmel chip on my T30 2366. hmm I even can’t remove the case
hehe
Can u tell me the place of the atmel chip and scl and sda on a T30 / 2366 ?????
I can see under the mousepad a big chip with intel, but there is one more little board under the mainboard next to the RAMs. I hope u understand it, because my english is not so well. Or do you know any germany websites, where the same thing is explained??
the most important thing for me noow is the place of that ATMEL CHIP and SCL and SDA on a T 30 ??
If there are any pictures, this would be very very nice.
Aaron E.A.
Wednesday, November 29th 2006 at 9:01 am
Hi Victor and others from ALLservice, I admire your devotion to help the community suffering from (or enjoying) TP security and patience needed to answer all the questions, often pretty stupid :-). Among many others, you have saved myself being locked out from my TP T42 after 3 tries to guess the SVP. Worked as charm with the simple interface, I only had to try 2 technician computers (my good old TP 560X could not find the eeprom, DELL C610 could). There is one problem left in my case: How do I get rid of the of the ERROR 0199: System Security – IBM Security password retry count exceeded? It is still there although I turned SVP off… It must be possible to reset this somewhere, isn’t it?
To help the community a little: I also looked at the driven interface and I have 2 ideas to possibly make life even easier.
1. What about using MAX233 (or 233A) instead of MAX232 (A)? MAX233 includes built-in capacitors and you would only need one more (designated C3 in the driven-i2cprog.pdf) which would simplify the circuit design (if I understand it well).
2. For obtaining any of the chips, consider visiting http://www.maxim-ic.com. You can get a really good price there. One possibility is to buy them and the minimum batch will suffice to anybody till his/her last day. What I’d recommend is to order a free sample. Just choose from the many variants a chip package that you can use (a while ago I ordered a sample of other stuff in legless form – not very suitable for soldering by hand). If you do not insist that you get it ASAP, 2 specimens come by regular post completely gratis packed neatly in a little box right to your home (otherwise you pay the express delivery). Know any cheaper source?
I wish you all the best and good luck. JL
Thursday, November 30th 2006 at 1:15 am
So its not possible to get the password this way on a R60 ?????? i’ll just have to frk ove he cash for a new laptop. :S:S:S
Thursday, November 30th 2006 at 2:37 pm
Has anybody already tried this on an X40 resp. can tell me where the Atmel Chip is placed on the board? I searched for it but didn’t find it.
Another question. Im not quite fit about this whole Resistor-stuff. There are many different types of 2,2kOhm resistors. Which ones do I have to buy?
Thanks
Uli
Friday, December 1st 2006 at 12:25 am
@Mike:
You can get rid of the password on a R60 by using the PC8394 Tools from allservice. I saw they just added this model, and I understand that almost all new models can be unlocked with the new software.
Friday, December 1st 2006 at 8:48 pm
Hi
I’m having a similar problem but its the boot password that I cannot get rid of. Is there a way to do this on the TP R40? I’ve disconnected the batteries (both the cmos battery and the laptop battery).
Any help would be appreciated!
Monday, December 4th 2006 at 1:08 am
Please send me the exact diagram with the two resistors and two diodes and the socket 9
9 pin socket I
Monday, December 4th 2006 at 12:56 pm
We Tried and it works well
thanks
Rajesh
Monday, December 4th 2006 at 8:10 pm
Thank you all. Took me less than 30 min to assemble the kit and get my password recovered of a T21. Just fixed another TP X40. Worked like a charm. By the way the chip is located beside the CMOS Battery, You just have to take the keyboard out peel off plastic covering on the chips. Its a 14 pin chip just like a T21. Have FUN guys and good luck.
Take care,
Imran
Tuesday, December 5th 2006 at 7:02 am
any comments on the G40
Tuesday, December 5th 2006 at 8:04 am
@Imran
Sure, that the X40-Atmel is nearby the CMOS-battery? What Type do you have? I just disassembled my keyboard again and found nothing there (Type 2371-79G). But I also read, that on the X41 it is placed on the bottom of the board nearby thy PCMCIA-slot. Maybe its also there on my X40 … I hope so.
Cheers
Uli
Tuesday, December 5th 2006 at 12:58 pm
HI
Does anybody have some experience with Thinkpad A31 model? Forgotten power -on password, should be usually removed by disconnecting backup and power batteries, but in this model it doesn’t work. What is the type of Atmel chip here, and where it is located? Advices will be appreciated. Thanks.
Tuesday, December 5th 2006 at 3:01 pm
To Brian:
Here is a topiuc on G40
http://www.allservice.ro/forum/viewtopic.php?t=380&highlight=g40
Tuesday, December 5th 2006 at 3:36 pm
Aqui tampoco trabaja el metedo de desactivar la baterias ( batery off ) para desactivar el POOWER ON PASSWORD.
AGRADECERIA INFORMACION.
incursion1@gmail.com
Tuesday, December 5th 2006 at 3:42 pm
Necesito desactivar la POWER ON PASSWORD DEL TP A20m de IBM ( NoteBook)
SI alguien sabe como, favor escribir
incursion1@gmail.com
Wednesday, December 6th 2006 at 2:17 am
Hi, I just built a simple programmer, and run r24rf08, I get a file ,mynb.bin in my computer,
but whe I run IBMPASS, I found the all data are Zreo in the file. Could you tell me how to solve this problem?
Wednesday, December 6th 2006 at 11:32 pm
Hi.
My ibm X40 has ath ATMEL Chip number AT97SC3201 with 28 pins. Anybody knows how to attaach the I2C cirruit with this chip? Any help will be greatly appreciated.
Thanx
Mana
Thursday, December 7th 2006 at 8:39 am
@Mana
This is not the right one. The chip you found is the security chip. The password-Chip is the same one all others have (24RF08). You have to keep on searching. Im still not sure, where the chip is placed on the X40. Some say, under the keyboard, nearby the CPU, others say it’s on the bottom of the board near the PCMCIA-slot. When you found it, please tell it here.
Thx
Uli
Thursday, December 7th 2006 at 9:49 am
@Mana
@Uli
Please mail me pictures to the mail above =)
Thursday, December 7th 2006 at 10:03 am
@admin
Of course I do. I’ll get the X40 sometime in the next week and will start with disassembling directly (the circuit is already bulit). Where should I send the pictures to (mailaddress)?
Cheers
Uli
Thursday, December 7th 2006 at 10:05 am
OK, reading helps
pekka ( atsign ) brevk (dot) org
Thursday, December 7th 2006 at 2:05 pm
dear friends who succeded,
could anyone be so kind to post a photo about these wires-resistors-zeners setup?
for dummies in electronics like myself…
i have all the “ingerdients” but i don’t even have idea where the gnd (ground?) wires go
grazie mille,
-chaos
chaos at financier dot com
Thursday, December 7th 2006 at 2:07 pm
@uli
i would appreciate the pics of the circuit and the chip also
thanks and sunny regards,
-chaos
chaos at financier dot com
Thursday, December 7th 2006 at 2:42 pm
@chaos
In this thread there’s a picture of a finished (simple) circuit.
http://www.allservice.ro/forum/viewtopic.php?t=380&highlight=g40
It’s much easier to built, when you have such a breadboard, because you can change the setup quite fast. I also bought a small one here in Germany for 6,95 Euro, so it’s not that expensive.
Regarding the ground wire. On the one side, you solder it to the DB9-connecter to pin5, then you go further and connect it to the Zener-diodes and then to the notebook ground (e.g. to the screw of the VGA-port or somewherer else).
Cheers
Uli
Thursday, December 7th 2006 at 6:14 pm
danke sehr Uli
Friday, December 8th 2006 at 12:04 am
Thank you everyone who have mailed me pictures.
I will try to get them online as soon as i get the time.
Those of you requesting a picture of the actual reader, i have paintbrushed a simplified schematic. I know you wanted a picture but i find it hard to get a shot that is easy to understand.
The simplified picture above in the post is the first draft, so bear in mind that it might have errors, as its late at night were i live, and i make mistakes while tired. Please let me know if you find something that is incorrect!
Also, check out @uli´s link a coulpe post up. There’s some good shots of the reader.
I would also like to mention that anyone with information on other models are free to create their own post here at sodoityourself.com and post instructions.
Friday, December 8th 2006 at 7:25 am
@admin
Your schematic looks bloody good and is definitely easier to understand. Thanks for this.
@the rest
But mayby some more remarks to kill some confusion.
1. Resistors
The 2.2KOhm resistors I bought e.g. have 3 red stripes and not red-red-orange. I also read in the allrevice.ro-Forum that there are different kinds of color-codes for resistors with the same resistance around the world. Just to confuse the people a little more …
I also read that it’s recommended to buy resistors with as less Watt as possible. The smallest ones I got, had 0,1 Watt (1/10). 0,25 and more Watt might be too much (as I read). So try to buy resistors with 0.1W at 2.2kOhm.
2. Zener diodes
Regarding the Zener Diodes. I don’t have to be excactly BZX79. The only important thing is, that they have 5.1 Volt. There are many different types of Zeners, so if you need to buy some, just check that they have 5.1 Volt, the rest does not matter. When you built the circle later then, please remember that diodes have a polarization. This means, that they just work in one direction and when you connect them in the wrong direction, nothing will work. Normally a ring around the diode shows you which way it works. You can also see it in the schematic Admin paintbrushed.
Enough electrics for today …
Cheers
Uli
Saturday, December 9th 2006 at 1:33 pm
CARL:
Did u find the correct chip? I also have a R30. Only ATMEL chip I could find is the 93c46 one. Is this the correct one?
Thanks
Chris
Monday, December 11th 2006 at 11:31 am
ok never mind
found it..
on the R30 it’s located on the underside of the board below pcmcia bay.
Monday, December 11th 2006 at 3:18 pm
also, i used the ibmpass 1.1 command line tool with /a switch to get password from bin dump.
PEACE
Monday, December 11th 2006 at 5:43 pm
Great info, however I’m having problems reading the atmel. I keep getting an error message saying can’t find eeprom. Can anyone help.
Monday, December 11th 2006 at 6:08 pm
@Paul
Check your connections, also what TP do you have?
Monday, December 11th 2006 at 6:52 pm
Hello Admin
Thankyou for all your support. Just located the ATMEL chip on my TP X40 Type 2371. It is located under the motherboard close to the USB port and RAM slot. Its an eight pin chip with this Number on it. ATMEL 93C46. I will try to read the dump today. will let everybody know how it goes.
Regards,
Mana
Monday, December 11th 2006 at 6:56 pm
Hello
It me again. Please ignore my last comment. the actual chip is under the mothrboard directly beneath the PCMCIA slot. It is ATMEL eight pin with this number on it. ATMEL 24RF08CM. Again its a TP X40.
Regards,
Mana
Monday, December 11th 2006 at 11:42 pm
Hello All,
trying to work on my X40. Keeps getting error “Circuit not found or bus error”. I know my circuit is working fine becuae when I pluged the same with another T21 just for a try, it game me the dump file right away and I could read the dump file and the password. I dont know what I am doing wrong in this case (S40). Any suggestions??
Mana
Tuesday, December 12th 2006 at 3:38 am
Hi Mike, the TP is a 390X. I’ll check connections and let you know if there is any difference. Also, for Ian, posted above for 390X, the atmel chip is next to the usb port at the back end, near the power plug.
Tuesday, December 12th 2006 at 4:20 pm
Hi Mike, it was a connection problem. Works fine now. Thanks. If you need pics let me know and I’ll gladly send them in. Again many thanks.
Tuesday, December 12th 2006 at 4:55 pm
There are mistakes in your paintbrushed schematic.
1. You mistaken the SCL and SDA, the red must be SDA and the green is SCL.
2. The color code is wrong, 2.2K=2200=red, red ,red.
Good luck!
Wednesday, December 13th 2006 at 4:31 am
@Softpedix
Thank you, you are so right. I have corrected the pic.
Its no good to read schematics while tired
Wednesday, December 13th 2006 at 11:38 pm
Hi.
I have T30.
Found ATMEL - under the RAM chip.
Soldered fine - have enough of this experience.
Conected. Started DOS prompt.
Had a respond: can not create the file (data .bin file).
What’s wrong?
Could anybody help me? I’m going nuts for the last few days.
Thursday, December 14th 2006 at 12:27 am
Hello… Let me start by saying that I have been playing with, and searching for ways to reset the bios password forever. I have a Thinkpad R40 that used to be a goverment laptop. I have this thing tore apart to do a few little upgrades, with the motherboard totally out of the shell. I found the ATMEL chip under the harddrive caddy. Question is does anyone have a picture out of a R40 that is wired or can instruct me on what needs to be wired and where? Building these things is no problem, but I am kind of leary trying to rewire something so small but what do i have to lose? A laptop that i cant use, lol… I think it is worth it. I kind of understood the instructions, and then i amde the mistake of reading everyones comments, and now im not totally sure. Any help or advise would be great, Thanks!!!
Will
Thursday, December 14th 2006 at 12:54 am
Helo Admin i have find in my Thinkpad 600E the chip Atmel 24RF08CT but with 14pin. please can you write me, which pins are the SCL and SDA?
many thanks,
tonic
Thursday, December 14th 2006 at 1:04 am
To tonic: open this: http://www.allservice.ro/forum/dl/simple-i2cprog.pdf
and you will find all information. Just read forum carefully.
Thursday, December 14th 2006 at 7:07 am
i cant afford 199 to fix my stuff its my laptop for school :S is there no wireing for the r60??? like all the other models shown here ????? can i bypass it manually?
Thursday, December 14th 2006 at 9:05 pm
I have a IBM Thinkpad R30 and it will not hold the date/time everytime I shut down it looses it. I went to Radio shack and bought a new cmos battery, installed it and it still will not hold system time. Any ideas out there?
Thanks,
Julie
Thursday, December 14th 2006 at 9:15 pm
I am having the same problem as listed in every other post about the r40. I wanna know how to bypass my power on password that I never even set or even know how it got there. Ibm wants me to send it in but wont tell me how to do it. My question is…
Is there an easier way to bypass? Do I have to mess with the eee thing? As you can see I have not a clue on what I am doing. Please help. Also I have another question are the passwords all the same a co-worker has the same laptop as I do and is there a way she can get into her programs some how and give me her password. Or if anyone else already reseted theirs and have a password that I may be able try.
Please help I am going Insame and am ready to strangle my teenage daughter!
Thursday, December 14th 2006 at 9:28 pm
Another quick question while surfing the web I noticed some forums talk about Jumpers. Do the ibm R40 have any? I have a power on password problem that I need to clear.
Friday, December 15th 2006 at 2:38 am
I have an IBM ThinkPad 600E with ATMEL 24RF08BT chip on it. There are 14 legs on the chip. I used simple-i2cprog.pdf to connect wires to the chip but with no success.
Can You help me please!
Friday, December 15th 2006 at 8:22 am
Hi Mike,
Started to build the dongle. Cut an old serial cable in half and used the femaile 9 pin. The parts were a total of $2.50 tax included at RadoShack.
The breadboard was a piece thin carton where I punched the holes for the 2 resistors and 2 Zehner diodes. The whole looked terrible but no shorts .
Anyway tried to look for the Atmel Eeprom but could not find it until I noticed that on your list above of TP models the TP23 was not listed. Was this a real omission in your list? So I’am out of luck?
Pls help.
Friday, December 15th 2006 at 8:52 am
Never mind Mike,
I went to the Allservice site and found this:
Locate the eeprom first according to your model (E.g. T20-23 and T30 have the eeprom underneath and can be accessed by removing the RAM modules cover, no need to dismantle the laptop.)
Darn, wished I found it earlier, my whole tp23 is all apart.
Friday, December 15th 2006 at 7:02 pm
This is the next step to revive the T23 my neighbor gave since he could not do anything. The Atmel Eeprom is the larger one . This means too that the contact are closer together and looking at my solder iron I realized that the width is 3 factors wider than the trace. You don’t wan’t to drop solder between the traces or burn a trace because its too hot and start ordering a new motherboard.
So I filed my solder tip conically into a very small tip. Beats buying a new fine tip soldering iron.
I’ll keep you abreast of my project next.
Friday, December 15th 2006 at 7:12 pm
@walter
Don´t you think the taking apart part is the fun part? Now you know what it looks like inside
Good luck to you, and i would really like pictures if you got the time: pekka (atsign) brevk (dot) org .
Friday, December 15th 2006 at 8:12 pm
I located the eeprom on my r40 Ibm. It is on the motherboard under the hard drive. It is a two colored green and black chip. I wanna go ahead and do the whole wire thing but I dont have any idea where to begin or on what side is the SDL /SDA. Someone any one please i am begg’n now.
Thank you.
Also my coworker has the same computer as I do hers is not locked at all nor did she ever set a pass word. Is there a way we can get into her eeprom and see her code and use it to unlock mine?
Friday, December 15th 2006 at 9:29 pm
Hi Jodim
I would not do it the hardware way as decribed here. Too risky. If you short out something or burn a trace you ‘ve got 2 TP’s out of service.
The soldering is very delicate if you don’t do it every day especially with the 14 pin chip. I suggest practicing it first and have definitely a sharp tip. It works great with my old solder iron. Will send a pic also from the chip location. Oh ya check with an Ohmmeter if the wires are not shorted to the next pin before you turn things on.
So just worked on your locked TP. Good luck.
BTW I still have not finished mine yet. Came upon software related problems.+
Friday, December 15th 2006 at 10:21 pm
Thank you Walter for the responce to my cry. I still have no idea where to solder the wires. My chip has 8 pins. How do I find out where to solder the wires on that chip. The manual list nothing about that. I was so excited to find this forum and it’s terrific that we have you men/women to help us dummies out but I am still lost. I see one other person unlocked their IBM R40 too bad he didn’t list the password!!!….
Saturday, December 16th 2006 at 12:19 am
OK Guys,
all the hardware prep went smooth. Followed all the instructions but at the cmd prompt it would not do anything.
had to use dos commands cd\ to get to rootdirectory and then cd\Allservice\dir
and then again cd\Allservice\24RF08
then \dir
then r24rf08.exe /p
it saves the file in c drive under P
went into windows and selected IBMPass20 Lite
opened th p file in C
click on the A to A conversion top left which gave me the above printout and look at line 330
BUT the pass word brought me to OK and after that went into LOCK again.
Help ! what do I do now.
Saturday, December 16th 2006 at 4:46 am
Can Mike or somebody explain how to read the line on 330. Mine read….you wouldn’t guess it …..IBM….twice like on the sample above ……..and all that work I did to get it…duuuuh.
Anyway how do I get through the other stages.
What is the second name on line 340 representing and what can I do with the numbers who are the same like the sample above.
I’m determined to get this lockup problem solved. Right now the score its IBM two - Walter one
thanks for all the help you can give me.
Saturday, December 16th 2006 at 7:32 am
Will you please disregard my instruction on how to use the dos commands.
Victor of Allservice has a better instruction on the Allservice forum. He is the one who wrote the program. Go read the forum if you need the instruction.
Sunday, December 17th 2006 at 2:18 pm
hi
i have a IBM laptop.model no is X21.and its pentium 3.i have a problem with it .i had a bios code in it..so i cannot ON the laptop now ..i want to break it ..so plsss u help me..because i visit ur site..and i think u can help me ..i will be waiting for ur reply…
Monday, December 18th 2006 at 11:55 am
@zohaib
Just read the instructions on the top of the page and follow it. You have to built a little electric circuit and solder some cables to a chip on your notebook. But this is all described on the top of the page. Please read.
Cheers
Uli
Monday, December 18th 2006 at 3:46 pm
hi,
Ive had a readout frome my a20m, but the paswoord is not compleet? What’s with thate?
Mi readout 0*0330 -ob bo-
0*0340 bo—ob
Since you can’t put in (-)? tried the ovious combinations, but nothing.
PS: every readout is exaxtly the saim.
Greets,
Stef
Monday, December 18th 2006 at 9:43 pm
@stef
Make sure you have clicked the button in the upper left corner in ibmpass ( with a little aA label).
Tuesday, December 19th 2006 at 1:58 am
OK guys,
Guess what, I’m writing this on a thinkpad T23 with a locked password my neighbor could not unlock and give the TP to me. Thanks to this forum and Victor of Alservice and $2.50 on radioshack parts an HD from a Compaq which had heatup problems my son gave me I’m now now the proud owner of a pretty good working laptop.
I changed the easy password now. Good luck guys and don’t give up.
Tuesday, December 19th 2006 at 3:26 am
I have a problem. I just followed all instructions on how to do this from this forum and allservice, Well I have the dump file but it is all zero’s. where should I go from here?
Tuesday, December 19th 2006 at 9:57 am
Thanks for youre reply mike. Don that and this was the resolt. So decrypter on but still no clear password.
Greets,
Stef
Tuesday, December 19th 2006 at 11:12 pm
need location of t he chip on TP A31 any help would be great
regards
Scott
Wednesday, December 20th 2006 at 10:10 am
Dear all,
I finally received my X40 yesterday and was so happy, that I can start soldering. So I first took it out of the box, switched it on and saw …. a power-on-password. So I disassembled the keyboard, disconnected the BIOS-battery, waited 10sec, connected it again, switched it on and: I directly work
I’m so disappointed that I’m not allowed to solder something now
Nevertheless, many thanks for this very valueable information.
Cheers
Uli
Friday, December 22nd 2006 at 6:50 am
CAn someone tell me the location of the chip I need to solder? I have an A21m Thinkpad
Friday, December 22nd 2006 at 6:28 pm
Hi,
I am going to try this. Hopefully it will help me as it did for most ppl here. I have found the ATMEL chip on the T22, but I’m a dimwit when it comes to electronics. Can someone please let me know if I’m doing the right thing. I am looking at the schematic and this is what I see visually :
1. Registers are soldered to pin 4 & pin 7 on the Serial Port.
2. Other kind of wires are soldered to pin 5 (GND) & pin 8 (what kind of wires are these ?)
3. The first diode wire is soldered to three (3) wires: the register wire from pin 4; the other wire from pin 8; and the wire coming from pin 5 (GND).
4. The second diode is soldered to two (2) wires: the register wire coming from pin 7; and the wire from pin 5 (GND).
The pic of what to buy doesn’t show that the wires in pin 5 & pin 8 are needed nor what kind of wire they can be. What kind of wires to use ?
For soldering wires to the motherboard, it shows to solder two to the ATMEL chip. Ground is easy but can the two to be soldered to the ATMEL chip be soldered anywhere on the chip or is there specific location on the chip ? And finally, connecting these wires to the circuit, means connecting these wires to the wires from pin 4 & 7 and the ground one to the wire from pin 5 ?
PLEASE HELP … email diagrams or complete instructions & what is needed to majortroubles@hotmail.com
THANKS THANKS THANKS in advance !!
Saturday, December 23rd 2006 at 8:25 am
i have IBM 240X. Ifound the ATMEL chip @ the other side of the motherboard….
following all the instructions… Why is it that there was no file created??? i typed r24rf08 dump.bin hit enter after i have connected the wires to the chip… what seems to be wrong??? I tried to use the patcher.exe it produces error “eeprom not available”…. but i checked out the atmel and it is well connected.. please help me
Monday, December 25th 2006 at 2:02 pm
i have IBM 390X japan model i can’t find the ATMEL chip can you plsss. help me what is the exact chip number of this model…
Monday, December 25th 2006 at 2:46 pm
I tried the above precedure with labtop ibm x40 actualy when i run the program
i received the message ( error eprom not available)
but after i tried several times i was able to enter the setup and I changed the password and the problem solved iam so gratful for the person who put me on the road so for further information fel free to abroach me
Tuesday, December 26th 2006 at 2:26 pm
Hi all and especially owner and writer of Sodoityourself.com.
After having been given a free IBM R61 and using the guide on this site to solve the supervisor issues, i just wanna post a big thanks for the guide and a job well done by the writer. Merry Christmas to everybody, and again thanks. H.Herold Denmark
Wednesday, December 27th 2006 at 7:13 am
I’m writing this on my revived T23. I would like to tell the people who started the project but encountered the several problems described above, please recheck your work. the instructions are correct and clear enough. If you found the eeprom and you have problems understanding the schematics go to http://www.allservice.ro and look for the picture where somebody soldered the resistors (not registers Rob) direct to the 9 pin female connector. Just copy what he did and you don’t have to understand the schematic. Be sure to solder the Zehner diodes with polarity on the right place (black band)
On the soldering I can’t emphasized enough to be careful with soldering. The darn thing is so small and if you don’t have a fine solderpoint vile the point to a conical sharp tip. Use the smallest solder wire you can get at Radio Shack. Do not use electrical or automotive solder wire. Use a magnifier to do the soldering and even hold your breath while touching the solderpoint. before turning the tp check for shorts caused by solder bridges between traces or chip legs and check continuity with an ohmmeter.
The 000 reading or other faulty readings is because you haven’t downloaded any data due to bad connections or shorts.
Good luck.
Wednesday, December 27th 2006 at 4:24 pm
Hello!
I have an IBM T60 laptop and have moved my BIOS password!
Can one help me?
Friday, December 29th 2006 at 5:08 am
Hello Reichel,
help yourself first by reading this forum from the beginning and the one at http://www.Allservice.ro about this subject.
If you have problems understanding any of them then maybe we can help.
Also explain what you mean with ‘moved’ password. Do you just simply forgot?
Walter.
Friday, December 29th 2006 at 6:48 am
Thanks. This worked perfectly on a T41. IBM said we had to replace the MB after a supervisor password was changed by an employee, but this procedure sorted it perfectly. Better than replacing a 1 yo machine!
Friday, December 29th 2006 at 3:28 pm
I have a IbmT42 Laptop, The Password has been given to the HDD I belive, If I Insert the HDD I will not be able to choose the Boot Sequence it will ask for password, If I remove HDD i will be able to enter into CMOS Setup and Can Change Boot Priority. But When i insert the HDD it will again ask for Password. I tried with many Utility Boot Cd But it is of No use. Can you help me to break open the HDD
Saturday, December 30th 2006 at 1:20 pm
Hallo!
Ich komme aus Deutschland, daher kann ich nicht so gut Englisch!
Ich habe auch ein Problem mit Bios-Passwort bei IBM T60, kann mir da einer weiterhelfen?
Geht diese Methode auch bei einem IBM T60, wie oben beschrieben?
HILFE, HILFE :-)))
Thanks.
Saturday, December 30th 2006 at 9:13 pm
Besten Reichel,
Ihre T60 is nicht in die Liste oben fuer diesen Methoden. Aber diese Artikeln ist von
http://www.allservice.ro/forum/viewtopic.php?p=1061#1061
Newer T43/T43p and R52 don’t use 24RF08 but PC8394T-VJG TPM chip.
PC8394 Tools are needed to read this chip .
T60/T60p, R60 and Z60 support is included in PC8394 Tools now.
Dieses is ein kompletes Methode und Sie brauchen nichts zu bilden.
Es kost ungefaehr 100 Euro .
Toi toi toi
Gruesse von Land zu Land
Walter.
Saturday, December 30th 2006 at 9:26 pm
Hi Jon,
I had a locked bios supervisor password and a HDD lock password.
I have been able to unlock the bios password using the description on this thread but need another method to unlock the HD. This method is advertised in http://www. Allservice .ro but cost you over $100. Luckily I had a spare HD from another not working TP.
If you can find an used HD for less than $100 I would go that direction.
Walter.
Sunday, December 31st 2006 at 4:34 am
Hi!
I successfully removed the password from my T30 using the description provided above.
I found ATMEL chip in the area where system memory [SO-DIMM] is installed.
No need to disassemble the laptop.
Excellent experience. Thank you very much!!!!
Dmitriy
Sunday, December 31st 2006 at 7:00 pm
Julie wrote:
I have a IBM Thinkpad R30 and it will not hold the date/time everytime I shut down it looses it. I went to Radio shack and bought a new cmos battery, installed it and it still will not hold system time. Any ideas out there?
Hi Julie,
I know you wrote this 1/2 month ago. My unlocked TP suddenly showed the same problem, possibly caused by putting the TP together not correctly after looking for the eeprom. The problem seemed not the backup battery underneath the main battery but two ‘watch batteries’ somewhere close to the rams. It had loose contacts which I fixed. Its OK now.
Sunday, December 31st 2006 at 7:15 pm
I like to add to this that I did not suspect the backup battery because it had a fixed connector and the watch batteries had spring clip connectors and my problem occurred when I was moving the TP quite a bit. I bend the clips some more for better contact pressure and cleaned it with alcohol.
Walter.
Tuesday, January 2nd 2007 at 1:56 am
i recently bouhgt a used ibm 600e laptop the cmos battery was dead and when i went yo replace it the holder that it plugs into came off the motherboard and i cannot find out where it goes so i can resolder it back on. i did not mention that the cmos battery has two wires on it and plugs into a holder on the board the holder on the board is the one that has came off i have checked all the web sights trying to find out where it refastens but have found none. on the holder it looks loke it has only one solder connection as if the positive and negative side are looped together if so how could a battery work in this manner any and all help would be appreciated on this as i want to give it to my granddaughter after i get it fixed thanks a million in advance Sonny
Tuesday, January 2nd 2007 at 5:17 am
YOU GUYS ROCK. I AM NOT VERY GOOD AT READING ELECTRONIC SCHMATICS. AND I AM NO GOOD AT SODERING. BUT I FOLLOWED THE DIRECTIONS ABOVE AND NOT ONLY UNLOCKED MY IBM THINKPAD T42.. BUT I ALSO ULOCKED MY FRIENDS… EASY TO FOLLOW.. THANK VERY MUCH FOR THIS WEBPAGE LIKE I SAID YOU GUYS ROCK.. MIKE M KWIQ69@MSN.COM
Tuesday, January 2nd 2007 at 7:05 am
Hi Sonny,
Download from the IBM site a free manual for your model where you can find where the battery connector goes to.
If you keep the cmos battery at its place and use the wires as a guide you will find where they came off from. It should look like a upside down plastic U housing with a slot in the middle to prevent the connector from connecting with the wrong polarities. If this plastic U is broken you will still find the two pins usually bent under 90 % from the motherboard.
Use a ohmmeter to determine the polarity. The -side should read zero ohm to any ground of the motherboard or chassis.
The pins looked looped together because when the housing broke it got bent. Or somebody tried to unlock the cmos by shorting the batteries.
Separate them and determine the polarity as described above and if you can not fix the connector housing just solder the batterie wires to it. Recheck your soldering. Good luck.
Walter.
Tuesday, January 2nd 2007 at 1:11 pm
Hi,
I have an X60 that asks for an unknown supervisor password. Before buying the RPC8394 tools, I’d like to make sure that I can access the PC8394 chip. Does anyone know where this is located?
Thanks,
Paul.
Tuesday, January 2nd 2007 at 2:13 pm
I don’t know if X60 has PC8394, but as I spoke with Victor of allservice.ro, the software is compatible with all new IBM models, maybe you can ask him.
Thursday, January 4th 2007 at 4:46 pm
Great work. It reminds me that no good deed goes unpunished! Thanks for the effort and for publishing it.
Friday, January 5th 2007 at 10:10 am
Error C0175 on thinkpad t21. Need clean EEPROm file
Saturday, January 6th 2007 at 4:54 am
Unbelievable!!! Works FLAWLESSLY! I bought a T40 for a mere $200.00 1.6GHz/80GB/512MB/CDRW-DVD/32MB Vid/14.1″ XGA had a bios pw could not axcess notebook at all
But thanks to this wonderful very helpful guide I was using T40 in appx. 45 minutes (took my time soldering onto mainboard) of buying parts from rat shack for less then $5.00 bucks 
I want to thank the author(s) of this guide, and keep up the excellent work!!
FYI: Atmel chip was underneath WiFi Card next to another 8 pin chip, the atmel chip had “Atmel G
24RF08CN
0334″ written on it. Good luck people.
Saturday, January 6th 2007 at 11:07 pm
Hello, I could´t find any Atmel chip in IBM 600X. (2645-4EG)
Can someone help where it is, or is there any? Or is there some other type of chip?
Sunday, January 7th 2007 at 9:30 pm
I have T20 and when I tried to do it. The command give a “ERROR: EEPROM not available.” I have double triple check my wiring. Please help.
Sunday, January 7th 2007 at 10:17 pm
I have one thinkpad R30 with forgotten bios password set and i’m not intrested in hacking it. If someone wants to buy it, please mail ronikantis [AT] gmail.com
Monday, January 8th 2007 at 1:31 am
It works fine
IBM T42 unlocked with no problems. Thanks for this great tutorial 
Monday, January 8th 2007 at 6:28 pm
circuit not found or bus error
Monday, January 8th 2007 at 6:30 pm
can some one give some idea of what I am doing wrong I follow all the info but still can’t get it to work. I still have the message circuit not found or bus error.
Monday, January 8th 2007 at 6:34 pm
I have one thinkpad R32 with forgotten bios password I found the Atmel ship with 4 pin in each side total 8 pin. I make all the circuit but still not circuit found or bus error. can some one give and idea.
Tuesday, January 9th 2007 at 11:47 pm
I have a problem with my T30.
I make dump.bin, but when I use IBM pass lite 2.1, I get password,
but this is not good, and don’t work. I try with AA on, but the same, not work.
What can I do?
Wednesday, January 10th 2007 at 10:38 am
I HAVE 390X JAPAN MODEL, CAN ANY ONE HELP ME PLSS.. WHAT IS THE EXACT ATMEL CHIP.
Wednesday, January 10th 2007 at 10:07 pm
Hi; I sent you the pic about the 600X Atmel chip location yesterday. I’m having some problems though. The cable is done and correct to specs. I have downloaded the software and installed it. My problem is that I open the command prompt window and navigate to the folder, but what do I type in? I have tried the r24rf08dump.bin, also r24rf08 dump.bin , I am confused… When I navigate to the folder it has the address already typed in, if I hit enter on the address, it pops up a DOS screen, if I type in anything at the command prompt it doesn’t do anything.
Also, on the chip it has a small circle in the corner, that is pin ONE correct? Any help would be appreciated
This is the folder address… C:\ALLservice\24RF08\r24rf08.exe
Do I just type C:\ALLservice\24RF08\r24rf08.exe\r24rf08dump.bin? that gives me an error…
Thanks,
Mike
Wednesday, January 10th 2007 at 11:48 pm
C:\ALLservice\24RF08\r24rf08 dump.bin Thats what I needed to type in! stupid me! That made it work right, I guess you just need to vent a lil steam once in a while to let new thoughts get in LOL
Great site! keep up the good work!
Mike
Thursday, January 11th 2007 at 3:41 pm
hi, disarm an IBM TP X41, to look for the chip Atmel but only find one with the number 24c04, your you believe that I can do the procedure in this chip. Pardon but I am the great inexpert one.
When I ignite the Tp only asks for the password me of windows, I need to do this procedure to find the key or you believe that with algun programmes I can extract the pass of windows.
Thank you
Thursday, January 11th 2007 at 11:23 pm
Hello, I have an Thinkpad R40 bought it at a pawn shop but I am locked out like most of you guys. I believe that I have found the bios chip but i don’t know which of the eight pin I need to connect to. Is there some way to “Read” the chips by counting from a certain point? Thanks.
SamBrown99[at]aol[.] com
(p.s. i am fixing it for my girlfriend)
Saturday, January 13th 2007 at 1:54 pm
Thanks for your devotion to help people we have a great friend on you. PLEASE help whit the thinkpad t43 what is about the chip
Saturday, January 13th 2007 at 2:29 pm
I managed to assemble a reader. I dumped the contents of the atmel (TP41) in a 1024-byte file and contents looks good; i can see the machine-model as well as the serial number but on address 0×338 there is nothing but hexadecimal crap. So i took another unprotected T41 and read the chip; on 0×338 you see all x’00′. If i change the password to ‘A’ (1 character), on 0×338 the value becomes Ô÷ú›=Ê( in hex : d4 f7 fa 9b 3d ca 17 28 ) So , there seems to be some kind of encryption. Passlite does not provide the answer.. ANY suggestions ????????
max.dekkers@cherrytronix.com
Saturday, January 13th 2007 at 3:39 pm
MAX, your laptop is using TCPA encryption. I’ve seen that allservice provide a fix for this, you need the writer W24RF08 and to pay a TCPA reset or maybe is free, just talk with them.
Sunday, January 14th 2007 at 10:43 am
Hm, this guy Li is just one that wants money for free allservice software. Is a scammer.
If you want to use the software always download from the source and support the authors not chinese suckers that will try to sell you a free software. Be aware, mike
Monday, January 15th 2007 at 11:55 am
hi. my thinkpad is A22m and ATMEL on it have 14 pin ! which pins must be scl,sda ????????????????
Monday, January 15th 2007 at 11:57 am
hi. my thinkpad is A22m and ATMEL on it have 14 pin ! which pins must be scl,sda ????????????????
writed on ic :
ATMEL F
24RF08CT
0042
Tuesday, January 16th 2007 at 7:56 am
I have some R40 pictures
Can you tell me how should i send them to you?
Wednesday, January 17th 2007 at 3:19 pm
hi. my thinkpad is A22m and ATMEL on it have 14 pin ! which pins must be scl,sda ?
writed on ic :
ATMEL F
24RF08CT
0042
what am i do ??????????????????????
Thursday, January 18th 2007 at 6:08 am
Confused as to what line password is on. Although line 330 is mentioned, only a “D” apears on that line which is not the password. Tried several dumps, all have had the same result. Any ideas?
Thursday, January 18th 2007 at 1:19 pm
i have a prblem on my ibm thinkpad t20 with error 188: invalid RFID derializtaion information area or bad crc2. can any one help me with clean t20 dump or tell me how to solve this.
my email add is mallmusa@yahoo.com .
Thursday, January 18th 2007 at 1:22 pm
if u got problem with ur t21 thinkpad mail me and i’ll tell u how to fix them or if u need a clean dump for t21, t22 i can help u.
Saturday, January 20th 2007 at 7:52 pm
can u repair crc errors?….how i can recognize de bad area data in a dump?…and after i must delete this data???
Sunday, January 21st 2007 at 4:10 am
hello… i built the simple-12cprog interface and used the info for my t40. it worked like a charm. thank you for your easy layout of the interface devive and the instructions on how to do it…. also i have a picture of the interface that i made if anyone wants to see it….. just let me know or leave a response….
Monday, January 22nd 2007 at 1:14 am
Hey guys, thanks for all your posts. i was able to unlock my think pad T41. Now i had trouble at first because i made two mistakes, i just want to let yall know that they were with the hop it will help you ll.
1 i misplaced the wires on my female 9 pin serial outlet, suggestion is to double check your connections in case of a problem. i kept getting ( EEPROM NOT AVAILABLE) when i ran the script.
2 i unplugged the small battery and forgaot to place it back. this made me get a message that said (circuit not found or bus error.) just plug the small yellow battery and that will probably solve it.
The following are just tips that helped me out
*make sure that your welds on the board dont over lap with other componets to prevent a short or false contact.
* check your connections with the diagram to make sure it correct
*If you have problems trying to turn on the computer dont panic relax; this is what i did and it worked for me the problem was it only turned on for a few secons and just didnt stay on. first i unplugged the computers battery , then i also unplugged the smal yellow battery and left it alone for about 5 min , came back plugged every thing back and worked just fine.
*i you are new to pc and have no clue how to use commander prompt this is what you can do; save all the files on the file: C: documents and settings\owner (the owner may change depending on how you labled this file it might have Administrator our your name) this is the defualt directory on the command promot, you can also just run command prompt and see what goes in place of owner.
after you saved al your files in this archive just type:DIR and hit enter you should see all the the directories including the ones you recently installed in your pc
Type the command given r24rf08 dump.bin and do what is instructed.
I used a 2 2.2k resistors 1/4 watts 5% and 5.1 V diodes
And Finally dont give up and kep trying, Good Luck and Thanks To who every started this.
Monday, January 22nd 2007 at 6:40 am
I Have TP IBM T30 . found the Ship under the RAM cover.
I solder the wire (so dificult , to small ! maybe I’ve done it wrong) Run the DOS program , and the message was : ERROR: EPROM Not Available .
It might be the soldering . Does the Ship is burned ? or still working . Now I want just to sleep , anyway feel free to call me 1718 790 7950 .
DOes the person upwaer
Monday, January 22nd 2007 at 9:11 am
Hi Everyone,
I did this for a friends T40 and was able to read the eeprom perfectly.
I get the file and go to the memory address 330 - and its Blank no password is shown.
All the other information including hte serial number model number etc is visible, but no password. Has anyone else experienced this and know how to fix it?
Thanks
Tuesday, January 23rd 2007 at 2:10 am
I am working on a t42 and am having a problem similar to danielk’s. On mine only a D apears on 330, which is not the password. I would appreciate help and i will let you know if i figure it out.
Tuesday, January 23rd 2007 at 2:30 am
Hi, anyone know about the thinkpad Z61t series? I have pulled it right out and the only atmel chip I can see is located beside the docking port and has 28 pins (14 per side) on it. Any help would be appreciated.
Tuesday, January 23rd 2007 at 7:54 am
Thanks for this guide, it worked on a thinkpad T20 with the 14 pin chip!
Tuesday, January 23rd 2007 at 8:23 am
Hy guys…
i have Thinkpad T60..
i have the same problem…
if i use this method, do i use exactly the same method or there are some changes
i am not that familiar with chip dan IC..
can you gut\ys help me please
Tuesday, January 23rd 2007 at 9:50 pm
Hi All,
Finally I found the T41’s pass, great site! Thank’s guys!
During my way I figured out that the picture of the circuit above (just below the text: Here is a simplified schematic for those unfamilliar with the above symbols:) shows BACK SIDE of the plug.
That’s why I got the following message:
ERROR: EEPROM not available
Tuesday, January 23rd 2007 at 9:50 pm
Hi All,
Finally I found the T41’s pass, great site! Thank’s guys!
During my way I figured out that the picture of the circuit above (just below the text: Here is a simplified schematic for those unfamilliar with the above symbols:) shows BACK SIDE of the plug.
That’s why I got the following message:
ERROR: EEPROM not available
Wednesday, January 24th 2007 at 3:55 am
I have now found two atmel chips on the motherboard, one is so badly written that I have to have large breaks after trying to read it (where is that magnifying glass) the other is a SC3203 which is apparently a security chip and not valid, though there are some reports on here that suggest this has the right number of pins but I can’t be sure. The chip that is hard to read is smaller and square in shape, has 10 pins on each side and 8356908 is written on the top. Can anyone confirm that these chips are either not applicable or are applicable?
Thanks,
Q
Wednesday, January 24th 2007 at 9:35 am
enyone have don this on a Thinkpad T60??
Wednesday, January 24th 2007 at 7:39 pm
I would like to mail you a copy of my bin file. I followed the instructions listed above, and read the chip. I entered the work in but still will not unlock. Not sure what to do from this point. there are a couple characters after the word, but they are showing up blank in the text part of the editor. I’ll mail it to you and see what you think. My think pad if a T42.
Thursday, January 25th 2007 at 4:37 am
Where is the amtel chip on a T60? I can’t find it next to the numerical co processor.
plz help
Friday, January 26th 2007 at 7:36 pm
I just done the job on a 600e. I used a white plus green LED instead in series of a zeener diode. These do the same job as the zeener and give a visual indication. The white LED has an Fv of 3v. The Green has a Fv of 2.1v.
Mine has a 14 pin chip. SDA is pin 8. SCL is pin 10. Vcc is 12.
Retrieving password from the 600 didn’t work following the above instructions. With machine on and powered, the result was no EEPROM. However, I did succeed as follows:
Get a 5v supply with limited current (limited to around 200ma) (a current limited desktop power supply, or perhaps 3 AA cells plus 200ma fuse). The current needs to be limited as it is easy to short circuit and fry something. With machine off, connected the circuit. Had a probe with +5V. Touched the probe on Vcc then quickly ran patch.exe then the program to gather the data.
The above procedure could fry something which is why I suggest limiting current, and only apply the voltage to VCC for the minimum time possible.
Saturday, January 27th 2007 at 9:42 am
I have a problem with a password.
My thinkpad is r32 and i will to reset my BIOS because i foget the SVP. Remove the the CMOS Battery and there it must to write a password.
What is this password?
What is wrong?
Regards.
Marius
Sunday, January 28th 2007 at 2:25 am
I have make all handling and the password only in 0×338 and not 0×340. You are to say itself why?
Sunday, January 28th 2007 at 2:56 am
Any clues on the location of the chip on an x41 tablet? I’ve searched all over, but can’t see it anywhere!
Monday, January 29th 2007 at 9:14 am
Hello,
we are more than five user of old ibm tp570 - look—-http://www.notebookforum.at/showthread.php?p=93052#post93052—–
and have the problem, that on each booting we must fill in the date and time again.
the Bios batterie is proved :ok. The Bios ist updatet IMET 62. But the problem goes on.
what is to do?
Bernd Muser Germany Stuttgart
Monday, January 29th 2007 at 7:53 pm
hello, I have IBM t30, have taken apart the motehrboard and have found the chip atmel, I am mounted on one small card that is taken apart, I am a chip to 28pin!!! the acronym on the chip is: atmel at97sc3201 the acronym on the card is: p/n 26p8193, please you help me!!! how I can cancel the pasword? the guide serves for the chip to 8pin not for those to 28pin!! my email is: andrea.gt3@libero.it if you have a solution please you send it to me
Monday, January 29th 2007 at 8:51 pm
Hello,
I have a Lenovo ThinkPad T60. I forgot the BIOS supervisor password and need to unlock it. I have already purchased the parts to build the interface to connect to the security chip. Can someone please send me a picture or tell me where the security chip is located in the T60 and what leads to connect? My email address is: edwin108@msn.com
Thanks,
Edwin Suarez
Tuesday, January 30th 2007 at 12:58 am
FYI for those of you posting, Doesn’t look like anyone’s bothering to reply to these any more, either that or they’re all too hard. I’m giving up on getting ours going because (this site at least) is not longer helping.
Wednesday, January 31st 2007 at 6:51 pm
Hi
I have IBM Thınk T22 dont bios pasword help me but turkish write please
Wednesday, January 31st 2007 at 10:32 pm
I just found my password using the instructions in the first 6 to seven pages of this sight. If you are getting data and it dosn’t look right make sure to turn on the button AA in left corner. I’ve been working on this several days and poof there it was there are a lot of little details that you have to pay attention too. Finding chip can be the hardest. Good luck don’t give up it can be done.
Friday, February 2nd 2007 at 12:05 pm
Please! Location for ATMEL on TP A31, anibody nows?
Sunday, February 4th 2007 at 1:56 am
One of my readers asked me the following question:
I linked him to your site.
Sunday, February 4th 2007 at 10:37 am
Hi!
Does anybody know if it works on ibm t22 ??? And does anybody know there exactly chip is placed??? And can you sent me some pictures of it ?
Thanks in advance!!!!
Monday, February 5th 2007 at 11:34 pm
I just successfully recovered an A20m laptop that was locked with the supervisor password.
It is not for the faint at heart, but you have little to lose as the laptop is useless
without the password. For the A20m, you have to completely strip down the laptop
following the directions in the IBM service manual (available on IBM web site).
The manual had slightly different screw arrangements than my laptop, but the sequence
of parts to remove was correct. The eeprom is located on the bottom of the motherboard
near the ram expansion connector but cannot be reached without taking the laptop apart.
It is a 14 pin device. You will need to solder a
couple of pieces of wire wrap wire onto the clk and data pins (about 2″ long) and
route them towards the memory expansion connector. Make sure you use different colored wire
for the clock and data signals and write down which is which.
Then put the whole laptop back together
by following the disassemble instructions in reverse. The 2 wires you added should
be hanging out of the memory access door. You will also need to pick up a ground
connection (I used a bare copper area near a mounting screw). Hopefully you dont have any parts
or screws left over when you are finished…. expect it to take about 2 hours to do this
process for the first time. I taped up the wires and left them on top of the memory
expansion as I really did not want to take the laptop apart again to remove them.
Tuesday, February 6th 2007 at 5:19 pm
could you please help me boot my ibm t42 using win xp sp2 without going throuh these procdure byu welding the atmp chip
Tuesday, February 6th 2007 at 10:23 pm
Thanks! I followed your procedure on a ThinkPad A31, Type 2652-J3G. It worked, and I now have my machine back. I have some experiences I want to share:
- I benefitted from using IBMs “Hardware Maintenance Manual” for my model. It is free for download from IBMs website. Without this I would surely have broken more parts, as I had to take apart almost the whole computer to find the chip.
- As a totally unexperienced solderer I realized very late that there is enough tin on the chip already to fasten the wire. Do not bother to add more tin, just heat the pin and stick the wire to it.
If anyone else are using ThinkPad A31 (it is probably valid also for A30, A30p, and A31p as the hardware manual is identical) - some specific tips:
- The atmel chip is below the “sub card for pc card slot”.
- I needed to remove the following parts in this order: battery pack, CD-player (”Ultrabay plus device”), modem daughter card, ethernet daughter card, backup battery, hard-disk drive, keyboard, keyboard cru insulator, keyboard bezel, ultrabay plus slot (note the procedure here, it is ease to break it) and finally “sub card for pc card slot”.
- The chip orientation is as on the pictures, with the two important ones down to the right. After only connecting the keybaord, the machine starts without problems in this unmounted state. All the names are taken from IBMs manual. Without this, I think you will not manage, at least without breaking most parts.
Thanks again! - and good luck to you others
Wednesday, February 7th 2007 at 10:05 am
Hallo every body,
at IBM 770z you only have to remove the dimm cover. you can find a 24c01 chip right next to the bios battery. It’s the only chip with 8 pins you can see there. the there is no need to open the notebook.
Wednesday, February 7th 2007 at 8:29 pm
i have a thinkpad R60 and its dssassembled the only amtel chip i can find has this number
Amtel at97sc3203 1.2.8.05 ***** ***** and its a 28 pin chip.
and its located under the pci xpress expansion slot. any help would be greatly appreciated.
can post pics if needed please someone help me!!!
i found a diagram of the 28 lead chip if that helps located here >>>>>> http://www.atmel.com/dyn/resources/prod_documents/doc5010.pdf
can someone please help me get this pass please
Friday, February 9th 2007 at 1:53 am
hello,
I have a same problem like some one above. My laptop is IBM thinkpad R40, I set POP, Supervisor and HD password. but after I installed asome software, my POP did not work, it was changed. So Iwonder cani recover my supervisor password through above method or not. I think some kind virus attacked the bios.
Saturday, February 10th 2007 at 2:14 am
Hi,
Thanks for the guide.
However, I always got “Circuit not found or bus error!” message. Just wonder whether I got the right components:
Resister 2.2k 1/4w (should I use 1w ones?)
T/R Zener 5.1v 20ma 400mw (Have to be BZX55/C5V1? difference?)
Thanks in advance.
Best,
ViX
Sunday, February 11th 2007 at 1:08 pm
hi all
please i need help ( i have IBM R50e and i forget password and i test all steps put i cant’t write this password Ž{–i-:Jc
can u help me
Best Reg.
Wassem Shehata
Monday, February 12th 2007 at 4:56 am
Thanks a lot guys! TP 390x had to take the computer completely apart and I found that chip in the corner of the motherboard by where you plug in the power cable. I found a repair guide to take it apart so I knew where every screw went at ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/09n8604.pdf. Thanks again!!
Monday, February 12th 2007 at 11:17 am
I have ibm tp r50e i found the atmel i solder it and i have my dumb.bin but in ox330 i see some weird characters for example : BOZI . fBi , i tryed all the combinations but nothing
Monday, February 12th 2007 at 11:19 am
i have exactly teh same problem as wassem shehata the pasword tha i got i cant write it is like BoZi . fBi but the o in word Bozi is not an o or a 0 is something weird
Wednesday, February 14th 2007 at 9:25 am
Not any solution for R60 model yet ?
Wednesday, February 14th 2007 at 4:10 pm
Hello:
Is there any one who did recover the supervisor password for IbM thinpad R40 using this mehod?
Wednesday, February 14th 2007 at 7:34 pm
Hello!
I´ve done all this like it´s told on your page. After doing this all the programm tells “Eeprom is not available”. What do i have to do? The File “Bump.bin is created, but its about 0KB. I´ve got an A20M. Is it necessary to put all the components together (it´s only the naked board without RAMS, Fan, etc.)?
Thanks for your help.
Steve
Thursday, February 15th 2007 at 2:51 pm
@nblueman
Turn on the AA button in IBMpass, if the password is not revealed then is a TCPA lock, ask allservice.ro for the service
@Hubert
This method works for all TPs using 24RF08 and 24C01
@Knude
For R60 you need PC8394 tools to read the TPM chip
Thursday, February 15th 2007 at 3:32 pm
@softpedix
Thank you for the reply.
I had turn the AA button on and back off again,i can read the password(if it is the password) but it doesnt work,and many of them could not type it in ibm for example
symbols like ; or #
What is TCPA lock and how i can ask the allservice?
