This script reads the supervisor password from the i2c eeprom (ATMEL 24RF08) in thinkpad laptops
in case of an encrypted password (passphrase set) the password can be cleared. (write to eeprom, last resort only!!)
There is tons of information about this on the web.
The missing piece was how to clear a password: just write 0x00 to all 16 password bytes.
Find the eeprom location of your laptop on those pages and connect some wires to it.
The hex dump can be imported into the program IBMPass to create a standard dump like the ones from the parallelport readers.
The eeprom is powered by 3.3V so use a voltage converter or power your arduino with 3.3V
This can be done easily with 2 arduino boards.
You can try using normal 5V but this can trash the mainboard.
Warning:
Allways make a dump of the eeprom before attempting to clear the password!!!
Any damage to your device is your own fault.
I have actually applied this method and recovered my password. It works and is worth about $120 because that is what a used IBM thinkpad R52 costs in India. Thanks a ton deif...you rock!!!
Do I understand correctly that I just need to hook up gnd, 11 and 12 pin to the chip directly? and then run program in console?
In my case I am using intel edison because I have one handy and it is convenient to switch between 3.3 and 5v using edison arduino board.
When I run program "dry" no wires connected to edison then if I try to dump eeprom it goes "00 00 00..." infinitely
if I hook up wires only to edison pins gnd, 11, 12 and try to dump eeprom it will say some error reading eeprom obaviously
Finally when I tried to actually use it I hooked it up correctly to the chip, powered on laptop(x230), tried to dump eeprom and it displays same error as if nothing was connected...
Hi! First message tells that you used this method with X201 too. But it has different eeprom chip, at least mine has MX25L6445E chip. I got the hex dump out of it but I just don't find mpv in it.
I'm having issues using this on my system.
I'm using an Adafruit Trinket Pro 3.3V to avoid the level shifting, and I'm trying to read the password off a W510.
When I connect it up, it immediately gives me a
"The Supervisor Password is: xNACK!! 0
yNACK!! 0
NACK
!!! Error !!! Could not read the Password!"
warrengardiner:
Awesome! Worked 100% removing a password on a Thinkpad T410 with encrypted password. Way quicker than any other options I found. Excellent work!
Simply used 2k resistors and and 5v zeners to do the level shifting.
Well .before i using it , i have tried lots way to reset password . but all failed
I know this is an old topic, but I just used it to reset the password on an old X100e laptop and I'm pleased to say that it worked flawlessly. Reading back the password didn't work (It was likely encrypted), but clearing it worked perfectly. After hours of trying other solutions this was the only one that worked.
I have an issue with supervisor password on my Lenovo Thinkpad X201t. I've read the eeprom content, but i don't know how to extract the password, i believe it's encrypted.
Hi,
I have Thinkpad T510, i use pinout from https://www.allservice.ro/forum/images/t510.jpg. But while trying read eeprom it returns !!! Error !!! Reading Eeprom failed! After powering on PC there is some voltage on SCL is this correct? Have someone full scheme with voltage stepper?
Thank you in advance