[FAQ] IBM ThinkPad Unlock Supervisor Password
Goto page Previous  1, 2, 3, 4, 5, 6, 7  Next  :||:
Networking/Security Forums -> Hardware // Upgrades

Author: noromamai PostPosted: Sun Oct 23, 2005 10:37 pm    Post subject:
thanks for the info. i had a look on my mainboard and it's not exactly the same. i do have a chip there but it reads 'MAX1989 MEE 508' and has 16 legs. Did IBM change the chips they use or did they just stuck it somehwere where one can't find it as easily...

I've included a pic, see here http://www.saikoutokuten.net/r52_chip.jpg

any advice?

Author: allserviceLocation: @your.service PostPosted: Sun Oct 23, 2005 10:45 pm    Post subject:
I think your machine type is different and the board also. The eeprom must be a 8 lead 24RF08. Look again for this chip.

Author: sst39sf020 PostPosted: Sat Nov 05, 2005 4:35 am    Post subject:
can not find the password use IBMpass

Author: allserviceLocation: @your.service PostPosted: Sat Nov 05, 2005 9:09 am    Post subject:
Maybe the password is TCPA encrypted. In this case, the dump must me modified and the eeprom re-programmed. You can send me the dump to see at the email address listed in 24RF08 tools.

bata_1: see the first post in this thread, pal.

all the best

Author: rachido PostPosted: Sun Nov 13, 2005 3:06 am    Post subject: Supervisor Password
Hi ALLservice,
I visited "Joe from Australia" 's web page and I must say, people are positive about his method, isn't that logic?
could you please send me the schematics and software needed to recover a Supervisor Password from a IBM TP T40, that would be a life saver.
the laptop is locked by the SVP in the bios.
please show the solution step by step.
waiting for your reply,

Author: allserviceLocation: @your.service PostPosted: Sun Nov 13, 2005 3:27 pm    Post subject:
I will never start to doubt about what you said before.
You see, my method presented here and the software are absolutely free. The software has been developed to read the eeprom as it is and not to encrypt the data. As a result, you can unlock any TP, how many times you want, whenever you need, free of charge. Smile

If you still don't know how and where, please see the first post in this thread. Download the software from the links mentioned above, install and you'll find 2 schematics to build.

I hope it will be a helpfull post this one.

Author: indirection PostPosted: Wed Dec 21, 2005 12:21 pm    Post subject:
Hi Jvan,

All is not lost my friend. I didn't fancy my chances soldering wires onto the legs of the 14 pin chip either, but i have been successful without needing to. I looked for a clip, but they were VERY expensive, and also i wasn't confident i was even buying the correct thing!!
If you build the simple circuit, as suggested by all service, you only need to 'solder' 3 pins, which can be achieved with a little patience, care, and a prayer or two to a God of your Choosing (or even none at all - seemed to work for me Wink....

You will need the following:
2 pencils
some cellotape
the legs of an unused resister. you just want the wire legs, cut these off a resister that you don't want. each leg should be about 25mm long.
1 simple chip reader circuit.

Solder a resister leg to a length of wire so it can be used as a probe. Cellotape this probe tightly to the end of a pencil so that the wire probe is at right angles to the pencil. You want the wire part of the probe to stick out about 15mm. You now have a probe that can be taped down to your laptop and will stay where itís put. With care and patience, you can tape the pencil to your laptop, so that the wire probe at the end of it is in exactly the right place so that the end of the probe is touching the pin your interested in.

I used two of these Ďpencil-probesí. One for the ground pin, and one for the data pin. The third and final pin (clock) I just held that probe on manually for the few seconds required to read the chip.
It's a delicate operation, but one that is within the skill-set of most people I'd say.

A small but important point is that you want to make your probes out of bits of wire that are not connected to your simple circuit. This is so that you can get all your probes set up without them being connected to the circuit, then connect them to the circuit when the time is right (see below).