Thursday, February 15th 2007 at 10:00 pm
@softpedix Thank you for you response. I will try it. My laptop is also using one kind of 24RF08, I have found it on the motherboard. Thinks
Saturday, February 17th 2007 at 3:42 am
Is there any way to remove the bios password from within windows on a thinkpad t60?
Saturday, February 17th 2007 at 8:07 pm
Worked on a T41 ok yesterday. Bit difficult to get the soldering right but got it in the end and recovers the p/w OK. Thanks
Sunday, February 18th 2007 at 7:26 pm
Found a real easy way to fix these. Buy an ISO loader made for reading smart cards ( about $29.99) then open it and go to the atmel. look for the dimple or PIN 1 on your atmel and replace. Anyone with soldering skills can do this in less that 5 minutes. The get the program XP Atmel 2.0 also found all over the net. Download the correct .bin for the Bios and solder it in on your ISO. Run XPAtmel and choose your file, it will show Atmel model and Vendor Family, ect ect. If your ISO loader has red dip switches, you use it woth pins 1 & 5, or 1 & 6 to flash your chip.
Good luck
Sunday, February 18th 2007 at 7:32 pm
sorry for poor spelling.
1. Get ISO
2. Open ISO
3. Remove Atmel chip from your IBM
4 Solder in your IBM Atmel
5 with seperate PC download from IBM the correct flash for your unit.
6 with seperate PC download the XPAtmel 2.0 program found all over net
7 open XpAtmel2.0
8 choose the file and click download
*note*
make sure your file is in the same folder as XP Atmel
if your ISO has dip switches you use either 1&5 on or 1&6 on to program.
9. Then re-solder in your Atmel into the Thinkpad
*you now also have most current flash file (BIOS) for that unit.
Enjoy.
Wednesday, February 21st 2007 at 1:34 pm
I have just bought an IBM T43 but the touchpad and finger print sensor are not connected to the mainboard. I want to disassamble the machine to fix the problem. Unfortunately, I do not have service manual of the IBM T43.
Should you have any information can help me, please tell me at auduyvuong@yahoo.com
Thank you
Thursday, February 22nd 2007 at 5:28 am
I could not get this thing running I’ve done all the wiring and soldering right and still could not detect the eeprom, or circuit not available. Is there anything I need to do, it’s a R51 thinkpad. Please help.
Thursday, February 22nd 2007 at 6:39 am
Hi,
I would like to buy someones assembeled stuff to unlock a t30… ready to use so Icould just solder to the chip, plug in the serial port and download the software. I would be more confortable knowing that you used it and worked. Please email me the price with shipping included to zip code 60077. livrom@yahoo.com
THANKS
P.S. I Need This ASAP
Friday, February 23rd 2007 at 4:34 am
Great job guys, I’m still looking for the location
of the eeprom (atmel 24rf08 or atmel 24c01a) on
the system board of my TP600 Pentum II type2645.
Could you or someone please post a picture of the same
system board and circule the location of the
chip for me, or does it have a different
number. many thanks. JAN.
Friday, February 23rd 2007 at 10:06 am
i have already succesfully acces my TP but when i did this what shows on the screen - Setup Warning!! PAP will overwrite to HDP-1. Does anyone know what options should i take. Help needed asap. and also which one of this options will totally remove the Supervisor Password? tyvm for any comments and suggestions.
Friday, February 23rd 2007 at 6:22 pm
Hello everybody,
Thanks, thanks, thanks!!!!
Two TP (T41 and X40) unlocked.
I just followed the instructions and everything worked perfect!
Thanks again,
Southern
Sunday, February 25th 2007 at 6:19 am
Can someone please help me, I have a T30, I conected everything, when I execute the patch it shows me that the clock it’s ok but when I execute the r24rf08 I don’t know how to make that bim file, I typed r24rf08 dump.bin with space and without the space and when I hit enter the black window it’s gone and there is no bim file created in the folder. I’m doing this over 5 hours and it’s just so frustrating I unsoldered everything put it back together and I get the the same results. What should I do? A fast reply would be much appreciated. Thanks
Sunday, February 25th 2007 at 9:49 am
I made it, Just unlocked the T30. This is the answer I was looking for(I found it in the forum).I might help someone:
A little DOS tutorial:
For example you installed the software in “c:\allservice\24rf08″ folder (or directory).
You have to launch it from a console window.
Start>Run, type “cmd” or “command” and press OK to open this console window.
You should see the system prompt:
C:\bla_bla…bla\>
Now to run the reader, type exaclty:
cd c:\allservice\24rf08 - with space between cd and the rest.
r24rf08 a.bin- a.bin passed as command line parameter -see?
Of course, do this at the right time exactly as in the procedure. means to strike the Enter key. In the example above the binary will be stored in a file named “a.bin” which will be in the same folder with the reader, c:\allservice\24rf08
Monday, February 26th 2007 at 7:24 pm
Czesc. mam laptopa t60 ale niemoge znalesc tam tego atmela, znalazlem za to blisko mostka jakis chip na ktorym pisze mx -150 albo 15g 25l1654m2c ale niemam zielonego pojecia czy to jest to zbudowalem juz ten czytnik. czy moze mi ktos powiedziec gdzie mam szukac atmela?? blagam o napisanie maila na konsolator@gmail.com!!
Wednesday, February 28th 2007 at 5:39 pm
Hello! I´ve got a problem with my TP 600 I bought it from an old man a month ago. He toold me it worked ok but..When i retrived it it´s looked with pw on power on.
I contacted him so i could get the pw but it was his sons old pc and it been without batterys for 2-3 years and he didn´t know the pw.
What can I do??????
Wednesday, February 28th 2007 at 9:29 pm
hello!
thank you guys! you saved my life! and a lot of money. i have a T42, and i bought it with a password already in. the seller told me, it is not stolen, but he also dont knew it.
i come out from less than 1$ in hungary, for the electronics. thank you!
kappelmi
Thursday, March 1st 2007 at 12:40 pm
Hello, i have an Thinkpad R60 with Bios Password, i can use this procedure for it?
Because this model on the guide isn’t mentioned.
If it’s possible, What is eeproom chip to operate?
thank you.
Bye.
Thursday, March 1st 2007 at 3:54 pm
So where do you get the C5V1 Zener diodes thats something you don’t get a radio shack.
Thanks
swacp645@yahoo.com
Saturday, March 3rd 2007 at 4:35 am
I have a my ibm 600x apart and would like to know where the bios chip is on this machine. Under the area around the mouse pad these are 3 chips that could all be this 8 legged fuse! I do see the tpc8002 is one of these chips, is this the beast?
Cheers, Pete
Great work-by the way!
Saturday, March 3rd 2007 at 5:38 pm
Hi
is there no any way o kracking this passord
like any superpassword which can unlok all passwords
Monday, March 5th 2007 at 1:25 am
hi there, i had power one password with supervisor password, i was trying this method for TP T21 but couldn’t sold the wires to eep rom, and i heated to sold enough on eep rom that one of sold was unsold, i thought i can’t do that, so i turn on the machine it says EATA reading error and it goes to BIOS without asking password, i disable all the password and i turned the machine off and i thought something wrong with EEP rom so i sold it again and then i trun it on and there was no EATA error but again asking for password i just hit enter and it says OK:D without even connecting or anything it’s done, i donno now how that’s happend:D
Monday, March 5th 2007 at 1:29 am
i have TP 23 with BAD CRC 1 Eror, any suggestion how to fix that?
Monday, March 5th 2007 at 6:07 am
My Thinkpad R30 is not locked, however I get the error ‘0189: Invalid RFID Configuration Information Area’. From some Google research it seems this could be due to a corrupt BIOS or CMOS. The laptop cannot be upgraded to later BIOS or booted, as you can only continue by pressing F1 or ESC. Both take you straight to the BIOS setup utility. I have tried every option in there but nothing allows me to flash the BIOS or continue booting. Is there anything here that can assist me to repair the laptop? IBM wanted 800 Euros to fix it, its only worth half that amount in good condition!
Tuesday, March 6th 2007 at 12:19 am
I just found this site and read about Sonny’s problem with the ibm 600e cmos battery connector breaking off.
I just had the same problem. I would like to replace the connector. Can a new connector be soldered on with out taking everything apart?
Where Can I get a new connector.
Roger
Tuesday, March 6th 2007 at 1:52 pm
Wow. What a fantastic page !
I have been playing with a few 390X’s with problems - and one with a locked password chip. I was uncertain as which chip it was, but your page has given me some welcome guidance !
I didn’t want to drop $25 on Ebay for a new chip when I have several other M/B’s here with other problems and clean chips! I just need to know which one is the culprit.
I see an Atmel and a PIC, so I assume one of those must be it.
Do you know which chip it is in the ThinkPad 390X?
Thanks !
John, from Newport, RI
Tuesday, March 6th 2007 at 2:12 pm
I think I found it !
The Atmel 8 pin 2408CN SMD next to the USB connector.
I’ll try replacing it.
All the best, my friend
Wednesday, March 7th 2007 at 2:45 am
“I just had the same problem. I would like to replace the connector. Can a new connector be soldered on with out taking everything apart?
Where Can I get a new connector. ”
Hi,
I get those kind of parts from DigiKey or Jameco.
http://www.digikey.com/
http://www.jameco.com/
Wednesday, March 7th 2007 at 3:00 am
Yup, I found mine next to the USB connector - 390X , and swapped it from another M/B and fixed it !
Lot’s of fun
#
Thanks a lot guys! TP 390x had to take the computer completely apart and I found that chip in the corner of the motherboard by where you plug in the power cable. I found a repair guide to take it apart so I knew where every screw went at ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/09n8604.pdf. Thanks again!!
# Comment by nblueman:
Wednesday, March 7th 2007 at 3:11 am
The 390X Service Manual.
Lots of fun !
Enjoy, my friends
http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-4BYJF6
Thursday, March 8th 2007 at 2:51 am
I have an R40 TP. Downloaded from the TP the .bin file. When I I ran the IBM password program there was nothing but zeros in the entire memory address. Any idea what this could mean? Have done the downloading from the TP several times with the same result. Is it a dead r24rf08?
Thanks for any help or suggestions
Friday, March 9th 2007 at 1:29 pm
I tryed the procedure but id doesn’t work on my TP X41
Friday, March 9th 2007 at 1:49 pm
I tryed the procedure but it doesn’t work on my TP X41
Saturday, March 10th 2007 at 11:00 pm
Hi , i got a tp a31 , looking for the proper way to dismantle the backplane ! There is any document so i can follow step by step !!!That will help me not broking it , thank’s !!!
Mega !
Saturday, March 10th 2007 at 11:07 pm
@x41. It works, X41 has PCA 24S08. R24RF08 works perfect with this. try again
Sunday, March 11th 2007 at 4:52 am
password: hi guys, can someone tell me where i can get the software IBMPASS v1.1
the IBMPASS v2 does’nt seem to give me the decoding i want.
jan.
Sunday, March 11th 2007 at 7:33 am
In IBMpass click the AA button. The password is at 0×338-0×33E. If the password is not working then it is TCPA encryption.
Sunday, March 11th 2007 at 11:32 pm
Hi,
A friend tried to dump the bin file prior to giving it to me; except he used 22k resistors instead of the 2.2k. I redid the circuit and was able to dump the file. However I can see the factory data but at 0X330 and there is no pw. It’s all zero’s and beyond i’ve got hyroglphcs. Any assist will be greatly appreciated.
Monday, March 12th 2007 at 10:40 am
@Andy.
If there is zeroes, the SVP is blank. You have either a POP stored in CMOS or a HD password -remove the drive
Monday, March 12th 2007 at 8:08 pm
hi can any1 tell me where to find the amtel chip for x41 please,,,,,, thanks
Tuesday, March 13th 2007 at 2:52 pm
now i have the bin file but i can’t find the password HELP ME PLEASE
Tuesday, March 13th 2007 at 2:54 pm
hi jamie it’s just nar the pcmcia on the backside of the mb
Tuesday, March 13th 2007 at 5:15 pm
Hi Guys there is 10 people asking how to recover password from T60 but no one answers to them. is it impossible or very hard? and please stop writting the http://www.allservice because there is notting about a T60 is written. So anyone one that can help? what about you admin huh?
Tuesday, March 13th 2007 at 6:28 pm
T60 can be unlocked with PC8394 tools from allservice.ro only that the tools are not free. I know the guys there and they have this solution since last year avaialble.
http://www.allservice.ro/forum/viewtopic.php?t=484&highlight=t60
Or simply search the forum for T60 and you’ll have tons of answers. Are you blind?
Wednesday, March 14th 2007 at 3:31 pm
HELP FOR THE T42 BIOS SVP RESSET.
I know must people succeeded on removing the password from their TP T42 eeprom. I’m e-mail you because you may give me few tricks and help me fix what I’m doing wrong! I did set up everything but I’m not able to get the dump.bin file after I start the TP… F1 anf after it stop working, press enter.
I don’t know if it’s my cmd that’s wrong
C:/allservice/24fr08 dump.bin
It’s is this that they put in the “run” area? Please help me if you can
Also how will I know if the kit is working right?
I’m not able to have any dump.bin file at all… I must be doing somethig wrong but I don’t know what!
PLEASE HELP!
STEPHEYOUM@YAHOO.FR
Thursday, March 15th 2007 at 3:33 pm
Any comments?
Have a t42 where a bios update was done without battery. T42 now veggie, can’t even get into bios. Is it possible to get another 24rfc8 from another junk t42 (bad motherboard) and swap. Or is it possible to complete bios update.
Thx for any help, ideas, comments.
Thursday, March 15th 2007 at 6:01 pm
I can see that all the information is very clear and seems to work for many IBM Thinkpad Laptops. I just have one question, when I press F1 my laptop doesn’t go into de Setup it just show me the blank Screen whith the lock and asking for the password.
What I have to do?
Thanks
Thursday, March 15th 2007 at 6:28 pm
To enter the SVP, which apparently you don’t have.
Thursday, March 15th 2007 at 9:21 pm
Does anyone have a working T22 bios dump they would be willing to send me. I have a 0175 error, and would like to know where the CRC check bits are so I can correct them. Friend of mine has a eeprom burner, so that should be fine to dump it back. Much appreciate it.
Friday, March 16th 2007 at 6:05 am
Success!!!
I built the interface today and it all worked fine!
Unfortunately, the first computer I screwed up - when desoldering the wire from the SDA on the 8 pin Atmel chip, I broke off the pin.
Duh !
So I will need a new chip for that one.
The second one I was much more careful with and everthing worked perfectly.
Get this ! the password for both the Power On AND the Hard Drive were both “1234″
How original !
ATM machines won’t even allow you to pick that number as a PIN.
What idiots !
Anyway, I am looking forward to finding more deals on Password Locked computers to fix and resell
Thanks again for a wonderful Web Site !
John, from Newport, RI.
Friday, March 16th 2007 at 6:08 am
Orlando, my 390X did the same thing - showed the lock when I tried to go into Setup.
But following the procedure everything worked fine anyway !
Friday, March 16th 2007 at 7:05 pm
now i have this error msg : “ERROR: Unable to open source file” does any body knows the solution ????????????????????????
Friday, March 16th 2007 at 8:47 pm
I tried the proceedure on an R50e. Everything worked fine, but the translation of the dumped .bin file does not provide a usable password. Could it be TCPA encryption? If so, what would I have to do to save this computer from the dumpster?
Saturday, March 17th 2007 at 4:00 am
Do you see a text word at 0×330 ?
Did you try hitting the button “AA On” at the top left of the screen ?
I am not familiar with the R50e, so it might be something more complex that they have cooked up to try and keep us in the dark a little longer !
Saturday, March 17th 2007 at 3:32 pm
@X41: My friend you use a non working cracked W24RF08. This is happen when you search for crack instead of paying the authors.
Sunday, March 18th 2007 at 4:53 am
Hello,
Thank you very much for your info. It’s work for my T30. I can be able to get in to bios and disable the T30 passwork.
Oh! one thing I want to mention here is after you have the DUMP. BIN file and loaded it to ibmpass . you have to press AA button on to top left of window from OFF to ON so you can view the password at line 0X330
Sunday, March 18th 2007 at 3:40 pm
Thank you very much for your info. It’s work for my T30. I can be able to get in to bios and disable the T30 passwork.
Oh! one thing I want to mention here is after you have the DUMP. BIN file and loaded it to ibmpass . you have to press AA button on to top left of window from OFF to ON so you can view the password at line 0X330
Monday, March 19th 2007 at 5:23 am
Hi,
Have tried the procedure on an 600x, but I got an error: EEPROM NOT AVAILABLE. Can you please help?
Tuesday, March 20th 2007 at 2:17 am
I spent 3 hours and 30 bucks workin on this, and all it says is Error No Eeprom or Bad circuit, I have done this 100% as described, all my components match what was described in the instructions and have checked my work several times. Never worked. Just pissed me off.
Thanks a lot jerkoff.
Tuesday, March 20th 2007 at 2:20 am
now my laptop is dead, thats ok, IBM can fix it for me. Maybe now they will replace the mainboard and the damn password will be gone for good and I wont have to mess with idiotic shit like this.
Tuesday, March 20th 2007 at 7:25 am
can you please email me what the pasword is because i did it right and got teh circut to work but now i duno what the password is? please message me so i can send yu teh screen shot
Tuesday, March 20th 2007 at 10:39 pm
Hello:
I was following your instruction on navigating the folder where I installed the R24RF08 v2.0b and IBMpass lite to the hard drive (c drive). Then I type in r24rf08 dump.bin and setting up the wiring and connecting the ATMEL chip reader. When I go to my spare PC and hit enter on the command prompt. It will exit the r24rf08 program as stated in the instruction and the password won’t dump on the spare pc, what am I doing wrong? I also used the tester included with the r24rf08 software and all it does is alternate between 0 and 1 and says at the bottom of box Clock started…
Am I doing something wrong? I have been trying to get this to work for weeks now I am ready to throw the TP out the window!!!
Please help!!!
Glenn
Wednesday, March 21st 2007 at 4:19 am
Hi to those who successfully retreived their TP password using the procedure especially on 600X. Would you be kind enough to share the information on how you did it? You may email me directly at Bernard_david@hstx.com Appreciate your kind assistance on this..
Many Thanks
Wednesday, March 21st 2007 at 1:51 pm
I found out why I got “Circuit not found or bus error!” .
I actually didnot have password on my laptop x40 but on the recovery partition. Stupid me!
Best,
ViX
Thursday, March 22nd 2007 at 12:12 am
@Glenn
My friend you may need to read this. Quoted from allservice forum, they made the software and method after all:
“Pal, I understand your frustration, but is not my fault you missed the good old DOS times.
I think I said this so many times, here we go again:
A little DOS tutorial:
For example you installed the software in “c:\allservice\24rf08″ folder (or directory).
You have to launch it from a console window.
Start>Run, type “cmd” or “command” and press OK to open this console window.
You should see the system prompt:
C:\bla_bla…bla\>
Now to run the reader, type exaclty:
cd c:\allservice\24rf08 - with space between cd and the rest.
r24rf08 a.bin- a.bin passed as command line parameter -see?
Of course, do this at the right time exactly as in the procedure. means to strike the Enter key. In the example above the binary will be stored in a file named “a.bin” which will be in the same folder with the reader, c:\allservice\24rf08″
_________________
Thursday, March 22nd 2007 at 1:47 am
Worked like a charm on my R51. I ordered all my parts from mouser.com and got them within 2 days. Just a couple hints I would suggest, some might have been mentioned before…
1.) File down your soldering tip if you need to and tin the wire you’ll be using, it helps. 2.) If you are having trouble with step 3 of “Dumping the password”, like I was - you might want to check out using test clips, I think I’ve heard them called gator clips too. It makes it easier than trying to move those carefully soldered SDA / SCL / GND leads around with the laptop on…
3.) If you get the “EEPROM not found” error, check and re check (maybe resolder) your connections. I got this the first time, which could have been a soldering issue. Then tested continuity to make sure. I did however get the error again, switched out the Serial cable and got the EEPROM dump successfully.
Oh and my ATMEL chip was exactly as stated in the tutorial, right under the WiFi card. Just had to remove the keyboard and bezel (thanks to IBM Maintenance Manual)
Lastly, I know how frustrating this is, so if anyone needs pics of the reader, let me know (not pretty, but it works) bsmith55 at gmail dot com
Thursday, March 22nd 2007 at 6:51 am
Hello to all,
Dear all, plz send the dump bios for IBM Thinkpad A22m, coz I got the message, 0175 CRC Back post stop. I want to reprogram bIOS.
Regards
Samiullah
khawajikzai1@yahoo.com
Thursday, March 22nd 2007 at 5:49 pm
Hello !! Please help me : I have an old TP 380Z. Can’t find any atmel called 24RF08 !!!!!! fany.francis@neuf.fr
Thursday, March 22nd 2007 at 6:42 pm
Hi guys thanks for the great site!
I am following your instructions to the letter and so far so good.I have an IBM R30 and from your site I now know where the little blighter is hiding!
(underside of MB below PCMCIA card)….how do I get the back cover off the laptop to locate the chip without resorting to a hacksaw!
Many thanks ..Larry
Friday, March 23rd 2007 at 5:12 pm
I was wondering about the connecting serial cable. Is it a straight thru cable (pin 1 connects to pin 1, pin 2 to pin 2 and so forth), or is it a crossover cable(example: pin 1 to pin 4, pin 2 to pin 3 and so forth). If it is a crossover cable, what is there a schematic available.
Saturday, March 24th 2007 at 11:26 pm
For the 600X you must remove the system board. Its on the back. Its located between the hole for the screw right to the accu-port and a chip with a white sticker on it.
|—————–|
| | …anyway I hope, I hope this will help someone searching…
| | ….for the rest, see turtorial, have fun.
—- |
| |
| |
—- |
| x |
| |
——————–
Saturday, March 24th 2007 at 11:28 pm
hmmm…this should look like a fliped E…
Sunday, March 25th 2007 at 3:58 am
@ Larry
Hope you haven’t brought out the hacksaw yet - try this first!
http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-39797
Sunday, March 25th 2007 at 3:47 pm
i have a problem i have a ibm t 60 and xp professinaol but i want change the bios bur i know not the supervisor passwort
how can i reset it …
kann ich es nicht einfach übergehen indem ich es löten ,, überbrücken oder so ,,,,
Sunday, March 25th 2007 at 3:48 pm
with out software i want soldering
Monday, March 26th 2007 at 5:48 am
Hi, I have a Thinkpad T23 that is locked…and i’m not good at this soldering, anyone in San Diego mind unlocking it for me? willing to pay. let me know, thank.
Email: nyc2sd.max@gmail.com
Monday, March 26th 2007 at 4:11 pm
Well it works, got it done on a T23. The chip on the 23 is not shown in the origional instructions. Found a example of the chip in the document. It is the 14 pin chip on the T23. The serial cable needed is a straight pass thru cable. Pin 1 connects to Pin 1 and so forth.
Thanks for the fix. Got a free pc out of the deal.
Tuesday, March 27th 2007 at 9:12 am
Thanks for these valuable information.
I have an X23. This is a Pentium 3 866 MHZ subnotebook which I found yesterday from our company’s disposal bin for electroninc equipment. It took me several hours last night just to locate the chip. The chip is on the bottom of the PCB, I have to completely dismantle everything. I will post the result and probably some pictures next week.
Tuesday, March 27th 2007 at 6:44 pm
hi
I did everything you said with my T23, I found something in the eeprom but when i tried it, it didn’t work at all… waht might be the cause?
PLEASE HELP ME!!!!
Wednesday, March 28th 2007 at 2:50 am
Hi,
Have tested the continuity of my connection on the chip and its okay, but still I’m getting error: EEprom Not Available on my 600x. Any help on this?
Thanks
Wednesday, March 28th 2007 at 6:55 am
I finally read the passsword ! Everything worked fine. Here are some additional comments:
1. Make sure that the soldering iron is clean and the tip is small. I used a weller soldering station which I can control the tempetature. 300°C is too cold, above 380°C may ruin the pcb. I usd about 360°C. Use magnifying lens to very your connection as there maybe hairline shorts. This is the most critical part of the work.
2. I did not have 5.1 zener in my junkbox, I used 4.7 volts and it worked fine.
3. The password will not be visible on location 300 at first, you have to convert the code by pressing the icon on the left sie of the menu.
For anyone with x23 or similar notebook, I can send them the pictures on the location of the EEPROM and the serial interface that I made.
Thursday, March 29th 2007 at 9:45 pm
You should see this one. X20 series do not need to be dimantled, the eeprom SDA and SCL are available through the Docking port
http://www.allservice.ro/forum/viewtopic.php?t=93&highlight=x20
Friday, March 30th 2007 at 10:13 am
Hay. I’m useing IBM X30 and Ican’t find ATMEL 24… anywhere. Please Somebody Help me…………………….
Friday, March 30th 2007 at 4:38 pm
I am not sure about that. In the X23, the EEPROM is not near the docking port connector, it is near the memory expansion slot.
My machine now is running with a new 80 GB disk and WinXP
Thanks for the info anyway.
Saturday, March 31st 2007 at 5:04 pm
Hello,
I have a Thinkpad T43, this procedure working with my laptop?
Tanks
Saturday, March 31st 2007 at 9:58 pm
I have an IBM thinkpad R30, what is the worst thing that could happen tryin to remove the password?
Sunday, April 1st 2007 at 2:46 am
HI, I have read the comments And I can not find this chip on the thinkpad 600x ,actually I found quite a few chips with the 8 legs configuration non with the 24rf08 written on it if possible can some one post or send a picture my email
jesusa72@hotmail.com
Thanks Jose
Monday, April 2nd 2007 at 7:16 am
TP 600
Power on password ,IBM site shows 2 copper pads on Board ( near RAM )
Power off , short reset contacts ,power back ON
Didn’t work ( I ended up soldering a wire link ,to make sure)
will the Atmel method fix this? [Power on pword ,not Supervisor]
Tuesday, April 3rd 2007 at 5:51 pm
Hi I have a TP R30 TYPE 2656 and can only find the eeprom Atmel 93C46.I have followed all the usefull info on your great site regarding locations of the required chip 24RF08cm…..but to no avail.I have the TP stripped down compleately.I initially tried dumping from the Atmel 93C46 and it worked in that it read it and gave me all zeros.
I have looked in every location mentioned on the site but to no avail.
Can you help????
Wednesday, April 4th 2007 at 12:47 pm
Hi if anybody has the location of the 24rf08 eeprom on a TP R30 could they let me know as I have looked everywhere with the unit stripped down.I found an Atmel 93c46 but do not think this holds thepassword. I would very much appreciate it ,thanks.(I have checked out all the locations mentioned on this site)
My Email :grehanl@hotmail.com
Thursday, April 5th 2007 at 9:33 am
Hi Larry, i have an x23 and i found the eeprom under the board. Similarly on the early post there is a guy who also found the chip under the board, below is the message :
Comment by Chris:
Monday, December 11th 2006 at 11:31 am
ok never mind
found it..
on the R30 it’s located on the underside of the board below pcmcia bay.
Good luck
Thursday, April 5th 2007 at 5:32 pm
Hi Juandelacruz thanks for reply. I will look again but as I have already done this, I have little faith in finding it there. I was not able to remove the back cover compleately and it might just be hiding behind some metal or other!
One thing is for sure ..those guys in IBM sure know how to hide things.If I find it ..its off to the opticians for me!!
Thursday, April 5th 2007 at 7:29 pm
any one who live in manhattan, queens, bronx, brooklyn area
and still having problem after the laptop is open contact me
no shipping i will come to your place finish the job for you
Thursday, April 5th 2007 at 7:30 pm
any one who live in manhattan, queens, bronx, brooklyn area
and still having problem after the laptop is open contact me
no shipping i will come to your place finish the job for you
manediop@yahoo.fr
Friday, April 6th 2007 at 7:09 am
Did it on an X23, and it worked like charm! Half of the chip was exposed under the DIMM cover - and luckily it was the right half. Got the “EEPROM not found” for quite a while before I realized that some Microsoft SW was keeping my COM1 reserved - I just didn’t notice that before I tried to run a serial port scanner.
Thanks everyone - this is great stuff.. surefire way to earn a couple o guru points.. (c;
Friday, April 6th 2007 at 12:57 pm
Hay. I’m useing IBM X40 and Ican’t find ATMEL 24… anywhere. Please Somebody Help me………Please mail to me.
Friday, April 6th 2007 at 12:58 pm
Hay. I’m using IBM X40 and Ican’t find ATMEL 24…
anywhere?
Please mail to me.
Thanks
fountain
Friday, April 6th 2007 at 1:09 pm
microfountain@163.com
Saturday, April 7th 2007 at 2:42 am
Great Job Guys. Outstanding instructions. Password recovered on the first shut.
Again Many Thanks
Saturday, April 7th 2007 at 3:31 am
MERCI !!!!
Sunday, April 8th 2007 at 3:30 am
Hello, I Followed the instructions from allservice but I get a dump.bin file with 128 k and IBMpass shows all 0’s. Someone mentioned a dos verson of ibmpass can read it. Where can I download a dos version? Any help would be appreciated. I’m so close but so far…
Thursday, April 12th 2007 at 7:43 pm
DOE THIS WORK W/ THE R60 VERSION?
WE HAVE HAD GREAT SUCCESS W/ THE R51 VERSION!
AND WE CURRENTLY HAVE A FEW T22`S INCOMING TOO CLEAR.
Friday, April 13th 2007 at 9:10 am
Hi I have a X60 - does this work for my Thinkpad ? I already took it apart hoping to just short the bios, but I cant find it ! Can someone help me PLEASE !
Friday, April 13th 2007 at 10:01 am
R60, X60 works with PC8394 tools and IBMpass
Friday, April 13th 2007 at 9:06 pm
Thank you Lorenzo - I read some of the other posts, is there some where this software is avaliable for free ? Or something simmular ?
Saturday, April 14th 2007 at 2:53 am
Thanks!!! I’m just another happy Thinkpad T41 owner with bad (human) memory.
You’re method provided instantly result and gave me my supervisor password back. However, I didn’t solder wires to the atmel chip: I used 3 (old) tiny HP probes to clamp on the tiny leads. So so marks left!
Many Thanks!
Luke
Saturday, April 14th 2007 at 2:28 pm
Hello everybody !
Found the ATMEL on my TP 380Z and everything is soldered. But now when I power on the TP, I have error code 178 : EEPROM not functionnal.
Any ideas ???
Do I have to ground on the EEPROM ? I only ground on a mounting screw hole.
Thanx
Saturday, April 14th 2007 at 2:35 pm
Hello. I want to remove password from IBM TP 600. The instructions from start of this site will work? Sorry for my english, it’s not my national language.
Saturday, April 14th 2007 at 7:58 pm
HI, I want to remove supervisor password form my TP T42. I did the same wich u mention in the diagram. but when I run the command on spare PC its give me this error : “Circuit not found or bus error!” . In the begining when I Power ON my TP these two errors displayed:
Error 0271 - eheck date and time setting
Error 0176 - system security. The system has been tempered.
plz help and advice me what to do now.
Saturday, April 14th 2007 at 8:01 pm
HI, I want to remove supervisor password form my TP T42. I did the same which u mention in the diagram. but when I run the command on spare PC its give me this error : “Circuit not found or bus error!” . In the begining when I Power ON my TP these two errors displayed:
Error 0271 - eheck date and time setting
Error 0176 - system security. The system has been tempered.
plz help me and advice me what to do now.
Sunday, April 15th 2007 at 11:12 am
the chip in a tp600 is on the bottom of the board. lower right corner of the pci bus chip looking from the front… marked ATMEL846 24C01A SC27 B
Sunday, April 15th 2007 at 1:40 pm
Thanks Glade for location of chip. Now I don’t know is this instructions on top of this site will work on TP 600. Mayby somebody removed password from TP 600 and can tell that this instruction work. If you want my mail is katran@wp.pl. Thanks for help.
Monday, April 16th 2007 at 1:26 am
Does anyone have the diagram for the amtel chip inside thinkpad x60s
The chip says AT97SC3203
the chip has 28 pins
Monday, April 16th 2007 at 4:11 am
Wow, thanks for the clear instruction! Works at first trial without any trouble. Did take some time to get wires to the EEPROM, afterwards, piece of cake.
Thanks, it revives my T23!!!!
Monday, April 16th 2007 at 6:29 am
Thanx a lot for that tutorial!
Worked absolutely fine for me and my T40!
Monday, April 16th 2007 at 1:50 pm
I had the 0199 error on a X30 I was given for free. It drove me nuts!
I discovered that if you press then the button next to it in that order, the laptop will boot.
Hope this helps!
Munky
Monday, April 16th 2007 at 10:04 pm
I have tp A22e- I noticed its not listed in the models at top of page. Will this method work 4 my model? If so, where is this blasted atmel chip I’ve been reading about. A friend of the family gave me the computer and I’d like to get it running, but after getting it dismantled it’s not looking too good. Any help u can give would b greatly appreciated, but since the thing was free, I’m not going to get to upset if ur method is not possible on my model. I sure would look pretty cool if I can somehow get it unlocked and that’s what I’m all about. Thanks!
Friday, April 20th 2007 at 12:16 pm
ined help for unlock bios pasword
Friday, April 20th 2007 at 12:18 pm
for my hp pavilion ze 5400
Friday, April 20th 2007 at 8:41 pm
Thinkpad A31, worked beautifully! I screwed up the wiring (wired it backwards because I didn’t read the diagram right) but once I got it sorted out it was quite smooth.
My circuit looks like a gangly mess, but it did the job! Thanks a bunch!
Saturday, April 21st 2007 at 1:01 am
TP R40, I found the 24RF08 chip under the Harddrive
Saturday, April 21st 2007 at 7:43 pm
anyone willing to sell me their working circuit?
Sunday, April 22nd 2007 at 12:40 pm
Thinkpad X31
location of the Amtel is on the bottom side. Next to the intel chipset chip on the outer side of the pcb and mem slot. It’s U36. the other side of the pcb is the pcmcia slot.
Must disassemble whole thinkpad
Sunday, April 22nd 2007 at 8:32 pm
Worked like a charm on A21M.
If anybody needs any help with this model - contact me junglemike({[@]})gmail.com
Monday, April 23rd 2007 at 12:47 pm
Hello everybody, as i understood there is no possibility to get soft to to read PC8394 chip on IBM T60… Did anyone solve this problem? If yes can you share information where I could get this soft? I’m planing to use it only once for my laptop, and I don’t wanna pay 110$ cause for little more price i can get my laptop unlocked…
please help! my mail jevgenijo@gmail.com Thank you !!!
Tuesday, April 24th 2007 at 5:31 am
Hi,
If you think this is too much work for you, I can help you unlock your laptop I unlocked a lots o them. email for detailes I’m in Chicago area.
livrom@yahoo.com
Wednesday, April 25th 2007 at 6:43 am
dear
i have confusion, Install the software.
Connect the ATMEL chip reader to the spare PC
1- software we have to install on spare pc, right?
2- connect ATMEL Chip reader to spare pc? how?
do u mean by db9 connector? how to connect with spare pc
i am very confused kindly send mail at personal email
regards
Wednesday, April 25th 2007 at 11:23 am
Hello, I could´t find any Atmel chip in IBM 600X. (2645-4EG)
Can someone help where it is, or is there any? Or is there some other type of chip?
Wednesday, April 25th 2007 at 11:27 am
Hello, I could´t find any Atmel chip in IBM 600 (2645
Can someone help where it is, or is there any? Or is there some other type of chip?
Thursday, April 26th 2007 at 9:40 am
Hello
I have a TP T21 and have followed your instructions to unlock the supervisor password. on pressing return I get a prompt saying ‘Eeprom not avaliable’ do you have any ideas what I am doing wrong.
thanks stu.
Friday, April 27th 2007 at 6:39 am
hi everyone!
Im going to give it a try, thanks so much for the Post, by the way..
Where can i buy these “electronic componets?”
How im supposed to ask, in the store for these wires things..?
Have a Awesome DAY! = )
Saturday, April 28th 2007 at 9:20 am
Where is the PW chip located on the Lenovo T60 - if you know it plz paste a screenshot…?
Monday, April 30th 2007 at 7:21 am
Thanks for the help you provide but the biggest problem I have is all the serial female 9pin have pin number 7 not in use. Infact it was left without a hole inside. I soldered the interface on the PC direct on the male serial port but it never worked. It always showed an error that the “circuit is not found or bus error”. My atmel is on IBM T20 located under the RAM cover. its a 14 pin chip. Also I cant identify the SDA and SDL pins of the chip because they are not marked. Please help cos I am sure have followed all instructions.
Thanks
Tuesday, May 1st 2007 at 1:15 pm
Hi
In a previous post I asked for help when I received an error ‘Eeprom not avaliable’
I built the electronics in a small plastic box and connected to my slave PC with an RS232 cable. When I checked the cable I found that an RS232 cable dosn’t have pin 4 connected. I made a simple cable with just pins 4,5,7,8 connected and it worked first time. I hope this may help someone.
Cheers
Stu.
Tuesday, May 1st 2007 at 3:51 pm
Do I need a breadboard to build this circuit? I am a newbie at this stuff
Tuesday, May 1st 2007 at 3:54 pm
1) Do I have to solder the diodes to the resistors and then solder the resistor to the cable?
2) There is a blue line from pin 8, on the female connector connecting to one of the diodes? What does that blue line represent?
3) When I insert the resistors into the female connector, the resistor is loose, is this suppose to be okay?
Thursday, May 3rd 2007 at 1:28 am
Hi all,
I created the reader circuit, but can’t locate the Atmel Chip on my X20. I have looked above and below the motherboard in every nook and cranny, any suggestions? Is this model to old to have the Atmel or am I just crazy?
Any help would be appreciated.
Mike
Thursday, May 3rd 2007 at 2:57 pm
Hi guys,
I’m about perform the procedures on this site, but cannot understand the wire diagram. Could someone kindly send me the pictures of connecting from the Atmel chip to the serial port and instruction for the password recovery software…
many thanks,
Concunho
Thursday, May 3rd 2007 at 2:58 pm
btw, my email is HarryNguyen117(at)gmail.com
Thursday, May 3rd 2007 at 5:08 pm
goooooooooooood job; success to unlock my t40.
big thanks man!
Friday, May 4th 2007 at 7:46 am
First, I want to thank all the posties that helped me to reveal the PW from my TP 600.
I tried it first with the PONYPROG2000, dumped the file, but the password wasn´t visible. Then I tried R24C01 and it worked the first time. Enclosed the steps I exactely performed.
You have to completely disassemble the notebook and remove the MB to get access to the EEPROM. For the job you have to connect all required parts back to run the system, also BIOS battery, but you don´t need the HD.
I changed the COM port settings of my working PC (Device MGR>Ports category>COM Port1>Port settings) to Baud rate: 115200; Data Bits:8; Parity: none; Stop bits: 1; Flow control: none
For this type of EEPROM I learned that it is necessary to work with the driven-IC2cprog device. First trials with the simple one didn´t worked.
Thinkpad 600 – guide for reading the Supervisor Password with R24C01:
1. remove the mainboard (Hardware maintenance manual page 87)
2. locate EEPROM 24C01A at the bottom of the motherboard, right hand side, close to the upper left corner of the big PCIBus-IC when the connector row is facing to you
3. solder 3 wires to pin 4, 5 and 6 of 24C01A
4. build schematic: driven-i2cprog.pdf
5. connect driven-i2cprog to com port of working PC and check port settings
6. install ponyprog2000 2.05a Beta (freeware from www)
7. Select from menu “Device>I2C bus 8 bit eeprom>2401″.
8. setup > Interface Setup: serial, SI Prog API, select com port
9. In “Setup> Interface Setup” invert the D-in, D-out and SCLK.
10. change PONYPROG2000.INI: modify the line: I2CBaseAddress=0xA0 to I2CBaseAddress=0xAE
11. Save PONYPROG2000.INI
12. Setup > calibrate > OK….
13. connect AC adapter to the TP 600 mainboard (mainboard without any other boards but with BIOS battery attached)
14. connect GND wire of driven-i2cprog to pin 4 of 24C01A (GND also can be connected to any GND pad of the mainboard)
15. press power button of the TP 600 mainboard
16. connect SDA to pin 5 and SCL to pin 6 of 24C01A
17. read eeprom with ponyprog
18. disconnect SDA and SCL wires
19. switch off the mainboard
20. disconnect GND wire
21. store the bin-file
22. install ibmpass2
23. open stored bin file with ibmpass2
24. at ibmpass press button “AA” – on
25. View>Translation>Scancode
26. For 24C01 eeproms the password is located at 0×38, 0×40 – read password starting at 0×38 – ending at ????
27. note password, if password is not shown proceed with a.
a. Install R24RF01
b. press power button of the TP 600 mainboard
lc connect SDA to pin 5 and SCL to pin 6 of 24C01A
d. Run R24C01.exe
e. Use command: r24c01 your.bin /x /d /i
f. disconnect SDA and SCL wires
g. switch off the mainboard
h. disconnect GND wire
i. open your.bin file with ibmpass2 (as above 23 ff)
Hopefully this will help someone.
Greets
Stan
Friday, May 4th 2007 at 2:05 pm
got x60s , wana break its power on password, is there is any way to do it. asap
Friday, May 4th 2007 at 2:39 pm
hello everyone,
anyone knows the website with pictures of the soldering diagram from the Atmel chip to the serial port. I look at the above diagram but cannot understand it. I’m a newbie at this…any comments or suggestions is much appreciated…
if you have pictures or something, please email me at harrynguyen117@gmail.com
thanks a million.
Sunday, May 6th 2007 at 1:00 am
can the atmel chip be re programmed? I think I just killed mine by reversing the scl and sda leads. Now says error 178 and stops.
Sunday, May 6th 2007 at 5:40 pm
Hello everyone,
I have a thinkpad t30 - eprom actmel 24rf08 with 4 pins.
Now stops during boot with the message error 0175 bad crc1, I think that is because
the contents of the actmel eprom is scrambled or something like that,
so i have to replace it with a good one, so anyone that has the same model, please send me a dump of the eprom bin file.
thanks to everyone for sharing Knowleges and experiences.
Monday, May 7th 2007 at 12:59 pm
if anyone has any dump file of any laptop please send it to chanavs@yahoo.com Thanks a lot
Monday, May 7th 2007 at 2:51 pm
hello guys,
I have a Thinkpad T40 and need to retrieve the BIOS password. Can someone please send me pictures of the actual wiring of the diodes and resistors and how they are grounded. I am not very good in this kind of stuff.. especially reading a schemetics.
email: harrynguyen117@gmail.com
Thanks so much..
Monday, May 7th 2007 at 6:26 pm
Can anyone send me a clean EEPROM dump from IBM ThinkPad T22?
I have such a machine which hangs with “0175 CRC1 error” message.
Thanks in advance.
sv_sim@yahoo.com
Tuesday, May 8th 2007 at 11:47 am
Ok,I know this most likely sounds a little dumb.But it dosent hurt to ask. Is there any way some one could simplify the steps for me .i was given a IBM think pad t4 but its locked .
Thursday, May 10th 2007 at 5:09 pm
hello folks, great site. this is really helping me out on a t41 that I was givin. now I have a question for you all that have done this.
Q: is there anyway to do this without a breadboard? (kinda working on a budget here
)
I have all the correct parts I need 5.1v zener diode’s, 2.2k resistors and db-9 female.
if it is posible can someone please post the diagram for me on the site? my old tech classes are abit rusty so the scematic is abit hard to fully undestand.
thanks for the help.
Friday, May 11th 2007 at 4:18 pm
Hello People,
Thanks at all for support.
I’ve just tryed succesfully on a IBM G40 with IBMpass for Dos.
Ciaoooooooooooo
Sunday, May 13th 2007 at 3:13 pm
ok, fixed all up, now all I need is the dump from a t41 with the SVP cleared. could someone please send me one or two, that would be great.
PoeticRuins(at)gmail(dot)com
Monday, May 14th 2007 at 5:31 am
sir still we are in confusion with the procedure pls explain step by step procudure so that we can do it.
Thanking you sir
with best regards
P.K.PATNAIK(TRC IN CHARGE)
SILVERTOUCH TECHNOLOGIES LTD,
NO.210, SHREEJI CHAMBER, B/H- CARGO MOTORS
OFF- C.G ROAD
AHMEDABAD, GUJRAT.
Monday, May 14th 2007 at 8:55 pm
Hi dudes ,
I was so excited by seeing this site , I am having IBM X-21 model TP . I am unable to enter the TP as I dont have its supervisor Pass word and I have read all this article but unable to get in the software logic and using the other spare pc , Pl I would like to know +++++ details about the spare pc using and all about its easy ness .
If any one is having same model and encountered the same sought of situation pls do me help me out , would be highly indebted for ur kind help ,
Yours friendly
Mahesh raja
Monday, May 14th 2007 at 11:44 pm
Yahoo!. My T60’s alive again. I gotta say for all of you, the T60 needs the new tools RPC8394 and WPC8394 from allservice.ro, at first I was looking for the 24RF08 but this model doesn;t have such an eeprom.
Keep up the good work, allservice.ro!
Tuesday, May 15th 2007 at 12:29 am
Hi All, I have a T60 with BIOS password. I found the ATMEL chip on the bottom of m/b close under the CPU. It has label 25010AN SU27 with 8 pins.
Anybody experience in this model or could somebody can send me please a clean dump file? Also so you think by purchasing the PC8394 tools I will have a guaranteed success (by having some electronic experience of course :)?
Thanks for any help provided!
Lori
Tuesday, May 15th 2007 at 4:08 pm
Hi! Outstanding site mate, outstanding site! I’ve managed to unlock a T23 with your tutorial. With a friend (who has more experise in ironing less-than-millimeter pins) we’ve built the reader unit (the simple one), without a breadboard (using traditional switch, to control GND; and SCL, SDA separately). I wanted to make some photos of the process, but I forgot, but if you need, I can send a photo of the final reader unit (without the switches). The whole thing worked like a charm, found out the password, and the TB looks much better now, than in the trashbin. Keep up the good work!
Tuesday, May 15th 2007 at 9:33 pm
What is the best way to reset the password on an IBM Thinkpad X41 with an Atmel AT97SC3201 28-pin chipset ?
Your help in advance is greatly appreciated
Tuesday, May 15th 2007 at 9:33 pm
What is the best way to reset the password on an IBM Thinkpad X41 with an Atmel AT97SC3201 28-pin chipset ?
Your help in advance is greatly appreciated.
Thursday, May 17th 2007 at 3:48 am
First of all I like to thank you for providing this wonderful site.
The location for this ATMEL is for IBM (X40)
The ATMEL 24RF08CM is at the back of the motherboard and is directly under the PCMCIA slot. This chip is cover by a black tape,
1st go to Start>Run>cmd> and type in cd c:\ (This is for you to direct the folder to c drive).
Following command is all you need to type in.
C:\ALLservice\24RF08\r24rf08 dump.bin
Just for your info.
The first spare PC I connect didn’t work (Compaq Evo N610c). The 2nd spare PC (Toshiba 1860) work like a magic.
Many thanks, manag to get the password using your technique.
I have some picture taken showing the loaction of the ATEML on IBM X40, please tell me were can I email.
Sunday, May 20th 2007 at 7:02 pm
I have retreived a eeprom dump from a G40 motherboard using your info, but I am unable to decipher the password at 0×338 and 0×340 which is (17 14 32 - - - - 5D). Is this an encryption, or lack of suitable software? Thank you.
Sunday, May 20th 2007 at 9:00 pm
First of all, thank you for providing this wonderful site.
I have IBM TP R51-1830, i found the ATMEL 24RFC8 cn 0417 location and i did all but never received any dump.bin file in dir.
could Help me what’s the problem or if anyone that has the same model (IBM TP R51) please send me a dump of the eprom bin file.
Your help in advance is greatly appreciated
Monday, May 21st 2007 at 12:45 pm
Hello,
Thanks for the great solution that you have provided, i have followed all your instructions, how ever I have a dump.bin file that has memory address 0×330 encoded. Do you have a solution for this?
Your help is very appreciated.
Monday, May 21st 2007 at 2:08 pm
Hello,
I found out how to translate the “encoded” password to “scancode” yet i cant seem to get a proper password from it.
The password it dumps is “›Ûm ^Ì@”
translation ” D fI”
I have tried various combinations of this output but still have not had any luck.
Thanks for the help.
Monday, May 21st 2007 at 5:38 pm
i have sony vaio ar11m but with pass word the bios phoniex can you help me
Monday, May 21st 2007 at 10:29 pm
All service provided me with the password from my EEPROM dump, and a revised version of the software that works with Windows ME. Thanks.
Tuesday, May 22nd 2007 at 2:40 am
Hi, I am planning to try this process. My knowledge is limited with electronics, so does it matter what type of wires you use. Also do you need an Ohmmeter? Next, how do the resistors, diodes and ground connect to the Serial Port 9 pin Female connection? If anyone can send me a picture that would be great. golroch@hotmail.com
I found my R40 Amtel chip below the Harddisk, someone already posted it, should have done a search on the page, almost tore the whole laptop apart
Anyway if someone could reply to my question, that would be great.
Thanks.
Tuesday, May 22nd 2007 at 12:36 pm
First of all, thank you for providing this wonderful site.
I have IBM TP R51-1830, i found the ATMEL 24RFC8 cn 0417 location and i did all but never received any dump.bin file in dir.
could Help me what’s the problem or if anyone that has the same model (IBM TP R51) please send me a dump of the eprom bin file. nikiterani@usa.com
Your help in advance is greatly appreciated
Wednesday, May 23rd 2007 at 12:05 am
i could really use a full view picture of the reader cable assembled for reference
Wednesday, May 23rd 2007 at 12:09 am
i also would like to help with joe orginize by model and step by step photo included
Wednesday, May 23rd 2007 at 1:23 am
Hi guys!
I have the IBM Thinkpad T43… How can i make this with the SVP??? I pay you!!!! please hep me… Give me an answer at my email accont….
Robbes84@yahoo.de
Please help me!!!!!!!!!!!!!!!!!
Wednesday, May 23rd 2007 at 7:23 am
@Bill Choy
photos for x40 chip location
send photos to yahmeen32@yahoo.com
Wednesday, May 23rd 2007 at 8:56 pm
Hi ppl…
I need some help, a very good help because I have a problem that aren’t in this posts so I requered ADIMS Help! I can read the Eprom and e see where is the passwrd place but the pass are spaces, or blanck spaces and I cant put pass on the TP! I trie lots of combinations but…nothing!
ADIMS SOME HELP PLZ…
sorry my bad Inglish…I’ll wait for a replay.
filipe_fiambre_essm@msn.com
Thursday, May 24th 2007 at 10:13 pm
poderiam me ajudar por favor em um think pad x31? e o mesmo procedimento acima? ou o esquema do cabo muda alguma coisa? desde ja agradeco!!
Saturday, May 26th 2007 at 8:37 pm
Hallo everybody, i want to ask how can open bios pass for IBM Thinkpad T60?Thanks for help from now, im waiting pass bios IBM Thinkpad T60 mail me,thankz!!!
Saturday, May 26th 2007 at 8:39 pm
so mail me: avtomat75@mail.ru
Saturday, May 26th 2007 at 9:12 pm
Error 0271 - check date and time setting?????
and asked pass,,,?
Wednesday, May 30th 2007 at 1:51 pm
Hello,
I have a Lenovo ThinkPad T60. I forgot the BIOS supervisor password and need to unlock it. I have already purchased the parts to build the interface to connect to the security chip. Can someone please send me a picture or tell me where the security chip is located in the T60 and what leads to connect? My email address is: psyhead[at]gmail[.]com
Thanks, Re:x
Wednesday, May 30th 2007 at 5:29 pm
Hi Victor Voinea I try to Unlock an IBM Laptop R50 , But what I get as answere is not possible to read because the password is TCPA encrypted.
I want to buy the other program like RCPA reset service
W24RF08 license (eeprom writer)
Is there an other way to buy the programs accept with a Credit card or Visa Master card
Wednesday, May 30th 2007 at 6:22 pm
Hi, i have a thinkpad t22, and says crc1 error 0175, i know that this is the bios, but my question is… ¿does anybody have a bin working for that machine??, pleaseeeee, i really need that, if anybody has one, please contact me as ingersur.redes@gmail.com thanks already
Wednesday, May 30th 2007 at 7:44 pm
I come from germany
I have a T20 and i could read the eeprom, but the programm IBMpass2.1 doesn’t show me any supervisor password. What is wrong - I need help
Thank you.
Wednesday, May 30th 2007 at 8:01 pm
Hi i try to Unlock an IBM Laptop R50 , But what I get as answere is not possible to read because the password is TCPA encrypted.
I want to buy the other program like RCPA reset service
W24RF08 license (eeprom writer)
Is there an other way to buy the programs accept with a Credit card or Visa Master card
Please contact me on me as bresida@yahoo.com
Thursday, May 31st 2007 at 3:57 am
anybody has the rom, or bin of the thinkpad t22???, pleaseee send to meeee ingersur.redes@gmail.com
Thursday, May 31st 2007 at 11:11 am
Thanks, is there ways like this for other brands.
