Solved

Thinkpad T410i supervisor password recovery

Posted on 2014-01-21
10
1,467 Views
Last Modified: 2014-01-30
Hi Guys,
I have a Thinkpad T410i (Win7pro) with an unknown Bios Supervisor password. The only supported route out of this situation is a motherboard replacement . . . however . . . .

http://sodoityourself.com/hacking-ibm-thinkpad-bios-password  describes a procedure to extract the contents of the EEPROM via a IC2 bus arrangement to the serial port of another PC with an ATMEL chip reader installed. Unfortunately all instances of the chip reader that I can find are infected - this has been noted else where.

Does anyone have a suitable chip reader and compatible decoder so that I can extract the supervisor password from the eeprom file dump. Maybe you have an uninfected version of the software referenced in the above link.

I have prepped the T410i with the three wired connections and have built the interconnect, just need the reader and decoder to complete this task now.

Hope someone can help . . . very frustrating to have got this far.

Thanks
0
Comment
Question by:TrevorWhite
  • 5
  • 5
10 Comments
 
LVL 32

Expert Comment

by:_
ID: 39798991
I don't know about the ATMEL chip reader, but this sounds a lot like what I did to get the hard drive unlock code from the eeprom of an original Xbox.
It also uses the SLC, SDA, and Ground wire, run through a PBC, and out to a DB-9 serial.

I don't remember which program did what, but I used PonyProg2000 and LiveInfo Beta to read and decipher it's eeprom. Maybe they will work for you.
One reads the eeprom and saves it as a *.BIN file. The other one reads the BIN file

I will see if I can find where I archived my notes and how-to's, and refresh my memory.

PonyProg2000
http://web.archive.org/web/20100207194900/http://www.lancos.com/ppwin95.html

LiveInfo Beta
http://www.logic-sunrise.com/forums/files/file/1248-liveinfo-beta-3-xbox-v16/
0
 

Author Comment

by:TrevorWhite
ID: 39799373
Hi Coral47,
Thanks for your time on this. I did try the PonyPony solution but it seemed the software was only for 32bit and only runs on Windows upto XP. The only machine I have available with a Serial port is an HP ProBook with Win 7 pro 64 bit

Your process sounds exactly the same as that I refered to - I have subsequently found that the program is not infected but is giving false positives. However I'm having other operational problems possibly related to the linkup wiring of the eeprom.

If you do find there is a Pony solution with a 64bit compile it may be of use later.

I'm liaising with the ALLService.ro guys to resolve current issues.

REgards
0
 
LVL 32

Accepted Solution

by:
_ earned 500 total points
ID: 39800031
This should be it:

PonyProg64
http://www.techcat.de/index.php?ponyprog

TVicPort driver: (needed driver?)
http://www.entechtaiwan.com/dev/port/index.shtm

links are from this page:
http://ponyprog.sourceforge.net/phorum/read.php?2,2249

not sure if this one is the same or not:
PonyProg  XP/VISTA/W7 (64-bit)
http://www.4shared.com/folder/P7KiuaHd/ponyprog_64bit.html
0
 

Author Comment

by:TrevorWhite
ID: 39800087
Oh brill, that should do the job . . . . especially after I connect my wires to the correct chip !!!
Oooops would appear I have attached to BIOS SPI flash which I wrongly identified as the eeprom. I have the correct connection points (and chip) identified now so will keep you all posted.

I'll use the allservice.ro software first but will also check out the PonyPony software for future reference. Will post back.

Regards
0
 
LVL 32

Expert Comment

by:_
ID: 39800110
>> especially after I connect my wires to the correct chip

Been there, done that.    : D
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:TrevorWhite
ID: 39811415
Well here is the belated update . . ..
With the right chip identified I was able to extract the SVR password . . . but TCPA locked. allservice.ro has software to unlock this but had issues writing back to the eeprom. After the logic on various other pins on the eeprom (which were correct) it was decided that the eeprom was damaged in some way so it will be replaced.

Had to ship this to a lab with appropriate gear to remove and fit this (rather small) item.

It has been despatched today and I'm expecting a functioning unit with the SRV password unlocked when it gets back.

I'm not expecting to require further input here but will keep this open so that I can confirm all went well.

Regards
0
 
LVL 32

Expert Comment

by:_
ID: 39811640
Thank for the update.
Bummer about the chip, though,   : (
0
 

Author Comment

by:TrevorWhite
ID: 39822102
I've requested that this question be closed as follows:

Accepted answer: 0 points for TrevorWhite's comment #a39811415

for the following reason:

Hi
Reason was that I resolved, alternative suggestion was alternative software same process. The solution was identifying the correct chip - this led to further issues as documented. Since I'm being chased to attend to this question I have elected to close before final conclusion is confirmed. IE the item has not returned from the lap yet.

Regards
0
 

Author Comment

by:TrevorWhite
ID: 39822098
So sorry, on reading my original question - it was answered in full. I must allocate full points to Coral47. Sorry for messing up
0
 
LVL 32

Expert Comment

by:_
ID: 39822331
Thank you much.    : )
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
Lithium-ion batteries area cornerstone of today's portable electronic devices, and even though they are relied upon heavily, their chemistry and origin are not of common knowledge. This article is about a device on which every smartphone, laptop, an…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now