The procedure is then:

Connect your simple circuit to your Doctor PC

With the laptop switched off - tape probes in place. Double check to make sure each probe is touching the right pin. At this stage, the probes are not connected to the simple circuit. One tip is that on a t20, t21, t22, the PCB layout is such that you can attach one of the probes to the Ďviaí near pin 6. A Via looks like a circular pad with a hole in the middle of it. You might find it easier to connect your probe to this rather than pin 6.
With the probes in place, it will become obvious that youíre going to need to balance the laptop on its side, so that you can see the screen, and the bottom of the laptop is undisturbed.

power on laptop - wait for all activity to stop. It should boot into its normal password screen.

Attach your simple circuit to your probes (connect ground first). My simple circuit had alligator clips on the end of each wire, so it was just a case of clipping the correct wire from the simple circuit, to the correct probe.

Get the doctor PC ready so that all you will have to do is hit Ďenterí and the reader software will run.

Carefully hold the last probe onto the clock pin (SCL).

Use your nose or big toe to press Ďenterí on doctor PC Ėwait a few seconds until chip has been read. If software complains, then your probes probably arenít connected firmly enough, or you may even have the wrong pin! (shame on you!). Donít panic, its probably just that one of the probes isnít making a good connection.
Try to read the chip again whilst applying a little downward pressure to the probes to make a good connection. If you have a friend who can help you, it is handy to have someone else drive the doctor PC, so you can concentrate on the laptop, but it is possible to do this by yourself.

With the chip successfully read, disconnect your probes from your simple circuit (disconnect ground last)

now, at this stage, you could switch your laptop off, and remove your probes. but you might want to leave them on until you have verified that you have successfully read your chip so you can have another crack at it of you were not successful the first time.

Run the password reveal software.

turn off laptop
remove probes
reboot laptop,
enter the password which you now know (see post from Allservice at the start of this thread).
Smile to yourself at how clever you are Smile

This technique has worked well for me on all boards i have tried it on.

I bought a job lot of 9 motherboards from a repair shop. some had password protection, some CRC errors.
If anybody out there knows how to troubleshoot the powersupply of a laptop motherboard, I'd love to know!

Did I win record for longest post?? - sorry all, but hope it helps someone.

Thanks, and good luck.

Author: allserviceLocation: @your.service PostPosted: Thu Dec 22, 2005 3:29 pm    Post subject:
Nice post. 10+

About the PS. For PIII machines like t20-22 look for ADP chips like ADP3410 or ADP3421. I remember a friend that he never waste his time checking, he always removes the ADP3421 from the start.

Author: indirection PostPosted: Wed Dec 28, 2005 12:34 pm    Post subject:
Thanks for the tip Allservice,
About the adp3421 and adp3410...
Like Jvan, I don't trust my soldering skills enough to attempt to remove these chips. I did read somewhere that before replacing these chips, you should have a go replacing the capacitors in the power supply. This is probably my limit. If anyone knows which ones to replace (and thier values), then that would be very helpful to me.

Thanks, and best regards.

Author: naseerak PostPosted: Fri Jan 06, 2006 4:27 pm    Post subject: confused
By the suggestion of a member I am repeating my request here which i posted in he wrong place earliar.
Hi Allservice you r doing a great job and this is my first time to build ur programmer as i have built many max232 based interfaces before but the capicitors you have shown in the schematics are non-polar with the values of 1uF which are supposed to be polar according my knowledge if u have purposely did so then it will be as right as any universal truth as your ability is undoubtfull. my other confusion is the VCC because during password prompt the TP is supplying the required VCC to the Chip then why it is necessary to include the exterternal VCC as u have told us that we need only three wires And if VCC is necessary then the same VCC can be derived from USB without nrrding AA cells.
Pleaese quench my thurst and finish my confusion I will be as thankfull to You as the world to the Georj Boole (Boolean Algebra Confused

Author: allserviceLocation: @your.service PostPosted: Sat Jan 07, 2006 10:31 am    Post subject:
1. Look again. The capacitors shown in the diagram are non-polar 0.1uF (0.1uF=100nF) not 1uF. There is also an asterisk explained in the "List of components". The schematic shows a MAX232A by default, but if you use MAX232 (without A) then the capacitors must be 1uF elcos, the polarity is shown by the IC schematic layout.