Regards Dexter
Thursday, May 31st 2007 at 3:13 pm
@Benito
But the other program and the reset service is provided by allservice.ro, go and ask there, not here….
Thursday, May 31st 2007 at 9:10 pm
Hello ,
tray all your explanation but unfortunetly when start the software r24rf08 dump.bin I got the message eeprom does replay.
I am using T60 with his docking station ( where we have serial port)
at backup pc.( the T60 doesn’t have directly Serial port)
Do you think this configaration can make this error message?
Or do yo have one idea from where I maked e mistake ?
Thanks a lot for your help
steve
Friday, June 1st 2007 at 3:46 am
hi sh, do you have a bin for t22???, if you are please send to meee pleaseeeeeeeeeeeeeee, ingersur.redes@gmail.com
or if you know a page or something too, thankssssssssss
Friday, June 1st 2007 at 2:36 pm
DO it ITS 100% WORKING THANKSSSSSSSSSSS AAAAAAAAA LOOOOOOTTTTTTTTTTTT
Sunday, June 3rd 2007 at 1:01 am
I have a number of ibm/lenovo recovery disks if any one needs help with that.
mark
Sunday, June 3rd 2007 at 9:24 am
I have a TP t23 lock. Anyone in San Diego area or close to me willing to help me out? I’m willing to drive to your place as long as it’s not too far… Willing to compensate you for your time. Thanks please let me know.
vixayb@gmail.com
Tuesday, June 5th 2007 at 1:00 am
i have an T30 and i dont seem to find the atmel chip it may be named othervise any ideas where i can find it? and What’s up if a connect my computer and it can not create the file (data .bin file)?.
Tuesday, June 5th 2007 at 4:29 am
if anyone have the bin of a t22, t21, o t23, please send to meeeeeeeeeeee , ingersur.redes@gmail.com
Tuesday, June 5th 2007 at 4:00 pm
ineed 2 cleer bios bassword in ibm laptop mod no r 40 e thanx
Tuesday, June 5th 2007 at 6:10 pm
Hi guys, can somebody tell me where is ths GND on the TP??
I’m a newbies and i can’t locate the GND on the motherboard.
Thanks
Tuesday, June 5th 2007 at 7:59 pm
Hi, I need the pin for the t20, the dumb.bin does not include the password in line 0×330, there are some letters, but they aren’t accepted!!!!
Help me please!!!
Thursday, June 7th 2007 at 11:28 am
Hi,
I was able to dump the data from the R24 chip. However the data looks encrypted or just plain trash. Is there a way for me to re- write a password? Any help is greatly appreciated.
Thursday, June 7th 2007 at 3:11 pm
O.K I have X40 the 24RF08 chip is located on the underside of the motherboard below the PCMCIA slot. did not solder chip tried but could not get found something online to make easier (Pomona 5250) is a chip holder that give you more room less chance to damage chip but i used two sewing needles & a eraser head from pencil (to hold both needles at same time) everything else worked like a instructed had a blast. need help or photos e-mail
Thursday, June 7th 2007 at 3:18 pm
@ Andy click buttom just under tool bar it should say Aa off click to say on and click on view in toolbar goto translation click on alternate scancode R series
Thursday, June 7th 2007 at 3:19 pm
It worked! I (had) a locked R51 Thinkpad and this procedure worked perfectly. Only trick was converting the coding in the line where the password was to ascii (I think) and it was revealed! Luckily, I used the same password for both the BIOS and the HDD. Thanks!
Thursday, June 7th 2007 at 9:16 pm
Help!!! Pease, who, than will be able!!!… Has Lost the password on supervisor (SVP) IBM T60p. I well understand in computers and know that not all so simply. Here over and over again tried to raise this subjects, but as well as have not discussed. If, there is information send on mail admin@rd.com.ru Thanks!!!…
Friday, June 8th 2007 at 8:19 am
Help!!! Pease, who, than will be able!!!… Has Lost the password on supervisor (SVP) IBM T60p. I well understand in computers and know that not all so simply. Here over and over again tried to raise this subjects, but as well as have not discussed. If, there is information send on mail admin@rd.com.ru Thanks!!!…
Sunday, June 10th 2007 at 10:50 am
PLEASE GUYS, WHERE IS THE GNDDDDDDD
PLEASE
Sunday, June 10th 2007 at 2:36 pm
Need Help. OK so i have looked on many websites and have determined that there are not many answners about the T43. I cant seem to find the atmel chip on this unit. Does anyone know if the crack is possible with this unit. Or where i may find the chip. I have the main board out and have checked it top and bottom. I think that i am missing something> PLease help.. Thanks in advance.
Sunday, June 10th 2007 at 8:18 pm
There is a simple answer, RPC8394 and WPC8394 reader and writer for PC8394T-VJG used in T43.
Monday, June 11th 2007 at 8:48 pm
Ok got it. But do know where the chip is located on the mother board? I cant seem to find anything on the board that says Atmel. Any suggestions on the location of a picture of its location.
Thanks again
Monday, June 11th 2007 at 9:30 pm
Hi,
I used the same steps to unlock my T42P password but i am not able to see any password in dump.bin file.
Pls help me in this regard.
Thanks
Tuesday, June 12th 2007 at 1:50 pm
Jake,
What ATMEL? T43 has the Winbond PC8394!
Tuesday, June 12th 2007 at 6:16 pm
softpedix.
I now understand that. Thanks. Where is the Winbond PC8394 located at on the board. Thanks In advance
Tuesday, June 12th 2007 at 8:40 pm
a friend gi-me a old t21 but he fargot the bios pass.
here is the softwere to red the eprom , i cant find is it here
tanks
Wednesday, June 13th 2007 at 12:00 pm
Hi again!
Do you guys know, what kind of supervisor protection is in a TP 560Z? The same ATMEL chip, or other?
Thank you!
Thursday, June 14th 2007 at 2:15 pm
Hi Everyone,
I have read the instructions and the diagram. I want to try for my T21 but I am not sure how and where will I connect to the spare PC. Should I connect the soldered serial port(female) to the male port on the spare PC?
I would be so grateful for your reply.
Martin
Thursday, June 14th 2007 at 2:42 pm
That’s true … good luck!
Thursday, June 14th 2007 at 4:54 pm
NEED HELP
Hi guys, i’m trying to crack a password bios for a thinkpad t42, but i’m a newbie, can somedbody send me a photography with the place of the GND??
my mail : lilimamacece@caramail.com
Thanks
Friday, June 15th 2007 at 5:47 pm
Just did this on a T42 - everything works 100% !!
But remeber to press the A->a button (top left) in the “IBM Pass 2.0 Lite” app.
On a T42 the ATMEL is under the wifi card (under the mousepad).
To Moimeme: GND is everywhere!
I screwed the GND wire in under the shield for the DVD bay.
Wednesday, June 20th 2007 at 4:25 am
I have T22, I went to radio shack today.. but could not find 2200 Ohm Resistors, instead found 2.2 Ohm (indcated on the diagram but requirement list). Even there are two options in 2.2 Ohm ie. 1/2 watt and 1/4 watt. I just bought as set of 2.2k Ohm (1/2 watt) and 220k Ohm (1/2 watt).. which one will be the right one? Any suggestion?
Wednesday, June 20th 2007 at 9:15 pm
Is there any way that i can clear the supervisor password on my ibm thinkpad 600 without soldering. Ive heard that you can use an eight pin test clip, but i am not sure of the details.. Can someone help me??
Wednesday, June 20th 2007 at 11:02 pm
@Oblivious
See what Ray Kawakami experienced with the 600:
http://www.allservice.ro/forum/viewtopic.php?p=915#915
No need to remove the board, anymore
Wednesday, June 20th 2007 at 11:11 pm
thank you for this very good programmes and also good thanks for allservises website
Thursday, June 21st 2007 at 10:45 pm
hola si querian pregutar me da foto de disco rigido para ver manual
Sunday, June 24th 2007 at 11:18 am
Hallo.My friend bought Lap Top Lenovo T60.It is booting normally but when You want to enter bios it is asking for password.Wich kind of password is this,is it supervisor pass? I can work in Windows,I think even that I can reinstall it,because when I press F12 key it is offering me boot options.Only thing is that I canot acces bios.Is the procedure for removing that password the same that is offerd here or it is easer? Because I have had an Lap Top T30 wich hade this power on password.It was asking for password on power on.Can somebody help pls?
Monday, June 25th 2007 at 2:37 am
Can you put this instruccions in spanish?, Thank you.
Tuesday, June 26th 2007 at 5:31 am
Please help , I am Also stuck up with the BIOS Password
Wednesday, June 27th 2007 at 2:16 am
i am having t22 laptop i couldnot find the bios please help me with steps
thanks
Thursday, June 28th 2007 at 3:26 am
I succeeded in tapping the chip on my 390x, but the password is not revealed as in the tutorial. the characters on the line that is supposed to have the password are not discernable. any advice??
Thursday, June 28th 2007 at 7:15 pm
hi hope you can help i was given a tp 770 do you think this procedure will work on this model?it was free so nothing to worry about if it dos not work.
Friday, June 29th 2007 at 1:50 pm
I’ve found a 24C01 ic on the 560z located at the bottom side of the motherboard, between the Intel Flash and PLOW2 ics. I will post some photos, if wanted. So, i am going to break the little one in a couple of days, but, still have to solve some problems with it. Whish me luck
Tuesday, July 3rd 2007 at 10:33 am
i don’t know how to hack my SPV password.
please teach me how…
hopefull……………………………
Tuesday, July 3rd 2007 at 5:58 pm
I successfully retrieved my password using this technique, however, I now have EEPROM data errors.
0187: EAIA data access error.
and
0191: System Security - Invalid remote change requested.
I have been through the loop of pressing F1 to enter set-up.
I think the EEPROM may not be soldered in correctly or I have damaged it. Any ideas?
The thing I have noticed is that the SDA & SCL solder points on the circuit board do not seem to be connected to any circuit tracks. There are a couple of copper circles with holes through the board next to the SDA & SCL surface mount points. Should these be connected with solder. I tried that too but this time the laptop just bleeped at me, so I don’t think they should be.
I appreciate any help anyone can give me.
Many thanks!
Tuesday, July 3rd 2007 at 10:09 pm
How much does a R40 pentium 4m costs?
Tuesday, July 3rd 2007 at 10:53 pm
When i try to enter to the bios utility it show an error to me something like it has been tampered or something like that, then it asks for the password
Wednesday, July 4th 2007 at 4:17 am
Look on ebay there are people that can help you, just search for IBM Password Removal, I have unlocked mine on ebay with a guy that has laptops 4 less from IL or something like that, I payd him to do it and I had my laptop back in less than a week in perfect working condition. I believe he can remove the password from any IBM model. I tried to unlock myself and I spent more time and money than my T43 is worth it, so I touth to give you guys a clue if you’ll be in trouble like me. You’ll spend more money than you’ll pay for the parts but if you think how much time you’ll spend reading all this forums and how to do it than you would reather go with someone that does this every day. If I would have found this info before I would have been less frustrated.
Wednesday, July 4th 2007 at 4:09 pm
hi!
wer weiss welch E-prom hat T43, und wo ist.
Danke.
Wednesday, July 4th 2007 at 9:47 pm
@Nathen
All the guys that claim to unlock newer IBM laptops are just using allservice software. This is available for everyone, the software is PC8394 programming tools, so don;t be silly.
Thursday, July 5th 2007 at 2:57 am
I have problem with T23… can any1 help me.. it d same the bios password prblem.. with the lock ICon on side.. .is it applicable this procedure to my TP T23?.. Can any have any idea.. I Really need Help..
Thursday, July 5th 2007 at 9:30 am
plz i really need help :((
Thursday, July 5th 2007 at 11:13 am
Hi all!
My father died and now i own his r52 can i do this tutorial or do i need this full package for money? actually i got no money:(
Sunday, July 8th 2007 at 8:05 pm
To fix a nonworking T21 my son bought a t21 motherboard at a local internetshop, RenS computer. The guy said it should be working. Starting up, hurray. Oh no, pass word asked… Shop owner asked for help: claimed ou own fault, could not get him to refund or give any other help. My opinion, he stole €60,- from my son for a unusable board. Pass the word: R&S computer in Holland can’t be trusted.
Anyhow: your site did bring the solution. Build the electronics, resitors and zeners only, downloaded programs, soldered in and found the pasword. It realy works now.
Thanks a lot
Erik
Sunday, July 8th 2007 at 8:36 pm
IBM Thinkpad T40/p , T41/p , T42/p Password Security chip i cant find it on my r40 board can somone help me
Tuesday, July 10th 2007 at 6:47 am
have problem with T23… can any1 help me.. it d same the bios password prblem.. with the lock ICon on side.. .is it applicable this procedure to my TP T23?.. Can any have any idea.. I Really need Help..
need help….
Tuesday, July 10th 2007 at 6:48 am
i have T23… with … a password luck too.. i need help..
need help….
Tuesday, July 10th 2007 at 5:06 pm
i have a t-21 look bios password , i pay a new eprom but were i can bay a new eprom in europe , or i sand the pc to unlook.
thanks y need help , beacause my dogther lok-me the PC t-21
Wednesday, July 11th 2007 at 5:47 am
Thanks Nathan you gave me the information I was looking for, I did not want to spend my time learning how to crack a password. I found the guy on ebay (ebay ID: less4laptops) and he unlocked my T30 for $25 + shipping, I’m glad I did not spend too much time searching for answers. I got my laptop back in 5 days. I’m really exited to have my laptop back :))
Wednesday, July 11th 2007 at 5:24 pm
I really appreciate if anyone can send me the bin of a t21.
Please send it to fdocino@hotmail.com
Thanks in advance
Friday, July 13th 2007 at 9:32 pm
any1 know where i can download a service manual for the t22 from the internet? thanks!
Saturday, July 14th 2007 at 5:48 pm
What really is the point in attempting to recover your own/lost password from an IBM thinkpad laptop computer ?
Are all you people really going to go out and purchase little things called diodes and resisters etc. and then attempt fine soldering of wires to the 24RF08 chip on a motherboard. After, ofcourse you have spent lord-knows how long stripping it down !!
I notice someone on this site has published a ‘photo showing you the 24RF08 chip. Small is’nt it ?!……….What he does not tell you is that this chip is also produced in the 14-pin package and is present in many models of thinkpad !!
You will need some very fine soldering skills indeed to attach wires to THAT particular chip !! The chances are quite high that unless you have previous training in this field, you will scrap your laptop !!
There really is no point in all this time and trouble when you can get it done properly for as little as £30 + postage now, on the Ebay.
Sunday, July 15th 2007 at 6:40 am
Hi. Wondering if you have a procedure on how to recover a thinkpad A31 supervisor password?
Sunday, July 15th 2007 at 10:50 am
The A31 model contains the 14-pin vesion of the RF08 chip. Forget any procedure unless you are a time-served engineer !!
Best bet is to go to ebay and search for user-pushkin1974, and then send your unit for a lousy £30 plus postage and get it done properly !!
Monday, July 16th 2007 at 1:26 pm
poe
Monday, July 16th 2007 at 2:10 pm
A31 is having the 8 pin chip! I guess you’re trying to advertise somebody who just takes money for an operations that it’s free basically. Mike, did you see this guy?
Monday, July 16th 2007 at 2:28 pm
A31 - chip location, in rest is exactly as for T40-t42
http://www.allservice.ro/forum/viewtopic.php?p=2747#2747
Tuesday, July 17th 2007 at 3:21 am
I am unable to find the eprom for the T43. Is it the 24c64rp? That is the only chip that I know is an eprom. I really need this, so who ever knows the location please email me. rsmith86@gmail.com
Thanks
Tuesday, July 17th 2007 at 6:06 pm
i conneted everything like the diagram, and when i press enter i cant find the dump bin file ,how do i find or tell if and where the bin file has gone,can anyone help!!!
Tuesday, July 17th 2007 at 8:25 pm
I have tried both systems Zenor and IC (max232c) and with 1st (Zenor) I get no action from the computer,with max232c it say no eprom found anybody can Help
Please..!!!!!Rodney.
Wednesday, July 18th 2007 at 3:20 pm
According to “softpedix”, this operation is ‘ basically free ‘, as he puts it !!
So far you’ve spent time and money on components and soldering and you’ve still not sorted it out !!
It should be mentioned here that a PROPER password removal is not performed by all this messing about with circuits, solder and bodged software, it’s done using the Antron test-head. This device is inserted into the cpu-socket and the cpu is then inserted into the head. The board is scanned and a complete schematic is drawn-up on a monitor in block-diagram form. Any firmware on ANY chip is then dumped to an editor for perusal by an engineer. That is why password removals are cheap nowadays as there is no soldering done during extraction. Only the 2-bit companies and tight-fisted cheapskates are fool-enough to risk their laptop(probably expensive) on dubious operations !!
Wednesday, July 18th 2007 at 6:23 pm
I have a IBM Thinkpad T42p and i forgot my power on password can i overwrite it somehow without using like disks to clean it out. I need help. I cant figure it out and when i got to my bios its locked also. Can anyone help me?
Wednesday, July 18th 2007 at 6:26 pm
i dont want to take it apart though so is there a way to bypass it?
Wednesday, July 18th 2007 at 7:13 pm
Can anyone give me advice? Please?
Friday, July 20th 2007 at 3:02 pm
Wrong ’softpedix’. The only person who is blowing ‘hot-air’ as you call it, is YOU…..trying to get the chips off the the boards !!……my boy.
I have just over 21 years experience in electronics engineering and microprocessor based systems. I rather think that it’s YOU that holds the title of ‘boy’ !!
I know about the Antron test-head…………….Because it was ME who sold it to Pushkin for £7,500 smackers !!
That’s how i know what i’m talking about.
Most of the people on sites like this are dealing with stolen laptops anyhow. Let’s be honest……….What type of person forgets their password when they are typing it everyday in order to use their laptop ???
Oh yes, almost forgot…………Does anyone know if this pedix-boy works for allservice ?………..He keeps mentioning their name all the time !!
Friday, July 20th 2007 at 6:53 pm
Hi,
Anyone can direct me to locate ATMEL Chip on T22 board. I would be more grateful if you can show me with the picture. I checked the board carefully but couldn’t find any chip written ‘ATMEL’.
Reply me at my email: martinralte1@yahoo.com OR in this page.
Saturday, July 21st 2007 at 6:45 am
no, its not that i stole it. i really have the worst memory in the world. Please help
Saturday, July 21st 2007 at 9:17 am
any1 .. can just answer my question is this procedure.. also applicable to T23? i Really Need the answer thankz. again..
Saturday, July 21st 2007 at 10:18 pm
@Stebra:
If you read this forum “da capo”, I am sure you’ll notice that all the discutions here are about using allservice’s free software, so its normal for anyone to mention their contribution. I will repeat this word for you: “FREEWARE”, does this mean anything? Hello? So go anywhere else and sell your 7500 non-existent solution (very amusing after all, I laughed with tears, no offense, but was a good one..) and let us be.
Oh, did I mentioned some idiots trying to make money.. I didn’t mean you. Do you feel offended? I know it hurts, but I can do anything for you, is the nature. So, if you didn’t come here to provide a free solution, then don’t come to sell your Pushin or Gorbatchev friend, because we simply don’t buy it. Got that?
@Martin, Francis: T20-23 have a 14 pin eeprom, it’s near the memory SODIMM slots. Just remove the memory cover and you’ll find it in seconds.
Monday, July 23rd 2007 at 2:48 am
thankz MArtin.. its the simple chip right beside the memory right?
Monday, July 23rd 2007 at 2:58 am
i GOt.. but the problem now is where i should solder the 3wires …i mean the ground.. the 2 for the reader… am confuse.. itz for the 14pins atmel chpiz
Monday, July 23rd 2007 at 3:55 am
I did with T22. It has 14 pin..! It works very well. 8 and 14 circuit instuction is found in http://www.allservice.ro/forum/dl/simple-i2cprog.pdf.
If any one like need helps email me at martinralte1@yahoo.com
Thanks,
Martinralte
Friday, July 27th 2007 at 1:25 pm
God damit, soon 500 comments!
Saturday, July 28th 2007 at 12:46 am
Please… I have fujitsu siemens laptop, and locked bios too. Do anybody knows how can I do it on this way with FJS or to redirect me to some site? Thanks
Sunday, July 29th 2007 at 7:13 pm
Help,
where can I order the C5V1 Zener diodes. cant find it
thanks
Monday, July 30th 2007 at 11:16 pm
If you an 390e tp the chip is located in the the right hand corner right next to an compactior and surround by usb and power porte
Tuesday, July 31st 2007 at 8:15 am
hey, man i have also this supervice password thing.
So i hope you could help me….:D
I have a IBM Thinkpad R40e
how can i open it…??
hope u can help me…
Wednesday, August 1st 2007 at 12:07 pm
hi mike, how about Thinkpad T60. pasword supervisor please. thank’s for your attention.
Thursday, August 2nd 2007 at 9:46 am
HI IM TRYING TO CRACK A PASSWORD(BIOS) IN THIS WAY BUT ALL I GET IS A PROMPT THAT SAYS ..EEPROM UNAVALIBLE..
WHAT THE HELL DOID I DO WRONG?PS I HAVE A A31P..PLEASE HELP
Saturday, August 4th 2007 at 11:37 pm
I need soft w24rf08 ( cracked)
Monday, August 6th 2007 at 3:30 pm
I am trying to locate the Atmel 24R08 chip but cannot fint it on my Thinkpad R32. Only able to find the Atmel 93C46. Hope someone can help.
Tuesday, August 7th 2007 at 3:27 pm
I have a T30, I obtained to execute the circuit, only that I do not obtain to descodification of password administration..$!!Ì… Somebody can help me?
Tuesday, August 7th 2007 at 6:19 pm
I have doing all the plan, i runned Itester and all seem to be connected, but when i do the command to make the dump, it say eeprom not available.
Tuesday, August 7th 2007 at 6:33 pm
NEVERMIND IT WORKED, I WAS ON VISTA THAT WHY , I TRYED IT WITH WIN XP CMD AND IT WORKED !!!!!!!!!! WOOOOOOOOOTTTTTTTTT
Thursday, August 9th 2007 at 1:30 am
It’s half past three in the morning, and I got pass!!!
A friend of mine brought me a laptop (of questionable origin) to repair. Firstly, I soldered wires on wrong side and was afraid that the chip was burned. However, everything was ok, and I got password.
Incredible
Thursday, August 9th 2007 at 9:31 pm
i have t42p, i found the chip ,i solder the wires ,everything by the book ,i entered the command in the command prompt ,and it said that the circut not found or something like that , and than after few tries ,the notebook wont start ,what shoud i do ,is the motherboard gone dead, or just the eprom ,should ii must programed again
please help me ……. if there anything to do with it
thank u
Thursday, August 9th 2007 at 10:31 pm
i also ran a file in C:\ALLservice\24RF08 directory called itester.exe and than i cancel it in the middle ,than the tp went dead
maybe this is what cause me the problem
please somebody help me ,please
Friday, August 10th 2007 at 2:32 am
I have a ibm thinpad T22 mobo with FRU 12P3890.
I can’t find he ATMEL chip.
Any help ?
Friday, August 10th 2007 at 6:24 am
hi,
I have a laptop IBM T 21, but I have a trouble with the AC adapter,, it does not work so I need a schematic diagram of this ac adapter. Can you help me>
Thanks
Friday, August 10th 2007 at 4:01 pm
Can anyone send me a clean EEPROM dump from IBM ThinkPad T42p?
can i program it back, cause the tp doesn’t show any screen when i turn it on, what should i do ? is it worth it ?
please somebody hekp me
eagle1234@walla.co.il
Saturday, August 11th 2007 at 1:54 am
Thanks! instructions couldn’t be simpler, used it to recover my T42 TP so problems, worked on first try. very well written!
Monday, August 13th 2007 at 5:40 am
need help
Monday, August 13th 2007 at 6:21 am
QUESTION 1
Not IBM but second pc, when it asked me to fire up cmd on other pc-ok I did
Then at that point what I see is C:\documents and settings\Eddie Wilson
Where do I go from here? WHAT I DID WAS I tried to type cd\dir enter then cd\dirr24rf08 enter
I don’t know can you give me the steps to navigate TO WHERE I NEED TO BE PLEASE
Question 2
On IBM T42P on start up I hit F1 and then it’s says enter bios THEN I get ERROR 0271: CHECK DATE AND TIME error 0176: SYSTEM SECURITY-THE SYSTEM HAS BEEN TAMPERED WITH. THEN I SEE A PICTURE OF A LOCK (WHAT DO I DO)
LAST QUESTION
TELL ME WHAT IM DOING WRONG. Okay ON SECONED PC I TRIED TO NAVIGATE TO WHERE FOLDER SUPPOSE TO BE AT, WITCH I DONT KNOW
MY GUESS IS C:\ALLSERVICE\24RF08 - THEN I STOP AT THAT POINT. I THEN GO TO IBM AND TURN ON AND HIT F1 TO ENTER BIOS THEN I GET MY ERROR’S BUT I JUST WAIT TELL I SEE NOIGTHING BLINKING OR FLASHING PREETY MUCH I WAIT FOR A BLANK SCREEN THEN I CONNECT THE SERIAL PORT TO SECOND PC THEN I CONNECT SDA TOGETHER THEN I CONNECT THEN SCL, THEN I HIT ENTER ON IBM AND I GET NOITHING, CAN YOU HELP ME PLEASE
THANK YOU
Tuesday, August 14th 2007 at 5:03 am
No chip on IBM A21m
Thursday, August 16th 2007 at 12:49 pm
So Do It Yourself:
I was able to complete the task of unlocking my T30 by using your process however it went much easier
than I planned or you described. After building the ckt and purchasing a USB to serial converter from radio shack and installing per the procedure the loaded down BIOS let me into Bios setup without extracting or using the software tools. I did try the exe apps but came back with some error referencing was nort able to detect data.(Perhaps the ckt was a white noise antenna which confused the Bios. At any rate I was able to assign a new hard drive password and delete the sys pass from my T30.
Sincerely,
pvincentdaniels@msn.com
Sunday, August 19th 2007 at 8:21 am
Is here anyone nowing something about de IBM THINKPAD type 2673?
A can’t get into the bios in order to change the booting device from harddisk to cd-rom. Password needed.
Thanks, Edward.
Sunday, August 19th 2007 at 3:39 pm
Hi,
My T20 thinkpad has come up with a stop post error 0175.
I have read many articles some saying this is a password problem others say I have to replace the board, I am not sure which it is. I have made the reader but have not attempted to use it yet until I know if this is going to fix my problem.
Could I please have a little help,
It would be greatly appreciated.
Regards,
Sue
Sunday, August 19th 2007 at 4:47 pm
Successfully read the chip and opened file in ibmpass but there are rows of f’s around rows 300 - 350 and nothing decodes for these rows. Does this mean it cant be unlocked?
thanks for the great website.
cheers
Stu
Sunday, August 19th 2007 at 5:44 pm
Anyone had the same problem i have..
when dumping the chip all is ok ,i receive the 1024 bytes and when i open the file with ibmpass 2.1 lite i can see stuff like this at adress Ox227 :
ThinkPad T42
so i think that my read is ok,but at adress Ox330 the data i see is only dot and on the hex side i only see 00’s
but i still cant come into my laptop,it all happen when i deceided to remove the password,so that my kids could use it after buying my new one….
anyone can help??
Tuesday, August 21st 2007 at 3:36 am
IBM Thinkpad R40. I have pictures if you want them of where the chip is that this site is refering to. Tim mentioned it’s location in the discussion area. Mike, e-mail me if you want these. They are a few meg in size. Probably under 3. The location is indeed below the hard drive and about 1″ over from the right front edge of the USB connection.
Tuesday, August 21st 2007 at 6:16 am
Hi,
to admin: thanks for these good informations…
I have an IBM X30, and after I modified the PASSWORD (the ascii caracters was not readable…), at the 0×338adress and 0×340, the thinkpad tells me ERROR 0175: BAD CRC1.
Whre could I find the checksum bytes in order to change them, or can someone send me a file of its EEPROM, in order to download it.
Thanks
Nicolas - malinerie@free.fr
Tuesday, August 21st 2007 at 4:11 pm
After getting a row of ‘f’s I went back and tried another dump and this time I got the password revealed at 0×330 as promised. Many thanks to your website.
IBM T20 now back up and runnin’
Stu
Thursday, August 23rd 2007 at 7:05 am
How do I remove my password onder “leave a reply”?
Can someone remove it, because I can’t.
Friday, August 24th 2007 at 9:30 pm
Hello,
I was able to recover the supervisor password of a R50e laptop using this method.
Thanks!
Saturday, August 25th 2007 at 1:58 pm
am tryin to do this on a t30 2366 and is not workin out all i get is a error code sayin circuit not found my chip looks backwards compared to the pics so which is the sda scl is there a way to tell like pin number need help soon before i pull out my hair
Saturday, August 25th 2007 at 11:32 pm
@ Captiant30 …….
I used the 1N4733A 1W Zener Diode (Catalog #: 276-565) from Radioshack, it worked for me.
Sunday, August 26th 2007 at 3:12 am
Hi,
I posted a message on the 19th and forgot to give my email.
Could someone please help me regarding T20.
Regards, Sue
the_pooks@hotmail.com
Sunday, August 26th 2007 at 5:20 pm
Worked great, (T40) thanks!
Wednesday, August 29th 2007 at 4:24 am
still waitin for a response to my last post
Wednesday, August 29th 2007 at 9:30 pm
Can I use an standard diode (ZD 5,1V) aswell?
Thursday, August 30th 2007 at 8:12 am
suppervisor and HD password problem, i have a Thinkpad X31
please help me, someone offer me this computer
Thursday, August 30th 2007 at 8:12 am
suppervisor and HD password problem, i have a Thinkpad X31
please help me, someone offer me this computer
nestorgba@hotmail.fr
Thursday, August 30th 2007 at 8:32 pm
well iam happy about the stuff you give foe free keep up the good work give knowledge and gain more iam also willing to help in any thing in your ordeal please mail me also i need schemetic diagrams of laptops p3 and p4 as new components are being manufactured adn put to use in laptops
Friday, August 31st 2007 at 9:11 am
Thanks for the info. It took a couple of hours to complete, but i was able to recover the password on my Thinkpad a22m. By the way, the factory supervisor password was “SUPPORT”.
Friday, August 31st 2007 at 5:10 pm
ibm type 2652.
salut.je arives pas trouves le eprom je ublies les codes je arives pas entre dans bios.merci
Saturday, September 1st 2007 at 3:29 pm
SOFTPEDIX I have a ibm thinkpad Z61t which boots straight to bios, can the above software/hardware crack work on this?
gratefull for any info recieved
Saturday, September 1st 2007 at 3:53 pm
ciao,io ho un ibm tinkpad t20 che non funziona,mi mandi un link dove posso trovare come procedere per individuare il guasto ?,grazie
Saturday, September 1st 2007 at 9:26 pm
Mrwillson,
No, the above software doesn’t work, you need PC8394 programming tools from allservice. The method is pretty much the same…
Sunday, September 2nd 2007 at 7:12 am
still no luck with my t30 2366 still says no curcuit found need help am goin nuts
qpid315@hotmail.com
aim lust8783
Sunday, September 2nd 2007 at 4:06 pm
what is the password set by ibm corporation (by default password)
Monday, September 3rd 2007 at 1:00 am
Great! Thank you so much for all the hard work to post a such great threat.
Monday, September 3rd 2007 at 9:52 pm
Hi
Has any one retreived the bios password on a T60 succesfully??
Tuesday, September 4th 2007 at 10:54 pm
Can any body help me with the T60, where is the chip located. Is it the same circuit used?
Wednesday, September 5th 2007 at 12:03 pm
I got the dump from my 390x but it did not reveal the password.. line 330 read all o’s and line 340 read 58 c4 fa 0b 44 b4 fa 02. Above and below were all f’s. the far right column showed y’s with the umlaut sign over them. Does this make sense to anyone? It sounds like Stu (8-27-07 comments) succeeded by running the process again. Is it a common to need more than one attempt to get a successful read? thanks, dan
Thursday, September 6th 2007 at 5:57 pm
HOW DO I FIND OUT WHAT KIND OF THINK PAD I HAVE AND COULD U TELL ME HOW DO DO IT AGAIN AND,IS IT ANOTHER WAY
Thursday, September 6th 2007 at 7:50 pm
i intend to use this method however i cannot locally find a pair of the Zener diodes.
C5V1…nothing local..any suggestions as to where to look? what kind of scrap equipment would i find the proper ones in?
i have a T22, original board croaked, bought one on ebay, locked BIOS…had it for a couple months sitting on the floor by my desk…would be helpful if you can help me!
would you be willing to assemble one for a reasonable price + shipping to me?
email’s best way to get me.
thanks for the good walkthrough though, gives me hope for this T22. [2648-4EU]
-bonestonne
Friday, September 7th 2007 at 10:28 pm
I have a A20m but I cant find the atmel chip anywhere. I took off the keyboard and almost all the components but I don’t see it. Is it on the back? The Maintenance manual doesn’t tell you how to get to the other side of the motherboard. Does anyone know exactly where it is or have any pics? Thanks.
Saturday, September 8th 2007 at 1:12 am
I have T41 it has Power on password. Is it possible reset power on password as well.
Please help me out. Thank you.
Saturday, September 8th 2007 at 8:32 am
hi, where do i find the amtel chip on my ibm r40 thinkpad , can anyone help me please.
Saturday, September 8th 2007 at 9:35 am
hi ,i found the amtel chip on my r40 but it has 24 pins , at97sc32012632510237 is the number on , is this the right chip , if so which is the scl and sda . thanks
Saturday, September 8th 2007 at 1:46 pm
On a TP A31 I found the chip under the pcmcia slots. That tip about the AA button being on helps too. When you do try turning it on, I found I had to put some of the stuffing back in to get the BIOS screen up. I literally took every module off to find that 8 pin chip, I’m glad its still working after all that.
Saturday, September 8th 2007 at 4:05 pm
Don’t forget to activate the transcode button. I was wondering why I could not recognize the correct data
But then everything works fine. Thanks!
Sunday, September 9th 2007 at 3:10 am
Hello everyone,
I have a thinkpad t30 - eprom actmel 24rf08 with 8 pins.
Now stops during boot with the message error 0175 bad crc1, I think that is because
the contents of the actmel eprom is scrambled or something like that,
so i have to replace it with a good one, so anyone that has the same model, please send me a dump of the eprom bin file.
My e’mail jose.jabr@gmail.com
Tuesday, September 11th 2007 at 7:15 am
what to do, when starting writing {System Security. Embedded Security hardware tamper detected. } code 0192
Tuesday, September 11th 2007 at 10:48 am
Please, how do I remove my e-mail address onder “leave a reply”.
Thanks, Edward.
Tuesday, September 11th 2007 at 11:28 am
hello my ıbm A31 loptop bios ım not bios clear pelase help me
Wednesday, September 12th 2007 at 12:49 am
Worked like a charm on an x30… only thing the walkthrough doesn’t list is that when reviewing the dump.bin in IBMpass, you need to click the A-A button to turn it to A-A On.
Monday, September 17th 2007 at 2:38 am
Procedure worked fine on a TP 240x. The ATMEL chip is on the bottom of the motherboard. IBM has service manuals you can download at http://www-307.ibm.com/pc/support/site.wss/MIGR-4KLKLP.html that helps disassemble the laptop. Thanks for posting this information!
Wednesday, September 19th 2007 at 2:48 pm
I have a X60 with a 28 pin atmel,can this one be done?
Friday, September 21st 2007 at 5:35 am
Well done to Victor who has saved lots of people money.
I seem to have done something to my A31.
Since i soldered the wires onto the amtel chip the screen will not work & no beeps. keyboard doesn’t work either.
I thought I’d try & recover the password anyway & bingo like one of the previos posts the password is SUPPORT! (so the Amtel chip is still working)
Any ideas on what I may have done?
I removed both the battery pack & the CR2022 battery backup overnight - could this have caused it?
Friday, September 21st 2007 at 6:14 pm
Good work, this article!! I’ve done one thinkpad of my friend, even don’t know model:D If you do it exactly step by step it have to work. Thanks a lot for this.
Monday, September 24th 2007 at 9:21 pm
Help Please!!
I built the simple circuit connected it to the Atmel 24rf08 chip on my Tnikpad T40. Ran everything just like it says and all I get is two different problems, at first got message that says eprom not available so I thought I soldered wrong on the eprom chip. Resoldeered then got error messages.
error 0187 EAIA Data Access Error
error 0191 Security System invalid remote change requested.
which is followed by
press to enter setup.
When I attempt to run the r24rf08.exe program I still get the message of eprom not available.
If someone could render assistance it would be greatly appreciated.
Please send info to: fredengland53@msn.com.
Thank you very much!
Tuesday, September 25th 2007 at 3:08 am
Hi
i can’t find the chip on my laptop i took it appart and i don’t see any where it says U53 i have U3 U33 and if you wanna see a pic of the inside of my laptop so you could tel me where is locate it let me know, send me yr e-mail to ledesma45@hotmail.com
Thanks
Tuesday, September 25th 2007 at 3:10 am
I forgot to mention that i have a IBM Thinkpad T60 and the start up password i don’t know it, have anybody had same problem that would like to share their password with me to see if it work for me.
Thanks
ledesma45@hotmail.com
Thursday, September 27th 2007 at 9:04 am
Help please …I don’t understand.What side of the db9 is in the schematics ? The back (where we should do the soldering) or the front one?
Friday, September 28th 2007 at 10:05 pm
hello there
for the one who was suffering from the null characters, from the bios, and also there was a guy told him that you dont have a psswork in your eeprom. okay the same happened with me and i got null character like rectangle %1,so at the same page i mean the ibmpass 2.1 lite at the upper left side you will fine two letter AA WITH AN arrow from above just push the bottin to on and it will change your null to real work i mean password. if it did not work go to view and you will see translation botton so put it on scancode and then pust the AA you will have the right answer, because first i got 1%1% and when i pust this thing it really work and i got DUNKIN as a password, and really i wana say thanks for the one who post this great information.
Saturday, September 29th 2007 at 8:21 pm
°celebration!°
another t42 was saved today:)
this was my uncles…
for those with “eeprom not available” ->like another one mentioned before, look that no other program blocks the com. also your reader needs good connection! poor soldering of the resistors and zs make it real hard to get a good signal. crocodile clips for connection to the reader work quite nice. and try it several times…
good luck
Sunday, September 30th 2007 at 3:25 am
I have an R40 and have just completed this. It does work though it is a bit tricky. To access the chip, remove the screen, keyboard and keyboard bezel. Take off the metal cover over the hard drive housing and also remove the hard drive. There is a thin sheet of black plastic that you need to wriggle under the hard drive housing to expose the chip. There are 2 8 pin chips and you need the one closer to the front of the laptop. The SDA connection is on the top right corner pin, the SCL on the pin to its immediate left and the ground to one of the large ground pads. The data is exactly where the instructions say it will be. In my case the password was EVHSBIO.
Thanks for posting this info on your website and for providing the software.
Sunday, September 30th 2007 at 8:35 pm
ok i’m stuck what is the reader circuit that is meantioned here? and do u have to solder it or is there another way around it? tks.
Monday, October 1st 2007 at 9:36 pm
my brother gave me his old ibm thinkpad labtop he lost recovery disk where in rhode island can i buy a recovery disk hope you can help me thank lillian
Wednesday, October 3rd 2007 at 1:52 am
Hi could anybody tell me where is the Eeprom on my thinkpad T60?
i took everything apart trying to read all the chips and nothing.
PLS helpppppppp!!!!!!!!!!!!!!!!!!!!!!!!!
Thanks
Wednesday, October 3rd 2007 at 12:00 pm
serial cod bios ibm thinpad seri 553846c/02/99
Thursday, October 4th 2007 at 8:26 am
tag, ist mir bissel zu schwer, muss bei ebaygekaufte T41 HDD PW löschen, jemand aus DE(Berlin) der mir evtl helfen kann??Bt melden taqi74@yahoo.com
Thursday, October 4th 2007 at 7:42 pm
hi, is the foto above on the top showing supervisor (SVP) password window or is this for Hard Disk password?? because on my t41 shows exactly the same symbol after starting the notebook, but if i remove HDD i can easy go into BIOS, and in there there isnt any supervisor (SVP) password been set, can any1 help me?? if i ll buy a new HDD the problem will remain there?? HELP ME HELP me SOS
Thursday, October 4th 2007 at 10:04 pm
Hi Guys!
I’ve been trying to recover the supervisor password on a TP R50e and all I get is a Password I can’t use.
Many of you are saying that this might be encrypted using TCPA. Have anyone found some way of decoding this?
The password that came up is Fýgæ“[x (ASCII) or 46 fd 67 e6 93 5b 78 a0 (HEX).
If someone knows how to decode this I’d appreciate very much indeed.
Thanks!
Saturday, October 6th 2007 at 8:02 pm
i am working on a dell inspiron 700m and am having difficulty finding the serial eeprom chip. i have found a 93c46w6 chip and a atmel tiny12 chip the bios chip itself is a pmc pm40fl004T-33VC.can anyone help me? thank you
Sunday, October 7th 2007 at 11:09 pm
hello admin and all helper here
i want first thank u all for sharing such usefull info
i have a problem with an old TP 390E type2626 in supervisor passwd
i see that am obliged to release a hardware for restore
so if u can mail me with some good picts of soldering and making this kind of rs
updater hw
tnx in adavance
sincerelly John
best wishes
Monday, October 8th 2007 at 2:21 pm
thanks sow much for your help
Wednesday, October 10th 2007 at 8:20 pm
does anyone have any pictures of what this whole unit actually looks like when built? I have seen reference to other home built units but they all have many more components than I see here. Would love to build and use this if I can see or understand it’s construction better.
Sunday, October 14th 2007 at 1:51 pm
i am getting error mesage eprom not found.
some time i am getting bus not found.
in my dump file also no data available
Sunday, October 14th 2007 at 2:37 pm
Hi there !
First excuse me cause my problem is not a password problem, but I think this forum is the good place just to find the infos I need : my EEPROM is just dead on a Think Pad T22 - 2848, I mean the bios itself is corrupted, so I cannot boot on anything nor acess the bios at all. The post freezes on this message : 0175 bad CRC1 Stop Post Task. And there is no way to return to default values (I tried to replace or / and remove bios battery).
My questions are : is it possible to remove the soldered eeprom, to re-program it elsewhere and then replace it on the mb ?? (friend of me have a machine to program eeproms) ? Or, if there’s is no jumpers to reset the cmos (is there not at all on this mb ?) would anybody knows another way to do that, for example in causing some short circuit ? The model of the eeprom is : ATMEL F 24F08CT 0119.
I really hope there is an alternate solution for such a dammage, otherwise the mb is over for good. Thanks in advance !!
Julien
Sunday, October 14th 2007 at 9:43 pm
I correct the infos : it’s an ATMEL F 24RF08CT (I had forgotten to type the R) well known as 24RF08, but this one has 7 pins on each size, wich are, critically, very smaller than the pictures in this tutorial. After new researches, I realy wonder if there is a way to REFLASH / replace / restore the bios with the hardware serial port method describer here.
Julien
Wednesday, October 17th 2007 at 9:07 am
well i have a t42 and i found the chip and all but and i saw the picture that was posted on your web site on what to do on my model but can you explane or send me a picture on how to hook up the spare computer to my chip. o and i have a atmelim thanks!
Wednesday, October 17th 2007 at 10:48 am
i have tp x41 which unfortunately has an atmel AT97SC23201 dhip, which has 28 pins, instead of just 8. here’s the pin diagram:
http://www.atmel.com/atmel/acrobat/2015s.pdf
as you can see, none of the pins are labeled “SDA” or “SCL”. so which pins would i solder to??
or will the above mentioned method for the 8 pin atmel chips not work with the 28 pin chip that i’ve got??
sixela918@hotmail.com
Monday, October 22nd 2007 at 10:47 pm
HI! For all thoose with the funny CMOS batterie automatic draining syndrome.
Please do yourself a favor and go to HOMEDEPOT and buy some plastic safe contact cleaner , and also a can of compressed air. Di assemble the laptop ( L3 all way ) and spray (soak) the board in the contact cleaner. After that use the compressed air especially around the QSOPS ( quad small outline packages ) and spray them with air until completely dry. Also make sure any CHIP does not have any cleaner under it. 99 out of 100 laptops it will remove and batterie draining, or onboard graphics problem.
Frank
313-5811313
Friday, October 26th 2007 at 1:59 pm
brilliant! it’s working! my R40 is alive! thanx! it was an old password, but last letter was cutted off somehow! so i usually using 8-lenth, and after the “break” it was only SEVEN! anyway! that was very helpful! and working 100% with first atempt! CHEERS!
Friday, October 26th 2007 at 2:15 pm
by the way, on R40 the ATMEL chip is located right under the HDD drive, 8-pin.
good luck!
Friday, October 26th 2007 at 3:18 pm
Hello, i´m trying to make this circuit and the first problem that i have is when trying to read the memory says NO EEPROM available, it takes me a lot of time review the circuit and possible problems but i dont find it, if someone can help me thanks
Friday, October 26th 2007 at 8:19 pm
Works great.
T30 chip is under the ramstick no need to take it apart.
Usb to serial adapter is a no go
Saturday, October 27th 2007 at 1:27 am
Writing from my fixed T42. Soft and interface work great! Thanks!
Some comments:
At first I tried to run r24rf08 without connecting interface to the chip (wires SCL, SDA and GND not connected) and got error: “circuit is not found”. When I connected the wires to the chip got the same error. Checked the circuit - looked good. Next step I ran the reader program from another PC without connecting wires to the chip and got different error: “EEPROM is not available”. After connecting the interface to the chip I got the bin file with my password.
So from my experience, if you keep getting “Circuit is not found” - try another PC with COM port. Double check your SCL, SDA, and GND connection if EEPROM is not available.
Good luck!
Saturday, October 27th 2007 at 9:22 pm
Works!. Used on Thinkpad 240. Amtel chip is on the bottm of the motherboard. Requires removal of motherboard.
Saturday, October 27th 2007 at 10:35 pm
Will this work for a IBM thinkpad X41 Tablet series?? If the epprom chip is the same should this work?
Sunday, October 28th 2007 at 10:49 pm
Hey, does anyone have a photo, or a general discription of where the chip is on an X60 tablet? If someone could e mail me a discription or a pic, it would help a lot. Thanks
cr@ckthepla.net
Monday, October 29th 2007 at 9:53 pm
please help trying to find the ATMEL chip to recover T60 Password any pictures or info on where it is please.
Tuesday, October 30th 2007 at 11:52 am
Worked on my X31 like a charm. Wonderful!
Tuesday, October 30th 2007 at 3:11 pm
Hi all
I have a problem with my new Lenovo 3000 200N. I got a power-on-password. No idea why. I din’t put this password on the computer!!!! The Notebook is only 2 days old and I bought it new. Now I want to get something from IBM on guarantee …. no chance they told me it is necessary to replace the motherboard because that stupid power-on-password. I can’t believe that. Has someone an idea how I can remove the password? Often it is just necessary to remove the backup battery and not replacing the motherboard. Is there a easy way to delete the password? Unfortunaly the backup battery is located deep in the lenovo. I have to unscrew everything (including monitor and so on…).
Thanks for comments
Gerhard
Tuesday, October 30th 2007 at 5:54 pm
used to work on thinkpads and removed various models with forgotten POP’s
fit new atmel chip
used a special parallel port wrap plug to get past 175 bad crc errors, reflashed atmel inputting system board serial number eg(11S64f3402zj1226 37354p)22 digit serial number is on a barcode label on the motherboard, job done
Tuesday, October 30th 2007 at 6:13 pm
I need SDA (PIN Diagram) of Atmel Chip# 8356908 in IBM T60 Laptop
please someone help me
Wednesday, October 31st 2007 at 11:51 am
Hi all, i own a Lenovo T60 and the easiest way to remove the poweron password is to remove the cmos battery. Use the hardware manual on how to dissamble the laptop.
Unplug it, disconnect the main battery and then take off the cmos battery. Leave the machine for a while and power on!!! Enjoy…
Thursday, November 1st 2007 at 6:44 pm
Can anyone please show me the location on the system board where to find ATMEL on a Thinkpad 770ED…
Thanks in advance…
Thursday, November 1st 2007 at 6:47 pm
Can anyone please show me the location on the system board where to find ATMEL on a Thinkpad 770ED…
Thanks in advance… email add: b34n_tut@yahoo.com
Friday, November 2nd 2007 at 12:35 am
Mil gracias, funciono todo perfecto, pude desbloquear mi t30 siguiendo las instrucciones.
Santiago.
Chile
Friday, November 2nd 2007 at 11:35 am
I found ATMEL 24C01A (8 PIN) on my TP 770ED and referred to schematic on c:\ALLservice\24RF08\rs232-I2C.sch - Sheet1, soldered a wire to PIN # 5 (tagged SDA) and Pin # 6 (tagged SCL). followed dumping procedure but got this error while dumping at the command prompt “ERROR: circuit not found or buerror”. Anyone .. Please advise… TP 770ED - my email is b34n_tut@yahoo.com
Thanks in advance
Monday, November 5th 2007 at 2:41 am
I did this with my IBM ThinkPad A30. On this model the ATMEL 24RF08 chip is under the PCMCIA card slot. I found the chip but did not solder. These chips are microscopic and would be very hard to solder without professional tools. After putting on the magnifying glasses I took some very very thin wire and was able to wrap it around the pins on the chip. I then clear taped them tight to some plastic on the case so the would not pull loose or short out when I made my connections. Instructions worked fine and the R24RF08 v2.0b software pulled the dump file like it was supposed to. When I ran the IBM Pass 2.0 Lite software my dump file showed a lot of weird characters but no password on the line it should have been on. Then I found this post from earlier and it saved me. When using IBM Pass 2.0 Lite to see the correct characters the button AA in the upper left corner of IBM Pass 2.0 Lite must be on. When I did this the password appeared on memory address of 0×330. Hope this helps the ones that are afraid to put a soldering iron in their laptop.
AS STATED BY THIS PERSON : IBM 390E TP : EARLIER IN THE POST
I just found my password using the instructions in the first 6 to seven pages of this sight. If you are getting data and it dosn’t look right make sure to turn on the button AA in left corner. I’ve been working on this several days and poof there it was there are a lot of little details that you have to pay attention too. Finding chip can be the hardest. Good luck don’t give up it can be done.
Monday, November 5th 2007 at 4:35 am
i am trying to hack my ibm 600 Supervisor password i built the kit but can not get the 2 programs to read the chip and the ibm pass lite was wondering if anyone has them or were to get them tryed the links here will not let me download them
e-mail to occchopper44705@neo.rr.com
thanks
chris
Monday, November 5th 2007 at 6:12 am
Check your zener diodes. I think they are supposed to go 1 way only.
This repost might help too.
Comment by Stan:
Friday, May 4th 2007 at 7:46 am
First, I want to thank all the posties that helped me to reveal the PW from my TP 600.
I tried it first with the PONYPROG2000, dumped the file, but the password wasn´t visible. Then I tried R24C01 and it worked the first time. Enclosed the steps I exactely performed.
You have to completely disassemble the notebook and remove the MB to get access to the EEPROM. For the job you have to connect all required parts back to run the system, also BIOS battery, but you don´t need the HD.
I changed the COM port settings of my working PC (Device MGR>Ports category>COM Port1>Port settings) to Baud rate: 115200; Data Bits:8; Parity: none; Stop bits: 1; Flow control: none
For this type of EEPROM I learned that it is necessary to work with the driven-IC2cprog device. First trials with the simple one didn´t worked.
Thinkpad 600 – guide for reading the Supervisor Password with R24C01:
1. remove the mainboard (Hardware maintenance manual page 87)
2. locate EEPROM 24C01A at the bottom of the motherboard, right hand side, close to the upper left corner of the big PCIBus-IC when the connector row is facing to you
3. solder 3 wires to pin 4, 5 and 6 of 24C01A
4. build schematic: driven-i2cprog.pdf
5. connect driven-i2cprog to com port of working PC and check port settings
6. install ponyprog2000 2.05a Beta (freeware from www)
7. Select from menu “Device>I2C bus 8 bit eeprom>2401″.
8. setup > Interface Setup: serial, SI Prog API, select com port
9. In “Setup> Interface Setup” invert the D-in, D-out and SCLK.
10. change PONYPROG2000.INI: modify the line: I2CBaseAddress=0xA0 to I2CBaseAddress=0xAE
11. Save PONYPROG2000.INI
12. Setup > calibrate > OK….
13. connect AC adapter to the TP 600 mainboard (mainboard without any other boards but with BIOS battery attached)
14. connect GND wire of driven-i2cprog to pin 4 of 24C01A (GND also can be connected to any GND pad of the mainboard)
15. press power button of the TP 600 mainboard
16. connect SDA to pin 5 and SCL to pin 6 of 24C01A
17. read eeprom with ponyprog
18. disconnect SDA and SCL wires
19. switch off the mainboard
20. disconnect GND wire
21. store the bin-file
22. install ibmpass2
23. open stored bin file with ibmpass2
24. at ibmpass press button “AA” – on
25. View>Translation>Scancode
26. For 24C01 eeproms the password is located at 0×38, 0×40 – read password starting at 0×38 – ending at ????
27. note password, if password is not shown proceed with a.
a. Install R24RF01
b. press power button of the TP 600 mainboard
lc connect SDA to pin 5 and SCL to pin 6 of 24C01A
d. Run R24C01.exe
e. Use command: r24c01 your.bin /x /d /i
f. disconnect SDA and SCL wires
g. switch off the mainboard
h. disconnect GND wire
i. open your.bin file with ibmpass2 (as above 23 ff)
Hopefully this will help someone.
