Thinkpad supervisor password read /clear

Projects Discussion and Showcase Device Hacking
1

This script reads the supervisor password from the i2c eeprom (ATMEL 24RF08) in thinkpad laptops
in case of an encrypted password (passphrase set) the password can be cleared. (write to eeprom, last resort only!!)
There is tons of information about this on the web.
The missing piece was how to clear a password: just write 0x00 to all 16 password bytes.
Find the eeprom location of your laptop on those pages and connect some wires to it.

http://www.ja.axxs.net/

The hex dump can be imported into the program IBMPass to create a standard dump like the ones from the parallelport readers.

The eeprom is powered by 3.3V so use a voltage converter or power your arduino with 3.3V
This can be done easily with 2 arduino boards.
You can try using normal 5V but this can trash the mainboard.

Warning:
Allways make a dump of the eeprom before attempting to clear the password!!!
Any damage to your device is your own fault.

I used it with a T40 and a X201.

Good luck

thinkpadEepromReader.ino (11.4 KB)

2

I have actually applied this method and recovered my password. It works and is worth about $120 because that is what a used IBM thinkpad R52 costs in India. Thanks a ton deif...you rock!!!

3

That's a nice hack.

I Wish I could do the same on my Dell Latitude.

4

Awesome! Worked 100% removing a password on a Thinkpad T410 with encrypted password. Way quicker than any other options I found. Excellent work!

Simply used 2k resistors and and 5v zeners to do the level shifting.

5

Can somebody please post some photos of the process?

I need to reset the supervisory password of my Lenovo Ideapad Z560.

Will this be applicable to Ideapads?

6

Hi guys! My first post here.

Do I understand correctly that I just need to hook up gnd, 11 and 12 pin to the chip directly? and then run program in console?

In my case I am using intel edison because I have one handy and it is convenient to switch between 3.3 and 5v using edison arduino board.

When I run program "dry" no wires connected to edison then if I try to dump eeprom it goes "00 00 00..." infinitely

if I hook up wires only to edison pins gnd, 11, 12 and try to dump eeprom it will say some error reading eeprom obaviously :slight_smile:

Finally when I tried to actually use it I hooked it up correctly to the chip, powered on laptop(x230), tried to dump eeprom and it displays same error as if nothing was connected...

Can we use built in SCL SDA pins in arduino?

7

Works great!!

ibm_haxxor.jpg
ibm_haxxor.jpg960×1280 207 KB

8

Worked nice on two T410s laptops and one T400.
Thanks!

I didn't have level shifter available, so I used 5V in data lines, no problems occurred.

P.S. I just made this account to thank you! This helped me a lot!

9

Hi! First message tells that you used this method with X201 too. But it has different eeprom chip, at least mine has MX25L6445E chip. I got the hex dump out of it but I just don't find mpv in it.

10

Just wanted to say thanks, this allowed me to save a Thinkpad X60s from ending up in a landfill.

11

Good afternoon to you want and eun the bios Lenovo T500 can help me someone
This is my ID SKYPE Bogdan_Alexandru31

12

I'm having issues using this on my system.
I'm using an Adafruit Trinket Pro 3.3V to avoid the level shifting, and I'm trying to read the password off a W510.

When I connect it up, it immediately gives me a
"The Supervisor Password is: xNACK!! 0
yNACK!! 0
NACK
!!! Error !!! Could not read the Password!"

Any ideas?

13

I spent hours on this but couldn't get anything useful from IBMpass. I later found a much simpler process described in a YouTube video: How to unlock BIOS Supervisor Password from Lenovo Thinkpad Laptop (no damage to laptop) - YouTube

Basically the steps are.

  1. Power on the laptop and short SDA and SCL as soon as you see the logo. Keep them shorted.
  2. The BIOS will think the EEPROM is corrupt and allow you supervisor acces to the BIOS settings.
  3. From here the video recommends to change the password. Enter the new password then confirm but before pressing enter release the shorted pins.
  4. Next I dissabled the password, saved changes and restarted to check.

Hope this helps someone.

14

warrengardiner:
Awesome! Worked 100% removing a password on a Thinkpad T410 with encrypted password. Way quicker than any other options I found. Excellent work!

Simply used 2k resistors and and 5v zeners to do the level shifting.

Well .before i using it , i have tried lots way to reset password . but all failed

15

I know this is an old topic, but I just used it to reset the password on an old X100e laptop and I'm pleased to say that it worked flawlessly. Reading back the password didn't work (It was likely encrypted), but clearing it worked perfectly. After hours of trying other solutions this was the only one that worked.

(Note: I used 5v logic for this without issues)

16

Hi,

I have an issue with supervisor password on my Lenovo Thinkpad X201t. I've read the eeprom content, but i don't know how to extract the password, i believe it's encrypted.

on address 0x330 and 0x340.

I've attached the eeprom content.

Could you please help me to clear the password.

Thanks

Passrod.PNG

Lenovo.zip (331 Bytes)

17

Hi,
I have Thinkpad T510, i use pinout from https://www.allservice.ro/forum/images/t510.jpg. But while trying read eeprom it returns !!! Error !!! Reading Eeprom failed! After powering on PC there is some voltage on SCL is this correct? Have someone full scheme with voltage stepper?
Thank you in advance