Note: Generally speaking, It is not necessary that a 1uF capacitor or 10 uF or bigger to be a polar one or "ELCO" all the time. It depends on the schematic request. It is true also that a non polar 1uF is kind of huge comparing with an ELCO.

2. The power source may be used for stand alone eeproms (not soldered) as well. It is specified there (again with 2 asterisks) what part of the PS to be used for unsoldered eeproms. It make sense, don't you think?
Use USB +5V is you feel better with that.

Well, if you pay attention just a bit you will find the best solution for your problems, see?

I think the world should thank to some arabs for the Al-Jabr first, he, he

Author: goenLocation: Indonesia PostPosted: Mon Jan 09, 2006 3:01 pm    Post subject: Where I can get the software and circuit schema?
Hello AllService,

Where I can get the software and circuit schema for unlocking the BIOS Password for my TP R40e? I try for this address


but the connection failed. Is there other address that I can catch up?

Thanks in advance.


Author: allserviceLocation: @your.service PostPosted: Mon Jan 09, 2006 11:45 pm    Post subject:
Well, try http://www.serviceforum.lx.ro/viewforum.php?f=12
or at least http://www.serviceforum.lx.ro

Author: Pop45398 PostPosted: Tue Jan 17, 2006 6:39 am    Post subject:
allservice wrote:
Posted: Sun Nov 21, 2004 1:22 am

If you don't care about the info then buy a new one. HDDs are almost impossible to unlock. The password is stored on a special track and the procedure is complicated and very expensive. The resulted HDD will never work the same anymore.

I don't know if your view on locked HDDs has changed in the last 15 months but I thought I'd share with you in case it hasn't, that unlocking HDDs is very easy, I've been doing it for several years. I learned about it on a UltimateTV forum, and it has now become widely known in the Xbox community as well. You will lose all your data, however. You need a program called MHD3.EXE. You can download it here. This link has better directions. It takes a while to run but there's nothing stopping you from doing something else. Smile

I've also been unlocking 770s (24C01) for many years. Iíve yet to mess with the newer models, though. Iíve been considering providing this service for a reasonable price for those who donít possess the skills or desire to do it themselves.

Keep up the good work. You provide a valuable service and seem to have the patience of Job.

Author: allserviceLocation: @your.service PostPosted: Tue Jan 17, 2006 10:54 am    Post subject:
The program you mentioned cannot be used to unlock a laptop drive or any drive that wasn't locked into an UTV. It claims that it is able to unlock drives used in UTV with the master password. This password is set by the UTV and probably is a standard password, I remember XBOX has "TEAMASSEMBLY". That's all folks.

Just to answer your question, I am very much involved in this matter and my opinion is not changed since then. To unlock drives coming from a laptop, that is a machine built to be a data-safe not a toy for kiddies, is not so easy. See here
Iíve been considering providing this service for a reasonable price for those who donít possess the skills or desire to do it themselves

Oh, I am sure your efforts will be highly appreciated by the rest of Thinkpad users community.Good luck!

Author: Pop45398 PostPosted: Tue Jan 17, 2006 1:25 pm    Post subject:
MHD3 has worked fine for unlocking Thinkpad drives for me. I do this in a desktop with a cheap 2.5" to 3.5" adapter. The first time I did it was when I inadvertently locked my own drive. After that I started buying locked drives off eBay. BTW, I am familiar with ATA encryption.

I've never messed (or played) with ax Xbox, although my sons have all heavily modified theirs, just assumed they were locked the same.

Networking/Security Forums -> Hardware // Upgrades

output generated using printer-friendly topic mod, All times are GMT + 2 Hours

Goto page Previous  1, 2, 3, 4, 5, 6, 7  Next  :||:
Page 3 of 7

Powered by phpBB 2.0.x © 2001 phpBB Group