Greets
Stan
Wednesday, November 7th 2007 at 8:04 pm
Hi, i need help if some one can !
i have an IBM thinkpad R52, it is locked, i need to find THE BIOS PASSWORD , i have to finish my memory that i start it, and it steel in the hard drive !
help me please , my e-mail is : adilelharaoui@hotmail.com
thank you in advance !
Friday, November 9th 2007 at 1:45 am
What do I do if my pissed off brother has set the biometric print to his own, and I cant do a thing on the computer, not even press a single button. It seems the whole computer is locked up, but still starts up in windows to the login screen?
Saturday, November 10th 2007 at 1:37 pm
In place of soldering the wires you can also wrap a single copper wire around the mentioned pins on the atmel. It did work for me all the times and it leaves de MB unharmed. Only make sure that you have very steady hands, no coffee allowed!
If you work very carefull you even maintaine the waranty!
Saturday, November 10th 2007 at 4:22 pm
found the password when i clicked on translate, but when i typed it after packing my t42 i still have the same message asking for the password. can i have a program to re-write the information on the atmel chip?
thanks
Nii Kpakpa
Tuesday, November 13th 2007 at 4:00 am
There is a much simpler way to fix the password without desoldering the chip or using decoder software !
connect two wires to a switch and connect to the sram chip at pin 4 (vss) and pin 5 (sda)
make sure the switch is open and turn on the pc
when the machine is booting press F1 for bios setup
after a short while the password prompt will appear
at this point close the switch and press ENTER
(the bios will try to read the password from the sram but receive only 0’s (blank password))
the bios setup will now appear
open the switch again
go to the password option and change to what ever you wish
BTW if you are concerned about taking the sda pin to ground dont be, the sda pin of the sram and the mother board support driving the sda are both sink only outputs (ie pulled to ground) which has a few K pullup resistor to positive, connecting this to ground is perfectly fine as this is exactly how the system functions when outputing a logic 0
Tuesday, November 13th 2007 at 6:07 am
Worked great on A22m. Chip is 14-pin on the underside of the board, very near the ram access cover. It can be seen from the access hole but don’t think you could attach to it without complete disassembly as i did. Here is a good diagram of the pinout for the chips http://www.passwordmethod.com/content/view/108/27/
Tuesday, November 13th 2007 at 3:30 pm
where’s ATMEL chip located on the a21m, please?
thanks.
Wednesday, November 14th 2007 at 8:43 am
This worked great on my T42, thanks! A tip for anyone getting the error “ERROR: EEPROM not available.”, try using another spare computer with a serial port as not all are supported.
Wednesday, November 14th 2007 at 8:29 pm
Tried on a TP R51 and it works great. Just make sure you push the “AA” button at the upper left of IBMPass 2.1 if you get weird symbols aftre dumping.
Friday, November 16th 2007 at 7:18 pm
hi i got thinkpad x60 the atmel is dirrent htne showing on picutre above
Friday, November 16th 2007 at 7:33 pm
I have a A20m thinkpad and want to reset the bios password. I saw your circuit and wondered if you had any for sale because I’m not too comfortable with setting the circuit up. Also when the bios password is reset can all the other passwords be reset thru the bios?
Friday, November 16th 2007 at 8:48 pm
can sum1 instruct mr how to find bois password for my thinkpad x60 i think its diffrent above picutre . also i has difreent atmel
Friday, November 16th 2007 at 11:35 pm
I used the basic circuit as described. works great for the t42. thanks
Sunday, November 18th 2007 at 12:25 am
Don’t screw up your Thinkpad if you are not a good technician or have good soldering skills.
We can do,
IBM Thinkpad password removal, fast service. for T20, T30, T40, T41, T42, T43, T60.
Service provided within Canada.
Starts from $50,
For T60, special price $199
Tel: 001-416-518-6889
Sunday, November 18th 2007 at 1:11 am
i give up… i spend the whole day and night with soldering this tiny wires - and i only get error-messages like:
[code]
24RF08 eeprom reader v2.0b - Win32 Console Version
Copyright (C) Victor Voinea, ALLservice 2004-2005, http://www.allservice.ro
—————————————————————-
Initializing timer…6088 OK!
ERROR: Eeprom not available!
—————————————————————-
Hit to exit…
[/code]
my tp is a t23 with 14pin atmel chip ‘24rf08ct’ version ‘0206′ using simple-ic.
did i burn the chip? but it looks normal -how can i proof this?
anyone here who had success with this chip?
best wishes & thanks
bluesmily (ät) gmx (dot) net
Sunday, November 18th 2007 at 1:26 am
part2
if i ‘block’ the correct working of this security-chip –>
error-message like:
187 eaia data access-error
by pressing f1
i could switch to bios…
Sunday, November 18th 2007 at 7:06 pm
ThinkPad model R32 has not one but two ATMEL chips. The easiest to find the wrong one a 93c46 near the keyboard connector and close to the ATI video processor. Although a serial PROM it is not the one holding the password!
The password PROM (24rf98c)is hidden under a clear plastic sheet underneath the hard drive holder frame on the top side of the main board. It is located just below the security chip socket and a little to the left. The printing on the chip is very difficult to see and finding the pin 1 dot is a very small dot. You have to remove the hard drive holder frame and the clear plastic sheet in order to view the 24rf08c chip.
I wish I could attach a photo of the location that I have but the words above will have to do. eMail me and I will send a note with the photo.
Sunday, November 18th 2007 at 8:53 pm
Thought it would be useful to share my experiance of carrying this out on a T42. firstly the interface it pretty easy to build, cost approx £3 for the parts including delivery. took about 30mins to make it and that including checking it twice to make sure I had everything perfect and i’ve not done any soldering for 15+years
For soldering the 2 wires to the chip, you will need a VERY steady hand, good light and a very fine tip to your soldering iron. Don’t try this if you don’t have all of these. I also found it useful to have a solder sucker for removal of the wires after to you have finished and in fact the first time I soldered the wires on, the two pins became soldered together (you really do need a fine tip to that iron). The solder sucker was a saver and for £5 it really makes a mistake like this easy to fix plus you can remove the wires and leave a pretty neat job (I can’t tell anything was ever soldered to the chip).
The software is easy to use and hey presto less than few seconds after obtaining the download from the Chip you can open the bin file with it and clear as anything the password is there as per the instructions. (Don’t forget to hit the button to convert the file once you have opened it)
Monday, November 19th 2007 at 1:24 am
This was awesome!!! Worked like a champ, once I connected all the wires correctly! (Had left the #8 wire off the db9 connector and it didn’t work, go figure)
Anyway, thanks for all the help and support.
Had a T42 that one of our disgruntled employees set a bios password for and I could not even re-format it.
This opened it right up!
Thanks again
Drucius
Tuesday, November 20th 2007 at 6:51 am
If you find it hard to do it yourself we will do it for you. We’re based in Chicago area. Email us at we servechicago@gmail.com. We unlock all Thinkpad models. You can drop it in or mail it in.
Tuesday, November 20th 2007 at 6:56 am
THe email did not post right. It’s weservechicago@gmail.com
Tuesday, November 20th 2007 at 7:03 am
Once again, all the credit for whatever we do goes to Victor from allservice.ro who wrote all the programs, designed the interface and helped us a lot along the way. So if you use our services or if you do it yourself please take couple minutes to send your thanks to the genius behind all this. Thanks Victor!
Wednesday, November 21st 2007 at 6:34 am
Unlocked my A30. Then tried a Thinkpad R40 and got “eprom not available” .
The problem was somewhere between the 1st laptop and 2nd I shorted out 1 of the zener diodes on my chip reader tool. Installed a new one and all is well. It must have touched something on the board by accident. I also used the super thin wire on this one so no soldering was needed.
Wednesday, November 21st 2007 at 7:18 am
may i juz ask, where exaclty at the pc part will connect the Atmel chip reader?
thanks
Friday, November 23rd 2007 at 11:44 pm
i have ibm r56 model of laptop . i had forget my power on pasword i am unable to open the laptop . computer asked power on pasword is any prosedure to crack the pasword ? somebodies say for replacing motherbord. so help me pleeeeeeeeeee i hope so.
Sunday, November 25th 2007 at 10:32 pm
Does anybody know where I could get the required Zener diodes in Montreal, Canada?
I went to two different The Source (ex Radio Shack) stores around where I live and the only thing I was able to find was the 2.2K ohm resistors. No 5.1 diodes, and no zener at all.
I also tried home-depot and rene-depot but no luck there as well.
Any help greatly appreciated, thank you.
Monday, November 26th 2007 at 10:47 am
how a can write eeprom for my t42
please any one can
help
me
Monday, November 26th 2007 at 8:53 pm
I kept getting the “Eeprom not found” message on a Think Pad R40 I was working on at least 50 times with no dump. I had rechecked the wires on my homemade chip reader a hundred times. Just for the fun of it I unplugged the CMOS battery and left it unplugged.
I then hooked up my reader again and low and behold I got my dump.bin. After getting the dump.bin and password I hooked the CMOS battery back up and reassembled the laptop. Hope this helps a few of you.
PS: All Radio Shacks usually carry the Zener Diodes. They only carry 2 kinds , a 5.1 and a 12 volt. They are in the steel drawers by the resistors.
Tuesday, November 27th 2007 at 1:38 am
I forgot BIOS password of my laptop - IBM Thinkpad T22.
And I hacked this BIOS password by using this shematic and program.
Thanks for usefull supports!
Thursday, November 29th 2007 at 7:44 am
I found the electronics store paradise.
Addison Electronics in Montreal. A supermarket of parts
So I got the stuff I needed, created the circuit but I get the Eeprom not found error.
Here’s a picture of my setup:
http://www.alaxa.net/24RF08.jpg
That black thing I use is a chip socket. I attached the 2 cables to the 2 pins i crooked a bit to match the Amtel. No luck
Tried removing the cmos as Reeper suggested, but same.
Anyone would know why it’s not working?
itester works. Both values change from 0/1
Thursday, November 29th 2007 at 4:12 pm
Worked on my T30 like a charm.
Atmel chip was under the #2 ram chip.
I took some shortcuts that worked without soldering. I used some 30 awg wire wrap wire and hooked it around the pin of the Atmel chip. Gently pull it tight for a good connection. Keep it in place using some electrical tape. Worked for me but be careful the wires have a good connection and do not short out on anything.
I could not find the diode listed above but the 1N4733A 5.1V Zener Diode (radio shack # 276-565) worked. The specs are close.
The password did not show up in the defaulted startup of IBMPASS 2.1 Lite. I pressed the AA button ( translation) just under file menu bar and the password was there.
Thanks to ADMIN and all the user comments for making this work the first time!
Thursday, November 29th 2007 at 6:50 pm
This works like a charm. Just follow the instruction to the letter and you cant go wrong! Thanks so much!
Friday, November 30th 2007 at 1:24 pm
I have 4 readers to buy if anybody is interested. Email me ross@challinor.fsbusiness.co.uk
Saturday, December 1st 2007 at 4:45 pm
Hi Guys,
I followed the instruction everything step went well except on Dos i received the error message “Eeprom is not available”. IBM Thinkpad R32 for same ATMEL 24RF08 as mentioned on instruction.
You can easily reach me at Yemking@gmail.com your help and coorespondance is highly appreciated.
Wednesday, December 5th 2007 at 8:19 am
Please send me the dump for Thinkpad A22m
or where can I download it?
Thanks..
Wednesday, December 5th 2007 at 8:22 am
My address: tobyinbox@gmail.com
Friday, December 7th 2007 at 5:03 am
Can anyone tell me where the ATMEL chip is located on the g40?
thanks
Friday, December 7th 2007 at 7:29 am
i am doing mcse 2003 certification
i want do download recent latest dumps from testking.com
so how to download using hack
please help me and
thank you
Saturday, December 8th 2007 at 10:48 pm
Thanks for the great guide worked fine on my TP R30.
Sunday, December 9th 2007 at 2:08 pm
i have ibm t60 passworf bio can helpe me plz
Monday, December 10th 2007 at 10:58 am
I am stuck with my T60 which has a problem with the security chip.
The computer freeze at the when windows tries to check the security chip and I cannot bypass the problem from BIOS because apparently there is a supervisor password set (which I don’t know because did not set!)
I guess IBM will charge me the substitution of the MB… so I followed your nice forum.
I am trying to understand why for T40 (and many other models) software and instructions are free, but for the T60 I should spend around $ 100 or more.
I understand the chip is different, but …
thank you!
Tuesday, December 11th 2007 at 12:57 am
Is there anyone on this thread that could sort this error 0175 out for me , i’m a welder and electronics are a bit beyond me , on reading this forum you sound like you all know what you are talking about , i would rather give some money to a sodoityourselfer as apposed to taking it to pcworld (spit) , i’m in Northumberland , UK
Tuesday, December 11th 2007 at 1:59 am
hey can you help me? tried this on a thinkpad t42 and iam obviously not understanding the proper way to operate the programs. i cannot find a file called “dumpbin” to load into the passcode program.
i tries start then run. found the proper program and hit ok. i then got the black cmd prompt screen. what do you do then?
when i hit enter it shuts off??
am i doing something wrong??
pls help anyone
Wednesday, December 12th 2007 at 6:13 am
sir i have a HP Compaq nc8430 Laptop. One day my friend come to my home and started using my laptop. During using he set a bios password in laptop. after some days when i check my laptop setup it ask setup password. My friend also forgot the password. I remove the comos battery but not reset the password. Please help me to solve this problum. i shall be very thankfull to you.
Sunday, December 16th 2007 at 5:22 pm
Thanks to all who have contributed to this site. I have a T40 that I got on eBay. The laptop works well, but the Supervisor pw was set. The seller did not know what it was. I wanted to load XP on it, but the boot order was set to HD first. Your site saved the day. Here are a few tips that helped me on the way.
1. The parts and pictures to build the reader were right on.
2. I don’t like to solder, so the comment about Micro Grabbers caught my eye.
I created my own Micro hooks from some fine wire and used them to carefully hook onto the legs of the eeprom. This worked for me, no soldering needed.
3. Once I connected everything up and followed the instructions to the letter, I got the EEPROM not Available issue. I read through more comments until I noted that someone indicated that not all computers will work as expected with the reader. I then tried another laptop as the reading PC and it worked first time.
4. I got the dump file and opened it as instructed. I went to the location in the file and there were a bunch of weird characters. Things I could not type into the password field. More reading of comments showed that there is a button in the password decoder that needs to be pushed. The button looks like a A=A at the top left of the interface screen. One click on that button and the password was reveiled.
5. I downloaded the reader and the password decoder. Look inside these zip files for more detailed info. This may help those with other models of IBM laptops identify the type of EEPROM that stores the Supervisor password.
Good luck to all. Thanks again to all who have generously contributed their time and talents.
Sunday, December 16th 2007 at 7:18 pm
Have tried in vain to solder with very fine tipped iron to the sda and sdl connections on my T23. The T23 has the 14 pin Atmel chip as you may know. Its damned difficult but will keep trying or have a go at the 30 swg idea wrapped round legs. Has anyone tried the switch and pin4 vss sram chip and pin 5 sda idea, sounds easier.
Anyone that could help me locate the sram chip pin 4? Bit of a novice at this i am afraid although have basic soldering skills etc.
Tuesday, December 18th 2007 at 9:02 pm
hey can you help me? ware is the Atmel chip on the IBM T60?
Wednesday, December 19th 2007 at 8:21 am
i need the file W24rf08 with the crack. Bcoz i hav no credit card to buy the licence to allservice. Its cheap enaugh, but hard for me to pay as i have no card.
So, i need help to u anybody who have the crack or serial key ???
Or where can i find it ?
Help me pls…
thx.
Friday, December 21st 2007 at 10:29 pm
Why don’t you ask allservice, you imbecil?
Saturday, December 22nd 2007 at 7:49 am
I Have an X60 IBM ,forgot my password,what can i do??
Saturday, December 22nd 2007 at 9:42 am
I did it! it is a tp 570E. The most difficult thing was disassembling the machine
The chip is really small! It has 14 pins, not 8; I found the right pins on ATMEL site, they are 8 (SDA) and 10 (SCL); soldering not easy, very very tiny, especially on 10 that is between two others. Then everything worked. While deciphering the file I had to click on the “translate” button in order to see letters and not hyerogliphics, but I had the password displayed clearly
thanks!
Sunday, December 23rd 2007 at 4:34 am
Worked like a charm. Now I need to get my hard disk password and reset that. Thanks to the original poster and solution.
Monday, December 24th 2007 at 8:11 am
I understand the soldering, But. the spare PC (my Desktop) downloaded the software, & install all ok. Were and how do I conect my T41P to my desktop, that is the part I dont understand. Where is the serial port 9 female connected to besides the SCL & SDA and gnd. Please advise
Monday, December 24th 2007 at 10:36 am
What about the T61 ?
Anybody have a solution to unlock the BIOS ?
Thks
Tuesday, December 25th 2007 at 10:43 am
first lots of thank to VICTOR and his team !!
and thanks to the nice ppl in this forum who share their problems, solutions and tips.
i have t20 which now works charmly. the 24rf chip has 14 pin, about 4.5 mm long, and is located just underneath the outer memory stik. i tried to solder the pins, but no luck, and got the 0187 error, which also means that the pins are not correctly soldered to the motherboard, i fixed this problem. And now the tip: i used 2 sewing needles, (soldered to the wires) and just hold them with my fingers atached to the SDA & SCA pins, GND wire was connected to one of the motherboard screws.
Thursday, December 27th 2007 at 1:19 pm
Thanks so much for this post. I did this yesterday on a T42P that I bought on Ebay and it worked like a champ.
Friday, December 28th 2007 at 10:48 am
I guess somehow I corupted my T30 eeprom and getting 0175 error. PLZ if someone have a dump file of any T30 email me, that helps me to rewrite a new one or reprogram it. if you think you can rescue my T30 with your eeprom dump file please email me at “jay_toudeshki@yahoo.com”
Thanks in advance. —Jay.
Sunday, December 30th 2007 at 12:37 pm
I have 3 readers left for sale, if any body is having a hard time gettin theirs working!
email ross@challinor.fsbusiness.co.uk
Sunday, December 30th 2007 at 3:45 pm
! have a t30 eeprom dump available on my website http://www.theshinyshop.com under items.
Monday, December 31st 2007 at 1:42 am
Hello,
I’m having problems with W24RF08 programmer. I have this error msg:
ERROR: Unable to open sorce file!
I was typing: w24rf08 guido.bin /e, w24rf08 guido.bin /i, w24rf08 /p /e. etc.
I was trying with diferent ways and I created before guido.bin in the same directory using r24rf08. I read this file before with ibmpass21 and my password is 00000006, but i only can type 7 spaces in my laptop ( IBM TP T22 ). Then I supouse that i have to program the IC AMTEL with diferent password or at list reset the existing one.
If any body know what i’m doing wrong, please let me know. Sorry, Cuban with only one year in US. guidoedt@yahoo.es
Monday, December 31st 2007 at 3:03 am
The program you refer here is a cracked good for nothing version of W24RF08. I suggest you to pay the author for all the hard work, instead of trying to steal, buddy. And you have guts to ask for help…
Wednesday, January 2nd 2008 at 12:21 am
Hi Guys, Thanks for the very informative site. I am in the process of dismantling my T60 to find the security chip but i have come to a dead end. I cant find the chip anywhere on the board and the only place that is left is on the back of the system board. But i really dont want to completely dismantle my laptop unless im sure it is there. Does anyone know where the secuirty chip is on a T60?
I forgot the supervisor password i set on the BIOS only. This was not a real bother because i could operate my laptop wit h no problems as the password only protected the BIOS section. Until one day i decided to put a password on the whole system so that people cant boot my computer. Then i realised that i cant do that because i dont have the BIOS password. A search on google revealed that a software called cmospwd can read or clear BIOS passwords. I tried to read it but it gave me something like !$12ABC which i was unable to enter in the password prompt. I then foolishly tried the clear password option which it said that the BIOS password has been successfuly cleared. When i restarted my computer, i typed F1 thinking that there shouldnt be anymore password, but it gave me a “checksum CRC error” and shortly later the password prompt came up. I restarted again wanting to go into windows and try the cmospwd program again but there with horror i found a password prompt requesting a password. So now i cant even enter the system!! The CRC error only happened once and now my computer is locked as if someone put a password on the system without my permission.
Would the above procedure work for me? I really need to access my computer. Any help would be greatly appreciated!
Sue
Wednesday, January 2nd 2008 at 5:49 am
I accomplished each step that the directions instructed.
when i type r24rf08 dump.bin into the cmd it says:
C:\Documents and Settings\Owner>r24rf08 dump.bin
‘r24rf08′ is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\Owner>
I have no idea what to do from here can some one help me?
Wednesday, January 2nd 2008 at 7:31 pm
I finally figured out how to download the dump file, but there is nothing in the 0×330 line
how do i fix this?
Wednesday, January 2nd 2008 at 7:33 pm
@Sue
Your laptop can be repaired only with PC8394 programming tools from allservice.ro
Put it back, it doesn’t need to be opened. The goto http://www.allservice.ro/forum/viewtopic.php?p=1061#1061 and buyt the full kit, with the CRC repair included. You should receive the kit and instructions. Or..pay $200 bucks to repair it locally…they all use allservice software, anyway.
Thursday, January 3rd 2008 at 2:27 am
@ Sue,
I think the security chip for the T60 is on the back of the motherboard. I had to completely disassemble the sucker to find it. The tip-off is that it is marked “U53″ on the board, exactly the same as the T42.
JM
Thursday, January 3rd 2008 at 8:39 am
I succesfully got the dump from my TP r50e .
I got something in the 0×330 line and tried all translation but the password is not right .
I tried to get the dump from different operating systems .
Any Clues ??
Thanks in advance
Ro
Thursday, January 3rd 2008 at 10:49 am
Thanks a lot for this guide, it worked on a thinkpad T20 with the 14 pin chip! The Chip here is locatet under the RAM Cover. The SDA is on pin 8 and SCL is on pin 10.
Here you can find the datasheet:
(8 pin Version)
http://www.atmel.com/dyn/resources/prod_documents/DOC1072.PDF
(14 pin Version)
http://www.adapt-plus.com/pdf/tssop_dip/140805tss.pdf
Monday, January 7th 2008 at 9:51 am
Hi All Friends in the IT Line.
This process is VERY GOOD FOR REMOVING BIOS PASSW-
if you have not access this HARDWAR THEN YOU ALSO CONT ME.
I THINK I M TRYING MY LB.
GO TO THIS PROCESS
“COPY FROM SOME FRNDS REPLY”
1. 1. remove the mainboard (Hardware maintenance manual page 87)
2. locate EEPROM 24C01A at the bottom of the motherboard, right hand side, close to the upper left corner of the big PCIBus-IC when the connector row is facing to you
3. solder 3 wires to pin 4, 5 and 6 of 24C01A
4. build schematic: driven-i2cprog.pdf
5. connect driven-i2cprog to com port of working PC and check port settings
6. install ponyprog2000 2.05a Beta (freeware from www)
7. Select from menu “Device>I2C bus 8 bit eeprom>2401″.
8. setup > Interface Setup: serial, SI Prog API, select com port
9. In “Setup> Interface Setup” invert the D-in, D-out and SCLK.
10. change PONYPROG2000.INI: modify the line: I2CBaseAddress=0xA0 to I2CBaseAddress=0xAE
11. Save PONYPROG2000.INI
12. Setup > calibrate > OK….
13. connect AC adapter to the TP 600 mainboard (mainboard without any other boards but with BIOS battery attached)
14. connect GND wire of driven-i2cprog to pin 4 of 24C01A (GND also can be connected to any GND pad of the mainboard)
15. press power button of the TP 600 mainboard
16. connect SDA to pin 5 and SCL to pin 6 of 24C01A
17. read eeprom with ponyprog
18. disconnect SDA and SCL wires
19. switch off the mainboard
20. disconnect GND wire
21. store the bin-file
22. install ibmpass2
23. open stored bin file with ibmpass2
24. at ibmpass press button “AA” – on
25. View>Translation>Scancode
26. For 24C01 eeproms the password is located at 0×38, 0×40 – read password starting at 0×38 – ending at ????
27. note password, if password is not shown proceed with a.
a. Install R24RF01
b. press power button of the TP 600 mainboard
lc connect SDA to pin 5 and SCL to pin 6 of 24C01A
d. Run R24C01.exe
e. Use command: r24c01 your.bin /x /d /i
f. disconnect SDA and SCL wires
g. switch off the mainboard
h. disconnect GND wire
i. open your.bin file with ibmpass2 (as above 23 ff)
IF UR NOT ABLE TO CRACK THEN CONTACT MY EMAIL ID:
lovever_bboy@yahoo.co.in
or call me ;- 9853482334
INDIA.
Wednesday, January 9th 2008 at 5:06 am
It worked with my R50e laptop!
Thanks so much to the author, this has been quite an active DIY article. Started in 10/2006 and still going strong.
If anyone needs additional help for their r50e, I would be glad to assist.
my email is drerock at gmail dot com
I made the circuit required for the reader, and could probably send it to someone if they need. I had never soldered anything before, and the gun I had was a big ol’ thing, so I managed to get it to work with some of the smallest clips I could find at radioshack. I had 2 serial ports on my computer, and the first one I tried didn’t work.
Good luck to anyone else to tries this, it felt so good to get past that stupid bios lock icon.
Wednesday, January 9th 2008 at 10:09 am
Hi, i have a problem whith my thinkPad r40, the bios pass was changed by himself. Enother problem is that the laptop has no com port’s, only USB, 1394 and for printer…. What can i do?
Wednesday, January 9th 2008 at 6:56 pm
HELLO,
I have a X31 type 2673.
Just want to recover the supervisor pass.
BUT,
The ship is an “ATMEL 422 93C46 SI27A”, 8 pins.
My 3 questions are :
Do i have to use the same reader as for ATMEL 24RF08 ?
same ” simplified schematic ”
How do i recognized the slc and sda on the ship ?
Thanks a lot.
Gbs
Thursday, January 10th 2008 at 8:37 am
hi all.i bought thinkpad t22 and there is a powered on password.i read a lot of in the web about programing security chip but any information is little about my experience.i couldn’t found security chip on motherboard.can someone send me picture or tell where exactly are placed that security chip.
thanks of all answered me.
Thursday, January 10th 2008 at 10:03 pm
Thanks a lot for this guide, I cant seem to get mine to work I tried it on TP T40, and a T41P, the dump file works fine but when I check the address 0×340 for the T40 it shows ff1 it dows not work as a password and the T41P shows 21 it does not work either thanx in advance if anybody know if I’m doing somethong wrong.
Friday, January 11th 2008 at 9:17 am
Thanks for this guide. I just follow the guide on TP X30 and everything works fine. Find the password @0×330 and use it to enter the bios without any problem.
Thanks again for the infomation to crack the bios password.
Friday, January 11th 2008 at 11:22 am
Hi for all ,
Any one can unlock my Lenovo Duo centrino T60???
Please make offer by e-mail :
rsoudane@gmail.com
Sunday, January 13th 2008 at 9:24 am
For anybody who needs w24rf08.exe, here is the full version for free! Use this to fix CRC, CRC1, and CRC2 errors! All you need to do is rewrite the Atmel with a good .bin file.
Multiple links in case they go down:
http://www.mediafire.com/?9k3mo1z9nxs
http://www.sendspace.com/file/mi6oub
http://www.badongo.com/file/7289886
http://www.uploading.com/files/JIHWTPQ7/24rf08c_tools_141_w24rf08_r24rf08.zip.html
Sunday, January 13th 2008 at 6:43 pm
Hi, thanks to the poster for the guide. I have a T42 and have followed the steps closely. I managed to dump the password ok but I cannot see the password when i scroll down to address 0×330 using the IBMPass software.
Can i send my dump file to anyone with experience that can help me or can you please send me some advice.
Is it possible that the dump file can be created without including the password in it???
Thanks in advance.
Sunday, January 13th 2008 at 9:09 pm
Hit the Off/On button to the top left in IBMPass.
Monday, January 14th 2008 at 12:49 pm
Dear Guys,
Please help me in the case of T61 lenovo, widescreen model. Is there a solution for it? I have checked with IBM service center, and they asked me to replace the mother board. Please help me … if you guys can ….please let me know if its possible or not…… thanks
Monday, January 14th 2008 at 1:11 pm
Sorry guys, the problem is that i have set a supervisor password, and it doesnt work at all.
Tuesday, January 15th 2008 at 4:02 am
Hi, does this method work on R60? I can’t locate eprom chip. Stripped completely TP, took out motherboard, but still can’t find it. Can anybody help with location of this chip if it exists? many thanks.
Tuesday, January 15th 2008 at 7:12 am
I just want to say how wonderful this site is!!!!!! I had all but lost hope with my T42. IBM had told me $175 to remove a supervisor password, they then came back and said $475. I was not gong to pay that much for a laptop that I had only given $50 for in the first place. Using your instructions, (after a little trouble with the programing) it worked liked a charm. Thank you guys so much for your time and effort in the making of this page. Keep up the good work and I will be referring anyone who has problems to you.
Thursday, January 17th 2008 at 9:22 am
I wonder how many of these T60 laptops are stolen…
Thursday, January 17th 2008 at 4:39 pm
Thank you for the help this site provides, I am trying to recover a t30 I was successful in retrieving the password from the dump.bin file by following all the instructions to the letter. However now my computer hangs during startup with the error 0175: bad CRC1, stop post task.
As best as I can tell, a few people have had this same problem but I can’t seem to find instructions on how to get past this error. In searching the web I am directed to replacing the motherboard (I would like to avoid this). Is there anyone who experienced this error and has instructions to correct it?
Thanks in advance.
Friday, January 18th 2008 at 11:01 am
Grazie, grazie molte per le informazioni che mi hanno permesso di trovare la password (SVP) del mio IBM ThinkPad A21e CXG 2628.
Thanks a lot
Friday, January 18th 2008 at 1:01 pm
Dear Guys,
Please help me in the case of T61 lenovo, widescreen model. Is there a solution for it? I have checked with IBM service center, and they asked me to replace the mother board. Please help me … if you guys can ….please let me know if its possible or not…… thanks
Tuesday, January 22nd 2008 at 8:22 am
Any one can find r52 Laptop bios ic please kindley send details
sdheenadayalan@gmail.com
Thursday, January 24th 2008 at 6:49 am
This is really awesome. I successfully revealed my T41 supervisor password. I did this exactly as the instruction, except I used two 4.3V Zeners since I don’t have 5.1V type in hand. Only r24rf08_setup.zip and setup_ibmpass21.zip were needed. I didn’t use w24rf08_setup.zip which is not free. I have a very old PC coming with RS232 port, and this PC is even running Windows 95. The r24rf08 is running well on the PC, but it can’t run setup_ibmpass21.msi. I use anther PC with WinXP to run IBMpass 2.1 Lite and it decoded the bin file amazingly. Thanks to this great stuff in sodoityourself.com and allservice.ro.
Thursday, January 24th 2008 at 1:52 pm
I located the eeprom ATMEL 24RF08 on my ThinkPad R40 2722-CU3. It is on the motherboard under the hard drive (U18) caddy, adjacent to the USB port. It is a two colored chip (black with a red stripe).
Saturday, January 26th 2008 at 11:06 am
Hello
there is an other way, to hack the IBM Bios Password. I made a documentation and ziiped it with all the things you use. (Programs, Schematics, Documentation) and uploaded it. http://rapidshare.com/files/86727521/Hack_ThinkPad_A20m_BIOS_Password.zip.html
I hope, this is helpful. Enjoy it.
Saturday, January 26th 2008 at 11:41 pm
Does anyone has the eeprom dump for thinkpad T21? Thanks!
Sunday, January 27th 2008 at 1:02 pm
Hi guys,
you’re great. With the knowhow from your page i could get my t22 back to life. I had some problems, especialy because the T22 has the 14 pin atmel chip directly under the ram cover(this i found out after the complete disassembling of my thinkpad) and later i forgot to scwitch on the AA decode switch in ibmpass 2.1 lite, but finally everything work and i could kill this damn biospassword.
Thanks a lot to you gyus and keep going.
Sunday, January 27th 2008 at 3:20 pm
aye i got a kind of big prob here i try to read from a a22 tp and i just get the message saying eeprom not found or cannot find circuit or bus i triple checked my soldering everything seems just fine then my wiring once again it’s ok but still get the same error. i already did it in a t20 tp with the same wiring and stuff do i need to use the max232 driven eeprom schema? help plzzzz
Monday, January 28th 2008 at 4:02 am
I find this post to the fastest and safest way to get ANY of your PCs running. You can also purchase a AVR/Atmel programmer for about 20 US dollars. You can build one for about 5 dollars. Using an ISO7816 device with dip switches is safe as you dont need to power on the laptop and risk damage. Here is a Copy/Paste of the post again ::::
Comment by justsomewellerdude:
Sunday, February 18th 2007 at 7:32 pm
sorry for poor spelling.
1. Get ISO
2. Open ISO
3. Remove Atmel chip from your IBM
4 Solder in your IBM Atmel
5 with seperate PC download from IBM the correct flash for your unit.
6 with seperate PC download the XPAtmel 2.0 program found all over net
7 open XpAtmel2.0
8 choose the file and click download
*note*
make sure your file is in the same folder as XP Atmel
if your ISO has dip switches you use either 1&5 on or 1&6 on to program.
9. Then re-solder in your Atmel into the Thinkpad
*you now also have most current flash file (BIOS) for that unit.
Enjoy.
Monday, January 28th 2008 at 12:00 pm
Hi, thanks to the poster for the guide. I have a T42 and have followed the steps closely. I managed to dump the password ok but I cannot see the password when i scroll down to address 0×330 using the IBMPass software.
Can i send my dump file to anyone with experience that can help me or can you please send me some advice.
Is it possible that the dump file can be created without including the password in it???
Thanks in advance.
PS: Thanks user ‘crack’ but i already tried restarting the T42.
Monday, January 28th 2008 at 7:27 pm
WONDERFULL….. it’s works perfectly….. thanks a lot!!!!!. In my country, IBM says “give me US$D 1.800 plus taxes to change your motherboard….. the new mac air is only for USD$ 1.700.. IBM must crazy with this prices….
Regards….
Jack
Wednesday, January 30th 2008 at 6:37 pm
i have problem finding the password chip for tp570 kindly send me the details of chip.Also the details of pins to which i have to connect the circut made as given.will the same softwares work with tp570.please please please
Wednesday, January 30th 2008 at 10:45 pm
Does anyone have a working dump of a TP A31? If so, e-mail me at powerhouseharry@triad.rr.com. Thanks
Thursday, January 31st 2008 at 5:20 am
I am unable to find the eprom for the T43. Is it the 24c64wp? I really need this, so who ever knows the location please email me. slevos@gmail.com Please help me i´m in chihuahua mexico
No puedo encontrar la memoria eeprom para mi laptop T43, alguien que me pueda ayudar decirme donde esta, en unas paginas dicen que es PC8394 y lo unico que encontre parecido al que dicen aqui es el 24c64wp? si es ese o favor de indicarme cual es?
Thursday, January 31st 2008 at 9:09 pm
Hellow everybody.
I read the article and I tryied to do it alone, and I succeded in recovering the password exactly how the article describes but the password does not match.Anyone has this problem too ?My IBM is a T42 model.
help please.
thank you.
Friday, February 1st 2008 at 1:17 pm
Hello,
i have readen everyting i could find about this subject and built the interface for Atmel chip. Works fine on TP 600x and now only thing im missing is correct dump file for it. Does anybody have the dump file for 600x to correct the crc error?
Thanks in advance, my email is mslovic@gmail.com
Friday, February 1st 2008 at 9:45 pm
WOOHOO! Thankyou for this info. Was given T21 that was locked, thanks to this info it’s now working again… Cheers!
Sunday, February 3rd 2008 at 10:20 am
hi i have a imb tp t60 can anyone tel me where the svp chip is ive striped the laptop ive found a atmel chip in the same location as other u53 its a atmel 618 25010AN SU27 is this the right chip ? if not can someone please tell me thanks
Sunday, February 3rd 2008 at 6:46 pm
hey i’m currently working to get the algorythm for encodage of password used by ibm. heard that when u call them u just have to tell them the s/n under ur tp then they give u a pass for ur bios. if ne1 feels concern about it or have info to share contact me at kranium45@hotmail.com
Wednesday, February 6th 2008 at 2:29 am
The only carbon-film resistors i can find are 2.2-k ohm ! they come in 1/8 watt, 1/4 and 1/2 … is this the right kind? and what wattage should i use if so? thanks email me jfallon@knology.net
Thursday, February 7th 2008 at 10:26 pm
Hi all,
Catalin, I am having similar problems, did u get a result yet? Please email me at das_bade@yahoo.co.uk
Thanks to the poster for the guide. I managed to dump the password ok which created a 1kb dump.bin file but when i scroll down to address 0×330 using the IBMPass software, IT IS BLANK. I have tried with the translation off and on.
Can i send my dump file to anyone with experience that can help me
Thanks in advance.
DAS_BADE@YAHOO.CO.UK
Thursday, February 7th 2008 at 11:50 pm
I tried this on a T30. I made the device followed step by step after several times loading
to my .bin file it loaded 128byte file via the shell. Used V21Lite to extract data
but received only 0s on 12 lines. No luck after several tries. Unhooked home-made reader device and upon rebooting password lock is gone but now I receive a error code 0176 CRC
error on system freeze. I see now someone posted that the COM plug diagram is from the back side not the front so my home-made device was wired wrong. If you mess up the first time apparently there is no way to go back on the T30. The eprom is now blank and I don’t think there is a way to add data back to the erased EPROM chip. I see you can
buy a new chip and solder them yourself on the MB if you search on google for one.
For those that say they built this setup found the EPROM and did it in five minutes must be suppermen cause it took me many-many hours.
DeepFreeze
Friday, February 8th 2008 at 12:38 am
CRC1 error fix???
I see after reading some posts that there is a way to fix the CRC1 error but has anyone tried this with success? If so let me know OK. All the links to the so called utility have been removed due to copy right infringement it says. Does someone have a legit site/link to this utility?
Thanks, DeepFreeze
Friday, February 8th 2008 at 11:07 am
hi. my thinkpad is A23 and ATMEL 24rf08ct on it have 14 pin ! which pins must be scl,sda ?
Sunday, February 10th 2008 at 10:07 pm
Hi,
Does anyone have a w24rf08 program? the links that crack gave does not have that files anymore.
Thanks.
PS. you can mail me the program if you have to onehotamanda (at sign) hotmail (dot) com
Monday, February 11th 2008 at 12:33 am
All good for T41, thanks for the site especially the photos, makes a heap of difference to the allservice forum site.
thanks
Monday, February 11th 2008 at 6:20 am
Works perfectly. Just a note: you don’t really have to solder anything to the eeprom. Here’s what I did:
1 - Assembled the reader with extended GND, SDA, and SCL leads
2 - Prepared the 2nd computer (installing the R24RF08 and IBMPass Lite software)
3 - Hooked the reader up to the 2nd computer
4 - Turn on the 1st laptop aand press F1 to get to the password prompt
5 - On the 2nd computer, go to the command prompt and CD into the directory where r24rf08.exe is
6 - Connect the GND to a metal part on the laptop
7 - Using both hands connect the SDA first and then the SCL
8 - Have another person type r24rf08 dump.bin and press enter on the 2nd computer
9 - It’s safe to unhook the reader
10 - Start IBMPass Lite and open the dump.bin file
11 - Click the translate button to ON
12 - Look for the password
NOTE: This will not work with a USB to serial converter. It must be hooked up directly to an actual serial port set to COM1.
Thanks all.
Monday, February 11th 2008 at 9:17 pm
Worked fine, i had no 5V1 diodes and used 4V7 ones.
Thanks.
Friday, February 15th 2008 at 12:42 am
Hey, I have an IBM Thinkpad T41 type 2373. I succeeded in finding the ATMEL 24rf08 on my laptop. I was asking whether the electronic stuff is necessary, can’t I just plug it in the seria lport and start things up.
PLEASE SOMEONE ENLIGHTEN ME.
MY EMAIL: hell-raiserx@hotmail.com
thanks in advance
Saturday, February 16th 2008 at 5:31 pm
Haven’t seen X21 laptops mentioned here. I found my X21’s ATMEL chip buried deep on the back of the MB. It is centered on the back of the MB board about half an inch from the rear edge. You have to remove the MB to get to it. You have to practically dissassemble the entire PC. Luckily that isn’t really hard and IBM has thoughtfully posted all their Service Manuals at this site with graphic instructions.
ftp://ftp.software.ibm.com/pc/pccbbs/mobiles_pdf/24p2975.pdf
Have not tried to recover the password yet, I have to get the electronics.but I will post results when I do
Sunday, February 17th 2008 at 4:45 am
3 month to find this page only to find out that the password was ( pass ) what is with this Admin’s today I fell so stupid. on to my next stupid problem now my T42 have a HDD Password and it is not “Pass” please help me…
Sunday, February 17th 2008 at 7:12 pm
I have just unlocked my T60 using the reader software from allservice.ro.
It includes a really easy manual and the allservice.ro support is great.
If somebody cannot solder the interface and/or fulfill the task of unlocking feel free to contact me. I would do it. I would not betray allservice.ro so costs would be $45 or $100 (depends on security options) for allserivce.ro plus shipping to germany and additional EUR 50 for my work.
Germany residents can get the whole package for EUR 100,-.
Interfaces for EUR 30,-.
Simply help for free.
Greets dare_@gmx.de
Tuesday, February 19th 2008 at 11:37 am
hi has anyone had any luck with the T60 ive searched everywhere and cant find anything ive found this [url=http://img409.imageshack.us/my.php?image=48108068vg2.jpg][img=http://img409.imageshack.us/img409/8427/48108068vg2.th.jpg][/url] just need the software to dump the eeprom thanks
Tuesday, February 19th 2008 at 11:39 am
this one
Tuesday, February 19th 2008 at 11:40 am
[URL=http://imageshack.us][IMG]http://img409.imageshack.us/img409/8427/48108068vg2.jpg[/IMG][/URL]
Thursday, February 21st 2008 at 2:48 am
I follow the directions and when I hit the enter key on the PC I get no dump.bin file stored, any thoughts, I have checked and rechecked all connections.
Thanks.
Friday, February 22nd 2008 at 1:36 am
T61 use P24S08 (24RF08 clone) and can be done using the free R24RF08 tool form allservice. Stop spamming here buster.
See http://www.allservice.ro/forum/viewtopic.php?t=779
Saturday, February 23rd 2008 at 2:07 am
IBM G40
I Replaced CPU Fan And Lost Date & Time And Had Never Needed Admin Password in Pass But it Was Need To Set Time & Date Before i Could Boot to Any Drive .
Followed This How-To Cost About $2.00 US Parts From Radio Shack .
## Worked First Time Like A Charm ##
Thanks Alot for this How-To
Saturday, February 23rd 2008 at 8:15 pm
Thinpad R30: The R24RF08 is indeed located at the underside of the board near the edge of the PCB. It is hidden behind a black adhesive tape, why I first didn’t detect it.
Another mistake I made was not to insert any RAM modules. Without RAM there is no proper POST and the PWD won’t be revealed while reading it with the dumper-program.
One should not forget to set the software IBMpass 2.0 properly. Under menu VIEW/TRANSLATION one has to set it to “Alternate Scancode (R Series)”.
Tuesday, February 26th 2008 at 8:49 am
Hello,
i have a Thinpkad A20M, last week i substituted the bios battery because it was finished, After this operation when i start up my PC it required a POWER-ON password. The strange is that i haven’t filled any password before and i do not know which is the value to be filled. I have already try to remove again all battery (PC and BIOS) for many times but the password still required.
Have anyone suggestion? Can i use above procedure? if yes in which row i can found the value of this password?
Thank you in advance for your help !
Sunday, March 2nd 2008 at 9:30 pm
Hi, i’m trying to restore a T21 that have “0175 Bad CRC1, stop POST task”, i found AMTEL 24RF08CT EPROM, …. anyone can send me a clear dump .bin file? pls send to vallors [AT] inwind [dot] it
thanks a lot!
Monday, March 3rd 2008 at 2:37 am
BTW: those last numbers (e.g. 0042) is just the date when the chip was produced (YYWW).. meaning 0042 is week 42, year 2000.. its unimportant to search for it
Tuesday, March 4th 2008 at 11:39 pm
hi.All
Can you help me, i want to know locating
IC Atmel 24RF08 in Motherboard IBM X41? can you show me
or sent Picture Motherboard IBM X41 Large Size,
because i cant find in my MB X41
thanks for your kind
–
Warm regards,
khamex
Tuesday, March 4th 2008 at 11:40 pm
hi.All
Can you help me, i want to know locating
IC Atmel 24RF08 in Motherboard IBM X41? can you show me
or sent Picture Motherboard IBM X41 Large Size,
because i cant find in my MB X41
i want to reply at khamex@plasa.com
thanks for your kind
–
Warm regards,
khamex
Tuesday, March 4th 2008 at 11:40 pm
hi.All
Can you help me, i want to know locating
IC Atmel 24RF08 in Motherboard IBM X41? can you show me
or sent Picture Motherboard IBM X41 Large Size,
because i cant find in my MB X41
i want to reply at : nkhamex@plasa.com
thanks for your kind
–
Warm regards,
khamex
Thursday, March 6th 2008 at 5:37 pm
Hi all,
will this work for a Thinkpad T60?
Anyone can help me!
Thanks,
Leo
Friday, March 7th 2008 at 1:48 am
haha my girlfriend and i both have lenovo r60 core duo anyways i was arguing one day with my lovely ladie and i threw it at my dresser ! when i booted it up again the ibm tpm bios support had lost the finger print files and allowed me to set new ones…..hum sometthing to think about !
Friday, March 7th 2008 at 9:42 pm
This is just a little warning about ALLService and their staff. (a little long, sorry)
I have been using my laptop but it does have a supervisor password set that just annoying, if nothing else. I was interested in their service for my T60 to remove the password as I heard they could do it. They, for the most part only take moneybooker payments, but, will take others like western Union. I sent them a letter trying to explain that here in the US we get scams all the time in emails that say “buy this cheap and send us money Western Union”.
My letter:
Hello again, well, I would like to order your service, but, I am a little hesitant. You are in Romania and request a wire transfer, I guess you do not have paypal? I feel a little unsure as I have no protection if this does not work. I am not saying this is a scam, Trust me, I am NOT a jerk , but, how do I know this will work? I have NO job and I do not wish to lose $45 if this is a scam. You will probably say “trust me”. I wish you used ebay and took paypal because then I could show you from my Ebay record of 140 buys, that I am a man of my word, because, I would ask if you would be interested in helping me with the password first, and then if successful, I would pay. If I was making 60,000 a year, I probably would not care at all either way.
Okay, it’s a little whiney, but, no way is it derogatory, or, offensive. I was merely stating that if they could give me some reassurance, I would be more than happy to pay them or do whatever they wished. It was a proverbial stretched out hand for help, a faith of good will.
This is their letter back to me:
Are you a joker? Or I guess I am having a good time.
Excuse me, but I am really bussy.
I then said:
No, I am serious. How do I know I will not be robbed/money stolen? I do not know you, and, you are in Romania! There are 100’s of scams in America that say “send money by western union”, to take money from Americans. How do I know you are NOT the same? Where is MY “guarantee”, if this does not work, I get my money back? With a company like “paypal”, I have help. If I send money by Western Union, I have NO help if you are not honest.
(Actually, paypal will not even help since it is virtual goods, so beware that fact also.)
There letter back to me:
Mr Bond, (funny name, cause that Jan Fleming’s character is brit and you are just a redneck),
We do our business via Moneybookers on a daily basis, WU is just an option. We accept PayPal as well, but PP is also the easiest way to obtain free software, used by con artists, and is the worst selling instrument for small software companies like ours.
I could accept PayPal, however, but after your last emails I just realized you are simply an idiot.
We do not sell to this kind of people, because to gurantee the success, a certain IQ level is needed, you know.
Victor Voinea
(there is also a guy named Bob who is just as bad, if he even really exists)
Now, I am here to say that I don’t know if their service works or not, but, it is obvious they do not care too much about others. I just want all to be forewarned that if you absolutely need their service and want to take a chance, I wish you luck. They are not concerned about you!! Here is something directly from their site:
“We do not accept PayPal, as this company lacks in any minimal seller protection. We do our business through MoneyBookers or bank or at elast Western Union, etc.”
Yet, when I ask about MY guarantee, I am an “idiot”? What the………?????
WOW! We need customer service like that in America! Apparently it’s a Romanian trait as they seem to be the most hated people in Europe, from what I have read last three days
while I was trying to find some Romanian words. I, personally, judge people as a one on one basis, but, they put that theory to rest for me. People are people, but, between all of the stories I have heard, people I have met (as I have dated a Romanian girl) and especially Europe, its true, they are not so good people. Then again, look up Vlad Dracula the impaler, bad bad baaad man, lol.
As far as I am concerned, as soon as I find out how they do it, I will share it free with the world and put an end to their abusive hostage holding attitudes. I will be more than happy to show them what kind of idiot I am.
All I need now is the PC8394 data sheet and I am 1 step from closing this deal. Being unemployed it’s a little hard, but, if I have to buy the data sheet, I will. As soon as I know where the SDL pins are, dump the file, I just need to run the hash programs and it’s done. You ALL will know then how to take care of this locked problem.
When they see this, they will surely start to act nice to everyone and try to give you a warm fuzzy feeling. Let it be shown here, that what you see from their personality isn’t real. I bet people will even get on here to defend them. It will be either the people from ALLservice, or, others that bent to their requests. It’s also funny that they try to look like they are doing the world a favor by explaining how to unlock the T40’s. The reason they did that was because the Japanese/Chinese found a way and was sharing it with the world. Guess they wanted to look like the hero. I wonder what excuse THEY will have and post, as they know I am now spreading the word about them. In all fairness too, let it be known that I DID give them a good piece of my mind, but, it was after the fact that it was clear how rude they were to me. I think people should be treated better, no matter who they are, unless they are in fact a-holas.
If you want to know more about this company, please feel free to contact me. Everywhere I go, I am going to try to have it where I am notified when someone posts to my story, so, you will be seeing a lot of me. “I” will give you the full story, or what you would like to know about them about them if you want to hear it, but, hopefully you see them through this warning for who they are.
Well, good luck with them if you go that route, I have to go take them down
Chris
Saturday, March 8th 2008 at 12:31 am
@chris,
You sound really like an idiot, if you ask me. When you want something from somebody, you don’t start saying: Hey, give me that you stupid Romanian or French or Italian. Or: You want to steal American’s money! How stupid are you, they have the right to call you that, baby.
Victor is the most supportive man I have ever know, I really like that man and he really helped a lot of people, just see the last news about T61 and X61 on their website:
http://www.allservice.ro/forum/viewtopic.php?p=3521#3521
Saturday, March 8th 2008 at 3:26 am
Hi Chris!
You are really wrong think about Victor and his staff for sure.Try to understand him by visit his forum read,read and read more post about how great him did/do to help alot of people even without money(in some case) I was his client when got t60 BIOS locked.I didn’t know well about PC even type command how to dump the bin from eeprom t60,but he help me by remotely step by step.He spended more than 3hous to teach me,he like the Coach.About spend your time to bring good person down??? All none stupid people will think what about you.For the method payment any person in any Country have they own polici.When you sock some one they will sock you back that is normal
my 2cents
baomobile
Sunday, March 9th 2008 at 1:02 am
Oh, please!..”..customer service like that in America!” Another american moron.. try PayPal customer service, mate.
Good job, allservice!
Sunday, March 9th 2008 at 6:06 am
Dear Chris,
Please excuse my boldness but I have to agree with Victor. You are an idiot. And not only that you are a loser. That is a big inconvenient. We have a president that is an idiot but he gets around just because he is not a loser. By a loser I mean a person who is afraid to take charge of his own action and life. A loser…Chris is a person who always finds a fault in something and is making up excuses for idiotical behavior. I’ve known Victor for years and he is on the top of my list as regards of integrity, brains and moral conduct. You are just the opposite, And you have the f.. nerve to doubt him. He has helped thousands of people and he is the person who when he first started did not even want to charge for his software. He wanted to give it away. If it weren’t for morons like you I would have agreed with him. But since LOSERS like you were born on this awsome planet of ours he has to charge money. And if I were him I would have 2 prices. One for regular people and a triple one for Losers. Sorry Chris. I know is going to be hard to read this ( or if I know losers you will go in denial from the first sentence) but please take it as an advise. Life is to short to be afraid and by being a loser you’re making it worthless. Please make some changes. You can start by apologizing to Victor.
Thank guys!
Wednesday, March 12th 2008 at 10:45 pm
T42
I have the reader ready, but when i turn on the computer and click on f1 the computer tries to go to the bios but then I get error 0271 Please Check date and time settings and then goes to the black screen with the lock on it.
Any ideas how to avoid this?
thanks
Thursday, March 13th 2008 at 1:26 pm
Just a FYI this same process will work with some sony Vio’s as well as many Toshiba and DELL. The location where the password is stored is different but with a good eye you can locate it easily. There was a guy charging something close to 20.00us for this service but he did provide a schematic to use with a bread board. Made it a lot easier.
Thursday, March 13th 2008 at 6:53 pm
Sony Vaio are almost all using 24C02 eeproms, You may simply use PonyProg with the circuit explained here, or better use ALLservice’s R24C02 made specially for VAIO eeproms. IBMpass can reveal the passoword as well.
Saturday, March 15th 2008 at 2:59 pm
can you help me ?
my TP X41 forgot password. i will try ic eeprom with hack bios in SoDoItYourself.com. but the result in command prom are . its not availble eeprom?
and my tp before startup i press F1, in screen
error
0187 : EAIA data access error
error
0191 system security-invalid remote change rquest
pls help me…. , give me info or solution about it
thanks and appreciate for you.
warm regard
Gamblez Wong
Saturday, March 15th 2008 at 4:28 pm
Hi i have a IBM thinkpad T43. I found an Atmel chip back by the modem. It reads 24c64an. What i would like to know is will the software for the 24RF08 work with this Atmel? Also are the pinouts the same for both?
Thanks
Sunday, March 16th 2008 at 1:17 am
Hi, for those wondering if the service offered for cracking the BIOS password is real and if it’s worth the money etc, I have used (or tried using) both of the main Thinkpad BIOS password cracking sites when my Thinkpad locked up … Victor in Romania http://www.allservice.ro and Joe in Australia http://www.ja.axxs.net/unlock/ I found both to be legitimate, helpful, and to offer a very good chance of cracking the password. Now, if you have an older Thinkpad with Atmel 24RF08 then try going with Victor because his software for that is free. For newer laptops, consider both. Both require you to dismantle the computer, build the reader (Victor also has the option to buy a ready-made reader), and work with their software to crack the password. Both say that getting the parts and building the reader is easy … well, yes and no, because finding some of the parts may be harder than either realises, so if you press ahead you may have to source parts at two or even three suppliers which means cost may be slightly higher than anticipated. Now, if you don’t think you can build your own reader or can’t be bothered doing so, go with Victor because he offers a ready-made reader (on top of which, fair enough, you also have to pay for the service of reading the BIOS password). If you think you can build your own reader, both offer a good service. Personally, though, I would go with Joe because 1) he’s cheaper, AND if your password has stronger protection and needs to be erased that’s included in the price whereas for Victor’s it is an extra charge; and 2) Joe has a very good step-by-step guide (photographs) of each stage of building the reader and using it, whereas Victor (who I tried using first) provides an electronics diagram that unless you have experience might as well be in Swahili and while he can point you towards a picture of a built reader it’s not quite complete (for example, no indication of where to insert battery wires) so in the end, frustrated, I gave up and went with Joe. I did find Victor helpful every time I asked a question, but he just couldn’t understand why I couldn’t understand the diagram. Joe is much better for novices like me. That said, it’s your choice so rest assured that both are legitimate, and you won’t be ripped off … and while you might damage your laptop, this seems harder to do than both advise (if I didn’t damage it, it must be hard to do so!) and you might as well try because the laptop’s as good as dead if you can’t unblock the BIOS password. I hope this advice helps people.
Sunday, March 16th 2008 at 6:56 pm
I bought an R51 used and it had the Supervisor password set. I followed these instructions and was able to ‘crack’ it.
Here are couple of tips that may help…
I didn’t solder the wires to the chip. I carefully used two wires bound together with shrink tubing with the ends barely poking out the end. Then when it was time to ‘connect’ them, I held them on the chip and had someone else hit ‘enter’ on the tech computer at the appropriate time. Worked flawlessly the first time.
Others have mentioned this… but when using the decoding software (ibmpass) don’t forget to hit the on/off button toward the upper left to reveal the password.
Once my password was ‘revealed’ it still didn’t work. Come to find out my Thinkpad had both the Supervisor password and the Hard Drive passwords set - AND they were different. I had to pop the hard drive out so the supervisor password prompt would come up. Then I was able to get into the bios and reset the supervisor password to ‘nothing’…
I have not been able to unlock the hard drive. Everything I have read so far indicates I will need to replace it. The important thing is that I was able to get the computer unlocked.
Thanks to Everyone who contributed to this post. It was very helpful.
Sunday, March 16th 2008 at 11:04 pm
Jcck, the main difference is that allservice’s software give you the possiblity of an unlimited use and do yourself the whole job, if you are a professional you’re looking for that for sure. You buy once and use forever. Joe is asking you for each removal, is not cheap as you said, is only an impression, Besides, he’s asking money even for the old 24RF08 laptops…
Monday, March 17th 2008 at 4:31 am
To those that called me an idiot, I laugh at you and shake my head in disbelief.
1) If I said I can make you a million dollars if you send me $100, would you do it?
2) You have no problem sending money to a website that could easily be made up?
2) So, you will send me money without asking what kind of guarantee I would offer you?
Please, send me your $100 and I will make you rich, I promise…………………. you idiots!
And who are you people? How do I know you don’t work for Victor? When I FIRST talked to Victor, I has the most positive thoughts of him. I try to explain to him that IF he was legit, I had the utmost respect for him. I also tried to explain why I was hesitant to send money to someone I don’t know. Imagine my shock when he said back to me that I was an idiot!? What if I called DELL and asked them, like all Americans do, to help with the password and they just called us all idiots? You think for a MINUTE that DELL would still be in business?? I will use HP, COMPAQ or any other US based company that is big and serious about doing business. If ANY of them called me an idiot in an email, their job would probably end right there. No matter how stupid the question or comment is, oh great Victor should have been polite about it.
I NEVER said to him he WAS a fraud/fake. I never said anything bad to him. He just thinks he is the greatest person and all others are below him, it shows. Dont be mad at me! If there was something, somewhere or someone reputable that could vouch for him, I would not send him an email and ask. All these sites he is on do not mean anything as ANYONE could say “oh, it works”. Honestly, I hope he IS honest, but, to not have any credible sites, and, just give him my money, you have to be kidding me. “I” have an ebay account that SHOWS I am credible, where is there’s? I am offering my credentials, why not them? I need a little more proof, and I called him/asked him on it, politely as I could. Only scammers get angry and upset when you do that………idiots!!!
Monday, March 17th 2008 at 4:45 am
Oh, one more thing to the people that called me an idiot. You can call me what you want, I am fine with that. To say I “may” be wrong, I would totally respect that, I might even say i could be wrong, but, to call me a loser and idiot it shows me who has a 3rd grade education level. I see you are also no better than Victor and if you were trying to stand up for him, you just brought him down even farther. You sound just like him, are you him!?
Does not matter, I am not here to throw words back and forth. I am just here to show all sides of Victor the great….or not so great in a social invironment anyways.
Tuesday, March 18th 2008 at 11:11 pm
I have a TP A21M and have not been able to locate the Amtel 24RFC8 or 24RF08CT 0042 chips. its tore down completely. If anyone has a component number on the board or a picture, anything would be really appreciated
Wednesday, March 19th 2008 at 8:25 am
I need schematec for reader writer 24FR08CT
please send me the compleate diagram for interface
Wednesday, March 19th 2008 at 11:18 am
Goma, good point. I agree, Victor has advantages too. For more experienced and more regular users of the services, Victor may well offer a better choice for them. But for people like me who are intelligent but nonetheless novices at electonics, only ever going to try unlocking one computer, and coming onto this site with very basic questions, they just want to know: are these guys legit, is the reader easy to build, and will the services deliver? For those people with limited experience willing to try building a reader for one-off use, Joe’s instructions are simply much easier to understand and the service is cheaper for them. (If Victor made his instructions easier to follow, this comment would no longer necessarily apply.) If, on the other hand, they don’t think they can build a reader for one-off use, or can’t be bothered, I made the point that Victor does offer a ready-made reader that would be great for them.
Thursday, March 20th 2008 at 5:31 am
I read so many comments but i need read/write 24FR08 through USB /serial port
i have seen a adoptor on net by rebios .net
i need schematic for this device
i think it is very esy to use because there is no soldring etc.
if any body have this schematic please i will thanksfull for schematic of this device
Thankyou
Thursday, March 20th 2008 at 5:32 am
I read so many comments but i need read/write 24FR08 through USB /serial port
i have seen a adoptor on net by rebios .net
i need schematic for this device
i think it is very esy to use because there is no soldring etc.
if any body have this schematic please i will thanksfull for schematic of this device
Thankyou
Thursday, March 20th 2008 at 6:17 am
Today I fix it my second ThinkPad R40, thank you all for your post help a lot. Procedure clear and efficient. See you
Friday, March 21st 2008 at 12:16 am
help::::::::
x60 lenovo
please! pass bios
no port 9 pin, my port is of 15 pin
¿? help: please::
Saturday, March 22nd 2008 at 1:14 am
HELP, I just spent $100 on a thinkpad 390E on ebay and it has a power on password set, i cant get into bios or into windows, i have no idea what the password could be, any ideas? will the method listed here work???
Sunday, March 23rd 2008 at 11:56 pm
Yes, it will work. 390E has 24RF08, the procedure is the same. See also the allservice.ro/forum, I think they have the 390 pictures somewhere
Monday, March 24th 2008 at 2:54 pm
Forgotten Power-on password
If the Power-on password is forgotten
and the Supervisor password is known,
simply go into the ThinkPad BIOS setup
utility and reset the Power-on password,
otherwise try the following:
Turn off the computer.
Remove the battery pack.
Remove the backup battery. This is
located under the battery.
Turn on the computer and wait until the
POST ends. After the POST ends, the
password prompt does not appear. The POP
has been removed.
Reinstall the backup battery and the
battery pack.
Note: Some ThinkPad systems have the
ability to reset the Power-on passwords
in the ThinkPad BIOS setup utility if a
Supervisor password has been set.
Monday, March 24th 2008 at 8:05 pm
Can anyone tell me where the atml chip is on a IBM T30 Thinkpad?
Tuesday, March 25th 2008 at 5:06 am
Reading Eeprom >>>
Done.
LapTop unlocked.
Thanks. :]
Tuesday, March 25th 2008 at 6:10 pm
Can anyone tell me where is the chip on Thinkpad A21M?
Thanks
Wednesday, March 26th 2008 at 4:41 am
Tengo una thinkpad T42, segui los pasos y a la primera no aparecio el password, pero despues de cerrar y abrir la aplicacion con la opcion “AA => OFF”, el password aparecio.
era uno de los mios pero solo los 7 primeros digitos fueron capturados por el Bios, por eso nunca habia podido acceder.
MUCHAS GRACIAS.
Wednesday, March 26th 2008 at 10:30 am
i found the chip. now everythings work fine.
Thanx
Wednesday, March 26th 2008 at 1:54 pm
Hello.
I’ve a TP A30 with a CRC1 error. I need a valid dump for this model. Does someone have a valid dump for this model? My mail ***86@hotmail.fr replace *** by davidp.
Thank you.
Friday, March 28th 2008 at 1:41 pm
chris,
you really are an idiot. i know victor for a few months. he’s the most supportive person that i have ever seen. he helps anybody he can. how you ended up like this, is your own darned fault. victor is a man of integrity. i am living proof of that.
Saturday, March 29th 2008 at 8:28 pm
i have got an T42 with BIOS Password set. The User forgot this Password. i build this little Interface and readed out the bin file succesfully. Unfortunately the IBMPass Tool coud not encrypt the file to display an useful password. Can you help me please? Can i send you the file per mail and you try to encrypt the valid Password.
Best Regards Klaus
Tuesday, April 1st 2008 at 2:44 pm
I just bought an used IBM ThinkPad T22. I took it apart to clean it. Now when i try to boot it, it wants a password :/ I’m now sure if it’s the supervisor password or another password. Please help me!
Tuesday, April 1st 2008 at 8:56 pm
Help please..anyone. can anyone tell me where the chip is on the A21M? the location or component number
Friday, April 4th 2008 at 2:53 pm
hey thanks guys. i connected every thing as specified above but wen I run the dump file it keeps telling me “circuit not found” can someone help me out?
Saturday, April 5th 2008 at 9:04 pm
Hi, i have the dump file when i open the file and turn on “AA” button in the line 0×330 says ” A A” (wihtout “) y put this in the password but dont work. can any help me? sorry abaut my engish,,, thanks
Saturday, April 5th 2008 at 10:34 pm
hey i asked you guys bout 2 weeks ago about the poweron password on a tp 390e, ok its a little icon with a computerand a masterlock, taking the batteryout does not do any thing, do i have to use the method described here??, please i need all the help i can get!, thankz
Monday, April 7th 2008 at 12:02 am
EEPROM Not Available !! Important, read me if you get this message!!
After messing around with this all day, and checking all my connections about a 100x, I finally narrowed it down to being a COM port issue. Under WIN XP I ran MSCONFIG and disabled ALL ’startup items’ AND ’services’, restarted and VOILLA!!! It worked!! Thanks to this forum and all users who posted threads, Information is KING!
EEPROM Not Available !! Important, read me if you get this message!!
Monday, April 7th 2008 at 1:14 am
Also, another handy tip:
Instead of soldering or wrapping to the EEPROM pins, I had soldered my wires to tack needles (you know the ones with the little beads on the end of them used for clothing.
I guess you could also use sewing needles, but I like the beads on the end of it…it made for easier handling.)
This allowed me to connect the SCL and SDA wires to the EEPROM pins without risk of shorting/damaging the ATMEL….the only problem I ran into using this method was…that I needed another hand to press the ‘enter’ key
Thanks & Good Luck to future IBM BIOS password hackers!
Monday, April 7th 2008 at 2:11 am
FYI: My Supervisors password turned out to be 966399 on an TP A30. If you have this model you may want to try-it-out for sh*ts and giggles, before attempting the hack. I don’t know if each TP has a unique password based on serial number or if they break ‘em down into batches. i.e. (1000-5000) will have this password, (5001-10000) will have another pw, and etcetera.
Thursday, April 10th 2008 at 1:25 am
Hello to all!
Can anyone send me a .bin of IBM Thinkpad T23?
Pleaseeeeee.. send it to my e-add:
yethoo at yahoo dot com
Thanks in advance!
Great site too, a lot of people revived their TP, hope mine too
Please send me a .bin of T32.. Thank you very much!
Thursday, April 10th 2008 at 1:30 am
Hello to all!
Can anyone send me a .bin of IBM Thinkpad T23?
Pleaseeeeee.. send it to my e-add:
yethoo at yahoo dot com
Thanks in advance!
Great site too, a lot of people revived their TP, hope mine too
Please send me a .bin of T32.. Thank you very much!
Thursday, April 10th 2008 at 7:27 pm
I run this line:
r24rf08 exam.bin
After that it shows me the next message:
Initialazing time… 19848 OK
ERROR: Eeprom not available!
Hit (Enter) to exit….
Can you help whit this?
Friday, April 11th 2008 at 12:42 am
hi boys! well, sorry for my bad english, but im from argentina, a spanish country… jaja, i just write for thank you for this tutorial. I had a death T21, because at the supervisor password that make impossible boot to windows or enter to setup. But all that it was finished by the siprog and the utilities of software. it was really hard to sold the wires of the eeprom, because it was one of that contains 14 wires… but, with a lot of pacience y careful, i made it! the fucking password is, was… 2001EGP
I said was, because i already disable that option in the setup menu…
Once again, thank you very much! all the technics here in my town wasn’t know how to fix it, so i had to take it in my hands…
i will recomend this method to everybody!
bye bye, and thanks again!
Sunday, April 13th 2008 at 9:51 pm
I have an IBM T42P, which we attached to 2 - 2200 ohm resistors & 2 zeners. etc to a serial port.
It works! I got a DUMP.BIN of 1024 bytes, but the file has nothing at location 330 hex.
I made several copies of the dump.bin file dump1.bin, etc… all are the same…
Help me with this passowrd please?
How might I send you one of these dump.bin files for examination?
Tuesday, April 15th 2008 at 11:41 pm
merci
Thursday, April 17th 2008 at 3:09 am
This is great info, I was successful on the first attempt at dumping the eeprom on my T23.
What happened in my case is that one day I turned on the thinkpad and it beeped and said error 271 check date and time or something along those lines. Then it went to the password screen and it would not accept my password. I tried everything like removing the battery and then finally found out about IBM’s stupid security chip. I’m glad I didn’t have to strip down the laptop as the eeprom was just under neath the ram cover. Some useful tips if you have to do this: Use a solid conductor wire such as wire wrap wire as it is a very fine gauge. You dont have to solder GND wire directly to the chip, just find a common ground point. You can use your DMM to verify this. A repair shop quoted me $200 CAN to recover the password!
Thursday, April 17th 2008 at 2:20 pm
maybe a different question than usual: after updating the bios of my T61 i got confronted with a bios password promt on the next boot. but i never set a password. i’m not sure if the upgrade just went wrong, but as i still see the lenovo logo followed by the password prompt and got no errors during update i guess it has worked.
so now i wonder if lenovo made a mistake and delivered a bios that has a default password set. can i use the tools from above as well to reveal the password if i only have the bios update files? i don’t see a bin file in there, but i guess somewhere in those files like $01AF000.FL1 it has to be, right? did anyone ever play around with those original files instead of the dumped bin file?
any help appreciated.
Friday, April 18th 2008 at 8:36 pm
Method confirmed to work with R50e. I successfully retrieved the password out of one. To anyone who says they couldn’t find the password in the dump file: You have to click the translation button labeled AA. Also make sure you have “Scancode” selected in the translation options.
Saturday, April 19th 2008 at 7:45 am
Just used the circuit and the two programs to convert my BIOS password locked T21 from a container of spare parts to a working laptop. Thanks so much for the assistance and advice on this site. I did not even have to solder wires to the EPROM. I used someone’s suggestion about holding probes against the two pins. I used the needle probes from my multimeter and someone else ran the programs on my desktop. Worked perfectly first time. Parts cost: AUD2.70! Way less than a used motherboard, let alone a new one. You made my day guys!
Saturday, April 19th 2008 at 11:53 am
I successfully hacked the password on a R30 but there is a space as the second character and when I type a space the laptop just beeps, so I cant enter it correctly. Does anyone have a solution for this
Thanx
Sunday, April 20th 2008 at 7:38 am
Hello i have a IBM T43 thinkpad! ..
Can anyone Email me exactly how to found out my bios password?
BIG thx in advance..
Sunday, April 20th 2008 at 9:22 am
Hello … SDIY…..
haha.. i already do repairing any problem related to IBM password removal. I got it only from the awesome tutorials of this site. Thanks…
I have built the interface hadrdare by myself and it always works well.
Tuesday, April 22nd 2008 at 11:46 pm
wondering if you would be able to show a picture close-up of the reader with everything put together i am terrible at schematics but if i had a picture of what wire went where and what it looked like when it was built i am pretty sure i can build it thanks so much for your help.
Friday, April 25th 2008 at 9:50 pm
awesome!! the a20m i worked on had the 14 pin chip. the system had to be disassembled entirely to get to the security chip under the mobo - the chip was located on the right side (if the mobo is out and flipped over) about 2/3rds of the way up.
what had happened, a supervisor password was on the machine, then it was left off for a year - so the machine was dead - as no one remembered the supervisor password, it couldnt even boot. with a few hours of work from complete disassembly to reassembly (2 times, it didnt work first time, so i double checked the work), it went comparibly smooth, and i can now re-use the celeron 500 mhz for a friend. please note - if you dont know electronics or have a steady hand, i do NOT recommend doing this repair. as i have both, it was not an issue.
Monday, April 28th 2008 at 7:48 pm
es que tengo una thinkpad t30 y no me acuerdo de el password de bios que puedo hacer
Thursday, May 1st 2008 at 4:34 am
Thanks, you saved my A31.
I did not solder the wires, but merely attached the GND wire with a screw and held the SDA and SLA onto the chip by hand. Steady as she goes !
Also, I had to toggle the display in the IBMPASS program so I could read the plain text, not the encoded characters.
Thursday, May 1st 2008 at 11:23 pm
I tried it on a TP 390X and it worked first time.
The Atmel chip is located at the back left of the laptop. It was a bit tricky getting a soldering iron to attach the wires, but not impossible.
Thank you !
PS the schematic should mention that SDA is on pin 5 and SLA is on pin 6
Sunday, May 4th 2008 at 9:40 pm
I found a way to reset the bios password for an IBM Thinkpad T42. By opening up the computer to find the ATMEL 24RF08 chip. Before turning on the computer short circuit the two lower left pins with any metal object that you can find(e.g. screwdriver) then turn on the computer. When the boot up screen comes up, press F1. When you see the small lock, simply press Enter and it will give you an error message then ask you to press F1 to enter the Setup. You are now on the Setup Menu (remember that you are still short circuiting the two lower left pins). Go to the Password section and you will see that the Supervisor Password is Enabled, since you are logged in as Supervisor by pressing the up or down keys you will see that it becomes Disabled. Once you see that it is disabled select it and it will ask you for a new password. At this moment remove the object that is causing the short circuit and type in a new password( e.g. 1), save and exit.
Now turn on the computer as you always do and when you see the boot up screen, again press the F1 button. It will ask you for a password but now you know it, because you set it. At this point now you can go into the password and have it disabled so you won’t go through all of this mess again.
Tell me if it worked with you… danielfixespcs@gmail.com
Monday, May 5th 2008 at 12:47 am
That will give a nice EAIA error and the Southbridge io ports will be damaged. I found this to be the idiots “method”, even for Dell. “Tel me if it worked for you…” nice, why don’t you cool your brain elsewhere?
Monday, May 5th 2008 at 12:47 am
That will give a nice EAIA error and the Southbridge io ports will be damaged. I found this to be the idiots “method”, even for Dell. “Tel me if it worked for you…” nice, why don’t you cool your brain somewhere else?
Monday, May 5th 2008 at 5:32 am
Call it whatever you want, Mr. Idiots method. All I am saying is that this is what I did and it worked for me. Everything still works fine, you can still set up a new Supervisor Password if you want. I just thought that if someone had a problem like mine this might help. “Si no vete a lamber gansitos!”
Wednesday, May 7th 2008 at 9:34 pm
Thanks for the info El Professor. Well, just let it be known thats an option with dangers inherited. Wonder if its safe to do with a resistor……hmmm…
Saturday, May 10th 2008 at 12:06 am
Hola a todos, solo para saludarlos y comentarles como fue que pude quitar la contraseña de encendido a una laptop IBM Thinkpad 380XD. La cual trae un chip EPROM (ATMEL, 24C01A, SC27).
La contraseña no me permitia entrar al BIOS cuando oprimia F1, porque lo primero que hacía es pedirme la contraseña.
Pues bien, hice el armado del circuito que en esta página se publica, bajé los programas soldé los cables al chip eprom y corri el proceso de lectura de chip desde otra PC. Pues nada que lo leía porque mandaba el error “EPROM not available”. Como a muchos otros en este foro.
Esta laptop antes de pedir la contraseña, ponía los siguientes números: 161, 163 y 158, luego pide la contraseña.
Decidí que iva a conectar el cable serial justo después que apareciera el 161, y asi lo hice. Pero hó sopresa, ya no continuó el 163, si no que apareció el 188 en tres ocaciones y luego el 163 y me mando a una ventana donde me pedia pusiera la fecha y la hora.
Después de eso de ponerle la fecha y hora se apago la pantalla y aparecio ventana de IBM y la cantidad de memoria instalada pero tardaba en mostrar algo mas y le quité el cable serial, y que entra al windows.
Reinicié y todo bien, pero apagué y volvi a prender y que me vuelve a pedir contraseña, pero como ya sabia como “brincarme o resetear” el chip lo volví a hacer pero ahora antes de que entrara al Windows oprimí F1 y entró al BIOS entonces voy al apartado de contraseña y para sorpresa mía ninguna contraseña estaba puesta ni administrador ni encendido y de disco duro. Mas sin embargo seguía pidiendo contraseña al encender sin ser ni aceptar ninguna. Entonces opté por ponerle contraseña al encendido y de administrador que de forma automatica se le puedo al disco duro.
Apago la Laptop, vuelvo a prender y me pide contraseña le pongo la de administrador y nada le pongo la de encendido y de OK. Y yo dije pues ahi quedó.
Voy a poner unas imagenes como referencia.
Cabe mencionar que con este método no usé para nada ningún programa porque los que aqui en el manual se mencionan no me funcionó.
mas informacion a mi mail seronoser@itelcel.com
Disculpen mi pobre inglés ya que mi idioma es el español
Saludos desde México
Saturday, May 10th 2008 at 2:08 am
Hello to all, only to greet them and to comment on them as it was that I could take the password of ignition from a laptop IBM Thinkpad 380XD. Which{who} brings a chip EPROM (ATMEL, 24C01A, SC27).
The password was not allowing me to enter the BIOS when it was oppressing F1, because the first thing that it was doing is to ask me for the password.
Well, I did armed{assembled} with the circuit that on this page is published, lowered the programs welded the cables to the chip eprom and covered the process of reading of chip from another PC. Since{so} not at all that was reading it because it was ordering the error “ EPROM not available ”. Like{as} to many{many people; a lot of} others in this forum.
Before asking for the password, this laptop was putting the following numbers: 161, 163 and 158, then asks for the password.
I decided that iva after the serial just cable connected later that was appearing 161, and like that I did it. But hó sopresa, already it did not continue 163, if not that appeared 188 in three occasions and then 163 and I get about to a window where he{she} was asking me was putting the date and the hour.
After that thing about putting the date and hour I go out the screen and there appeared window of IBM and the quantity of installed memory but it was late in showing something more and I took the serial cable from him, and that enters the windows.
I began again and all good, but I extinguished and took again and that asks me for password again, but like{as} already wise as{like} “ me skipping or resetear ” the chip I did again but now before it was entering the Windows I oppressed F1 and it entered the BIOS then I go to the paragraph of password and for my surprise any password not even manager was put not burning and of hard disk. More nevertheless he{she} kept on asking for password on having lit without being do not even do not even to accept none. Then I chose to put password to the ignition and of manager that automatically I him{her; you} can to the hard disk.
I turn off the Laptop, take again and he{she} asks me that I put password that of manager and nothing I put that of ignition and of OK. And I said since there it stayed.
I am going to put a few images as{like} reference.
It is necessary to mention that with this method I did not use for anything any program because those who here in the manual are mentioned it me did not work.
more information to my mail seronoser@itelcel.com
Forgive my poor english
Greetings from Mexico
Tuesday, May 13th 2008 at 6:48 pm
Hallo,
I need help.
All what is written belongs to the 24RF08CT with 8 legs. But my chip has 14 legs.Who can help me? It is for an IBM 600X.
A lot of thanks
Hartmut Gerlach
Wednesday, May 14th 2008 at 12:36 am
Hello
I have 2 - T40 Thinkpads. Number One has the dreaded “Black Screen” crash problem, due to a known issue with bad solder connections on the Graphics Processor Unit (GPU). This would require a solder reflow to fix, and is a pretty much hopless cause. I have another T40 that is perfect, except for having a password locked bios.
Question is - Can I just switch Atmel password chips? Put the one from the t40 with bad gpu, into locked t40. Or is there more to it than that?
Any info would be appreciated…!!
Wednesday, May 14th 2008 at 8:25 am
Pls Help My
Tp23 stop post and msg
017 : bad crc stop post task
Wednesday, May 14th 2008 at 8:39 am
Hallo,
I need help.
All what is written belongs to the 24RF08 4 14 legs.Who can help me? It is for an IBM t24
A lot of thanks
Aries
Thursday, May 15th 2008 at 9:49 pm
Dear
I have a problem with a IBM TP R40 that appears when lighting the 0187: EAIA data access error, and it is begun after several intents of out and ignition is able to enter, if somebody had some solution to this problem I would thank them to him. I didn’t make anything of removing him the countersign the error she/he appeared alone.
Greetings and Thanks
Thursday, May 15th 2008 at 9:55 pm
Dear
I would thank any help to solve this error 0187: EAIA data access error of IBM Thinkpad R40, pleas send me answer mauriciooliva@msn.com
Sunday, May 18th 2008 at 12:17 am
Hello,
Bought a IBM G40 from a fellow that had tore into it to try and bypass the password.
He gave up and I tried your method, and lo and behold, now the laptop does not have a password.
Thanks for the info, I will keep my little contraption just in case I run onto another good buy with
a bios password laptop.
RHF
Monday, May 19th 2008 at 3:02 pm
Hi,
I am going to be following this procedure to hotwirring the computer to find the password, only thing is i dont clearly understand of what the images show, as i am not sure of where the ground is on the computer, can you please show me some sort of an image that will clearly display where the wires must go, i have already found where the chip is (AMTEL, 24RFC8, 0446), but i do not know where the third wire goes, as well as i do not know the exact equipment i should be using (such as the wireles not resitors etc), and i do not know how exactly the wire should be placed (e.g. on a board, etc), clear images of all posible shots to show the exact places and how to do this would be great, such as step by step images. Please email me at samjohny666@hotmail.com to let me know how i am exactly meant to do this and where i can buy the eqiupment.
Thanks!
Monday, May 19th 2008 at 5:38 pm
I have reviewed all the data regarding the hardware build. I have not located the WATT requirement for the Zener or Resistors. I believe a 1/4 watt will work well for each. However not sure.
Thank you
Monday, May 19th 2008 at 8:23 pm
my stinkpad r40 seems to have a bad starter for the backlight seen it flicker… once. so i flailed it apart, completely.now i have a quandry,disconned thebatt w/ heatshrink on it BAM three strikes ur out i.e. no clue what im doing, obvly. im getting a “beep beep” after the TPibm power up then yeah,whatever itll collect dust just like everything else i try to do PEACE!!!
Wednesday, May 21st 2008 at 3:57 pm
My X41 (type 2526-Y77) has got P24S08 EEPROM chip located on downside of motherboard. P24S08 is a clone of famous ATMEL 24RFC8 password chip.
Monday, May 26th 2008 at 4:56 am
I have attempted to pull password from chip. I have created the hardware and have tested with meter to ensure correct. everytime I attempt to create the .bin file, I receive an the follwing error C:\ALLservice\24RF08>r24rf08.exe burkhart1.bin
24RF08 eeprom reader v2.0b - Win32 Console Version
Copyright (C) Victor Voinea, ALLservice 2004-2005, http://www.allservice.ro
—————————————————————-
Initializing timer…23704 OK!
ERROR: Circuit not found or bus error!
This is an X40 with 24rf08 chip. Any help would be appreciated.
Wednesday, May 28th 2008 at 2:25 pm
Hi,
I initialised the TPM on my nc8430.
After rebooting the password I entered didn’t work.
I tried hundreds of key-combinations but withouth success.
The hp-service told me (after about 2 hours of conversation and useless talk) that it was impossible to help me and I needed to replace the mainboard.
Does anybody know any way to reset the tpm chip?
Or is there anyway to remove that chip from my board?
i tray everything 3 month long , but no result .
i find only after long ahour internet surfing the security chip Infineon SLB 9635 TT 1.2
slb9635tt12
please help
I am completely despaired,
Friday, May 30th 2008 at 11:41 am
Hi, thanks for this informations…..I have a T30, I have read the eprom and put it in a bin file and i used IBMpass 2.1 Lite to decode the file and between the row 330 and 340 I found the password that is repeated in the 2 lines but not recognized (& . . . . . . J ) = 26 12 12 00 00 00 00 4a.
can u help me?
Friday, May 30th 2008 at 4:45 pm
work this instruktion for the r52???
Sunday, June 1st 2008 at 8:46 pm
Hello,
i have an old Thinkpad 760ED with Bios Password and HDD-Password,
Where can i find the bios-chip or what can i do?
please help me, thx
Tuesday, June 3rd 2008 at 3:05 pm
@Claude El Helou
In IBMpass click the A_A button and you’ll have a surprise
@cybaer
No. R52 requires the other software, RPC8394
Tuesday, June 3rd 2008 at 7:59 pm
Hi don, I click A_A button and i have the surprise
so thank u very much…….
Sunday, June 8th 2008 at 4:46 pm
Hi,
Thank you very much!!! Everything worked like a charm on my R50e. The EEPROM is located exactly where described (below CPU).
The instructions are easy to follow.
Great work.
Thank you
D
Saturday, June 14th 2008 at 8:04 pm
Hi,
Thanks for this tuto. It’s a great work.It works for me on an X61.
But I wonder if it’s not possible to do this by a software way…
On lenovo site you can dl a soft to manage bios setup including secure parts to copy on many many other laptops. It’s SRCMOS.EXE. As they say if you have a supervisor password, this one is copied at the same time. When doing backup of a supervisor passworded bios config, the exe can ask you this password. It prooves the soft can read the supervisor password…
I’m not skill in ASM to disassemble this exe, but if one cant do it. It should be a better way to recover the supervisor password!
Thanks to consider it !
PS : Please, excuse my bad english…
Sunday, June 15th 2008 at 4:26 pm
Good, very good.I have note AMD 64_x2 2.4Ghz/Hdd-320/4gb/GeForce 1280Mb turbocashe/
on my comp Fifa2008 game very stupids .i have VistA(fuck) Please help me(david_tutasia@yahoo.com) Ukraine
Congratulations all vs Euro 2008 & Euro football2012 in Ukraine .Go to Ukraine.
Thank.
Sunday, June 15th 2008 at 4:31 pm
im sorry my bad english & please help me I very like game EA sports Fifa2008 but i play in PES08 (japan fuck) now.
Monday, June 16th 2008 at 3:41 pm
I don’t know why you guys have to go through all this. about twelve hours ago, i disabled the password on a T30 by removing the cmos battery, then booting the laptop while plugged into the power adapter only.
Monday, June 16th 2008 at 9:33 pm
I have a Compaq nc8430 mobile pc can some one help me to get my Bios password HP tel me i must buy a new motheroard ? please help
Riek
Monday, June 16th 2008 at 9:36 pm
Is it the same as IBM ?
Tuesday, June 17th 2008 at 12:21 am
THINKPAD R52 HELP!!! How come nobody has any info about them :S… IBM ThinkPad r52 it doesn’t even have an atmel chip. I dissasembled the whole thing, looked everywhere and nothing :(… WHERE’S VICTOR? HEY VICTOR!!! HELP!!.. I won’t call you an idiot I promise… Joe?.. where are you guys.. this junk doesn’t have an atmel chip ;( I’ll give a kiss if you help me out… it won’t matter if you don’t brush your teeth… *wait a minute but i don’t like men.. :S… ok I can try it, just help me out guys ok?. I’ll be hopping for your reply. Geez I even borrowed my old friend joe his mouse and took it apart to build the chip dumper,.. uh.. he doesn’t know yet but I think he won’t mind… as long as he doesn’t find out
hehehe. please just a little help :(..
Tuesday, June 17th 2008 at 5:12 pm
Hey, great site. I took my tpT21 apart as far as it would go…….. then read the rest of the posts…….. seems i didn’t need to do this!!!
WHY DOES IBM MAKE IT SO HARD TO DO SOMETHING ILLEGAL??????
Thursday, June 19th 2008 at 10:29 am
hi !
I have R61 i have the same problem..,
i opened my tp but i am not able to find out ATMEL 24RFC8 password chip.
could any one help me for this model…R61….
as one comment saying the p24508 chis is also the ATMEL 24RFC8.shall i go head with that…
Thursday, June 19th 2008 at 6:43 pm
THINKPAD R52 HELP!!! why nobody wants to help unlock my junk :(.. come on guys.. I need it for school
.. and ibm want’s to charge me 800dls to unlock it + tax. + california tax + fedex :(.. and I have to prove that is mine.. hard thing since I got in a thrift store :(.. they say the receit from the store is not proof. WHAT IF I TAKE OFF ALL THE CHIPS.. AND INSTALL CHEETOS INSTEAD :p HEHEHEH.. OK JUST KIDDING BUT COME ON GUYS.. HELP!!! :(.
Monday, June 23rd 2008 at 4:42 pm
Hello:
I went to buy the resistors & Diodes and the I was told I need to know voltage for resistors and the IN number for diodes.
Could you please help.
Thanks
Wednesday, June 25th 2008 at 12:03 pm
@Gio
Contact allservice on their forum or at their support - at -allservice.ro for the PC8794 tools.
Wednesday, June 25th 2008 at 3:49 pm
hi !
I have R61 i have the same problem..,
i opened my tp but i am not able to find out ATMEL 24RFC8 password chip.
could any one help me for this model…R61….
as one comment saying the p24508 chis is also the ATMEL 24RFC8.shall i go head with that…
on your board you can find this SST25VF016B password chip
Wednesday, June 25th 2008 at 9:09 pm
I have R61,
I can’t locate the eeprom location? please help with photos?
Thursday, June 26th 2008 at 2:12 am
Finally! That T42P unlocked clean, per the Admin’s instructions:
1.) Password is NOT set, if no 330H password.
2.) PC logo=PC pw or Cylinder logo=HD pw
3.) Drain the CMOS by unplugging the cmos battery.
Then SHORT the pins it plugs into to drain it, or it never discharges cmos!
My PC Came right up, afterward without pw anymore.
4.) Then HD Lock Cylinder Logo appeared! Tried LowLevel Format to remove HD pw. No luck,
Bad HD after testing with PC Check 6.05 Fixed by replacing HD with a spare HD.
Runs like a real fast charm… Many Thanks to Mr. Admin!!!
Thursday, June 26th 2008 at 10:28 pm
I have a Lenovo X61s, the onlt ATMEL chip i can find is multi pin package marked AT97SC3203
The problem that i have is that the battery backup was removed on this machine and no one knows the administrator password and the bios and power up password has been set
Is this machine scrap?
Friday, June 27th 2008 at 6:42 am
Hi,
Thanks for great material by admin. I apriciate his afforts. My laptop IBM a22m shows HD Lock Cylinder when i power on or even i press F1 to open bios setup.
I have a question that can we reset hard disk password with supervisor password. I search about it on net that it is not possible to remove haddrive password, it must be replaced. is there no way to reset hardrive password. Can i use the above mentioned procedure to get HD password ?
Saturday, June 28th 2008 at 11:47 pm
Thanks for the information. It worked like a charm on a A31.
8 pin chip under PCMCIA, upper right hand of M/B
Slip ups that may benefit someone:
“Circuit not found” Make sure your serial port is enabled in the reading machine. DOH!
“eprom not available” Make sure you have grounded pin5 from serial cable to the circuit. (same ground in PC chassis.
Thanks again, got a usable machine instead of ebay parts!
Sunday, June 29th 2008 at 5:04 pm
I’m still stuck with my THINKPAD R52, i tried several time to look for a chip somehow similar to the atmel, but i found none. not even under the motherboard. does anybody knows anything about it?.
Monday, June 30th 2008 at 12:45 pm
may i have the tuto in french please
thank’s aot
Tuesday, July 1st 2008 at 7:55 pm
Hi, I´ve the dump file, but i still don´t know my password. There is an sign whitch i can not recognize. Can You help me PLEASE???
Wednesday, July 2nd 2008 at 8:12 pm
I’m still wating… help!.
Friday, July 4th 2008 at 12:48 am
I’ll test it later, thanks alot for the great topic you ware posted!
Friday, July 4th 2008 at 5:27 pm
It worked great on my t23. But if you don’t know you got to push AA in IBMpass 2.1, you will not see the password.
Saturday, July 5th 2008 at 2:28 pm
IBM tech my ass, you’re using allservice’s software and hardware
Saturday, July 5th 2008 at 9:24 pm
hahahha.. good one dantes :P. . . I still need help with my r52 :(.
Saturday, July 5th 2008 at 9:31 pm
but i think im going to get andy’s service to unlock my r52 :(…. running out of options.
Sunday, July 6th 2008 at 2:12 am
hello, I have the same problem as everyone tells me to connect “ERROR: EEPROM NOT avaiable” rather than finding solutions, if someone knows that it can be please contact me my e-mail is dj.lucasmontana @ live.com thank you very much
Sunday, July 6th 2008 at 2:35 pm
I have a t40 password recovery method worked first time thanks.
Sunday, July 6th 2008 at 11:21 pm
Gio, ask allservice, the software will only cost you $45 is not passphrased, and forget about these pussies
Tuesday, July 8th 2008 at 11:20 am
I have a ThinPad R60. I know the security password exactly, but somehow the message security password retry limit exeeded appears and I cannot accessdie BIOS Software. What to do if I know the pasword but cannot start BIOS?
Thanks
Wednesday, July 9th 2008 at 3:38 pm
Hello.
Does anyone have a EEPROM dump for TP T21? Please send it to boeserbengel@hotmail.com
Thanks.
Thursday, July 10th 2008 at 2:34 pm
Thanks, it worked on my t40.
Friday, July 11th 2008 at 7:31 am
Hello all!
I’m trying to fun with my T60 with forgooten password. Does anybody has an experience doind this with T60? Should i do it or it is better not to try and leave it..?
Monday, July 14th 2008 at 1:35 pm
I’ve done the T60, it requires a bit of expertise but allservice’s help&support was great.
http://www.allservice.ro/forum/viewtopic.php?t=952
These are the tools, I bought only the software, nut anyway should you have problems making it, the circuit is available from allservice as well.
http://www.allservice.ro/forum/viewtopic.php?p=1061#1061
Monday, July 14th 2008 at 8:08 pm
Hello,
I just read-out the chip succesfully but I ended up at with the following string as password (which I don’t know which keys correspondent with the keyboard).
31 24 17 31 0B 25 00 CD
31 = 1
24 = $
17 = ETB ??
31 = 1
0B = VT ??
25 = %
00 = ?
CD = ?
Any help much appriciated.
Regards,
Clueless
Tuesday, July 15th 2008 at 2:51 am
Hi,
a little confused about the diodes.
I can’t seem to find anything on the” “2 x C5V1 Zener diodes ”
Looked on radio shack and i’ve only found 1N4733A and 1N4742A.
I’m thinking the 1N4733A is what i need, but any help would be most appreciated. Oh and thanks OP for the information.
TIA!
Tuesday, July 15th 2008 at 7:42 pm
It worked like a charm on my T30! Neat!
@Unfixed:
The diodes are plain 5.1Volt Zener diodes. Ask for these at RadioShack or any such electronics store.
@Desperate/Clueless:
You might need to change the translation in IBM Pass 2.1 Lite. Try one of them You can find it under View->Translation.
Wednesday, July 16th 2008 at 1:37 pm
@Desperate
Its “njinok”, baby
Friday, July 18th 2008 at 9:12 am
Excellent site,- have a A22m,- locked when the internal button cell went flat and the time/date is lost. Changed out the Amtel chip (14leg) with a new one but this just makes a CRC error as the bios knows the chip isnt right,- DONT bother swapping the chip. Just follow the instructions on this site carefully,- took me 2 hours in all. on the A22m the amtel chip is hard to find, its on the underside of the mainboard close to where the hardisk fits in. the ENTIRE laptop must be stripped to get at it,- then assembled carefully with the 3 wires coming out of the harddisk bay (leave the disk out) I have emailed the pics of the chip and its connection to this site and hopefully they’ll put them up. Thanks to everyone involved here including ALLSERVICE for the eeprom reader etc,- you are doing a good job for the environment,- without this site this laptop would now be in a landfill site…what a waste!! jules.
Saturday, July 19th 2008 at 11:17 am
if somebody need thise programm PC8394T programming tools free I will send.I have no crack.
envarkaraev@gmail.com
Sunday, July 20th 2008 at 9:41 am
can someone please send me a picture of the actual wiring of the diodes and resistors and how they are grounded (i am not very good in this kind of stuff.. especially reading a schemetics)
thank you
Sunday, July 20th 2008 at 9:42 am
Has anybody already tried this on an X40 resp. can tell me where the Atmel Chip is placed on the board? I searched for it but didn’t find it.
Another question. Im not quite fit about this whole Resistor-stuff. There are many different types of 2,2kOhm resistors. Which ones do I have to buy?
Thanks
Uli
Sunday, July 20th 2008 at 9:43 am
Tried on a TP R51 and it works great. Just make sure you push the “AA” button at the upper left of IBMPass 2.1 if you get weird symbols aftre dumping.
Sunday, July 20th 2008 at 9:45 am
i could really use a full view picture of the reader cable assembled for reference
Sunday, July 20th 2008 at 9:49 am
I can see that all the information is very clear and seems to work for many IBM Thinkpad Laptops. I just have one question, when I press F1 my laptop doesn’t go into de Setup it just show me the blank Screen whith the lock and asking for the password.
What I have to do?
Thanks
Sunday, July 20th 2008 at 9:54 am
Just used the circuit and the two programs to convert my BIOS password locked T21 from a container of spare parts to a working laptop. Thanks so much for the assistance and advice on this site. I did not even have to solder wires to the EPROM. I used someone’s suggestion about holding probes against the two pins. I used the needle probes from my multimeter and someone else ran the programs on my desktop. Worked perfectly first time. Parts cost: AUD2.70! Way less than a used motherboard, let alone a new one. You made my day guys!
Sunday, July 20th 2008 at 8:21 pm
well it seems that nobody had ever had a r52 thinkpad. and I’m not willing to pay 250 just for some software, … built the reader but, this junk doesn’t have an atmel chip… must be something diferent. anyway, with those 250, I’d just add another 100 and get me a brand new computer. thanks guys, you’ve been really helpful,… at least trying to sell me those things heheheh. peace out.
Gio.
Monday, July 21st 2008 at 4:50 am
hey guyz,,,can you guys tell me if there is a way to find out the bios/supervisor password through windows,,.
my t21 lets me enter into windows, but not into bios due to the password.
so i am hoping and wondering if there is any way that i can find out/reset/delete the bios/ supervisor password from inside the windows by running some sort of program or some command or something.
any help is appreciated.
thanks all and thanks for putting up this site with this info.
Monday, July 21st 2008 at 4:16 pm
@Gio
I know the software is $45 (full kit is $100) at allservice and R52 has PC8394 not the Atlem, I unlocked mine and took me 2 hours to complete the interface.
Wednesday, July 23rd 2008 at 12:19 am
hey guz im trying real hard to get this to work, but having no luck, so if any of you can help me out a lil bit.
i am havin two problems..
one…i am not sure how exactly to connect the diodes and resisters in what order, so if someone has a picture of model they made, that would solve most my problem..
so can SOMEONE PLEASE PROVIDE ME WITH A PICTURE OF HOW THE WIRES ARE CONNCETED WITH THE DIODES AND RESISTORS..PLZ THX
2ND problem is that after i connect all the wires (maybe its rong design, maybe not) i open up the r24fr08 reader, a window opens but i don;t know what to do after that, it just tells me to press enter to exit.
help me out guyz plz..thx.
router124@Hotmail.com
email me whatever u can. actual design pics. thx again.
Wednesday, July 23rd 2008 at 12:25 am
how do i get the dump file..help me out fellas
Wednesday, July 23rd 2008 at 1:50 pm
Boys and Girls ..
Here is the lo-down on the T60, just to stop all the wishy woshy on this thread. This is in two parts:
PART 1: Hardware:
1. PC8394 is not a chip. This happens to be the name of the tools from allserviceswhatchimmycallit from Romania. By the way, well done to them .. great guys, and I personally think that Romanian techs are bright and very intelligent people [ IMHO ] and no, I am not Romanian, nor married to one
2. The T60 does NOT use an AT24RFC08 chip; It instead uses a TPM (Trusted Platform Module), again made by - you guessed it - Atmel. The Chip designation is AT25C010AN. In general, what is on the market as a replacement for the chip today is AT25C010A, which is the same chip, same spec, just a new numbering convention from Atmel. Phew !
3. The AT25C010A[N] chip, akin with all 25Cxxx series chip, is NOT I2C compatible, nor does it use the I2C protocol -> therefore, the reader herein will NOT work, so stop looking for equivalent pin outs on where to hookup the reader. The TPM [ aka AT25C010AN in this case] is an SPI chip. I am therefore (very) doubtful that someone has actually read the contents of the 25C010AN chip on the T60, but that’s my suspicious nature.
4. There is a way to read and program this chip with an SPI reader, which is what the two sites - Romanian and Aussie - are selling. Buy it, or get your own SPI programming device, or even wait for me to get a moment from this damn hektic life, and I’ll post a reader design on this thread.
PART 2: Software:
Here is where it gets interersting. Again, well done to both the Aussies and the Romanians for there software, but don’t take this as an endorsment: I have used niether.
You will need to:
1. Read the chip content
2. Find the password
3. Reset, or decode it.
I am currently working on a T60 motherboard, and have a completely unlocked T60 at my disposal too.
If you need your T60 decoded, simply ask me for a replacement chip. I’ll post you a pre-programmed one if you are competent soldering it. Alternatively, for the same money, I’ll send you a clear dump for your chip that will clear the password.
I’ll e-mail you the software to read your chip and the dump to clear it.
Either way, the cost is $130.00 + shipping for the chip. If it’s the software path you want to go, then all I need of you is your $130, clear into my PayPal account. Costs are not negotiable. Other models quoted individually.
I am reachable on worldentropy@yahoo.co.uk should you wish to correspond.
Thanks,
Ahmed.
Monday, July 28th 2008 at 9:08 pm
Tried it on a TP R51 and it works great. Just make sure you push the “AA” button at the upper left of IBMPass 2.1 if you get weird symbols aftre dumping.
Monday, July 28th 2008 at 11:09 pm
Ahmed buddy, I can unlock T60s and i know what chip is it. I admit we got allservice’s solution. But I gotta tell you, wtf are you talking about? IMFAO!
Tuesday, July 29th 2008 at 1:13 am
gee.. ok let me see.. I paid 100dls for mi r52. and this guy wants 130 for his little tricky software…. MMM… let me think about it, since I got me the new hp entertainment system with 4gb of memory…MMM NAAA.. you put your little dongle and software wherever it fits you better. there are many others, who like me, don’t mind sharing their skills. I thought this whole site was of helping people out that’s the “SO DO IT YOURSELF” not a free market for some rippers or scavengers. anyway thank all of you guys who helped me an others… for that R52.. well looks good as a door stop hehehehe :P.
Wednesday, July 30th 2008 at 5:51 am
Thank you very much. I unlocked the bios password from my deceased cousin’s T42.
I use the circuit board to make easier for the connections..
Thank you again!!!
–Dunga
Sunday, August 3rd 2008 at 7:22 am
Thank you for the excellent instructions! It’s kind of you to go to so much effort to help people with the same problem.
I’m pondering buying a Thinkpad model T22 and the seller does not know the password. The only part I didn’t see in your directions was how do you connect the little gadget to the working computer? Do you connect the spare serial port to the serial port on the working computer?
And would you please type Thinkpad? Seeing TP over and over again is a distraction, and it means toilet paper.
Thank you for your help
Friday, August 8th 2008 at 6:18 pm
Hi guys, great job! I find out the password for the T22. The ATMEL chip is a 14 pins type and is located direct under the RAM. The machine musn’t disassembled. Works very well.
For german passwort’s you have to know, that the “y” is a “z” because of the german keyboard design.
Thanks Frank
Monday, August 11th 2008 at 9:20 pm
hi,
I have a T61, I have read the eprom p24s08 and put it in a bin file and i used IBMpass 2.1 Lite to decode the file and between the row 330 and 340 I found the password that is repeated in the 2 lines but not recognized =b1 e6 0d e4 cc 2c 95 8f (AA button on).
Thanks in Advance,darius.
Wednesday, August 13th 2008 at 12:48 am
[...] link:http://sodoityourself.com/hacking-ibm-thinkpad-bios-password [...]
Monday, August 18th 2008 at 11:06 pm
hi. I am a hacker. I can get you an aol,yahoo,myspace,facebook,gmail…etc password. I do charge a fee to get a password though. Once i do get password i’ll show you proof i have it. Are you interested? E-mail me at Fordf202006@yahoo.com
Thursday, August 21st 2008 at 2:21 am
NO SOLDERING OPTION
I just recovered the password on my T23 and found a way to avoid soldering to those tiny pins on the Atmel chip.
There are some test pads in the vicinity of the chip so I did some probing with an Ohmeter to find out if there are any useful connections. There is a row of small circles that runs parallel to the back edge of the computer. The circle at the end nearest pin 8 (SDA) has continuity with that pin. The circle about 2 locations toward the center of the computer with a little white line has continuity with pin 10 (SCL).
The holes in these pads are so small that 30 gauge wire is the largest that will fit. I used 30 gauge wire wrap for the connections. In fact, when you cut the end of the wire it will usually deform a little and I had to file the end with a nail file to make it fit in the hole. The connections are suprisingly secure with only friction to hold them. When I tore the rig down it took a good bit of force to pull the wires out of the holes.
Hope this is useful to someone.
Thursday, August 21st 2008 at 8:02 pm
The guys trying to get $130,= for the trick are way beyond the limits of reason. You can buy a replacement systemboard / motherboard for that price on well-known auction sites.
Friday, August 22nd 2008 at 2:03 am
Can someone help me find my password to Windows98? I have many text files that contain passwords to previous levels in Zelda. Help! Please sen me email to “dicksniffer@turdlicker.com”
Saturday, August 23rd 2008 at 2:49 am
Anyone care to share PC8394T programming tools? I just bought this replacement board for my r52 type 1849 and supervisory password is enabled. so, for me to spend the $110 to fix this is unreasonable. Also, which pins do i solder the wires to with the pc8394t? please email me at: laptopprogram@yahoo.com
Sunday, August 24th 2008 at 1:11 pm
Works perfectly in my T40 IBM Thinkpad laptop. Now is unlocked.
THANKS
Thursday, August 28th 2008 at 10:36 am
hey dude i cannot get password from r30.i hav found the atmel 93c46,i have made circuit shown and connected it. but the dos program started says eeprom not found.plz plz plz help me .i cannot install windows in it.setup hangs with a blue screen.so i hav to configure bios
Friday, August 29th 2008 at 6:15 pm
Sir,
I have IBM2628 Laptop with password locked….I have used this password hacking procedure. but the dos prompt replies “Eeprom not available” and then after my laptop doesn’t work…there is something wrong with the EEPROM. It has ATMEL 24RF08CT 14 pin eeprom. The laptop now just power on but not displays IBM logo or anything else…It has been gone in dead condition…Please some body suggest me what to do now…I have stand alone universal programmer..can somebody send me the EEPROM bin file. so that i can reload it in my eprom…or somebody suggest me how to ON my laptop again in proper working condition….I will very thankful to you….
Sunday, August 31st 2008 at 6:19 am
Thanks for the info!! I have a T30 Thinkpad and the ATMEL 24RF08CN chip was under the memory chip. I build the reader and use the Allservice program and it show the password just fine. It took a long time to find the ATMEL chip but once I found it all went well. The Allservice site had great documentation on the different types of chip and what pins did what. Thanks again for now I have a working system.
Monday, September 1st 2008 at 8:55 am
[...] If it’s a Thinkpad and BIOS password then you will have to invest in some serious kit to extract the password as they encode them on a separate chip. I have a second user Thinkpad with some BIOS options unavailable (virtualisation for one) and have looked into this quite a bit. Here is a link to the kind of thing you need to be looking into. Hacking IBM Thinkpad Bios Password : SoDoItYourself.com Not for the faint of heart. [...]
Tuesday, September 2nd 2008 at 8:10 pm
I’ve found better HI-FI pictures of someone who follow this tutorial, the article is on spanish and english, I’ve found useful his how to.
compunauta dot com/forums/linux/gus/otros/eca.ibm.thinkpad.bios.recovery.html
Quite nice another happy user
thanks a lot this really works!!! Ibm Thinkpad T42.
Wednesday, September 3rd 2008 at 3:25 pm
how can i Unlock by Bios Password for IBM T60 any help me Friends
Shall I Work Out This Problem Please Help me
Saturday, September 6th 2008 at 10:02 am
error not 45$ but 35$
Saturday, September 6th 2008 at 11:16 am
Hi, I have a system password on my Thinkpad R60e, and I don`t know how to remove it .The method shown above is for every other thinkpad model exept mine:(.Can anyone help me with that???
Monday, September 8th 2008 at 1:43 pm
Hello. I do not see a clear explanation on how to unlock a t43. What exactly am I looking for in the motherboard? I do not see anything resembling anything close to what you guys are saying is ‘right there’…please help.
Tuesday, September 9th 2008 at 2:07 pm
T43 has PC8394, the big 100 pin or so chip. You may need to buy PC8394 tools from allservice.ro, at least the reader. And it has unlimited use and work for all the other models like T60 and R60 too.
I used it a few times afterwards to unlock my friends machines, best solution for IBM and best support ever!
http://www.allservice.ro/forum/viewtopic.php?p=1061#1061
Tuesday, September 9th 2008 at 7:31 pm
HI all, i dont find anywhere the IBMpass DOS version cause it seems the lite doesnt able to write to me the good pwd, so if somebody knows where i find lps wirte me or send me in mail…thanks for all.
Thursday, September 11th 2008 at 7:24 pm
t60 uses 8394 chip.
Monday, September 15th 2008 at 9:35 am
Hi,
I have here R50e does anyone here find were that little thing? What will be the risk of doing this instruction in a wrong term?
Thank you.
Tuesday, September 16th 2008 at 2:01 am
Excellent job on this project!
I have recovered 4 passwords from T30’s & R40’s so far!
But, I have another T30 that won’t give it up! The dump.bin file has the info from the T30 chip, but line 0×330 is blank on the output! The rest of the line is a “0’s”. The timer ran correctly and the file DID download to dump. Watched it go….it just is blank!
The BIOS Password Prompt still comes up on boot. Line 0×340 has a readout of ” 8. 8. 6″.
I have tried it 3 times and every try comes out with exactly the same dump.bin read.
Sure would appreciate a direction on this one!
Thanks,
IBM NUTZ2
Wednesday, September 17th 2008 at 5:29 pm
IBM nutz2
that means it’s a power-on password. it has happened to me too.
alex,
Wednesday, September 17th 2008 at 7:17 pm
Thanks Alex.
What can we do about that? Guess I need to research a POP solution for my IBM’s?
IBM NUTZ2
Thursday, September 18th 2008 at 3:11 pm
Alex;
I’m a duh on the POP! POP is controlled by the CMOS bat. I forgot before I remembered!
IBM NUTZ2
Monday, September 22nd 2008 at 11:20 pm
Hey there- great website ! Just wondering if theyres any hope for an IBM Thinkpad 380 ED with the Bios password problem. Any thoughts would be great.
Saturday, September 27th 2008 at 7:17 pm
Any one know of this will work on a 560X?
Sunday, September 28th 2008 at 8:09 pm
One more time. if somebody need thise programm PC8394T programming tools free I will send.I have no crack.
envarkaraev@gmail.com
Monday, September 29th 2008 at 1:26 pm
bihola,
just the program pc8394t by itself, will not work without registry entries.
cheers.
Monday, September 29th 2008 at 10:25 pm
Hi! Outstanding site mate, outstanding site! I’ve managed to unlock a T23 with your tutorial. With a friend (who has more experise in ironing less-than-millimeter pins) we’ve built the reader unit (the simple one), without a breadboard (using traditional switch, to control GND; and SCL, SDA separately). I wanted to make some photos of the process, but I forgot, but if you need, I can send a photo of the final reader unit (without the switches). The whole thing worked like a charm, found out the password, and the TB looks much better now, than in the trashbin. Keep up the good work!
Monday, September 29th 2008 at 10:25 pm
Hi Everyone,
I did this for a friends T40 and was able to read the eeprom perfectly.
I get the file and go to the memory address 330 - and its Blank no password is shown.
All the other information including hte serial number model number etc is visible, but no password. Has anyone else experienced this and know how to fix it?
Thanks
Monday, September 29th 2008 at 10:26 pm
hi all.. can some one tell me if the sketch of the 9 pin female is the back or the front that we see. and also where do you solder the ground.
thank you
Monday, September 29th 2008 at 10:28 pm
Besten Reichel,
Ihre T60 is nicht in die Liste oben fuer diesen Methoden. Aber diese Artikeln ist von
http://www.allservice.ro/forum/viewtopic.php?p=1061#1061
Newer T43/T43p and R52 don’t use 24RF08 but PC8394T-VJG TPM chip.
PC8394 Tools are needed to read this chip .
T60/T60p, R60 and Z60 support is included in PC8394 Tools now.
Dieses is ein kompletes Methode und Sie brauchen nichts zu bilden.
Es kost ungefaehr 100 Euro .
Toi toi toi
Gruesse von Land zu Land
Walter.
Monday, September 29th 2008 at 10:29 pm
Hello People,
Thanks at all for support.
I’ve just tryed succesfully on a IBM G40 with IBMpass for Dos.
Ciaoooooooooooo
Monday, September 29th 2008 at 10:33 pm
I did with T22. It has 14 pin..! It works very well. 8 and 14 circuit instuction is found in http://www.allservice.ro/forum/dl/simple-i2cprog.pdf.
Thursday, October 2nd 2008 at 3:32 am
danielk,
your laptop has a pass phrase. it has to be read using “driven interface” tool. you can check more info on this site: http://www.password-removal.com
or email me alidabir1@dishmail.net
cheers
Thursday, October 2nd 2008 at 3:36 am
danielk,
if the password is blank, then it’s the power-on password. just unplug the cmos battery (the round yellow battery) under the palm rest for a few minutes, then plug it back in, and the password will be gone.
cheers.
Thursday, October 2nd 2008 at 8:55 pm
Thanks for this link,
About 10 years ago I was used to unlock téléphone by changing an Eprom adress
Since then I completed abandoned electronics.
A few days ago I started again and …. what a pleasure.
Even if I had some difficulties…
- soldering the eprom (Yes…I’m living in France and there’s no SOICs here… just in the states…)
- My serial door was KO…
I tried with another computer and “tata” it worked.
Thank’s for this page
ZaEsteves
Viva o Benfica
Thursday, October 2nd 2008 at 8:59 pm
Hi ! Thank you for your process, it’s very clear and helpfully.
I found my lost password on my T40 pretty easily.
The only things maybe you need to mentionned it’s when you read the dump file, don’t forget to click on the button “enable/disable translation” and then you can see the password in the line 0×330.
Thanks again !
Cedric for FRANCE
Monday, October 6th 2008 at 8:10 pm
I’ve got a present a thinkpad t43 with locked svp,
I removed the batteries and so on.
I tried “the hacking page” and stripped the thinkpad, but I didn’t found any atmel chip.
May help me somebody, pictures of the t43 are available.
I don’t know what I should do now…
(sorry for the German-English)
Tuesday, October 7th 2008 at 8:27 pm
Where can the supervisor (SVP) password chip called ATMEL 24RF08 be found in an IBM T60? Under keyboard?
Any help in finding it would be appreciated!
Thanks,
Trying to save us whom forgot our SVP Password!
Thursday, October 9th 2008 at 9:43 pm
im nide opene bios t43p
Saturday, October 11th 2008 at 8:01 am
bonjour a tous, tout d’abord je parle mal anglais mille excuses, problem pasword IBM R40 type 2683 ,le petit cadenas ,donc j’ai fait le montage pour lire ATMEL 24RF08 ,mais je n’ai pas de port serie RS232 sur my portable just USB ,je ne sait comment faire pour faire communiquer les deux PC ,help me please ,contact other by oovoo ,vingtdieux or MSN messenger patacc@msn.com, merci de votre aide ,cordialement Gilles
Monday, October 13th 2008 at 2:31 pm
To Admin & ER & W Hacking Team;
After being successful several times on password retrieval, I am not getting “error: eeprom not available” message constantly! I have rung out the connections on the serial cable and bread board. It has not changed from the first success. Any idea’s?
Thanks!
IB IBMNUTZ2
Tuesday, October 14th 2008 at 7:56 pm
alex;
thank you! I see that now.
Am still getting error eeprom not available message constantly. just tried on a R30. Same message. I have double checked every component for positive contact on the bread board. it still rings out correct. I just checked the 2.2 resistors = 2.2. Checked the diods….they are not leaking. the wiring exactly matches the schematic. it worked a couple weeks ago and now on a T23 & an R30, each has an error. could the 24rf08 be damaged on both? they do not appear to have been soldered/worked on before.
IB IBMNUTZ2
Sunday, October 19th 2008 at 9:47 am
sir, i have an ibm thinkpad T20 laptop.when i power on this thinkpad than i see erore 0175 code or some tine it dose not open or power on.please tell me how could i repiar thise my self . thanks.mamun
Monday, October 20th 2008 at 12:31 am
This website is wonderful! I have a R50 that had a bad video chip that completely quit working about a year ago. New motherboards were extremely expensive, so I just shelved the laptop until I could find a cheap motherboard. As it turns out a cheap motherboard was finally available on eBay last week, so I purchased it. Little did I know, or the seller know, that the motherboard was password protected. BUMMER. So after a lot of web searching, I stumbled on this website.
I spent my time and carefully built the circuit as shown at the top of this blog. I was able to get the entire circuit in the D-Sub plastic shell. I carefully planned the layout of the components and slipped heat shrink on the leads to insure shorting would not happen.
Everything went as planned and I recovered the password to the R50. Interesting enough, the password was very generic. It was “IBMBIOS”.
Kudos to the author of DoItYourself.com!
Tuesday, October 21st 2008 at 5:04 am
Hi,
Thank you for the great site. Question: what do I do with the 9 pin female. Where do I connect it or what should the other side of the 9 pin female be and to where to connect it to?
Thanx a million
Wednesday, October 22nd 2008 at 1:38 am
Thanks very much - T22 - chip was right where several appends described it would be. Didn’t even have to remove the case - IMPORTANT - Note comments about the ON/OFF Translate Button in the upper Left hand position just above the HEX display. I thought I had a bunch of unprintable characters until I reread the comments above and tried the button and VOILA - the PW appeared. Right where it was supposed to be. Thanks again for a great piece of work!
Wednesday, October 22nd 2008 at 2:59 pm
IBMNUTZ2
when you get “error - eprom not available”, it can mean:
either the contacts are not connected right, the ground is not connected right, or the eprom chip has been re-soldered incorrectly, or the circuit is not right. re-check connections. you’re saying this used to work before, and now it’s not working?
Thursday, October 23rd 2008 at 12:37 am
Thanks for your response!
Yes, it worked on 4 machines. These last two are in error.
I’m using the same ground clamp (rung out to bread board ground) on the large hex screws on the LPT1 Port. I have NOT removed/replaced any chips. And the ground from the ‘patient’ machine rings out to the main computer with the program, running XP Pro.
They were contacted right out of the case. I was sure to identify the ‘dimple’ on the chip at leg 1. I just can’t figure out what has gone wrong at this point. I have no more machines to eperiment with unless I purposely password a BIOS and try to retrieve it (just thought of that).
IBM NUTZ2
Thursday, October 23rd 2008 at 6:19 am
bring it to IBM if still under warranty
Thursday, October 23rd 2008 at 7:39 pm
Hi all,
First off i’d like to thank this site and everyone here for their impressive efforts and information. My friend has asked for help with a TP390 2626 laptop with reference to him not knowing the supervisor password. I’ve completely stripped the laptop and i have the mainboard completely out. I can’t find a chip with ATMEL written on it anywhere on the board. and i mean i have looked everywhere. What i did find though is an 8 legged chip near the power and usb sockets with 24C03 written on it. I’ve researched this chip using a few sites and the pinouts are the same as the 24RFC8 chip. I’ve downloaded the software as suggested in the tutorial and I’m going to build the tool to extract the password.
i’ll let you all know how i get on.
Friday, October 24th 2008 at 9:46 am
for lenovo thinkpad t61 is still good working? if it yes, i will to try. but thats not ok, i wont to try. thanks for every body with your attention
Friday, October 24th 2008 at 3:17 pm
Hi, IBM T23, There is a password on my wife’s hard drive and she forgot it.. I asked IBM for help and all they said was change the hard drive.. I did and it works fine.. IS there a way I can retrieve the info in the drive? Will this setup help me remove the password on the old hard drive?
Friday, October 24th 2008 at 3:41 pm
Hi MarioWolf:
Had the same issue. set the password protected HD up as SLAVE and accessed it from the new setup. Got the files back. You willnot be able to remove the password using this proceedure.
Friday, October 24th 2008 at 6:38 pm
Brilliant! it really works! I’ve checked on IBM r51.
Thanks a lot!
Friday, October 24th 2008 at 10:17 pm
This really was brilliant! Worked on the first shot on my t23. Just remember to press the aa button.
Saturday, October 25th 2008 at 8:54 am
Huge thanks!
I had initally problems, but then I realized that I used 2.2 MEGA ohm resistors. Stupid me. After changing to 2.2Kohms it worked on my first try. I didn’t solder anything to the ATMEL chip, just pressed the resistor wires against the pins on the chip. So it’s certainly doable. Now my T40 BIOS is unlocked
Tuesday, October 28th 2008 at 5:52 am
[...] Following instructions posted here: http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/, I plan on doing just that. I have lots of spare wiring lying about and actually have all the needed parts except for the zener-diodes. [...]
Tuesday, October 28th 2008 at 2:13 pm
Does anyone tried the Atmel solution on a Thinkpad X61?
Please let me know.
Thanks - Pedro
Tuesday, October 28th 2008 at 7:10 pm
Hi there,
first of all great work and great manual!!
I felt really confident with these instructions, so I began to disassemble my T30 (Type 2367-gg2). Unfortunately, after disassembling quit everything except the PC Card Slot, I couldn’t find any ATMEL 24RF08 but “only” an ATMEL 234 93C46 SC27 which resides between the backup battery’s plug and the HDD.
So do I have to search any further, e.g. on the mainboard’s bottom side, or should I try to read the ATMEL 93C46 after reading its datasheet on my own?
It would be really wonderful, if I could work again with my old buddy
Thanks in advance and much respect for your work!!
Regards
Ronny
Wednesday, October 29th 2008 at 3:08 pm
Hi Ronny;
It’s under the front memory stick/slot. Just remove the memory cover and remove the memory stick, if it’ there. No further disassembly required!
Saturday, November 1st 2008 at 4:06 pm
THANK YOU Alex for your reply.
Monday, November 3rd 2008 at 6:16 am
heres the easyest way ever to reset the bios passwords with no need for the chip reader!
Just touch the sdl and sda posts together with a paper clip or something just keep contact and turn on the pc with them touching hit F1 to enter bios it should show a security error but it lets you in the bios. keep contact on the sdl and sda and go to security-passwords-administrator password hit enter when it asks for you to enter a password remove the paper clip from the posts and enter your password and hit enter it will say password saved.
use something youll remember for the password.
you should disable the rest of the passwords and hit F10 to save and exit.
and thats all you have to do ps i used a copper wire for better contact you no need for sauder.
Monday, November 3rd 2008 at 8:56 pm
Has anyone had luck with a R52? I have found some sites that state that they can do this, but I would prefer not to get ripped off. Has anyone purchased the kit from AllService? Is the physical interface be the same (just different software and attach points) as the one described above? Do I need to buy the writer software as well as the reader?
Tuesday, November 4th 2008 at 3:18 pm
Hey I need help, I have a IBM think pat x41, and the circuit is done, but at this writing Chit atmel:
“ATMEL 608
24C64AN
A SU27 ”
Let me know if this is because the chip onto the board does not say: U53 but said: U65
I need help please …
Tuesday, November 4th 2008 at 3:28 pm
my Mail is charls15@hotmail.com
Friday, November 7th 2008 at 12:14 am
Worked for me on an A30p. The chip is under the pc card slot on that model. Quite a bit of disassembly was required to find it. I soldered the wires to the chip and a ground pad and ran them out through the pc card slot. I then reassembled the thing and hooked the wires up to the interface which Iplugged into and old win98 laptop. Dumped the chip extracted the password and I was in. All in all it was very simple to do.
Many thanks.
Friday, November 7th 2008 at 5:49 pm
My spare computer dose not have a serial 9 port on it,Is there anyway to wire the ATMEL through a USB port?Thank you.
Wednesday, November 12th 2008 at 5:05 pm
final fix for the ibm reset
bull malarky,
just short the pins 3 and 6 as you boot it will clear as you hit escape,
it will jump right into bios settings,
remove the batteries and run on ac while doing this.
this fix has been verified by me just now..
nice lot of hacking though but a real over kill ,
nice pics too.
what is pin 3 and 6 , count down from the top left 123, continue at bottom and count up 56 ,
1 8
2 7
3 ——–6
4 5
http://sodoityourself.com/wp-content/uploads/2006/10/locating_atmel.jpg
just like the dells , same jump for them too.
Wednesday, November 12th 2008 at 8:08 pm
Hi all again. Do i have to refit the entire laptop to extract the password ? its awkward as the wires are not soldering to the chip but i do have an 8 pin soic plug that i can have connected.
Ive buit the tool and get a timer ok message but when the software goes to read the chip it says error eeprom not found.
Any help is appreciated.
Thanks
Dave
Thursday, November 13th 2008 at 3:25 am
karl,
bull malarky.
that doesn’t work. do not fool people. YOU NEED TO READ THE CHIP. GOT IT?
Friday, November 14th 2008 at 5:19 pm
great!!!!!!!!!!!!!!!!!!!!!!!!
IT WORKS FINE.
tested on IBM T30.
thx!
Saturday, November 15th 2008 at 4:38 pm
Is there a way to do this on a gateway2000 laptop with a HDD password? If I put in another hard disk drive it locks it out; apparently it’s tied to the original drives serial number.
FYI, the rss 2.0 (comments) feed is messed up in your wordpress installation. It should be http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/feed/ and not http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/SoDoItYourself.com
Wednesday, November 19th 2008 at 12:34 pm
I followed the instructions to the letter for my T40. Everything happens as expected but Passlite tells me the line at 0×330 is “&/”. I tried this for the password but it doesn’t work. Any ideas?
Wednesday, November 19th 2008 at 12:37 pm
Nevermind I didn’t hit the translate on/off button. It now works - brilliant!
Sunday, November 23rd 2008 at 6:26 pm
Good JOB !!! THANK YOU YOU HAVE SAVED ME. 100% Working
Sunday, November 23rd 2008 at 10:56 pm
help plz i have ibm A31 and i cant find bios chip (atmel)…..where is it ? plz help !
Monday, November 24th 2008 at 10:29 pm
I need a link to the exact product (Resistors and Zenor Diodes) that you bought. They need to be in USA company
booman360ster@gmail.com
Friday, November 28th 2008 at 9:49 am
can i replace amtel R40 thinkpad with other amtel from R40 THINK PAD. i have 2 r40 laptops ,one of my r40 is dead, other one with supervisor pasword problem.
thanks
dilip
Friday, November 28th 2008 at 10:02 am
Help Please, any software reset the bios to simple operation
Friday, November 28th 2008 at 10:53 pm
I take (from Thinkpad T41) at the 0×330 the Hex numbers:
c0 74 27 96 1d 8f c3 0a
but I cannot read the password.
I only read spaces and ; 9
Can anybody help me?
I can only suspect my Greek Windows XP on the spare PC.
I also had read the password from an A31 that it was only numbers so I do not think that I do any mistake now.
Sunday, November 30th 2008 at 4:21 pm
mitty,
The Atmel chip in A31 is under the pcmcia adapter near to the upper left corner.
I have read the password but now the laptop is closed and I have not any photo to send.
Monday, December 1st 2008 at 9:21 am
hello ok how can i get the C5V1 Zener diodes a guy tell me to use 1v diode and 2 of 2v diode can i do that ?
i did what the guy say and it dont connected to my pc can someone help ………..plz
jorge
Monday, December 1st 2008 at 5:21 pm
Hi everyone, I was using this method on R30, everything is fine..expect that I cannot put the mess read via ibmpass from eeprom as a password. The pass should be stored at 0×338 - 0×33e : in the non-translated mode I have here these numbers: 61 25 5d 5d 3d 01 ff.. what is the pass? Thanks!
Monday, December 1st 2008 at 5:41 pm
Mot de passe Portable IBM 600E (2645) ATMEL 24CO1A
Bonsoir,
J’ai fait le montage du site sodoityourself.com avec le logiciel r24rf08 mais je n’ai toujours pas réussi à trouver le mot de passe du bios de la carte mère, Erreurs de lecture de l’Eprom et/ou Eprom HS ou la carte mère ? Et quand j’arrive a lire soit disant quelque chose, je n’ai que des zéros dans mon fichier *.bin (Lecture avec IBMpass v2.1 Lite).
Petites questions :
Sur L’eprom, j’ai le VCC à 3.2v, au lieu 5v, est-ce normal ? Idem pour le SDA ? Sinon j’ai aucunes activités quand j’allume le portable jusqu’au fameux mot de passe (Apres les erreurs 161 et 163 de la pile CMOS).
En faisant Itester j’ai ceci en sortie du port série avec le montage :
Grd et SDA = 4.3v
Grd SCL : 4.5v
Voilà, je n’ai pas trouvé de forum en Français pour ce genre de manipulations, je précise aussi que le portable n’est pas volé, c’est juste pour approfondir mes connaissances en informatique, en vous remerciant d’avance !
Portable password IBM 600E (2645) ATMEL 24CO1A
Good evening,
I made the assembly of the site sodoityourself.com with the software r24rf08 but I still did not succeed in finding the password of the bios of the mother chart, Misreadings of Eprom and/or Eprom HS or the mother chart? And when I arrive has to read is saying something, I have only of the zeros in my file * .bin (Reading with IBMpass v2.1 Lite).
Small questions:
On the eprom, I the VCC with 3.2v, the 5v place, is this has normal? Idem for the SDA? If not I have aucunes activities when I light the portable until the famous password (After errors 161 and 163 of pile CMOS).
By making Itester I have this at exit of the port series with the assembly:
Grd and SDA = 4.3v
Grd SCL: 4.5v
Here, I did not find a French forum for this kind of handling, I also specify that the portable is not stolen, it is right to look further into my knowledge in data processing, by thanking you in advance!
Tuesday, December 2nd 2008 at 8:09 pm
Can ibm thinkpad x60s be recoverd? I got an ATMEL 25010AN-SU27 chip. Can u use the same program ibm lite and writter to read this chip. Thanks
Wednesday, December 3rd 2008 at 12:07 pm
Finally located the amtel chip on the X41.
its located on the rear of the motherboard in the right hand side between the USB port and the Docking station, its referanced as U65 and is marked 24C64AN
Thursday, December 4th 2008 at 7:00 pm
Just recovered ibm t40. worked just like promised. God dam boy! Any way my eyes aren’t what they used to be. It was a hard soldering session and double checkin a lot
-provo
Friday, December 5th 2008 at 2:30 pm
martin,
when you flip the AA switch on and off, if you don’t see the password in 0×338 then it means that the password is TPM locked. and it has to be read using a different device, not siprog. email me: alidabiri1@dishmail.net
Friday, December 5th 2008 at 2:33 pm
Panagiotis,
this means that the password is TPM locked. and it has to be read using a different device, not siprog. email me: alidabiri1@dishmail.net
Sunday, December 7th 2008 at 5:03 pm
alexwv thanks for the link. I will try it very soon and post some results.Thanks bro!
Monday, December 8th 2008 at 9:59 pm
Thanks man! It worked really well!
The Hardest part is founding the ATMEL CI in the board
I recover yhe pass from a Thinkpad A31 and the Atmel chip is in the upper part between the modem port and the S-Video out.
Thanks again!!!
Wednesday, December 10th 2008 at 9:49 pm
what is the chip called for ibm tp r60. where do i find it on the motherboard. which program(s)do I use to extract a dump file. what is the procedure. can u give me a schematic for the hardware required
Friday, December 12th 2008 at 10:16 pm
Is someone tried to reset Security Chip on Lenovo (i have R61i). Thanks!
Saturday, December 13th 2008 at 5:07 am
OMFG.. This actually worked! I was skeptical, but i was sucessfull in getting my svp password XYZ5678
Only problem that I had was because I didn’t push the pins all the way through on my female serial port. Kept on getting eeprom not found. fixed the plug and it worked like a charm!
thanks!!!!!!!!!!!!!!!!!!!!!!!!!!!
Saturday, December 13th 2008 at 5:07 am
OMFG.. This actually worked! I was skeptical, but i was sucessfull in getting my svp password XYZ5678
Only problem that I had was because I didn’t push the pins all the way through on my female serial port. Kept on getting eeprom not found. fixed the plug and it worked like a charm!
thanks!!!!!!!!!!!!!!!!!!!!!!!!!!!
btw, i have a t42
Sunday, December 14th 2008 at 8:19 am
Ok not to be like a dumbass or anything but i need some help.i need a picture of the reader if anyone has one I’m much more of a visual person. what im saying is i can make the device im sure but i need a few pics to make sure its right.I have a thinkpad 600e so if anyone can show me what pins on the eeprom i need to solder to exactlythat would be great. Please help
Monday, December 15th 2008 at 8:21 pm
what is the chip called for ibm tp r60. where do i find it on the motherboard. which program(s)do I use to extract a dump file. what is the procedure. can u give me a schematic for the hardware required
chip is atmil 83569
Monday, December 15th 2008 at 8:43 pm
for thinkpad r60 . atmel 8356908 …tmp1-33 …tmp2-34
Monday, December 15th 2008 at 10:04 pm
Are there standard SPV Passwords used in the BIOS ?
Post your Passwords to see if there are similarities. Maybe folks could go this route vs having to build a device ?
I saw one Password already…
- XYZ5678
Tuesday, December 16th 2008 at 1:28 pm
Thnx, for manual.
This really work! I’m unlock my IBM X40! Thats really simple.
Russia, Moscow.
Tuesday, December 16th 2008 at 5:43 pm
hai,help me my com IBM 570,i can’t open my password,already forget,help me to cancel my password?
Sunday, December 21st 2008 at 2:22 am
Can someone post where the 600e chip is located?
Friday, December 26th 2008 at 10:39 pm
So not only are you soldering wires to a chip on a laptop, but a chip under the CPU? You sir, are a maniac.
Saturday, December 27th 2008 at 9:51 pm
briliant i did it it works thanks and i used 2000ohm resistors was an r51 think pad good work men
Friday, January 9th 2009 at 10:13 am
hi
i have a t23 tp with a unknown power on password can some one tell me how to get around this
thanks
martin
Friday, January 9th 2009 at 10:01 pm
can you also tell me the pin configuration on a 14 pinatmel chip
thanks
martin
Tuesday, January 13th 2009 at 10:06 am
Works like a charme ;)) Gathered my T30 pwd in a matter of a few minutes. Don’t forget to click on the “Enable/Disable translation” in the IBMPass app, otherwise you’re looking at the encrypted pwd!
Thanks for the effort!
Sunday, January 18th 2009 at 3:12 pm
[...] Re: IBM T40 BIOS password (SVP) resetten Sabayon User wrote: > Volgens de service-manual van IBM moet je het moederboard vervangen > indien je het BIOS wachtwoord niet meer weet: > > Attention: If the SVP has been forgotten and cannot be > made available to the servicer, there is no service > procedure to reset the password. The system board must > be replaced for a scheduled fee. > > Dat kan toch niet waar zijn? > > Wat is gebeurd: backup batterij is leeg waardoor het systeem om een BIOS > wachtwoord vraagt omdat de datum en tijd ingesteld moeten worden. > > Met geen mogelijkheid meer aan de praat te krijgen. Is toch te > belachelijk voor woorden. > > Apparaat is een krijgertje van een vorige werkgever die ik er niet mee > lastig kan en wil vallen. > Dat wordt waarschijnlijk knutselen: http://sodoityourself.com/hacking-ib…bios-password/ [...]
Monday, January 19th 2009 at 1:54 pm
Thanks alot for all the tit-bits. I just hope i will be able to fix mine.
Wednesday, January 21st 2009 at 6:41 am
Thanks very much.
Thursday, January 22nd 2009 at 7:11 pm
Hi all,
Any advise how to unlock a T61p with nxp p24s08 TPM ?
Thursday, January 22nd 2009 at 8:47 pm
[...] interfejsik do zdumpowania pliku z hasem plus programik do jego zdekodowania. Instrukcje s tu: http://sodoityourself.com/hacking-ib…bios-password/ ps. w sieci mona kupi gotowe zestawy (interfejs plus oprogramowanie). Kosztuj w granicach 40-50 [...]
Friday, January 23rd 2009 at 12:36 pm
[...] kun je het password uitlezen. Als je zelf geen knutselaar bent, misschien een handig neefje ?
http://sodoityourself.com/hacking-ib…bios-password/ [...]
Friday, January 23rd 2009 at 12:36 pm
[...] kun je het password uitlezen. Als je zelf geen knutselaar bent, misschien een handig neefje ?
http://sodoityourself.com/hacking-ib…bios-password/ [...]
Saturday, January 24th 2009 at 1:21 pm
I am going to try it on a t60 it’s the only way i think…
Saturday, January 24th 2009 at 4:45 pm
hey guys, whats the easiest and cheapest way to remove/recover bios password for the T60? can i make the reader/writer or are there people that offer this service for cheap? like on ebay?
Saturday, January 24th 2009 at 6:48 pm
have anyone try it on a thinkpad r61…and can i use this method to get my SVP back ? let me know pls…
Sunday, January 25th 2009 at 12:13 pm
Easy :S ??!! You think those are easy steps??!!
Sunday, January 25th 2009 at 6:30 pm
Mike,
I have a DELL INSPIRON 8500 that has either a motherboard password or a power on password — I’m not sure about the difference. When you power it up alll o fthe lights come on like normal and then you get a screen that asks for a password before you can even geet into the bios setup menue.
2 questions.
1. Do any o fhtose “100% gauranteed” Password recovery/hacking CDs/dowmnloads really work for this situation?
2. Will your EEPROM reader technique work for the DELL INSPIRON 8500 and if so wher can I get the detailed kind of instructions that you have for the IBM TP?
Thank you very much. DELL is worse than NO help on this. They have the information on the original owner but refuse to contact her to verify if the computer is stolen or not and will not reset the password without that information. Unfortunately, the computer was given to my son by an instruuctor at WSU who bought it at some kind of sale at WSU and we can’t track the ownership back any farther than that.
Thank you for your work. You are taking worthless junk and making it into usable computers again.
Don Jones
Monday, January 26th 2009 at 6:53 am
HEY!
I AM JUST WINDERING IF THIS MEMETHID CAN WORK ON t61? PLZ LET ME KNOW….THNKS
Monday, January 26th 2009 at 6:55 am
ITS A IBM THINKPAD T61!
Monday, January 26th 2009 at 10:37 pm
Hi. I am a hacker. I can get you a password (aol, myspace, facebook, msn/hotmail,yahoo..etc). I do charge money to get a password. Once i get the password i’ll show you proof i have it. Are you interested? please email me at fordf202006@yahoo.com
**I CANNOT RECOVER A LOST/STOLEN/FORGOTTEN PASSWORD**
Tuesday, January 27th 2009 at 7:28 am
Bios and poweron password is the same thing. This is used to access the bios to start the computer. The password recovery CD’s that you see on Ebay and other places work great for password removal of HDD or user passwords, but are useless to recover or remove a Bios password. Nice try tho. FOFL.
Tuesday, January 27th 2009 at 6:26 pm
alexwv,
thnx for the help. but i really don’t want to send out my laptop, i got personal data in there. If you any other way please let me know! i would really appreciate that. ( T61-POP)…………… thnnx 4 the help
Tuesday, January 27th 2009 at 8:25 pm
I’m getting an error from the app. Says Circuit not found or bus error. I’ve checked on the connections on the circuit itself and they are good. I’m getting this error message connected to the Amtel Chip and disconnected.
I’ve never tested this serial port before though. Any what this error means?
Wednesday, January 28th 2009 at 11:37 am
Prima di tutto grazie al sito sono riuscito a levare la password a un ibm t20 ,la procedura dei fili saldati e la stessa ,pero’ non riuscivo a leggere l’eprom con il programma Reader for ATMEL 24RF08 allora dato che anni indietro mi divertivo a clonare le carte di tele+ e sky ecc,avevo una serie di software per leggere e scrivere epron ,prova e riprova finalmente con PONIPROG 2000 VERSIONE 2.07 BETA e stata letta in un secondo poi riportata in chiaro con IBM Pass 2.0 Lite spero di essere stato utile mi dispiace ma parlo solo italiano .
Un Saluto a tutto il forum Pierpaolo
Friday, January 30th 2009 at 10:35 am
Any advice on tp w700 supervisor pw recovery? Thanks.
Sunday, February 1st 2009 at 8:36 am
I have a T30, the dump.bin file has the info from the T30 chip, but line 0×330 is blank on the output! The rest of the line is a “0’s”. Tested and ran several time and same result.
The BIOS Password Prompt still comes up on boot. Remove BIOS battery and tried again and still 0×330 is blank………would appreciate a direction on this one
Sunday, February 1st 2009 at 8:36 am
I have a T30, the dump.bin file has the info from the T30 chip, but line 0×330 is blank on the output! The rest of the line is a “0’s”. Tested and ran several time and same result.
The BIOS Password Prompt still comes up on boot. Remove BIOS battery and tried again and still 0×330 is blank………would appreciate a direction on this one…..
Tuesday, February 3rd 2009 at 8:07 am
Just further to that, I might add that I was running the capture and analysis software in Linux under Wine. Installs and works without a hitch!
Wednesday, February 4th 2009 at 8:35 am
Karl gets reamed for saying this, but if you have a CRC:0175 error,
his method fixed my old A21E . The Amtel chip is under the hard drive,
and you have to strip the laptop down completely to find it.
Solder or attach wires onto pins 3 and 6 as karl described!
Let them hang out the hard drive bay,when you re-assemble.
You need the floppy drive installed, and the current BIOS diskette.
Full battery, and AC adapter,just for the bios update…
Press power button, wait for video. NOW, short/touch the wires together.
Press the ESC key . Next, press the F12 key ,when the menu comes up,
select the top choice -removable device.
Ignore any Hard disk not found warnings before or after this point!
Let the BIOS diskette run, leaving the wires touching/shorting…
Even if you had the latest BIOS , it will still run the update,for some reason.
Let it run, says computer will reboot. But mine never did.After 5 minutes,
I shut it off, after saying my last goodbye(just in case..) .
It came back on, WITHOUT the CRC: 0175 error !
Could not believe it ,so turned it off, and back on. The A21E is ready for
action again ! Thank you Karl !!!!!!
Comment by karl:
Wednesday, November 12th 2008 at 5:05 pm
final fix for the ibm reset
bull malarky,
just short the pins 3 and 6 as you boot it will clear as you hit escape,
it will jump right into bios settings,
remove the batteries and run on ac while doing this.
this fix has been verified by me just now..
nice lot of hacking though but a real over kill ,
nice pics too.
what is pin 3 and 6 , count down from the top left 123, continue at bottom and count up 56 ,
1 8
2 7
3 ——–6
4 5
http://sodoityourself.com/wp-content/uploads/2006/10/locating_atmel.jpg
just like the dells , same jump for them too.
Friday, February 6th 2009 at 1:43 am
Hi, just wanted to let everyone know that this will work on a Thinkpad A22m. Like some of the others, it uses a 14-pin Atmel 24RF08 that is located on the bottom of the motherboard just up from the RAM slots, and it cannot be accessed without completely disassembling the computer. The pinout for the 14-pin chip is located here:
http://hey-tech0.tripod.com/
http://img6.imageshack.us/img6/9214/pinoutjt2.gif
I also had to substitute 2K resistors and 1/4W 5.1V zener diodes, and they worked just fine. I recommend building the “reader” circuitry into a DB9 hood with the connector to keep everything secure.
Friday, February 13th 2009 at 8:47 pm
can anyone tell me where the bios chip is located at on a r60 .
thanks in advance
Sunday, February 15th 2009 at 12:24 pm
My IC 24rf08 (from ThinkPad T42) eeprom is burnt, and i find another from other TP but i need dump for my ThinkPad. Is anyone have dump for T42. My Mail: emajl_adresa@hotmail.com
Monday, February 16th 2009 at 5:51 pm
Hi 2 all,
Is anyone have clear dump for T61, my emal address is andryuha82@inbox.ru
Thanks in advance.
Monday, February 16th 2009 at 9:33 pm
I’m looking for a procedure to bypass the power on password on an IBM thinkpad 2652. Can you give me the steps to locate an execute the necessary method? Thanks.
Wednesday, February 18th 2009 at 2:41 pm
J’ai un IBM Thinkpad X40 dont le Bios étais verrouillé
J’ai suivi tous les instructions du debut de la page
Et ça marche parfaitement.
Merci beaucoup.Merci Merci Merci!
Thursday, February 19th 2009 at 12:33 am
Dear friend, I have thinkpad T23 with the same problem, The EPROM Atmel chip is 14 pins. Will this method work with my laptop to recover the password? If Yes then How? please advice, I’ll be grateful.
regards,
Daljit
Sunday, February 22nd 2009 at 7:26 pm
i want password bios t 60
Wednesday, February 25th 2009 at 10:22 am
Dear friends I have r50e laptop,with the password problem,The chip is 24rf08,I tried to read it using my universal programmer (superproLx)I was able to read 25%(upto 0X00E0) the hex(bin) file goes like this.
:200000008008070D0902400004607000821000010E040C010220C0757000004830482A20A2
:200020007575454500000000003C48302D550000000000000000000000000000000000E82E
:20004000AD000000000000000148594D443233324D36343644362D4A20202041410435FF31
:20006000FF0855000000000000000000000000414934384E31313232322D30332000000038
:20008000000000000000000000000000000000000000000000000000000000000000000060
:2000A000000000000000000000000000000000000000000000000000000000000000000040
:2000C000000000000000000000000000000000000000000000000000000000000000000020
:2000E000000000000000000000000000000000000000000000000000000000000000000000
:20010000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
:20012000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDF
:20014000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBF
:20016000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9F
:20018000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7F
:2001A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5F
:2001C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3F
:2001E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1F
:20020000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE
:20022000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDE
:20024000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBE
:20026000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9E
:20028000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7E
:2002A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5E
:2002C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3E
:2002E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1E
:20030000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD
:20032000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDD
:20034000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBD
:20036000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9D
:20038000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7D
:2003A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D
:2003C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D
:2003E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1D
:00000001FF
please guide me how to read password location i.e 0X330,if any body having bin file for the same mdel it will be a gr8 help to me,I will just try to program it on the other empty chip and solder it on the board .please guide me what to do next
regards
Sathyananda
Monday, March 2nd 2009 at 12:00 am
can i pay someone to do this. if you can or know someone who can please email me at leisselarry@sbcglobal.net
Thursday, March 5th 2009 at 5:43 pm
Hi,
I get something else.
0×330 000000000000000 cd3696deec330343 ” ,2f
0×340 cd3696deec330343 88c6fa0383c2fa02 ” ,2f 2 l
a litle bit strange for a password because you can’t type a ” in the password.
anyone???
Saturday, March 7th 2009 at 12:19 am
Where did you purchase the 2 C5V1 Zener diodes from? And if I cant find them, is there any others I could use? Please email me back ASAP at wbill510@yahoo.com Thanks!
Tuesday, March 10th 2009 at 1:46 am
Great post. It is very useful for my IBM T40. Do it work in Thinkpad T61?
Tuesday, March 10th 2009 at 1:26 pm
Hello, don’t worry is possible Crack the password in bios and in hard disk, write me at topsat_ar@yahoo.com.ar I tell you how do it
Wednesday, March 11th 2009 at 1:10 pm
Hi!!
I’m Sebastian. I’m From Argentina
I’ve got a X60 but it has not the at24RF08 chip or may be I donot know how to find it inside. It could be hidden ? other vise, I found other chip (at25010 su27) inside, and I need if you can help me to guess the bios password because I saw in this eeprom datasheet and it has not the same definitions like in the pin.
I could buy the pc8394 tools if you explain me and give me waranty.
thanks
Wednesday, March 11th 2009 at 6:05 pm
I have tp r-51 I’m trying to builded it myself. Can you send a diagram of this device explaining the size of all 3 wires. This is what I have so far. I solder the zener diodes tip on, two different spots on the ground wire. After that, I solder one of the tip of zener diode to the tip of 2.2k ohm resistor- then stuck the other end into # 4 hole of the serial port 9 pin female. then I did the same to the other and stuck that 2.2k ohm into hole # 7 is that correct so far. Please helf with the rest of info on building the reader . If you can send a pic I will be very happy. Thank you
Wednesday, March 11th 2009 at 6:12 pm
please send me a pic because I only have two pins coming out of the serial port 9 female
Sunday, March 15th 2009 at 8:32 am
If someone has a problem to recover password on IBM DELL HP TOSHIBA FUJITSU SONY ASUS COMPAQ VAIO and other laptops , email me , I may help . You have to include make model service tag etc…, as much information as you can.Emails like “can you recover my laptop” without full additional information will not be answered .If your email gets into my spam box - you are out of luck .I may also buy your locked laptop if price is right.
Friday, March 20th 2009 at 8:21 am
hi i have tp t60 I have 2 errors message when I press the thinkpad blue button during the startup to enter the BIOS. i cant rember the password some1 said take the battry out so i did now i get this messge
Error 0271 - check date and time setting
Error 0176 - System sercurity. The system has been tempered with.
can any1 help please please
Friday, March 20th 2009 at 10:13 am
Hello,
Has any one retreived the bios password on a X60s succesfully??????
How read AT97SC3203 ???????
Saturday, March 21st 2009 at 10:31 am
IBM lenovo X60s , IBM lenovo X60s , IBM lenovo X60s , IBM lenovo X60s ,
I successfuly unlock them ,I successfuly unlock them ,I successfuly unlock them
contact :
id. yahoo messenger : emilianovich1
Tuesday, March 24th 2009 at 8:34 am
Deparolari, deblocari orice model de laptop .
Cateva exemple :
IBM
-240, 240X,390E, 390X,570, 570E,600e, 600X,770Z
-A20m, A21e, A21m, a22m, A30, A30p, A31, A31p
-G40, G41
-R30, R31, R32, R40, R51,R52,R60,R60i,R60e,R61
-T20, T21, T22, T23, T30, T40, T40p, T41, T41p, T42, T42p,T43/p,T60/p,T61,
-X20, X21, X22, X23, X24, X30, X31, X40, X41,X41t,X60,X60s,X61,X61s,X200
-Z60 series, Z61 series
DELL
SONY
HP
ACER
LG
COMPAQ
TOSHIBA
contact:
tel: 0721.594.260
id. yahoo messenger: emilianovich1
mail : emilianovich1@yahoo.com
Tuesday, March 24th 2009 at 11:07 pm
Incredible site! Was able to build the circuit and nab the password off a T21. Thanks so much for taking the time and providing such excellent information and diagrams. I simply used a couple push pins for the two chip connections and a alligator clip for the gnd. Took about 3 tries to get a good connection holding the pins in place while my trusty assistant depressed the ENTER key for me. Thanks again!
Wednesday, March 25th 2009 at 2:30 pm
I have a problem
I have a T42 , i Have read correctly the eprom
But i don’t know the keyboard of this laptop and i don’t know how to digit the password !
My password seems to have special character that i don’t know how to digit
Their HEX are :
22 - 24 - 05 - 22 - 2C - 19 - 2E - 20
Friday, March 27th 2009 at 2:18 am
Thanks to this hack, I was able to recover the bios password of my R50.
However before being able to do so, I encountered several problems as what the others had. For the benefit of the others, I like to share my experience.
My spare PC have two serial ports. When connected on the first serial port, I get the message “Eeprom not available”. Transferring the connection on the 2nd port, I get “Circuit not found or bus error”.
I tried disconnecting the CMOS battery and main battery for several minutes and re-attach again. Now I had a bigger problem. Before I can see the bios settings but is not able to change the settings because of the password requirement. Now after starting up my TP, I receive an “Error 0271 - check date and time setting” message. Worst thing, my TP won’t start at all. I cannot access the bios and the OS won’t load also. Without the bios password, my TP is now good as dead!
Still hoping for the best, I tried to check the step-by-step guide on how to do the hack. I found out that I had a reversed connection on the pin assignment on the 9-pin serial connector. The diagram shown in this site is the actual view at the back of the connector. I mistakenly soldered the circuit parts and wires thinking that the view is from the front part of the female connector.
After doing some rewiring, everything worked like a charm.
On my first try, I recovered the password!
Thanks for everything!
Friday, March 27th 2009 at 7:34 pm
Dudes, just locate the system battery on the motherboard and yank it for 30 seconds, that’s all… so much for ibm security
Saturday, March 28th 2009 at 10:22 am
I successfuly unlock any model laptop, any password and give some examples .Have priority clients from Romania .Will give below the list of laptops that unlock successfully .More details you can provide the mail or yahoo messenger .
contact:
id. yahoo messenger: emilianovich1
mail : emilianovich1@yahoo.com
IBM
-240, 240X,390E, 390X,570, 570E,600e, 600X,770Z
-A20m, A21e, A21m, a22m, A30, A30p, A31, A31p
-G40, G41
-R30, R31, R32, R40, R51,R52,R60,R60i,R60e,R61
-T20, T21, T22, T23, T30, T40, T40p, T41, T41p, T42, T42p,T43/p,T60/p,T61,
-X20, X21, X22, X23, X24, X30, X31, X40, X41,X41t,X60,X60s,X61,X61s,X200
-Z60 series, Z61 series
DELL
SONY
HP
ACER
LG
COMPAQ
TOSHIBA
Monday, March 30th 2009 at 8:31 am
Ibm Laptop. Forgot the Bios password. if anyone can help ? HELP .. HELP..
Dont buy IBM laptops ….
Monday, March 30th 2009 at 7:47 pm
I’ve got it !!!
For me, it was really an adventure, but finally I hacked my TP A21e.
Thanx a lot for this description !!!!
marko
Wednesday, April 1st 2009 at 5:51 pm
Thank you SO much. I wired the circuit with parts from Radio Shack…followed connection instructions, used the software! Worked like a charm. Now I have a great Thinkpad R51, that I had pretty much written off and was getting ready to sell for parts! Great Job! Thanks again!!!!
Wednesday, April 1st 2009 at 9:59 pm
I was wondering about your diagrams. I understand the chip is different(a 25L1605), but the legs are the same ordering as per the datasheet. I have a pack of 2200 Ohm resistors, and a pack of Zener Diodes, 5.1V, IN4733A from Radioshack. I also have a female serial head for connecting to my computer, so by your guide I am set. My only question is before I solder it all together, and code a reader for the T60, will this method theoretically work for me? Once I get it all said and done, I will gladly provide you with pictures and the steps I took.
Wednesday, April 1st 2009 at 10:59 pm
If anyone has any advice on my T60 issue above, feel free to email me at ectara_sayja[at]yahoo[dot]com.
Thursday, April 2nd 2009 at 10:33 pm
Also, I do not wish to do business with allservice.ro or password-removal. I am not interested in purchasing software. If you want to screw your fellow users by charging them for their ignorance or bad luck, go ahead. I’d much rather code one myself. All I need is some help with the theory and a push in the right direction.
Monday, April 6th 2009 at 3:17 am
THANKS A LOT for this site!!!
I can solve the problem. :))
T30 motherboard (from ebay)
(Chip: 24RF08CN, 4pin: http://www.atmel.com/atmel/acrobat/doc1072.pdf)
After message “Eeprom not available” (it do not work on some WinXP (Pro) - however…)
I use an other OS(XP)-installation (or use an other computer!)
Check connection of COM with “R24RF08/itester.exe” !!!
The password stand in bin-file (1024 byte) at 0×338-0×33E and 0×340-0×346
If you can not read/type password e.g. “Ž{–i-:Jc” or e.g. (HEX-CODE) “01 … 05 32 12 03″
use in IBMpass (2.1) [worked in ubuntu/wine - fine!] the button “AA” (On) to read.
good luck!
Tuesday, April 7th 2009 at 6:54 pm
peter pan,
that’s baloney. you have three types of passwords:
1) power-on password (PWP) - this can be removed by taking the battery out.
2) supervisor password (SVP) - this requires reading the password from the chip.
3) hard drive password (HDP) - the password is stored in the firmware area of the hard drive. requires special device to read the firmware area.
you don’t seem to know what you’re talking about. you just got lucky and encountered a power-on password which went away by removing the battery. try putting a supervisor password in the BIOS and see if you can remove it by taking the battery out.
http://www.password-removal.com
Tuesday, April 7th 2009 at 7:33 pm
thanks a lot…
i have bin file… but, i can’t read password.
my password: »Üö×]:§
hex: bb dc f6 d7 5d 02 3a a7
what can i do?
thanks…
Wednesday, April 8th 2009 at 6:42 am
wow..thx..i ve tried this and it is really work. nice article . thank you verymuch
Wednesday, April 8th 2009 at 6:43 am
wow. i have tried this. and it s really work!!! nice article ! thank you dude!
Wednesday, April 15th 2009 at 10:33 am
hi i do this for T20 , 21 , 23 , R40 it is some time work some time not work and i also have HP NC6220 with bios power on password is there any body knows how to unlock the password kindly help me im waiting for your replay if you know any way email me at jawad@jysourcing.com
Wednesday, April 15th 2009 at 8:24 pm
hi,can help me ihave notebook toshiba can unlock it please…..
think you
Wednesday, April 15th 2009 at 9:27 pm
Great site, I have R61 followed the direction and end up with the hex which I can’t read
hex:- a7 e5 ae a4 ea b0 92 b4
string:- §å®¤ê°�´
Any help much appriciated
Thanks
Friday, April 17th 2009 at 12:50 pm
alexwv:
I have a power-on pw problem, my T42 has been laying aside for about a year now without battery and backup battery. Pw is still there, so it doesn’t always help to remove batteries. I will now try this method and see if I can recover that darn password which I never set.
Cause this method should also recover power-on pw right?
Friday, April 17th 2009 at 1:31 pm
I was given a T23 last week with a BIOS password in place that no one could remember what the password was. I came across this site while searching for a fix as pulling batter did not reset the password (as decribed above). I went to the local radio shack and bought all the parts listed (among a few other additions) and built the jig. To my amazement the process worked on the first try. Thank you for the info.
Not sure if anyone thought of doing this but i put in dip switches on the board so that i could solder the leeds to the TP and turn them on one at a time in stead of soldering them while the unit was on. worked like a charm… i will try and attache a picture if i can.
Friday, April 17th 2009 at 2:58 pm
Anyone know if its possible to use either 4,7V or 5,6V zeners? I got both but not 5,1V of course…
Monday, April 20th 2009 at 10:52 pm
[...] it still didn’t work. It’s probably easier to just get a new mobo for it. the site I read from was Hacking IBM Thinkpad Bios Password : SoDoItYourself.com goodluck.. __________________ Cammed, bolted, sprayed, lowered.. and still soooo slow… My [...]
Tuesday, April 21st 2009 at 10:50 am
T30 UNLOCKED O.K.
A LOT OF THANKS
Tuesday, April 28th 2009 at 3:09 pm
thank you very much ….. 100% get correct password
thanks ahain
haroon alam
Tuesday, April 28th 2009 at 5:07 pm
Great thread wish this was around when I needed it 5 years ago but oh well. Any how dug up my old eeprom chip out of my R40 and used a Dataman Programer model 48pro to read it and see if I could find the old password that was on here when I bough thte laptop from a pawn shop. and NOPE that layout is right and Im shure it is there but the password is not realy right (its device control hex codes “$13 $1E $2E $1F $12 $13 $2F $2D” which aint no ASCII chars. The app that “decrypts” the pass word is a simple hex editor is all like “WinHex”.
As for the if one wants to know if they found the right chip take the Chip ID number and download the data sheet and see if it is in fact a EEPROM chip. It is possible that some may use a 16 leged EEPROM but most I suspect are going to be 8 leg life the one mentioned. Also if you cant figure out what the pass word is you could allways enter a new password in the location of 0×33a and 0×340 and see if that does the trick for you allthough before writting anything to the chip I would definatly make shure you make a back up image of what was there first. Im shure some one would be willing to remove thier password from the thier chip and upload an image some where for any one who just wants to clear thiers off of thier eeprom.
Just food for thought alot of things are not as complicated as one thinks. The data is not “encrypted” persay on the eeprom only written in hex code which translates to alot of common keys is the ASCII format.
PS my R40’s chip had a green paint dot on it and was in the lower left corner under alot of crap top side of the mobo.
Tuesday, April 28th 2009 at 5:16 pm
Oh forget some of that above LOL freddy was right over looked this point lol
“Comment by fredy:
Monday, April 6th 2009 at 3:17 am
THANKS A LOT for this site!!!
I can solve the problem. :))
T30 motherboard (from ebay)
(Chip: 24RF08CN, 4pin: http://www.atmel.com/atmel/acrobat/doc1072.pdf)
After message “Eeprom not available” (it do not work on some WinXP (Pro) - however…)
I use an other OS(XP)-installation (or use an other computer!)
Check connection of COM with “R24RF08/itester.exe” !!!
The password stand in bin-file (1024 byte) at 0×338-0×33E and 0×340-0×346
If you can not read/type password e.g. “Ž{–i-:Jc” or e.g. (HEX-CODE) “01 … 05 32 12 03″
use in IBMpass (2.1) [worked in ubuntu/wine - fine!] the button “AA” (On) to read.
good luck!”
THANK YOU!! pass was RACSERV
Wednesday, April 29th 2009 at 3:06 pm
sembolist, send me your bin file i can read it.
my email is alidabiri1@dishmail.net
Wednesday, April 29th 2009 at 3:08 pm
R60, T60, Z60, X60, T43…. and later models can not be read with this device. it needs another device to read it. to get more info, visit:
http://www.password-removal.com
Wednesday, May 6th 2009 at 12:03 am
HELLO TO EVERYONE !
I am trying to get a solution for my laptop. Right now i have my laptop on guarantee service, they call me to replace my motherboard and asking me TO PAY $600- FOR THE PART NOT LABOR, because my laptop is locked with a UNKNOWN BIOS PASSWORD. This Bios Password was created by a Password Genius of Sportmau, because I have accessed my BIOS but I cannot change, because of a password, that never set. All my passwords worked except that one, i decided to use a Password genius, but then CMOs/BIOs cleared and When I started up my computer, appeared LOCK asking for a Password, I used my Fingerprint and worked but asked me for the password too. I tried my passwords like always and not worked. Until now the warranty technician called me and explained me that IBM, solution is to replace motherboard, what i have to do ? please If someone has passed this situation please email me. my laptop is X60 IBM lenovo Tablet
Wednesday, May 6th 2009 at 4:46 am
I have a G40 IBM thinkpad. I went to Radio Shack and bought all the items
listed, soldered all of them on a breadboard and then I pulled my G40 apart to find out that the motherboard does not have a 24RF08 or anything that looks like it. Has anyone else foung the memory chip? I have pictures of the motherboard that I can e-mail. Help!
Wednesday, May 6th 2009 at 6:17 am
Error on last statment. I do have 3 each 8 legs chips. They are label PU2, PU3 and PU4 on the motherboard. PU4 sits by itself under the mouse pad where PU2 and PU3 sits close together. The chips have the numbers SC 2.5
1565IS
0406. Any help?
Thanks, Bill.
Wednesday, May 6th 2009 at 9:01 am
try this:
http://blogs.ibibo.com/reset-windows-password
Wednesday, May 6th 2009 at 8:13 pm
I don’t think you are not seeing the problem I cannot boot the computer. All that comes up is the super’s password. Password on post. I cannot get past this password, that is why I took my computer apart. Thanks for your reply.
Thursday, May 7th 2009 at 1:02 pm
Update….
I managed to download Philipp’s message after all.
Thanks….
Stan
Sunday, May 10th 2009 at 6:41 pm
Hi
Found this site recently after having a clearout of old laptops.
The IBM Thinkpad A20m needed the svp which i had forgotten
Downloaded the 2 software programmes and made the simple circuit
using 2 zeners & resistors. Note a20m has 14pin 24rf08
Problem 1 Using a laptop with windows xp pro I could not get the r24rf08 programme to work .
Solution found old version of windows (win98) programme worked OK
I created file called dump.bin using edit command in DOS
This is format I used C:\allservice\24rf08\r24rf08 dump.bin (note the space before dump important)
When this programme has run just type dump.bin and decode line300 using IBM passlite2.1
Another comment which I discovered was that the reading computer had 2 comm ports
I had plugged into comm2 by mistake and got error message saying no eprom so use comms port 1 only
Monday, May 11th 2009 at 5:35 pm
Take my advice and don’t remove the CMOS battery. I had a functional Thinkpad x61 but I didn’t know what the supervisor password was and I needed to chance one of the advance settings. BIG MISTAKE! Now it is nothing better than a door stop: It has a power on password set which I don’t know. I can’t do anything with it, not even get into the bios. I’ve located the chip but it is a 28 pin chip and as far as I can tell, it is very difficult to solder such tiny wires. But that is pointless, as I don’t even know which wires to solder. Everything here is geared towards the 8 pin chip. Turns out even if I find out which wires to solder and dump the bin, the rom may be protected by tcpa and it won’t work anyway. Don’t take the battery out on the x61.
Tuesday, May 12th 2009 at 12:20 pm
Hi,
I trie to downmoad http://www.allservice.ro/forum/viewtopic.php?t=61 – Programmer
Antivirus Bitdefender detect a Trojan.Generic.488794 in it !!!
Can somebody tell me if I can continue without AV ! I trie severals mirror sites and it’ the same …
Thanks a lot for suggestions.
Alain
Wednesday, May 13th 2009 at 8:12 pm
Hi,
My spare pc don’t have serial port !!
May I use an USB to RS232 PORT SERIE ADAPTATER CABLE ??
Have somebody experience this?
Thanks in advance to everybody.
Alain
Thursday, May 14th 2009 at 4:16 am
You just helped me plz if you have a IBM thinkpad R52
I see my bios of error mesages for the date and time
more and he asks me a password before they start
I tried several methods but still the same prb
I test 9pin with r24rf08 and w24rf08 + IBMpass Lite2 but nothing
After several searches for R52 there are test point 1tmp and 2tmp called for the circuit bios PC8394T
did not found plz help me for th position for this tow test point for this bios and reseting the pass
thank you
Saturday, May 16th 2009 at 8:41 pm
Thanks a lot for this site!!!
I recover my password !!
On a T30 with the 24RF08 behind the memory !
I think I will now remember my password !!
If somebody needs my little reader circuit, let me know !
Thanks again and again.
Alain
Sunday, May 17th 2009 at 4:09 pm
Can somebody help me please? Built & rebuilt the circuit 3 times now (first circuit experience), plugged it all in & all I can get is “Circuit not found or bus error” I am trying this on an X41 tablet & have 3 of them to do!! I had to take the machine apart because the Atmel is on the underside of the motherboard & below the access hatch for memory etc. If anybody has any suggestions i would be very grateful. Many thanks.
Monday, May 18th 2009 at 7:14 pm
Hi all,
An excellent thread with outstanding contributions.
However, I could not implement the suggestions, largely due to my own fault. I tried to solder a wire to the EEPROM chip which is a difficult job in any case. I did not have a low wattage pointed tip solder. Ended up shorting two small components close to the chip. When I tried to rectify, the components themselves came off the motherboard and stuck to the solder iron. Could not solder them back to their place and lost them. Even then, I tried to solder a wire to pin 5 of the chip. It could be done, but soon the copper strip holding the pin of the IC to the motherboard came off.
From my experience, the lessons are:
1. Never attempt to solder anything to motherboard unless you have a proper soldering tool.
2. It is much batter to locate the EEPROM IC and make it accessible to your view even when the laptop has been assembled. In my case (Thinkpad 600), it could be easily done by drilling a small hole (about 1 cm dia) in the bottom cover of the laptop, when the motherboard was out. Thereafter one can temporarily connect the pins of the IC to outside circuit with the help of two probes (similar to one found in common multimeters or any hard wire will do) without soldering any wire to the motherboard.
3. The best would probably to follow the method of Mr. thecheese given above. It needs no components and no software downloading. (I am assuming that it works, I have not tested it). If his solution is applied, one just need to hold a probe on pin 5 of The IC and short it to the earth of the motherboard (say on the outer metal of the USB port) for a second when the password is being asked by the Thinkpad and press enter and then disconnect the pin 5 from the earth. For this work, best would be to drill a small hole in the cabinet of the Thinkpad instead of trying to solder a wire to the chip.
Cheers
Sunil Bansal
Wednesday, May 20th 2009 at 1:52 am
Mr. thecheese method did not work on a X61s.
The problem is that if you enter a blank password, you will get access to the BIOS with very limited permissions, and therefor can’t change the supervisor password.
If empty passwords had been allowed, I think it should have worked. At least the method seems sound enough.
Thursday, May 21st 2009 at 4:55 pm
Does anyone know where the ATMEL 24RF08 chip is located on the IBM TransNote (Type 2675)? It doesn’t appear to be under the keyboard or anywhere else I can see.
TIA,
MisterMike
Sunday, May 24th 2009 at 3:59 pm
Missing IBM ThinkPad A22m bioss chip?? Where chip is located on motherboard? I remove many IBM laptop model password using chipreader. This A22m model is new to me
Jouni
Tuesday, May 26th 2009 at 4:37 am
oi tudo bom tive um pouco de dificuldade com o dos mas consegui brigadao
Wednesday, May 27th 2009 at 3:19 pm
could you pls. provide me more pictures of how the wiring setup is done? I’m not so goog in electronics, I just want to make sure i get this right. i would greatly appreciate your effort if you could provide me more information on this interface.
Thanks from Germany.
Paul
Monday, June 1st 2009 at 12:03 am
Dear friend I has an laptop Lenovo IBM ThinkPad model 2686DGU, year 2003, I got problem is I couldn’t remember the power on power password or ( IBM ThinkPad Supervisor password ) the power is on but the screen is lock-up doesn’t let me see anything during the syytem booting up. I looked at the picture that you’re posting on the top of this page, that is same problem I have been had
could you pls. provide me more pictures of how the wiring also how to connnect to 2nd computer and the setup is done? I’m not good in electronics, I just want to make sure that i get it right set up and right HW connection. i would greatly appreciate your effort, I do need more detail, please give me more information on this issue.
Thanks for your time.
Austin.
Tuesday, June 2nd 2009 at 12:23 am
thecheese,
i don’t think you know what you’re talking about. your suggestions are misleading at best and downright ignorance at worst.
your method DOES NOT WORK - period.
Wednesday, June 3rd 2009 at 11:56 am
The only software and method that works for T43, T60 and the others is from allservice.ro. They made the software and tools, is amazing how everybody come here, instead of their forums.
Everyone is using that software, all websites that offer unlock service for IBMs are using Victor’s software found here:
http://www.allservice.ro/forum/viewtopic.php?t=61
We’ve bought it for our company (in Germany) and already done 30+ TPs like a charm. They offer the best support I’ve seen so far and deserve it.
Monday, June 8th 2009 at 7:50 am
Hi all!
I have Thinkpad R60e with unknown pop/supervisor password. I disassembled it and found on motherboard ATMEL 8356908 chip. If I understand right, I need for password recovering PC8394 Tools 1.0d full package or enough with only RPC8394 1.0 TPM reader?
Thursday, June 11th 2009 at 10:16 pm
Hi , I have IBM TP R50e. When I power on the machine i got Error code 0187 and 0191, any one please help me what should i do to remove these codes.
Pleeeeeeeeeeeeeeeas
Saturday, June 13th 2009 at 5:37 am
trying to retrieve BIOS PW on a R51 TP. Hooked everything up and got the EEPROM error and now after checking the connections I am getting the Circuit not found error. I think I am regressing in the process. Please, help me. email me at mr Underscore Wilde2003 at yahoo. thanks
Tuesday, June 16th 2009 at 4:41 am
IBMPass/ IBM Pass its called can be found here:
http://www.allservice.ro/store/utils/index.htm
Tuesday, June 16th 2009 at 4:43 am
Can anyone please confirm whether this will work on a t60p?
Monday, June 22nd 2009 at 3:31 am
I have the IBM T30. Made up the chip reader using the 2 resistors, 2 diodes and 9 pin female serial port. Solder 2 wires; 1 to the SCL and 1 to the SDA on the ATMEL chip and a wire to the groud on the motherboard of the T30. Then on the spare computer, i turned it on, i downloaded the reader, and installed it. I put the chip reader in place, went to start, run, my computer, all services, R24RF08 file, and open the R24F08 V2.OB and click ok. typed in R24RF08 dump.bin (in the black box), went back to the T30, turned on the power, press F1, to enter Bios. when all lights stop, i hooked up the ground, the SDA, and then the SCL. Went back to the spare computer and hit enter. The black box goes away but no dump file is created. Please help!. Thanks.
Tuesday, June 23rd 2009 at 5:30 am
My laptop was a freebie from a Freecycle group. Never needed the BIOS until later when I found the SVP. This article was very useful in turning my boat anchor back into a laptop. Thought I would leave my comments. First time I tried this, didn’t work. I kept getting the bus error or chip not found error. Here is what I learned.
1. Use the lowest voltage resistors you can find. I used 1/8 watt to finally work.
2. Make sure that when you build your RS232, push the pins all the way down in the holder. I don’t think I had mine all the way the first time.
3. Unless you are an electronics god, I wouldn’t try the soldering. I found another article where when it came time to read the chip, one person held the contacts on the chip while the other operated the software. It only takes a few seconds to read the chip so the soldering seems a bit overkill to me, you just have to be super careful.
4. when I first loaded the dump.bin file in the file reader, the output was garbage. Then I noticed a little button up top which said “Enable/Disable translation”. Like magic, the password was before my eyes. If the software gives you garbage, keep playing with the settings, it is in there.
Thursday, June 25th 2009 at 3:42 pm
i have ibm thikpad z61t , cmos password is lock , i havd located the atmel chip near by expansion slot . the chip is 28 pin with the eprom code at97sc3203 . somebody can help me to unlock the password .
Saturday, June 27th 2009 at 12:30 am
No one wants to go to allservice.ro because no one wants to pay to fix their or other’s mistakes. I’d rather build the circuit myself and use my own serial dump program that I wrote in C to do it, rather than have someone else profit from my misfortune. I received little help, and a massive amount of advertising telling me to pay someone to do it for me. No, thank you. It seems as if I and others on this site are largely on our own, even in the age of public domain.
Monday, June 29th 2009 at 5:57 am
Beautiful! Thank you sir I just unlocked a laptop a friend gave me because he thought it was trash.
Here are my notes:
- I had a model T40 with the same chip in the tutorial
- I got away with using some diodes I had sitting around (1N4002)
- Check the pinouts on your DB9 (RS232) connector!!!
Mine were actually numbered backwards (instead of 5-1, 1-5 etc.)
- My serial cable was also numbered in reverse order too, however once I switched the
wires it worked perfectly.
- My password was gibberish until I clicked that button on the top left in the IBM
password program.
Thursday, July 2nd 2009 at 7:17 am
Hello sir,
you are my hero! I have just restored forgotten password on X31. I simply followed all steps mentioned in your tutorial and it works! Thank you very much…
Wednesday, July 8th 2009 at 2:47 am
Dear friends I have r50e laptop,with the password problem,The chip is 24rf08,I tried to read it using my universal programmer (superproLx)I was able to read 25%(upto 0X00E0) the hex(bin) file goes like this.
:200000008008070D0902400004607000821000010E040C010220C0757000004830482A20A2
:200020007575454500000000003C48302D550000000000000000000000000000000000E82E
:20004000AD000000000000000148594D443233324D36343644362D4A20202041410435FF31
:20006000FF0855000000000000000000000000414934384E31313232322D30332000000038
:20008000000000000000000000000000000000000000000000000000000000000000000060
:2000A000000000000000000000000000000000000000000000000000000000000000000040
:2000C000000000000000000000000000000000000000000000000000000000000000000020
:2000E000000000000000000000000000000000000000000000000000000000000000000000
:20010000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
:20012000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDF
:20014000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBF
:20016000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9F
:20018000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7F
:2001A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5F
:2001C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3F
:2001E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1F
:20020000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE
:20022000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDE
:20024000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBE
:20026000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9E
:20028000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7E
:2002A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5E
:2002C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3E
:2002E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1E
:20030000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD
:20032000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDD
:20034000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBD
:20036000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9D
:20038000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7D
:2003A000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D
:2003C000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D
:2003E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1D
:00000001FF
please guide me how to read password location i.e 0X330,any body have bin file for the same ??please mail me (thejananta@yahoo.com),I will just try to program it on the other empty chip and solder it on the board .please guide me what to do next
Thanks in advance
regards
Sathyananda
Saturday, July 11th 2009 at 8:22 am
my t21’s 24RF08 is broke by reveres polarity
i have a new one 24rf08 ….but i dont heve dump.bin file
have any one upload fdump.bin?????
Monday, July 20th 2009 at 9:33 pm
Hi all, I located the eeprom on the bottom side of a lenovo T61.
P24S08 NXP (read out with:r24rf08)
Made the electronics connections, read out eeprom, this is dump.bin at location
0×338 6A:76:72:DB:D5:05:D4:85
0×340 6A:76:72 :DB:D5:05:D4: C2
means: jvr??(F1)??
Any ideas?
THX for help
Monday, July 27th 2009 at 6:24 pm
Hi.. anyone in Toronto who has done a T30/t40 sucessful?
Friday, July 31st 2009 at 10:48 am
Hi,
I tried this on a T42 and x330 memory is all “ff”.
I’m needing to recover the “Access IBM” password, is the password this process is suppose to recover the one I need?
I press the “Access IBM” at power-on, it prompts for the power-on password (which I know, [but the dump.bin file doesn't show this password as I expected it to]). The IBM Rescue and Recovery screen loads and a prompt appears for a password (an input box titled “IBM Verify Password”), this is the password I do not know, I need it to reinstall the prebuilt software back to factory. Has anyone got any ideas with this?
Thanks for any help you can provide.
Friday, July 31st 2009 at 11:33 am
Ok, I have tried again running the dump at the power-on password (I was originally running it at the “Rescue and Recovery” passowrd prompt). The x330 dump is…
“00 00 00 00 00 00 00 00 2f f9 28 96 40 fa cc 96″ which gives a translation of ” V ‘ f “. Any ideas where I am going wrong?
Thanks again
Monday, August 3rd 2009 at 1:53 am
Did I read correctly?
You first turn on the password protected machine, THEN while the machine is on, solder the wires to the SDA and SCL pins on the Amtel chip?
Monday, August 3rd 2009 at 7:25 am
[...] Does anyone of you uses IBM?? In this case this might come handy…Have fun… Hacking IBM Thinkpad Bios Password : SoDoItYourself.com [...]
Wednesday, August 5th 2009 at 2:47 pm
larry,
DO NOT SOLDER anything on the password-protected machine while it is ON.
Friday, August 7th 2009 at 7:17 am
HAS ANYONE SUCCESSFULLY DID R40?
Friday, August 7th 2009 at 7:45 am
HAS ANYONE SUCCESSFULLY DONE THE IBM R40 HACKING GUYS?
I AM ABOUT TO DO ONE , BUT HAVENT YET OBTAINED THE ENTIRE
HARTDWARE LIKE DIODES AND RESISTOR.
nduduzo.mkhize@kznhealth.gov.za
Sunday, August 9th 2009 at 4:13 am
Thanks. Worked perfectly.
Wednesday, August 12th 2009 at 2:26 am
This does work on an IBM R40. ATMEL chip is under the thin plastic where the hard drive was. It might help to include a diagram of the wiring needed, or show a breadboard picture or show the diagram visually, especially what the wires look like all soldered together. All in all I spent less than 5 bucks for the resistors and zeners. It worked on the first try and I thank you for this information. Let’s all do more publishing of solutions and tips and tricks for these kind of problems. Maybe we can help each other instead of having someone tell us we need to buy another motherboard,,,well I found help here, and I am grateful. THANKS!
Friday, August 14th 2009 at 1:24 pm
Thank you for this. It worked first time for me on an X31. I had trouble finding the 24rf08 on the X31 but thanks to an earlier comment I tracked it down. No electonic experience. Great fun.
Friday, August 14th 2009 at 3:23 pm
For 24CF08CT the SOLUTION IS HERE
http://monitor.net.ru/forum/files/24rf08ct_172.jpg
Saturday, August 15th 2009 at 10:10 am
Not 24CF08CR but 24RF08CT , (IBM THINKPAD T23 Localized under the Rame Module Near The Speaker)
For 24RF08CT the SOLUTION IS HERE
http://monitor.net.ru/forum/files/24rf08ct_172.jpg
Saturday, August 15th 2009 at 11:27 am
well can you telll me if i changing this bios chip with new one it’s gone solved or not
thank you
Saturday, August 15th 2009 at 11:31 am
sorry this is the right email
Tuesday, August 18th 2009 at 7:21 am
Hi everybody
i have to say Thank you for all the information.
it was really helpfull
thanks
regards
Maxd.
Thursday, August 27th 2009 at 11:24 pm
Hi,
I have Thinkpad x41 tablet model 1869-CSU.
I want to know place of Atmel IC in X41 tablet mainboard.
Thanks
Regards,
Omid
Friday, September 4th 2009 at 7:43 pm
quenther,
that means that the password is encrypted. it needs to be decrypted. for password help visit: http://www.password-removal.com
Saturday, September 5th 2009 at 9:26 pm
0X330 is blank but the T20 still ask for a password?
Sunday, September 6th 2009 at 7:20 pm
Hi,
i want to remove password from my ibm t60. i read all procedure that’s great. only 1 thing which i want to confirm before going to do this that shall solder the wire direct serial port to atml or not. because i saw some of friend in this site showing some white color board on where he solder resistor and wires.what’s that board?
Friday, September 11th 2009 at 4:45 pm
Hi,
the procedure worked perfectly on a TP X41, thank you and AllSoftware.ro for the software: You’re great!
One hour of work and 5 USD of materials!
The chip on my X41 is underneath the m/board just oppsite side of the PCMCIA slot.
The chip is a Philips PCA24S08, SCL and SDA pins are the 2 most right on the side of the “P24S08″ label (as well as for the atmel chip).
I didn’t risk to solter the chip, instead I connected the end of the wires of the interface to two pins (GND connected somwhere in the m/b) and while the program was running I kept the pins connetted to the chip manually. It worked.
Saturday, September 12th 2009 at 11:06 am
[...] so Hacking IBM Thinkpad Bios Password : SoDoItYourself.com __________________ Frei ist, wer in Ketten tanzen kann. Das Leben ist ein Heidenspa, fr [...]
Saturday, September 12th 2009 at 1:27 pm
Hi,
Thanks a lot ! it wooooorks
Friday, September 18th 2009 at 4:05 pm
Hello everybody ! I have a Thinkpad r500… with svp…can somebody help me to were in atmel chip….and this chip reader is good for my Thinkpad r500. PLEASE !!!!!!
Saturday, September 19th 2009 at 5:49 pm
Could you post a pic of the completed adapter. I think I understand the schematic,, but would like to see a final project.
Thursday, September 24th 2009 at 1:02 am
Hy guys, i got my thinkpad z60 back and forgot my supervisor password
I still got access with fingerprint but not more
Do i need to open my laptop for reading with the RPC8394 tool?
Friday, September 25th 2009 at 5:44 am
PS/2 mouse does not have DB9 connector. Serial one have.
Friday, September 25th 2009 at 7:16 am
Funny, I did more or less the same with an HP notebook… unfortunately hackaday did not like the history :_/
http://blogs.nopcode.org/brainstorm/2006/08/25/omnibook-xe3-resetting-a-bios-password-the-hardware-way/
Friday, September 25th 2009 at 8:03 am
[...] Did you forget your hardware-based password and now you’re locked out? If it’s an IBM ThinkPad you may be in luck but it involves a bit more than just removing the backup battery. SoDoItYourself has an article detailing the retrieval of password data from an EEPROM. [...]
Friday, September 25th 2009 at 9:59 am
[...] This post was mentioned on Twitter by Tonimir Kisasondi and Saint Crusader. Saint Crusader said: RT @mobilebomb: hacking ThinkPad BIOS EEPROM password http://bit.ly/2HKrf2 >> thinkpad คือคอมในดวงใจเสมอ [...]
Tuesday, September 29th 2009 at 1:49 pm
Dear Sir,
We are direct providers of Fresh Cut BG, SBLC and MTN which are specifically for lease, our bank instrument can be engage in PPP Trading, Discounting, signature project(s) such as Aviation, Agriculture, Petroleum, Telecommunication, construction of Dams, Bridges, Real Estate and all kind of projects. We do not have any broker chain in our offer or get involved in chauffer driven offers. We deliver with time and precision as sethforth in the agreement. Our terms and Conditions are reasonable, below is our instrument description.
DESCRIPTION OF INSTRUMENTS:
1. Instrument: Bank Guarantee (BG/SBLC) (Appendix A)
2. Total Face Value: Eur 10M MIN and Eur 5B MAX (Five Billion USD).
3. Issuing Bank: HSBC, London or Deutsche Bank Frankfurt or any Top 25 WEB
4. Age: One Year, One Day
5. Leasing Price: 6% of Face Value plus 2% commission fees to brokers.
6. Delivery: SWIFT TO SWIFT.
7. Payment: MT-103.
8. Hard Copy: Bonded Courier within 7 banking days.
All relevant business information will be provided upon request.
If Interested kindly contact me via Email:~ stuartbaird090@aol.com
Thursday, October 1st 2009 at 2:17 am
I seem to be having a problem at this point…..
“Fire up a command promt(Start->run type cmd) and navigate to the folder where you installed R24RF08 v2.0b. Type in (don’t hit Enter):
r24rf08 dump.bin”
…. I installed the programs but it seem impossible to “navigate to the folder” can someone help me with this? If I try and run it from the windows folder it doesn’t seem to work.
Thursday, October 1st 2009 at 9:19 am
Is the 24c64wp clip the bios IC?I fail to update the bios of my acer aspire 2920,and my laptop can’t open now,I don’t know witch IC on the motherboard is the bios IC? Does anyone can tell me?thank you!
Thursday, October 1st 2009 at 9:20 am
Is the 24c64wp clip the bios IC?I fail to update the bios of my acer aspire 2920,and my laptop can’t open now,I don’t know witch IC on the motherboard is the bios IC? Does anyone can tell me?thank you!
Saturday, October 10th 2009 at 3:21 am
Wow, it worked perfectly. But at first my password looked like random ASCII characters on my thinkpad a21e in IBM Pass 2.0 Lite. I thought that it was TCPA encrypted, but saw that the a21e doesn’t use TCPA. I took me a while but I found out that the AA button must absolutly be ON for the a21e.
Friday, October 23rd 2009 at 2:01 pm
hola
gracias a ustedes y a un error logre desbloquear la ibm t400
el chip de seguridad integrado es el p24s08
la solucion a el problema de la clave o pass es mas sencilla de lo que creen
1:soldar un cable a cada una de las patas 5-6
2:armar el ordenador y tener listos los cables con las puntas peladas
3:precionar power y en ese momento unir el cable 5 y 6 en corto circuito solo 4 segundos y separar
(veras que la maquina no enciende pero las luces si)
4:apagar y volver a encender realizando el corto entre el 5 y 6 ya cuando esta encendiendo(3 seg +-)
(aparecera un error y intentara repararce el cmos por conexion remota)
5:apagar y ya veras que te dejara entrar en el bios pero no podras realizarcambios
6:la patita numero 3 del p24s08 se conecta pormedio de unos microcapacitores de ceramica con una lupa veras que tiene una pista de la medida de un pelo bueno entre el primer capacitor y la pata 3 corta con un cuter (cuidado de no cortar otra cosa )ya esta.el chip esta desactivado y el bios reseteado.
pd:yo lorealice al corte al soldar un cable en la pata 3 y corte la pista sin querer y mira esta es la solucion ,por mas que tus hijos quieran no permitirte el acceso ya no podran bloquearla con este procedimiento.
al encenderla podras entrar al bios y realizar cambios y no te pedira la clave
suerte
Saturday, October 24th 2009 at 12:10 am
Thanks to Victor at AllService for his help in unlocking my X61. A fast service with all completed from initial enquiry to unlock taking less than 2 hours
http://www.allservice.ro/forum/viewtopic.php?t=61
For a thinkpad with TCPA encryption this is the only way to proceed. You will need to have basic soldering skills. If you have a helper to enter the command on the technician’s PC, you will not need to solder onto the mobo of the X61. The biggest advantage is that you do not need to ship your laptop anywhere - all required components to build the interface are available in any electronics store and the software/files are available via email.
Saturday, October 24th 2009 at 1:09 am
Hi,
I have a Lenovo T500, I took it apart to find the atmel but instead the atmel, which is missing (I did find the U53 location, but it’s empty) I did find another flash Winbond 25X64VFIG 16 pins located very close to the missing one, I find out it is a serial flash but it has a huge capacity 64MB !
On the other side of the main board I did find a NXP made 24s08 which is probably the same like the Atmel 24rf08 one you described, this is located close to the DVDrom connector.
Please let me know if there is anything that can be done ?
Thanks a lot
Saturday, October 24th 2009 at 1:18 pm
Comment by Sebastian:
On the other side of the main board I did find a NXP made 24s08 which is probably the
traductor google
hi
thank you and error managed to unlock the T400 ibm
integrated security chip is p24s08 = Atmel 24rf08 8 pin
the solution to the problem of password or pass is more simple than you think
1: solder a wire to each of 5.6 feet
2: assemble the computer and be ready cables with bare tips
3: Precionar power and then connect the cable 5 and 6 shorted and only 4 seconds separating
(you will see that the machine will not start but lights if)
4: off and relight the near by between 5 and 6 and when it’s on (3 sec + -)
(see an error and tried the cmos by repararce remote connection)
5: off and it really let you enter the bios but you can not realizarcambios
6: the number 3 p24s08 paw connects microcapacitores adaptive behavior of a ceramic with a magnifying glass to really have a clue of the extent of a good hair between the first capacitor and the leg 3 intersects with a cutter (careful not to cut anything ) and esta.el chip is disabled and reset the bios.
pd: I lorealice cut the solder to the leg 3 and accidentally cut the track and watch this is the solution for your kids but do not want to let you access and can not block with this procedure.
to turn it on you can enter the bios and make changes and do not ask for the key
lucky
el chip esta serca del conector del cdrom parte posterior
Saturday, October 24th 2009 at 8:45 pm
Hi,
my T23 was the last PC running M$ - does there exist an equivalent to “IBM Pass 2.0 Lite” under debian ?
Thanks a lot,
Merci bien,
Jupp
Sunday, October 25th 2009 at 11:30 am
Wildbynature: I successfully used this circuit to read out the atmel chip on a couple of r51s. so if you’re getting an error there’s probably a problem with your circuit: wrong components, miswiring, something. Or you’ve caused some damage to the laptop in the process of soldering. I didn’t solder, I hand held the wires to the chip wile a friend ran the program.
The ibm passlite program did not correctly decode the bin file, though. I found another program on line that would do it: cmospwd 5,0. It displays several possible decodings of the file, using different algorithms. The second one displayed showed the right password.
Monday, October 26th 2009 at 12:29 am
Hello..Very nice setup on how to fix the bios lockup… anyone know were this ATMEL chip is located on a Thinkpad A20p been unable to find it….??????? HELP….
Monday, October 26th 2009 at 8:20 pm
Hello..Very nice setup on how to fix the bios lockup… anyone know were this ATMEL chip is located on a Thinkpad A20p been unable to find it….??????? HELP….
magnifying glass and patience.
■ ThinkPad 570E
■ ThinkPad 600E, 600X
■ ThinkPad 770X, 770Z
■ ThinkPad 240
■ ThinkPad X20
■ probably more
External sources
■ ATMEL
■ ATMEL - Direct link Direct AT24RF08C
■ ATMEL - Direct link to AT24C08 Direct
■ ATMEL - AT24RF08C product page
■ ATMEL - AT24C08 product page
and p24s08 T400
buscar
Tuesday, October 27th 2009 at 10:33 am
regardez ici :
http://www.passwordmethod.com/images/EEPROM/ibm_a20p.gif
Tuesday, October 27th 2009 at 10:34 am
A. By Using the Motherboard Jumper:
In most motherboards CMOS battery is soldered, which makes it difficult to remove the battery. In this case we use another method.
Almost all motherboards contain a jumper that can clear all CMOS settings along with the BIOS password. The location of this jumper varies depending upon the motherboard brand. You should read your motherboard manual to check its location. If you don’t have the manual then look for the jumpers near the CMOS battery. Most of the manufacturer label the jumper as CLR, CLEAR, CLEAR CMOS, etc.
When you find the jumper, look carefully. There will be 3 pins and the jumper will be joining the center pin to either left or right pin. What you need to do, is remove the jumper and join the center pin to the opposite pin. e.g. if the jumper joins center pin to left pin, then remove it and join center pin to right pin. Now wait for a few seconds and then again remove the jumper and join the center pin to left pin.
Make sure to turn the PC off before opening the cabinet and resetting the jumper.
B. By Using Software:
I have found that BIOS/CMOS Password Recovery Tool is the most effective.:
BIOS/CMOS Password Recovery Tool is a program that works instantly to remove any lost or forgotten BIOS/CMOS password. Simply boot your PC to DOS and execute the program, and get access to forgotten BIOS/CMOS passwords in just seconds
BIOS/CMOS Password Recovery Tool Service: http://www.biospasswordrecovery.com/
Tuesday, October 27th 2009 at 10:33 pm
Hi I know there is a SOLDERLESS way of hacking the IBM PASSWORD. I know this because I know someone doing it and other companies only charge $25 to do it so they are not going to take your laptop apart (A20M, A21M, A22M, A23M) and fix it for $25. I am pretty sure its using a device through the parallel port and decoding the output again as before. It works on A20M, A21M, A22M, A23M, A30, A31, T20, T21, T22, T23, T30 probably other models too. If anyone finds out how please post it! EVERYONE WILL LOVE YOU FOR IT!
Wednesday, October 28th 2009 at 11:47 pm
oh my god
it`s work!! i have IBM A31 .. and the password i can read! this is very good tutorial!
thx!
Thursday, October 29th 2009 at 11:13 pm
That’s great, and similar to what I suspected, but I own an Acer Aspire 4710, Euro model, made in 2007. The BIOS is locked and it absolutely won’t clear by easier methods, also removed all parts from the casing, no visible clues. What software or device can I use? Acer wants $100 USD to correct problem.
Sunday, November 1st 2009 at 3:34 pm
[...] Although THIS is not for a toshiba, it might give u an idea [...]
Monday, November 2nd 2009 at 1:00 pm
Hi, on my R61 reading NXP P24S08 :
0X330 : 00 00 00 00 00 00 00 00 4e 2d 73 8e 81 b7 96 f4
0X340 : 4e 2d 73 8e 81 b7 96 f4 88 c6 fa 03 83 c2 fa 02
after press ( AA ) button result is : +X
Why not decoding password ???
also used patcher !! same result !!
HELPME,HELPME
Best Regards
Wednesday, November 4th 2009 at 7:35 am
is this will work in IBM Thinkpad R52 and will you discrived it in more detail step by step with photograph.
Wednesday, November 4th 2009 at 7:40 am
i have IBM THinkpad R52,n i m getting same type of screen as my brother do something and dont know wht he has done. I m getting the lock at screen when i m starting my laptop same as u given the pic, the solution u have given will work in IBM Thinkpad R52 and will you discribed it in more detail step by step with photograph. and is any other trick which is easier then this.. i think it is an superior password.
Friday, November 6th 2009 at 3:00 pm
Riz,
thinkpad R52 does not use Atmel 24rf08 chip. it uses a different kind of chip that can not be read by the simple device.
Friday, November 6th 2009 at 3:07 pm
Chris,
sure, there’s a way to read the password using serial port. but, you have to have access to THE CHIP (Atmel 24rf08). you need two laptops: the locked laptop and a technician’s pc. an electronic device is connected to the Atmel chip that plugs into the serial port of the technician’s pc. the password is read and then decoded. in case of A20, A21, A22, A23, A30, A31 the laptop must be opened. on 20 series, the chip is at the bottom of the motherboard. on 30 series, the chip under the keyboard. for T20, T21, T22, T23, T30, the chip is easily accessible and the pc does not need to be taken apart. but, you still need an extra laptop to READ the locked laptop’s chip.
Saturday, November 7th 2009 at 8:38 pm
It works like a charm, thank you very much
We were stuck because we didn’t use ground cable and dumping application couldn’t read chip memory. The best DIY we ever did.
Monday, November 9th 2009 at 10:45 am
how can i remove BIOS password in Lenova x61 tablet laptop. I have forgotten my password.
please mail me at fahad.ahmad@langleyacademy.org
thanks.
Monday, November 16th 2009 at 8:51 pm
Holy boy! It worked. I’d never held a soldering iron before in my life, and this hack worked. Major major major props to the author. I’ve just salvaged a dead brick and turned it back into a working rig.
Tuesday, November 24th 2009 at 9:59 pm
Hi folks thank you for the help out their on this IBM A20p Thinkpad..I found it finely … The Bios chip for this laptop is Located on the bottom side of the board right under the PCMCIA Slot U55 chip Number 24RF08C ATMEL….
Thursday, November 26th 2009 at 6:48 am
This worked great on A IMB T40) used RadioShack Part # 276-565 Item # 1N4733A 5.1 ZENER dIODES 2 IN THE PACK FOR $1.30 US AND TWO 2.2K RESITORS AS SPECIFIED and a old serial port cord mapped out the pins with ohm meter to the colors and worked like a charm
To access the eprom chip download the service manual from IBM it tells just what screws to take out be carefull they are differant lengths involved you take out the ketboard very easy to do and the touchpad holder also very easy and the eprom is just the same place as in the pictures above it is on the left be carefull to make sure you get the SCL and SDA correct on your wires i soderd wires to the eprom and a copper place just above the chipset up and to the right for the ground then hoocked the wires to the ends of the resitors wires turned on the laptop and pc then hooked the serial cable into the pc the software will install to a directory of its on on the root of your main drive mine was
C:\Allservice
when you go to the command prompt you will (ExAMPLE. winxp ) be in C:\documents and setting\yourname> if you type SPACE cd.. and hit enter it takes you back one directory so if you do it again space cd.. enter you will be in C:\
this makes it easer to get to the directory you whant
then type cd (hit spacebar once) allservice and hit enter and it should read c:\Allservice
then type cd (hit spacebar once) 24RF08 and hit enter and it should read c:\allservice\24rf08
then type r24rf08 dump.bin and it should look like this then
c:\Allservice\24rf08\r24rf08 dump.bin
now when your ready hit the enter key it should now read the eprom chip and make a file called dump.eprom in c:\allservice\24rf08 directory on your harddrive if you have the IBMpass.2.1 installed just double klick the eprom looking icon and the program IBMpass.2.1 will automaticly launch read the password and wala your done
Thanks the software provided buy allsevice (I.E. R24RF08 v2.0b ) shows the same diagram for the programer in the pdf files that are included with the software just incase you lose the site addy i want to thank the provider of this information for your posting this on this site you are the bomb:)
IBM shoud be ashamed of itself for telling people to trash there laptops and or buy a new motherboard when this method is a easy as it is
Thursday, November 26th 2009 at 6:50 am
last post was supposed to be a IBM T40) sorz about the typo
Saturday, November 28th 2009 at 9:44 am
Well Tony Nice there is some good info in your post and some advertising going on allso about some software here!
But in the case of my IBM T40 this is the ONLY methoud that will work so dont you people out there get suckerd into thinking that a peice of software as in tonys advertisement above would work in the case of these certain IBM laptops at wich the passsword is writen to the eprom just like a bios flash or firmware flash is wrote to a chip in your cd/dvd/ drives and so on the info stays on the chip reguardless of any a/c or battery conection kinda like writitng to a cd or floppy drive or even your hard drive it stays put even after being removed from a eletrical connction
Use this methoud for your pasword recovery on your IBMs with the eprom chip and you cant go wrong! because it is the only thing that will work! Period!!
Sunday, November 29th 2009 at 3:08 am
Hi, I have a TP x60 and I was wondering if this will work for me. And if it will work, dose anyone know where I would find the chip I’m looking for? Thanks to everyone that share’s their information. Without you many people would have expensive paper weights and no computer!
Sunday, November 29th 2009 at 4:50 pm
Thank you so much for this. I am by no means a skilled IT person and have never even opened up a laptop before but your instructions were so clear and simple to follow that even I had little difficulty in locating the password. Yes, the soldering was a bit of a challenge (requiring a steady had and the help of a magnifying glass but I did succeed. You’ve made my day. Thanks a lot.
Wednesday, December 2nd 2009 at 4:58 am
I have an IBM TPD R60 which i forgot the SVP password. Now i am unable to use the TPD. I checked the motherboard for the ATMEL chip and was able to find one, its no. is AT97SC3203. I think this is the one which has the SVP stored. Could anyone please guide me how to solder the wires to this chip and a circuit diagram for reading the EEPROM details. Thanks in advance.
Wednesday, December 2nd 2009 at 5:55 pm
Hi.
I have also a problem with a T43. I fount the PC8394T-VJG but i don’t know where to connect the eeprom programing interface. Where are the TPM1 and TPM2 points on the PC8394T-VJG.
If somebody can help me my e-mail adres is: szabi_biro_83@yahoo.com
Thursday, December 3rd 2009 at 7:35 pm
Please HELP.
Shall I problem with LENOVO R61 type 8918.Eeprom P24S08 filling eats 0×330 :66 ad 11 07 f2 c4 21 ac following a reversed in IBMpass 2.1 Lite eats passport:,>72 Q> Please may me this translated right ? Thanks.
Thursday, December 3rd 2009 at 7:41 pm
email:07stevo07@zoznam.sk
Please Help.Thanks.
Thursday, December 3rd 2009 at 10:19 pm
Hello,i have T60 and my motherboard is FRU41W1360 i have not located ic security where is this please?or i oblige buy tools victor thanks you very much!!!help help me
Saturday, December 5th 2009 at 6:32 pm
Hello everybody
IBM T40, I have 2 errors message when I press on F1 during the startup to enter the BIOS.
Error 0271 - check date and time setting
Error 0176 - System sercurity. The system has been tempered with.
1-Is it a problem?
2- I connected everything like the diagram, and when i press enter i cant find the dump bin file ,how do i find or tell if and where the bin file has gone,can anyone help!!!
3-It is possible use an USB to RS232 PORT SERIE ADAPTATER CABLE ??
Have somebody experience this?
If somebody can help me my
Thanks in advance to everybody.
Tuesday, December 8th 2009 at 2:41 pm
Dear author,
My spare computer has no serial port. I bought a USB-to-serial port. The problem is that it is a male serial port. Will this still be alright?
Tuesday, December 8th 2009 at 3:01 pm
To whom it may concern:
My spare computer has no serial port. I bought a USB-to-serial port. The problem is that it is a male serial port. Will this still be alright?
Tuesday, December 8th 2009 at 11:51 pm
there are some key generators which you can use to bypass the BIOS password of various other vendors:
http://dogber1.blogspot.com/2009/05/table-of-reverse-engineered-bios.html
Wednesday, December 9th 2009 at 5:01 pm
hey there just curious im about to perform the hack on my own but was wondering cani use my usb serial cable on my laptop?? i think so but just curious….. thanks anyway
Wednesday, December 9th 2009 at 6:57 pm
one has to have a real steady hand to solder on the ic pins. but once you have it done, it worked me at first try.
nice one.
thanks
Felipe
Thursday, December 10th 2009 at 12:04 am
Any way to get a better picture of how the seriel connecter,resistor and zener diod are put together?
Thanks
Thursday, December 10th 2009 at 4:28 am
the serial connector on the schematic is shown from the back of the connector.
i tossed away my protoboard as it had very unreliable connections. maybe it was worn off.
so i picked up a piece of stripboard and mounted the circuit there. soldered the wires coming from the inside of the notebook to the stripboard and fired up the system. when it was prompting to enter the password i connected the serial port (already soldered to the circuit, to the notebook)to the computer, not the wires individually, then i started the dump on the command prompt and ot worked at the first try.
it read a 1024 dump.bin file, i openned with the IBM pass lite app, and at first didnt recognize anything as a password on 0×330, but, i TURNED TRANSLATION ON and it appeared a 0710 code as password. that was it.
excelent method.
thank you very much
Sunday, December 13th 2009 at 9:17 pm
What A great sight! I am almost there. I have made the chip reader and found the security chip on my TP R40,its the black and green colored one. I am not sure where to connect the red (sda) and green(scl) wires and ground to the chip. If anyone can supply info or better yet a picture it would be greatly appreciated.
Thanks
Monday, December 14th 2009 at 4:01 am
Hallo Ihr netten,
ich habe be ebay vor kurzen ein IBM ThinkPad 204x Notebook Typ 2609 ersteigert, leider fährt der Rechner das XP Betriebssystem nicht hoch, Schlosssymbol wird angezeigt, er verlangt nach ein code 7 Stellig, ich kann nichts machen Wer kann mir schnellstens helfen! Wer hat einen passenden code für mich Phonix Bios 4.0 Release 6.0. Kann damit irgendeiner etwas anfangen!!! Vielen Dank für eure Hilfe Peter
Wednesday, December 16th 2009 at 11:33 am
JUST THANKS VICTOR IS BOSSMAN THANKS
Thursday, December 17th 2009 at 2:24 am
Can anyone please supply a picture of the connections to the eeprom on a TP R40. Also do they need to be soldered or can I have someone hold them on the eeprom. I have all the hardware and still cannot get results.
Pleease any help greatly appreciated
Sunday, December 20th 2009 at 1:42 pm
Hey did any of you guys think to a socket somewhere on the back to save opening the laptop for future convienance?
I just took the three soldered wires and soldered them to a miniture plug and taped it and fed the wires to the mem slot area,so if it happens again? alls I do is open the mem cover and plug it into the gizzmo reader.
IBM A30,the chip is under the PCMCIA rack slot.
Sunday, December 20th 2009 at 2:28 pm
Atmel Chip at the bottom of this page in PDF format.
http://www.datasheetcatalog.com/datasheets_pdf/A/T/2/4/AT24RF08.shtml
Tuesday, December 22nd 2009 at 4:38 pm
I just followed all the instructions and it worked first time.
THANK YOU VERY, VERY MUCH!!!
How did you ever manage to work that out? Very impressive.
Wednesday, December 23rd 2009 at 2:53 am
I’ve noticed that some of you guys get the error…”Eprom not found” or words to that effct?
I had this also and switched to another computer and everything went fine,found the password and poked it in…this worked.
I’m assuming on my other computer that there was a conflict on my COM ports? and this is why I was getting the error of”Eprom not found”.
Thursday, December 24th 2009 at 5:30 pm
how do i use the software i got everything wired up i have a r40 when i type in r24rf08 bump.bin in the dos promt i hook up all wires and i get nothing no file made
Monday, January 4th 2010 at 11:57 am
Is there a posable that u can install your operating system even due you are incounter of this problem, ibm thinkpad superior password crc error… i need some detail on how to survive this problem i do not know what are the posable solutions for this problem…
Friday, January 8th 2010 at 3:50 pm
I have a Lenovo G530 444624U that has a HDD password lock before post. I have the bios password. My question is will this process work on this 2008 machine? I tried taking the 250gig HD out and tried reading it however it will not run it is locked down. Any ideas? Thank you in advance.
Friday, January 15th 2010 at 12:22 am
hello i ve not serial port on my pc.
-It is possible use an USB to RS232 PORT SERIE ADAPTATER CABLE ??
Have somebody experience this?
i have a 1024 dump.bin file, i openned with the IBM pass lite but didn t recognize anything?
please help
Saturday, January 16th 2010 at 1:53 pm
[...] einfach: http://sodoityourself.com/hacking-ib…bios-password/ Ne sry glaube kaum dass da ein Master existiert…wre ja auch dmlich… __________________ [...]
Saturday, January 16th 2010 at 7:27 pm
I successfully dump the contents of the chip. But, when I view the contents the password it
appears to be a combination of conrtol characters. The Hex Values are in 0×330 are as follows.
22 18 03 1f 88 04 26 02
The ascii portion (if it were readable looks like this)
. . . . . . . . ” . . . ^ . & .
can anyone help me with this? is there a way to write a password to the chip so it
can be typed in on the keyboard?
Thanks
Sunday, January 17th 2010 at 12:12 am
As the code is on the Atmel 24RF08 chip, would it be possible to replace this with one of another board? I have my old R50e motherboard which I know has no password set
Sunday, January 17th 2010 at 2:12 pm
[...] you have to short a chip, however i don’t know if this method will work on ibms ,take alook at this http://sodoityourself.com/hacking-ib…bios-password/ __________________ if in doubt ,google [...]
Sunday, January 17th 2010 at 4:37 pm
The guys are right about the 24RF08 chip on the R50e it IS where the password is stored. I have been very lucky MANY THANKS YOU GUYS I changed the above chip from an old motherboard and SUCCESS! I came up with a simple tool for de-soldering the chip without damage will post it at: http://www.paulbg.com/soldertip.html ASAP.
Wednesday, January 20th 2010 at 11:21 am
Is there an easier way to do this when one hasn’t got an RS-232 port?
Thursday, January 21st 2010 at 2:13 am
funciona para la t30 y donde encuentro el chip en este modelo
Thursday, January 21st 2010 at 2:14 am
donde se encuntra esl chip en la t30
Thursday, January 21st 2010 at 8:49 pm
HI
I MADE THE CIRCUIT AS GUIDED FOR MY T61 TP, BUT WHEN I RUN THE DUMP COMMAND IT SAYS BUS ERROR, WHAT IS WRONG COULD ANY ONY ONE TELL ME THAT, I HAVE CONNECTED THE WIRES ON SERIAL PORT AS PER THE DIAGRAM, CONNECTED THE ZENER DIODE GROUND + THE PIN MARKED NUMBER 1 ON THE SERIAL PORT TO THE OUTER STEEL BODY OF THE SERIAL PORT. AND THE GROUND ON THE EPROM IS CONNECTED TO THE SCREW SURFACE ON THE PCI BOARD OF LAPTOP FRO WHERE IT IS THEN CONNECTED TO THE GROUND OF THE ZENER DIODE CIRCUIT WE MADE. ANY THING WRON I HAVE DONE I HAVE TRIED A LOT OF TIME BUT IT SAY THE SAME BUS ERROR. PLEASE HELP DUMMY HERE. THANKX
Tuesday, January 26th 2010 at 2:40 am
Hello! I built the hardware and tested all connections. Loaded the software on technician laptop. Tripple checked the connections on both ends of the board. All seemed to go fine, however upon press ing enter to iniate the dump the IBM Pass 2.0 Lite came up on it’s own with x0x and a blinking cursor. I waited to see if anything developed but no luck. I went into the directory and found dump.bin had zero bytes of data. Connections on the chip are perfect (done under 10x magnification with soldering station). I pulled the cmos battery, and main battery for 24 hr. however got same result again. The laptop is a Thinkpad T42 with the exact layout as you describe. I am baffled as to what I am doing wrong. I would appreciate any help you can give me. Many have used your system successfuly so I must have done something wrong. Phil
Thursday, January 28th 2010 at 3:00 am
Props to you’re tutorial, but this is definitely not for electronic newbies.
Can’t you post more pictures and better instructions to the Soldering the ATMEL 24RF08 Chip reader steps?
What the hell is a chip reader? Or any picture about where the wires you soldered to the AMTEL chip ends up going into? For ex. the serial port and how everything is just put together in the end.
People who say this are easy obv. have engineering background or are just pure genius.
Sunday, January 31st 2010 at 4:02 am
Hi, I was a bit rough with the soldering and broke one leg off and it can’t be resoldered, can you think of any way out of the dilemma??
Monday, February 1st 2010 at 8:02 pm
Hi
Thanks a lot!!! It took some hard work but I managed to make my lappy IBM R40e work. Thanks again.
Monday, February 1st 2010 at 8:34 pm
I were able to make it work first time. If someone is not able 2 do it then pls read instructions very carefully at least thrice. Its not very difficult all u need is patience and be very careful while making circuit with 2 z diodes and 2 resistors. Ensure that the connections r as directed otherwise u might harm u lappy. Double check every thing. Remember that u need 2 different software one is to read the eeprom and other ibmpass lite to reveal the password from the .bin file created through the first software both available free of cost on 1 website. Thanks. Gopi Batra Delhi
Tuesday, February 2nd 2010 at 4:39 am
I need clear suggestion / move for the issue of Bios Password Lost in Laptop….
Tuesday, February 2nd 2010 at 8:55 pm
Worked! Created the circuit and read the Atmel 24R0CN033N found below the cpu under WIFI card of my T41 Laptop. Thask excellant toutorial. Will send some pics I took of the Atmel Chip, Wires soldered to it, and of my Reader.
Friday, February 5th 2010 at 8:59 pm
I had a thought or two before starting this project. I had in my hands a Classic Thinkpad X40 recycled from a corporate.
After purhcasing needed zeneds and diods, i spend a while with this, but it was a great fun!
Especially when the eeprom was on the “dark” side of the MB. And the DB9 shematics were otherwayround. Newertheless I got a working X40.
It´s a thrill to learn something new!
Monday, February 8th 2010 at 3:33 am
Hello i have a T400 , anyone now what chip use the bios?
Saturday, February 13th 2010 at 12:59 am
Thanks a lot for this tutorial. It worked over my T40 thinkpad. By the way, if you search for the datasheet of theAtmel chipyou’ll discover the GND of itself. I used that point for ground and it worked fine
Wednesday, February 17th 2010 at 6:59 am
I purchased twelve A21m two years ago from a local college. Not all of them had passwords in them. I figured it didn’t matter because there was nothing in the Bios that needed changing.
They all worked great until the cmos battery died in the five that did have passwords. The bios is locked so I can’t get in to reset the date and time for it to complete the boot.
I do not want to take all five of these apart as it seems the A21m has the chip on the bottom of the MB.
Any suggestions. I tried a utility last year when the first one died but had no luck.
email me jimates at thejmart dot com.
Tuesday, February 23rd 2010 at 6:03 pm
I was able to get my supervisor password for IBM T60 make just on first try. My friend Hassan from Bangladesh, Lakshmipur, had purchased this IBM from a second hald laptop dealer after month it got locked when he opned the laptop to change the ram, since he did not know the actual password he went to the same dealer and had tried in so many places, not even a single laptop repair shop was left unturned, they all demanded USD 50 or 100 to clear the supervisor password but, after few days they will call and tell “Sorry boss” you can take your laptop back. He even took the laptop to the Lenovo IBM workshop, they informed him that they will check and call, after two days they called and asked to pay USD700 and replace the MB as nothing can be done to clear the supervisor password they told that it is a MISSION IMPOSSIBLE.
THANKS TO THIS SITE AND THE ADMIN the instructions given is excellent and very clear. If someone is not able to do it then please read instructions very carefully at least thrice. Its not very difficult all you need is patience and be very careful while making circuit with 2 z diodes and 2 resistors. Ensure that the connections are as directed otherwise you might harm the laptop. Double check every thing. Remember that you need 2 different software one is to read the eeprom and other ibmpass lite to reveal the password from the .bin file created through the first software both available free of cost on this site.
Wednesday, February 24th 2010 at 3:26 am
Dear helper - silly question, but I have a T30, that is erroring with the 4 beep codes for the security chip problem - can this be resolved by reloading the eeprom f/w?
If so, can it be done with thissoftware if I make the gadget?
Many Thanks
John
Wednesday, February 24th 2010 at 12:59 pm
Hi Guys
I have a client that has a t42 and it looks like im gonna have to do this for him.
my question is, i see in the diagrams that it is connected with cables and not direct the diods and resistors. what cable was used? ad can it be done directly to the diodes and resistors? would be great to get a pic of how they actualy connect to the rs232 aswell.
Thanks
dan
Wednesday, February 24th 2010 at 1:29 pm
Also does anyone know what will happen if it is done without diodes and resistors?
Dan
Monday, March 1st 2010 at 4:30 pm
Sorry for my poor english …
I’ve got a chinese X61 with qwerty keyboard, everythink worked well, but when i try to convert the HEX value, it give me this at line 330 :«k£0qIÜ (with a space before )
and with AA on, the equivalent is ” B 9 ” (with 4 spaces before)
Question : is it because the password had been registered with a chinese keyboard ?
Is there any possibility to convert this Hex value, to send it logging on a qwerty KB ?
too hard for me, please help … thank you very much
From Paris, France Really Sorry for my english
Wednesday, March 3rd 2010 at 10:56 am
Hi,
I have same problem of my T400!
The value at 0×330 lines is 6′ (with space line before).
please help.
Wednesday, March 3rd 2010 at 2:33 pm
Thanks for this. I have just made this and successfully recovered a password for TP R40. It only cost me AU$15 for all the parts, which saves getting another motherboard.
To KWEB & nino,
Just make sure that the translation if “OFF”, I had that problem until I realised that the translation was on.
Thursday, March 4th 2010 at 5:43 pm
Allways same problem with X61 from China :
0×330 -> 00 00 00 00 00 00 00 00 - 8f ab 6b a3 30 71 49 dc
That mean in scancode mode i obtain this result :
Off: «k£0qIÜ
On: B 9
Question : Is it possible to enter ”Ü” with a qwerty KB ? and is it normal to choose translation OFF ?
Thursday, March 4th 2010 at 10:21 pm
other question, is it possible to modify the .bin deleting the password and replacing by “00″ hex value at line 0×330 and 0×340 ?
Friday, March 5th 2010 at 5:47 am
i use ibm r50e.now i have problem to acces window becouse my notebook need security password.i dont know that.its hapen since my ibm battery damage and i always turn off my notebook without shut down.what i do,i just switch off the power supply.now after a few day when i turn on my notebook yhe lock icon come out and i have to fill the password to open the security cord.
really really need your help.pls
Sunday, March 7th 2010 at 5:43 pm
Hello,
Thanks for the helpful Information.
I have an Ibm Thinkcentre here and the bios is locked i can not save any settings because someone tried to update the bios an the Pc wont boot.
I have found the security chip its an 33-4c-S2AE and i found a Datasheet too.
http://pdf1.alldatasheet.com/datasheet-pdf/view/170451/SST/SST25LF040A-33-4C-S2AE.html
Can someone please tell me if the software works for this chip too and is the wire the same?
many thanks
Wednesday, March 10th 2010 at 6:45 pm
[...] had to change the planar (the notebook equivalent of the motherboard.) Followed the instructions on SoDoItYourself and constructed a serial port interface, downloaded the software and I was very quickly able to get [...]
Thursday, March 11th 2010 at 8:29 pm
This does work! I just tried it on my R40 & T20 and got the password like a charm follow instructions exact and you will have the password in no time! (I used all parts exactly)
Friday, March 12th 2010 at 11:03 pm
I can’t believe it. This actually worked for me. I was somewhat skeptical, but patience, patience, patience. Some observations:
* I had a Thinkpad 600e I bought off eBay that reported the 161, 168 error codes in BIOS and with the flying ‘duck’.
* Hitting Enter at the first BIOS prompt for a supervisor pwd results in OK, but it is not (OK). You can’t get past the flying duck without a supervisor password.
* The security IC was a 14-pin 24RF08CT installed under the CPU module.
* I had to get a very fine soldering tip PTJ7 (0.01″) for my Weller Soldering Pencil (TC201).
* It was very tricky to get the (30 gauge) wires soldered on the pins as the pins are VERY close together (0.2″) on the 14-pin IC (I’m sure this task would be easier with the 8-pin 24RFC08 IC.)
* I have a very strong magnifying glass and strong light to inspect my soldering prior to power-up.
* I hard-wired the power directly to the IC as well so I didn’t have to reassemble the laptop.
* I kept coming back to search the discussion forum comments and someone, somewhere ran into the same hurdles I did, but the answers to the comments worked for me to.
Great job! Thank you so much to providing this level of detail. It took me about 3 weeks elapsed time, but I am one happy camper!
Jacko
Saturday, March 20th 2010 at 11:50 pm
hello.does anybody know if this solution works for asus x50gl notebook?i forgot my supervisor password. i went to a service with the laptop and they somehow managed to make it boot.now it’s working but i can’t acces bios to change settings and the system time resets on every reboot.
Sunday, March 21st 2010 at 11:36 pm
Hello everyone!
Firstly thanks for your guide! I have a problem with my T500 that hasn’t been solved:
At first I could boot the machine but could not do any advanced changes in the bios.
After calling Lenovo support they advised to remove the time-date battery and insert it again. After this it completely locked up. Previously I saw in the bios that the supervisor password was set but encryption was disabled. All other password were disabled as well.
Now with your guide I assembled this reader and read succesfully the chip. After analyzing with ibmpass I see only zero’s at 0×330.
Is it required to enter the bios that the password will show up?
What to do with completely locked-up machines?
Greetings and thanks in advance.
Tuesday, March 23rd 2010 at 9:22 pm
@ coxi
you need to use a software like KillCMOS, it s the best way to clean your CMOS.
Tuesday, March 23rd 2010 at 10:06 pm
For R32 searchers, I found the little sucker, it is an 8 pins chip located very very hidden nearby the left side of the cmos battery or to the right side of the pcmcia slot
Thursday, March 25th 2010 at 9:39 pm
For all who got the 0271 error check date and time settings, it means the date or time are out of range (range valid is 1991 to 2099). This occurs when the cmos battery is completely discharged. Replace the cmos battery and try the procedure again. For replacing the cmos battery use any of lithium 3V battery (probably you need to soldering the + - outs into the mainboard connector)
Tuesday, March 30th 2010 at 12:27 pm
when i solder the wires in place, my tp T40 dosent display, en when i remove the connevtion from the chip, it displays to the password screen, is their sm thing wrong, am sure i Did it by the book… any one knows of a way around this?
Tuesday, March 30th 2010 at 3:34 pm
Thanks very much for this. Worked great for my old T20.
Issues I encountered:
1. The chip in the T20 is the 14 pin version, and is under the RAM cover.
2. “Eeprom not available”- poor connection to the chip, or no ground (what I thought was ground turned out not to be).
3. To get the password to show in the IBMPass program, you have to click the A->A button in the top left.
Thanks!
Simon
Wednesday, March 31st 2010 at 6:51 pm
hello
i have x40
i have done every thing
dirgram is good
but its giveing the error
168:0
170:128
and then it says done
when i go to the directory there is a file created name 02.ob
i open it in ibmpass softwre
but there is nouthing read able…dose anybody help me what should i do next
i have connected correct atmcl
Thursday, April 1st 2010 at 10:00 am
saam again
i done every thing , but it dose not read the password…..it says
wÿ
Saturday, April 3rd 2010 at 1:04 pm
Hi,
I’m interested in trying this.
Does it work for the standard power-on password ? or just for the supervisor one ?
(or does it reveal both)
Would this work if you had a power-on password set, but not a supervisor one ?
Also, do you need to fully enter the bios screen before running this (or is being at the password prompt enough ?)
Thanks
Sunday, April 4th 2010 at 4:58 pm
believe it or not i was able to erase the password on the ibm r40, when i was soldering SDL and SDA i put too much solder and fused both pins together, then i turned on the pc, and dead, nothing,, then i cleaned the mess i created and turned on the laptop, and went to the bios and boom! password gone!!
try it for yourselves!
Wednesday, April 7th 2010 at 11:39 am
i removed the power up password on IBM TP R40 not by using this method but by putting one dipswitch on the motherboard to down position. i then entered bios and set power up password to none. power down dipswitch back to up position
Saturday, April 10th 2010 at 3:05 am
I followed the instructions here and successfully created the dump file from the ATMEL chip on a X23. When I went in to IBMPass and read it, it was gibberish. After enabling translation, the characters at 0×330 were readable. The only problem is that what appears is “9-QQ” (without the quotes). When I tried to type this in to the X23, it would not accept the “-”. So it seems special characters aren’t allowed for the password, yet there it is, in the dump file, at the right location. Any ideas?
Saturday, April 10th 2010 at 3:46 am
Update to my last post: This time, I disconnected the CMOS battery prior to start up and left it disconnected. I started up the system, hit F1, waited and then did the dump. This time, at 0×330, was a different set of characters. I typed this in and it worked! So if you are having success getting the dump, but the data you find(after clicking the translation enable button in IBMpass) doesn’t work as a password, try unhooking the CMOS battery.
Tuesday, April 13th 2010 at 4:37 am
Hi I have a lenovo thinkpad R500 and I get the lock and can not remember the password this can be done to my notebook too.
regards
Tuesday, April 13th 2010 at 5:57 am
This worked great on my T42, thanks!
If you have problems w/ “EEPROM NOT AVAILABLE”
- don’t panic, check your connections with the diagram to make sure it correct
- and make sure resistors/diodes is correct
If you cannot read a dump.bin file
- try to switch button “AA on/off” at top on IBMpass 2.0 Lite program
brgrds.
ikorangedane
golden host, cv.
jakarta-palembang
indonesia
Wednesday, April 14th 2010 at 3:47 am
How do I do this procedure for an X41 Think Pad? The ATMEL chip is not the same as in the original post. Thanks
Thursday, April 15th 2010 at 4:59 am
Hi I have a ThinkPad R500 and find the bios chip to unlock my notebook someone knows where you are.
regards
Friday, April 16th 2010 at 8:19 am
I made the chip reader and I have connected the chip reader to my spare PC. I have tried everything I could to get program to dump. Still nothing. I have run the test and found that the SDL and the SCL keeps going in and out after the clock started. Could use some help. Thanks, Bill.
Friday, April 16th 2010 at 1:10 pm
Hi, great post m8.
I want to recover my bios pw from a x30.But where can i find the bios chip on the mobo?
Thanks anyway
Wednesday, April 21st 2010 at 6:19 am
Work like a charm… THANKS
Sunday, April 25th 2010 at 3:24 pm
[...] stuff you need cost about 5 $ at your closest radio shack type of store. Also you need a spare PC with a serial [...]
Sunday, April 25th 2010 at 8:29 pm
AWESOME!!! Worked like a charm.
Wednesday, April 28th 2010 at 7:30 am
[...] (daca o ai pe aceasta poti intra in BIOS si scoti orice alta parola) se poate recupera si asa: http://sodoityourself.com/hacking-ib…bios-password/ am verificat (pe un R51) si merge [...]
Monday, May 3rd 2010 at 11:08 pm
عندي حاسوب محمول من نوع (IBM ( type 2645
أبحث عن bios password
est ce qu’il ya quelqu’un qui peut me donner la solution merci
Tuesday, May 4th 2010 at 11:36 am
I have ibm thinkpad A31 laptop, i open my laptop but i didn’t find atmel 24rfc8 eprom ic for reset bios password in this model which nember is the eprom ic anybody tell me please……………
Tuesday, May 4th 2010 at 4:28 pm
I need help, because I have an IBM Thinkpad and everytime I turn it on, it has a hand with an X across it, a lock on it and 3 X’s. I’m trying to figure out the default password for my R51 Thinkpad the 2888 series.
Wednesday, May 12th 2010 at 12:34 am
hi anyone knows how to do for a blocked R500 lenovo supervisor password.
regards
Saturday, May 15th 2010 at 2:10 pm
hi there, i got problem with my t43..
i forgot the password..,i have no idea to follow your method because everythings difference..actually this is my first time facing problem like this..hope u can help and guide me the way to solve my problem…your cooperation are highly appreciated
Monday, May 17th 2010 at 1:19 am
I tried to dismantle a TP T61p but could not find the ATMEL chip, and ended up busting the display somehow. I don’t know what exactly happened but the screen seems to be getting power but remains blank, the usual ThinkPad logo no longer shows up. Did I fry the video card in the process? Or is it just a connection that went loose? I have no idea!… Any suggestions?
Wednesday, May 26th 2010 at 5:16 pm
firstly sorry for my English. secondly hello.
I have an IBM t41 worked up a month ago, I installed and reinstalled windows 3 times in two years (since I bought). started to reboot and tried to reinstall the OS and the next second to display error and it asks password. I followed the steps described by you and show my f 0 * 330 2. I tried but … Please help me.
Basil yours.
Wednesday, May 26th 2010 at 6:10 pm
Hello people!
A question,
IBM T22 900Mhz 256ram
R30 1000Mhz 128ram
Can anyone tell me which is the one to keep and which to get rid off?
T22 is faster and plays video better but it’s case is weak and has cracked on right side.
R30 seems significantly slower with videos, very stop start not sure if just because of 1/2ram, but is very good structurally.
Thanks!
Thursday, May 27th 2010 at 9:06 am
hello.
I have an IBM t41 worked up a month ago, I installed and reinstalled windows 3 times in two years (since I bought). started to reboot and tried to reinstall the OS and the next second to display error and it asks password. I followed the steps described by you and show my 0 * 330 f 2. I tried but … Please help me.
Basil yours.
I need help
Monday, May 31st 2010 at 8:38 pm
Hi Guys,
Do You know if this procedure will work with Thinkpad X301 ??
Does anybody solve problem with x301 password ?
Tuesday, June 1st 2010 at 6:38 am
hello.
I have an IBM t41 worked up a month ago, I installed and reinstalled windows 3 times in two years (since I bought). started to reboot and tried to reinstall the OS and the next second to display error and it asks password. I followed the steps described by you and show my 0 * 330 f 2. I tried but … Please help me.
Friday, June 4th 2010 at 1:55 pm
Hi all
I need to know if there is someone in the Toronto (Canada) area that might have a Key Finder rady to work that would be willing to give a hand for a T22.
Preference would be given to someone with the Key Maker 9A USB as it seems a lot easier to use.
I live downtown, close to the City Hall and I have severe travel restrictions so please let me also know your whereabouts to see if I can reach you or you can meet me in the City core.
Please let me know.
All the best
Friday, June 4th 2010 at 8:59 pm
i can´t use dos , so I´ve typed cmd … then comes dos …
c:\documents and settings\pc1>
what shall I do next to find the files installed ?
Don`t know type dos …
someone could please help me …
Sunday, June 6th 2010 at 12:16 pm
Hello can someone tell me how to write to the chip with this circuit because all i keep getting is error at line…errors
Any help would be great
Thanks
Wednesday, June 23rd 2010 at 1:25 am
[...] unless you have a high level of computer hardware knowledge and ability. The instructions are at; http://sodoityourself.com/hacking-ib…bios-password/ , otherwise take it to an IBM repair facility and have them do it for [...]
Saturday, June 26th 2010 at 9:17 am
Hi on my Chip is: ATMEL 24RF08CN and the number 0350.Can i read the SVP?
Wednesday, June 30th 2010 at 8:18 pm
Hi!
I have T30 (secure chip?) and it ask Password when try to bios or normal start. I have readed Atmel and I find password but it wont work when I try to input it in field? Do I need to write something back to Atmel also (remove password in hexbumb?) Please help.
Thursday, July 15th 2010 at 6:43 pm
MINE WAS DAVID!!! T27 Try that first.. the T27 is at the memory bottom leg is one and skip one leg and the other is right above.. I used a pic programmer I had for reading Xbox eeprom..not even sure the value,… experiment.. If it say error reverse the 2.. ground can go anywhere
Monday, July 19th 2010 at 11:35 am
May sound silly but how is it possible that so many people wind up with TPs of which they don’t have the Supervisor password.
If it is your employer’s TP you are likely not to know the password and if you buy it used and it is without password it is likely stolen. IBM better updates the technology to put the serial memory in the PCB itself or a UART part such that is has no RxTx lines on the outside.
Tuesday, July 20th 2010 at 1:17 pm
trying this method I’ve broken one leg of 24rf08
And now I bought new 24rf08 and now I need a dump to put it
Do any of you have to dump my laptop
IBM R50e
Type 1834-EG1
S / N 99-VXWK6 05/04
Please !
Tuesday, July 20th 2010 at 1:21 pm
Yes and i need the dump for
R50e
Please give me
Just send me the file dump.bin for my R50e
Dump.bin can be with password but i will find password with IBM Pass Lite 2.0
Thursday, July 22nd 2010 at 4:45 pm
okay guys i found i new way to reset the pass with only a screwdriver …
will try to make a site with a tutorial to reset the tmp chip .. i think it works on every ibm notebook
here is a picture from an IBM X41 tablet i reseted the pass today
http://ug1.kw.cx/ug/0257/1549/123784929_full,r,470×470.jpg
you have to put the screwdriver between the 2 pins to contact them .. and now power on ya machine and go to the bios … you will receive a message with an security chip error or something like that
this chip was on the bottom of the mainboard … i think the T Notebooks (T40 , 42 , 43 , R50, R51 have the chip under the touchpad
will share this here for ya guys
i trade with used computers so you have to try many thigs to delete passwords ^^
The same way to delet passwords on DELL (D610, D600, and many more)
greetz Adrian
Friday, July 23rd 2010 at 7:10 pm
thankyou… it work fine for me…. my notebook is reborn!!!
Sunday, July 25th 2010 at 2:02 am
hi guys,
I understand all the schematics. My problem is how can i connect it to a spare pc.
As i understand it, it will connect using the Serial Port 9 pin Female. But how can i connect it with those connections at the other end. i actually have 2 female serial port, one is mouse adapter and the other one is d sub connector. I just cannot figure out how to connect it to the spare pc. Somebody help me please.
TY
albert
Monday, July 26th 2010 at 3:35 pm
Can this be done if the thinkpad does not have its ddr memory inserted?
Monday, July 26th 2010 at 4:32 pm
i think x41 tablet hast onboard memory
Tuesday, August 3rd 2010 at 6:24 pm
Albert, you have to cut Serial cable. Strip the rubber coating to expose thin wires. You have to test which ones are # 4, 5, 7, 8 and solder them to the breadboard according to schematic. The female serial plug goes in second computer.
good luck.
Thursday, August 5th 2010 at 3:39 pm
Hi all
i have this error 0271 check Date and time setting IBM thinpad BIOS password. i got a solution over the internet but please if yo cam give me another idea i will be grateful
Saturday, August 7th 2010 at 5:02 pm
it’s very helpful to me, I have a x60 laptop and meet the same trouble.
Sunday, August 8th 2010 at 9:31 am
May sound silly but how is it possible that so many people wind up with TPs of which they don’t have the Supervisor password.
Tuesday, August 10th 2010 at 12:09 am
yea sounds prety gud..thx
Friday, August 13th 2010 at 12:08 am
i can’t break the password on IBM A30 laptop
i want u to send the process in my email :rooboy2009@yahoo.com
Tuesday, August 17th 2010 at 1:13 pm
Hello Dear…………….
I have Think-pad R31 It has supervisor password that i forgot I tried to clear CMOS/BIOS by short circuit with jumper but still it ask me every time to change date and time and not booting. I am really exhausted. Please help me.
jimdanial007@yahoo.com
Hassan
Thursday, August 19th 2010 at 4:50 am
I have R32 IBM think pad but the supervisor password is blocked and I have went to IBM service to check it but can’t help. Could you please guide me how to reset the password? Thanks
Wednesday, August 25th 2010 at 5:53 pm
i used a gateway restore cd, i bought ten ibm thinkpad r40’s i read i would have to gointo repair and i didnt have a ibm windows xp restore so i put in the gateway restore cd i didnt even have to goto repair just put it in went right to windows xp i changed the password like wow because i had been trying all day to bypass everything i read didnt work got lucky i guess it sure saved me alot of trouble
Tuesday, September 7th 2010 at 9:17 pm
The simple machine worked very fine for me. Thanks
Wednesday, September 8th 2010 at 1:19 pm
will this software “rf2408.exe” recognize the connection of “USB to COM port cable”? i dont have any com port in my spare laptop.. i also managed to remove the battery of T42 but nothing happens, still asked for bios password., help and thanks in advance.
Thursday, September 9th 2010 at 10:56 am
Thank you! I restored my T23. Great work, it is very useful.
Friday, September 10th 2010 at 1:57 pm
i have already thissolution with w24rf08 registered.
now i need for latest solution for ibm centrino .core duo . core 2 duo
if you r have any latest solution then plz mail me.
Friday, September 10th 2010 at 10:37 pm
Will you know the way to hack W510 BIOS SUPOR passwords?
cheers
Monday, September 13th 2010 at 3:30 pm
my IBM T42 bios password has been decoded,.. thanks a lot to the author.. even 4.5 volts zener diode still works. but my HDD password is not same to BIOS password. bad luck! have any of you guys know how to decode password from HDD? it would be a great help. it is difficult to buy 2.5 IDE HDD right now, most of them already use SATA cable.
Monday, September 13th 2010 at 8:39 pm
Has anybody done this with a X60 Tablet (or a regular X60)? If so, maybe we can get in touch!
Saturday, October 9th 2010 at 3:11 pm
I request Ur service / advice/help for remove supervisory password of my laptop. Ican pay pl contct me on the Mobile or leave Ur Mobile No by email. So that Ican call You for discuss the issue
gs
Saturday, October 30th 2010 at 10:37 pm
I tried on my T30 but the tp.bin file is only 128 Bytes as opposed to 1KB. Is this expected? If so, which characters are the password?
Friday, November 19th 2010 at 7:57 pm
jala con madre muy recomendable gracias te debo como 250$$$ o sea la mitad de lo que voy a cobrar jejejejej
Friday, November 19th 2010 at 8:15 pm
Anyone out there that can help me with SVP i dont now anything about teknic
so it must be some password ore a way to get the old one out of the bios Ore the Power on PW I tryed to remove the back up bat it dint help
thanks
zagget@gmail.com
Saturday, November 20th 2010 at 2:16 am
[...] sorry i found the website but its for IBM http://sodoityourself.com/hacking-ib…bios-password/ i also found this dunno it that helps http://www.go4expert.com/forums/showthread.php?t=114 if the [...]
Saturday, November 20th 2010 at 1:16 pm
HI Victor,
Excellent service!
Trying to recover my T40 bios password but faced problems……
I did build your circuit corectly but had to connect it via the printer port of my Technican PC a T42 which has no COM1 connector. Is this a problem?
Anyhow it keeps saying: circuit not found / bus error
The SDA/SCL output remains on 1.08/1.75 Volts despite clock switching with ITESTER. Is the COM1/printer converter the cause? Should I use a desktop as master PC?
many thanks
Hans / the Netherlands
Saturday, November 20th 2010 at 1:20 pm
I have Think-pad R51 1830 BMG
Thanks a lot for this. Worked great for my old T51.
I made an electronic circuit on breadboard and connected it to com1 to another pc.
My svp was “CO2X077″ .
if you have any question , i will be happy to answer .
Thursday, November 25th 2010 at 8:02 pm
please tell me how to reset my IBM THINKPAD A30 Password please help
Wednesday, December 1st 2010 at 3:05 am
Nice article and i can see many people got help.
<<>> Actually i didn’t, it was my father
i need to unlock IBM thinkpad Z60m
Wednesday, December 1st 2010 at 3:07 am
DON’T BUY IBM LAPTOPS
Sunday, December 5th 2010 at 4:22 pm
i made the max232interface but showing eprom not available, pls help
mine is R51, i crosschecked the ic and connections all seems perfect
plx help is there any comport settings to check?
Monday, December 6th 2010 at 12:17 pm
Thanks for the hack info.
Got problem like EEPROM not found, because I connect SDL SCA before turned on the laptop.
So I cut the cables, and re-connect it when laptop is ready.
1. Turn on your ThinkPad with all the wiring you just soldered.
(wires, only wires. Dont connect directly using the wires from your schematic)
2. Press F1 during the startup to enter the BIOS.
3. Wait untill all activity stops, blinking HDD leds and such.
4. Connect the ATMEL Chip reader. GND first then the SDA and SCL. (connect the wires in order)
5. Now go to your spare PC and Hit enter on the command prompt.
Wednesday, December 15th 2010 at 5:09 am
HI IT WORKS WITH R51. THANKS A LOT
:)
Wednesday, December 15th 2010 at 12:08 pm
millions of thanks, it works perfectly
T41
Thursday, December 16th 2010 at 2:56 am
Does anyone know if this works for the T61p? My ATMEL chip reads
AT97SC3203
1.2.0.09
7F0208
0746 X PH
The chip has 28 points. Please help
Monday, December 20th 2010 at 5:30 pm
I have an IBM thinkpad R51 that i haven’t use in a very long time i forgot the bioss password. can anyone tell me how to access my old password or disable it?
Wednesday, December 22nd 2010 at 1:21 am
can the “BUSTED” ATMEL 24RF08 Chip be replaced?
hello everybody i have this problem with my IBM R50e. my tech friend tried to revive my beloved R50e…we have seen this forum” Hacking IBM Thinkpad Bios Password” and did follow everything…. but it seems that the so called ATMEL 24RF08 Chip was accidentally short circuited… and when he booted it up again…. it just beeped several times and no more display came out…. can somebody help me with this please… thanks and mMerry XMAS to all.
Thursday, December 23rd 2010 at 8:43 pm
It worked for me - i managed to read it from an old ibm a21p
Friday, December 24th 2010 at 11:34 am
My x200 got busted cause i flashed the Bios without removing the SVP and now i looks like it gots into a TCPA lock
Is there a way to rewrite the Bios properly?
Thanks Daniel
Friday, January 7th 2011 at 5:31 am
Here’s a way to reset the BIOS SPV password for an IBM Thinkpad T30. NO NEED FOR ALL THAT WELDING AND ELECTRONIC CIRCUITRY STUFF! KEEP IT SIMPLE! Thanks to the message from El Professor on May 4th, 2008, on this thread, for sparking the idea, further confirmed by Adrian on July 22, 2010.
Open up the computer to find the 8-pin ATMEL 24RF08 chip. On the T30, it is under the memory slot closest to the edge of the computer, towards the left.
Before turning on the computer, short-circuit pins 3 and 4 with any metal object. On the T30, with the memory slots close to you and the display hinge away from you, these pins are the two top-right on the chip. I used an open paper clip, insulated at one end just so I would not touch the metal during the procedure.
Turn on the computer.
When the boot screen comes up, press F1.
When you see the small lock, simply press Enter. (Apparently, you may have to repeat pressing F1 and Enter once more - I did not have to).
You are now on the Setup Menu (remember that you are still short-circuiting pins 3 and 4).
Go to the Password section. If you see that the Supervisor Password is Enabled, press the up or down keys until you see that it becomes Disabled (I did not have to do this as it was already marked Disabled).
Once you see that it is disabled, select it and it will ask you for a new password.
At this moment, remove the object that is causing the short-circuit, type in a new password (e.g. 123456) and retype it in the confirmation field.
Save and exit. You have now reset the password to whatever value you entered.
The computer will reboot.
At this point, you may wish to return to the BIOS and disable the SPV password if you don’t care to have a password set.
I do not know if it is possible to simplify this procedure and simply disable the password and not set a new one. I did not try that. But this procedure sure beats dumping memory.
Wednesday, January 12th 2011 at 4:05 am
Hi, I just built a simple programmer, and run r24rf08, I get a file, r40dump.bin in my computer,
but when I run IBMPASS, I found the all data are Zreo in the file. Could you tell me how to solve this problem? I also have 2 errors message when I press on F1 during the startup to enter the BIOS.
Error 0271 - check date and time setting
Error 0176 - System sercurity.
can you please help me?
Monday, January 17th 2011 at 6:40 am
Hello,
The description and also the little programmes are great. I opend a old T42 and T21. Thank you very much, because they can now further used and go not to the electronic trash. Good for the enviroment
Now some help for the others.
14 Pin Chip is Pin 6 ground and 8 SDA / 10 SCL to connect the self build interface. !Difficult to solder! The 8 Pin Version is Easy to solder on the contacts.
Second result. Please mention in the Guide that you have to press the Translation function in the ibmpass program to see the password. (It is the AA function on top of the results)
Any way a great help that you offer
Thank you very much
Chris
Saturday, January 22nd 2011 at 8:51 am
if any like i have bios master password
can email me his detialz on my email address … i will provide him bios master password
“a_a_lovly@hotmail.com”
Wednesday, February 2nd 2011 at 4:36 pm
Hi friends!, I am from Argentina and I want to take the password of my notebook IBM T43. Would you like to help me please¿?. Thanks. My e-mail is elkartuxeneize@live.com.ar
Friday, February 4th 2011 at 10:45 pm
From Mexico.. It worked like a charm. I love you man, thank you!!
Monday, February 14th 2011 at 2:52 pm
To Le Chameau:
I really want to try this your way. I don’t quite understand the shorting out you are doing though. Did you use 2 separate paper clips, one for each pin, making sure the other end of the clips don’t touch any other metal? I’ve done something similar on a toshiba but was suppose to touch metal, shorting it out. Or are you using one paperclip touching the two pins to each other?
Tuesday, February 15th 2011 at 8:12 am
lenovo t400 flash pinouts please….
Wednesday, February 16th 2011 at 2:25 am
Hey, could someone tell me what’s the password in this picture? I did everything step by step and this is what I got and I’m not so sure if I did right.
http://imageshost.co.uk/show.php/1816_untitled.JPG.html
Please help.
Wednesday, February 16th 2011 at 4:33 am
Me again. If anyone know how to decode the data in the pictures I uploaded please send me an email: tdcharming@yahoo.com.
thanks.
Thursday, February 17th 2011 at 2:42 pm
ibm t43 bios passworr
Saturday, February 19th 2011 at 3:51 am
in the diagram the blue line that goes in the serial port in the 8 slot what wire iss that? can some one please clarify.
Saturday, February 19th 2011 at 6:30 am
I did all the steps for my T42 Thinkpad. And it gave me the password of “fL”, small f and big L. But when I used this password to enter BIOS setup, it never recognise it as right password. Can any one tell me what this reason is?
Thanks!
Sunday, February 20th 2011 at 12:42 pm
My bin file is epmty all zero Please help
Friday, February 25th 2011 at 6:03 pm
Hello All,
I have a locked ThinkPad x300 that my friend sent me. Has anyone tried this with a model as new as the x300?
After searching around it seems like they might have switched to a different type of chip? A SuperIO.
I will be looking into this more soon, and will post what I find out, but if anyone has any pointers, please let me know.
Greg
Monday, February 28th 2011 at 1:29 am
Hey all
DONT SEND UR LAPTOP TO ANYONE U DONT KNOW.
They just want to steal it…. u will never see it again.
And by the way, Dont try to solder in your laptop if u havent done it before…u will be sorry.
Wednesday, March 2nd 2011 at 4:58 am
Hi everyone.
Thanks so much for this site. I’m trying very hard to decipher my T60 SVP, but I’m not very good with schematics, and I don’t really understand the schematics for the interface of the PC8394T.
Can anyone help me with this, and maybe draw a simplified version like in this DIY??
Thank you so much in advance..
Monday, March 7th 2011 at 4:46 am
i need help to hack my t30… im try the diagram in the site and i dont know what worng…
answer my to this mail and ill semd you the pics of my bios and my wirng…
thanks,
billy
Monday, March 7th 2011 at 8:21 pm
Worked great on my t22. Thanks to all.
Tuesday, March 8th 2011 at 7:34 pm
I’m in the process of unlocking my X40 laptop. I found the chip on the bottom side of the mainboard, by the PCMCIA cage. There was also another 2 Atmel chips, one on the bottom and another one at the top of the mainboard. This one is labeled ATMEL AT97SC3201. Some digging on that reference showed that this is the actual BIOS chip, where the BIOS program is installed, but the actual password is stored in the ATMEL R24F08, both of them work in conjunction. To solder the wires, I used small wires and before soldering them, I dipped them in FLUX, also put a tiny bit of FLUX on the legs of the atmel chip to be soldered. Once fluxed, I dipped the wires on melted solder and this “tinned” the wires, making them a lot easier to work with. The tinned wire was then put in position and one touch with the solder iron did a neat connection to the corresponding leg of the atmel chip. I’m now waiting for the resistors and diodes to arrive in order to put together the rest of the asembly. My advise to anyone doing this is to TIN THE WIRES BEFORE ATTEMPTING TO SOLDER.
Wednesday, March 9th 2011 at 11:23 am
Many Thanks it works at my tp21
Wednesday, March 9th 2011 at 3:43 pm
SPV password recovered. Awesome set of instructions!
In my case, I didnt’t solder onto the EEPROM, but instead held the wiring in place with thin masking tape. Using a magnifying glass, was able to press the wires to the EEPROM connections to make good contact.
Didn’t solder the earth either, with a good length of stripped wire wrapped aroung the harddrive chassis.
When at the SPV password prompt, then hit the enter key on the PC running the reader software.
In the IBMPass app. Ensure to click ‘AA on’ (top left of App window) to change the format to readable text.
Many thanks & all the best.
Thursday, March 10th 2011 at 9:34 am
hello I would like that to help me get a universal code for my IBM T20 my bios is locked. thank you in advance
Thursday, March 10th 2011 at 10:08 am
Has anyone hacked the T60 SPV? I’m still trying to understand the schematics for the interface of the PC8394T, but I’m not that experienced with this kind of diagram.
If anyone has hacked the T60 using the PC8394T interface, could I possibly get a picture of your interface? Just to help me understand the schematics..
Thank you in advance
Thursday, March 10th 2011 at 5:31 pm
Hi thankyou for the person who have provided this solution, Great you are the best*
I challenged to my friend that this password will be easily removed by removing the CMOS battery i told and taken this Laptop IBM Thinkpad 570E to my home, i strugled to remove the password, then i found this solution and did the same procedure and worked for 2 dys and finally did the same and got the password and it working
icoudent believe that i can do this this
Thankyou for the solution Dude
Thursday, March 10th 2011 at 6:33 pm
Anybody out there? I split my 240x and on the underside of the motherboard see a AMTEL F 24rfdcn .0007 Is that the right chip, I don’t see any other AMTEL’s.. And I have Radio shack IN4733A 5.1v ZENER Diodes, 5.1v , 49 mA, max pwr disp 1.0W….
is that a suitible sub.
Can’t wait to try to put this together with leads hanging out from bottom of M.B. Should be fun…
J
Thursday, March 10th 2011 at 6:36 pm
Make that a ATMEL F 24RFD8 CN .0007
Saturday, March 12th 2011 at 4:54 pm
I CANT FIND THE ATMEL CHIP WITH THIS 24RF08,THE ONE I SAW IS ATMEL AT97SC3203, AND ITS THE ONLY ATMEL CHIP ON MY LAPTOP,I HAVE RIPPED THE BOARD APART, AND THERE IS NO OTHER CHIP, EXCEPT THIS ONE I SAW ABOVE. pls i need help seriously bcos my laptop is locked and i really need to unlock it.anyone with useful help pls mail me,at kelvinking4life@yahoo.com
Saturday, March 19th 2011 at 2:57 pm
I was also told that you can remove the chip and let sit for 5 min. then re install and this would clear password. Might try this later let you know how it went.
Saturday, March 19th 2011 at 6:36 pm
Yo, un humilde chilenito logre leer la EPROM de mi Lenovo T60 y desencriptar la SUPERVISOR PASSWORD.
Saludos de desde Chile, y gracias por el manual que me ayudo de mucho
Monday, March 21st 2011 at 12:13 pm
hello can i ask you for my lenovo t410i
i wont to restore my old bios password or read
Monday, March 21st 2011 at 12:17 pm
hello can i ask you for my lenovo t410i
i wont to restore my old bios password or read it’s eprom
thank you for all
Friday, March 25th 2011 at 2:00 am
Hi, I have the TP A20M. need help to unlock my computer. appeaser@mail.com. Thanks.
Friday, March 25th 2011 at 2:26 am
boa noite!!! a placa do meu noot é diferente da mesma á cima , por favor como faço p/ desbloquea-lo obg e fica com Deus
Friday, March 25th 2011 at 7:21 pm
Just unlocked my X32! Took me a while because I soldered the 9pin connector incorrectly (as stated in the feedback before). Therefore, watch out - the schematics can be a little missleading if you dont check and compare the numbers on the connectors with the wires you are soldering!
If it works, it works like a charm! Perfect! Thank you!
Saturday, March 26th 2011 at 10:28 pm
Thank you very mutch … worked as a charm for me !!
Wednesday, March 30th 2011 at 6:23 am
I was really happy when I found your page about hacking ibm-bios password. But when I start doing this, i can’t find ATMEL 24RFC8 0446 at my notebook TP T410s, can you help me.. Thanks before. Hendra
Tuesday, April 5th 2011 at 3:40 pm
Password recover and change or remove unknown or forgotten Passwords for ThinkPad™
Repair of CRC Errors for ThinkPad™
I can clear your Supervisor Password even if TPM has been enabled (all ThinkPad models except SL400 and SL500 series).
Mail me at aw@edv-wetzel.de to get instructions.
Wednesday, April 6th 2011 at 4:18 pm
helo dear this was a big effort i appreciate but i need solution for lenove R60. if u can please help or suggest.
thanx
Friday, April 8th 2011 at 12:01 am
Hi. I can’t finf any atmel chip on my board. I found 3 PIC 3253Q (16 leads).
Please help.
Saturday, April 9th 2011 at 9:22 pm
Thanks to this site I managed to get an old T23 working.
I got my 13 year old son to make the circuit and it worked first time.
The only issue I had was that the password contained a letter O and a numeric 0 (zero).
In the password they looked like identical characters. The letter O was code 0b. The numeric 0 (zero) was 11.
Thanks.
Tuesday, April 12th 2011 at 1:41 am
Hi - can I replace the atmel chip from another R50e board that doesn’t have a password?
Thursday, April 14th 2011 at 9:23 am
Dear Daniel can you please tell me what the password is for your T23. Thanks.
Saturday, April 16th 2011 at 1:14 am
Thank you it work like charm in a G40, In a G40 the ATMEL chip is underneath have to remove the motherboard from the case. I use different diode Zener i used the 1N4733.
Saturday, April 16th 2011 at 3:45 pm
plese can u help will this work on the SL510 LENOVO THINKPAD
Sunday, April 17th 2011 at 12:24 am
Hi,
It is impressive job…can i do it for my thinpad t410
Tuesday, April 19th 2011 at 9:31 pm
Can anyone help decode the password from this (everything inside the inverted commas)?
“9 *1+ ,” (nine,space,space,star,one,plus,space,comma). I got the dump successfully, if I’m correct thinking it is HEX code then the values from 0×338 (and repeated in 0×340) are: 0a 87 b1 37 4f 4e 73 33.
Would appreciate if someone can help. I have done this for another laptop in the past but this time it isn’t so simple it seems!
Thursday, April 21st 2011 at 2:02 pm
Bonjour, je n’ai pas de prise db9 sur mon ordinateur comment puis-je relier le montage fais sur mon r51? est-il possible de le faire par prise usb? merc
Friday, April 22nd 2011 at 2:38 pm
j’ai un problemesur mon ordinateur IBM R32 serie, dont un message me demande de regler avant tout la date et l’heure avant son oureture, que faire à propos?
Friday, April 22nd 2011 at 3:06 pm
code 0271 incinnu, d’où la machine ne s’ouvre pas, Marque IBM R32 serie
Friday, April 29th 2011 at 5:10 am
hey folks
i just used the solution from Le Chameau with a T42r
i had to do it 2-3 times and then the password was disabled.
by the way the ATMEL 24RF08 chip is under the wlan card. pin 3 and 4 are at the bottom left.
here is the post from Le Chameau again:
Here’s a way to reset the BIOS SPV password for an IBM Thinkpad T30. NO NEED FOR ALL THAT WELDING AND ELECTRONIC CIRCUITRY STUFF! KEEP IT SIMPLE! Thanks to the message from El Professor on May 4th, 2008, on this thread, for sparking the idea, further confirmed by Adrian on July 22, 2010.
Open up the computer to find the 8-pin ATMEL 24RF08 chip. On the T30, it is under the memory slot closest to the edge of the computer, towards the left.
Before turning on the computer, short-circuit pins 3 and 4 with any metal object. On the T30, with the memory slots close to you and the display hinge away from you, these pins are the two top-right on the chip. I used an open paper clip, insulated at one end just so I would not touch the metal during the procedure.
Turn on the computer.
When the boot screen comes up, press F1.
When you see the small lock, simply press Enter. (Apparently, you may have to repeat pressing F1 and Enter once more - I did not have to).
You are now on the Setup Menu (remember that you are still short-circuiting pins 3 and 4).
Go to the Password section. If you see that the Supervisor Password is Enabled, press the up or down keys until you see that it becomes Disabled (I did not have to do this as it was already marked Disabled).
Once you see that it is disabled, select it and it will ask you for a new password.
At this moment, remove the object that is causing the short-circuit, type in a new password (e.g. 123456) and retype it in the confirmation field.
Save and exit. You have now reset the password to whatever value you entered.
The computer will reboot.
At this point, you may wish to return to the BIOS and disable the SPV password if you don’t care to have a password set.
I do not know if it is possible to simplify this procedure and simply disable the password and not set a new one. I did not try that. But this procedure sure beats dumping memory.
Friday, April 29th 2011 at 9:25 pm
hi i need to know which is the voltage that manages not to burn anything thanks.
Thursday, May 5th 2011 at 9:11 am
Hi
I have T23 IBM Think pad
Will it work on it?
Saturday, May 14th 2011 at 10:09 pm
Hello:
I have 2 errors message when I press on F1 during the startup to enter the BIOS.
Error 0271 - check date and time setting
Error 0176 - System sercurity. The system has been tempered with.
and i put out the battary of bios to empty th charge but same messege comming need password
pls what is password no. ?
tnx
Thursday, May 19th 2011 at 2:43 pm
I have a Question, in the simple schematic in between the two resistors, there’s a blue line going into the 8 pin hole. What is that another wire? is it a copper wire? also is the GRN is that a copper wire as well?
Wednesday, May 25th 2011 at 1:24 pm
j’ai un problemesur mon ordinateur IBM R32 serie, dont un message me demande de regler avant tout la date et l’heure avant son oureture, que faire à propos?
Thursday, May 26th 2011 at 6:09 pm
Hi there
I have Lenovo R61i, and I set up bios password for it, but when I did turn back to default setup it keep asking me password, I try to find bios chip in its motherboard but I could not find it,
Can you help me please?
Monday, May 30th 2011 at 5:27 pm
Hello everybody! I followed yuor suggestions here and there and All of You gave me a very very useful HELP!
I’ve been asked from a very kind friend of mine to reset to zero his laptop fron his former company but…it was locked and super-locked also with safeguard 4.01..This is about my experience with an IBM X41 2525-63G hacking (if I can say so…).Well, I started with a simple removal of the hard drive (a 60 Gb travelstar) because it was partitioned and only 20 gb where left to user and 40 for the company stuff..I connected it to a portable hdd box and I managed to cancel the hidden partition of 40gb in order to format all the available space in one single 60gb..to do it I tryed partition magic 8 but it was too complicated..(and not free..) so I used the software available under Win7that in English should be something like system tools or administration tools..work was done in less than 10 minutes..Second part was tuff.My BIOS was under fingerprint secure and/or under password and no way to access the bios config to install OS by USB or external CD.Thank to “El Professor” I managed to open the X41..Not an easy game..U must be very carefull and gentle (I have available some pic’s at cbern@libero.it).U must unscrew all the screws in the bottom in order to remove keyboard upper frame an after also the mother board itself.The reason is that on thi PC the famous ATMEL etc..is not him but its name (thanks to janko_wodnik..)is P24S08 and is on the lower face of the m.b..Than I choose to perform the procedure with the scredriver (a small one..)and I managed to find a fakir position to be able to keep with one hand the screwdriver into position and with the other switch on the pc, pressing F1 at startup, entering the bios, make the selections inside the menu etc…But in the end, when I saw my password working I felt like a God!!!After that was very simple to put everything together with all the screws in the right holes (Ibm uses the same kind of screws and there are only 3 kind of them,1kind in the botton and 2 inside the pc and so is very eeasy to remember their positions), the thin cables in the right places..then the KB and the screws in the back…At last I find out that the X41 is capable to support Win7 and all the drivers are available (more or less easily..U have to choose the right one expecially for the Wlan..).Thanks again to all of You..and if U need help just write me cbern@libero.it
Saturday, June 4th 2011 at 5:56 pm
Hi is there anyone from Mumbai who can provide me circuit or the password recovery help. I need it urgently. My laptop IBM R50 suddenly start to ask password after RAM upgrade. Please reply me at mahesh_jog@rediffmail.
Thanks in advance.
Monday, June 20th 2011 at 8:07 pm
24RF08 on R30. It´s just 01cm. to the left from the white Memory Slot. You must discover a black tape. If you want, I can send you photos.
Tuesday, June 21st 2011 at 4:51 am
My R30 is model 2656. The ATMEl 24RF08 is to the right if you see the White Memory Slot, under a black tape.
Tuesday, June 21st 2011 at 6:56 am
Hi everyone
how can I findThe ATMEl 24RF08 BOIS chips on Lenovo R61i? Please
cheers
Thursday, June 23rd 2011 at 11:16 am
Hello. Is there a similar solution from HP Compaq 8510p?
Thanks
Thursday, July 14th 2011 at 8:08 pm
Anybody ever tried it with a dockign station as a second computer? I want to unlock a X32 with the help of a X31 with dock but it doesnt work? The circuit works, tried it last time, but had a regular PC as second PC. Do you think its a problem with the power? Can I hook up a battery to the circuit somehow?
Michael
Wednesday, July 20th 2011 at 7:18 am
I have serious problem here.. i am using new TP E420 with toshiba hdd.
Few days ago I set up user and master hd password from bios, but after it was saved I can’t use that same password when I start the laptop. I can’t even enter bios because it will ask the hd password first unless I remove the hdd. Without the hdd, the hd password option in bios is invisible. I’m stuck. Any solution to this? Thanks
Thursday, August 4th 2011 at 9:20 pm
hello every body am here to save all of u from this stress. there is a easy way to unlock ibm.
first solder a wire and grounds on the ibm motherboard.
next turn on the laptop wait 54 seconds then use the grounds and toucher the slc on the 24rf08 chip.
u have to do it like 10 times or more but it will work trust me i pull 8 by my self i figures it out. sometimes the laptop will freez wen u touch the ground on the slc but thats ok just restart thinkpad and do same procedure again
Thursday, August 4th 2011 at 9:23 pm
turn on the laptop press f1 wait 54 seconds as it will change to other super visor password screen to eneter bios u touch the ground on te slc before that screens come on.
Wednesday, August 10th 2011 at 4:46 pm
Please help!!
I managed to read the EEPROM on X61s but the value at line 0×330 is ËJz±ÚôÎ
I have pressed the AA button and altered the translation but I am unable to find a password that I can enter on the keyboard, any ideas. I think that the password maybe encrypted.