BIOS password on a Thinkpad

there is nothing you can do, as it is not stored in VRAM (volatile). So you would have to either:
1: Get a new BIOS
2: Get the password from the neighbor
3: Get the BIOS Flashed (Which is costly)
Considering that 1, and 3 are pretty much not able to be accomplished on the laptop, you are stuck with option 2

This thread had a few suggestions, which may or may not work for you.
Plus, there's a little more reading Here.

I've had a good deal of luck with this sort of thing, but it does require (usually) tearing the laptop down. Basically, you're going to need to find out which BIOS chip the laptop has, or which bios version you have. You can find the spec sheets for the chips via googlage, which may take a while. Find which pin you need to jump on the bios, and what you need to jump it to, and go to town. Be wary, some laptops store the password in an external flash chip (external to the bios chip, still on logic board) and THOSE are the major pains in the arse, but still not impossible. Good luck!

The first is the easiest, remove the CMOS battery that is keeping the BIOS settings.
The second involves opening the laptop and changing the jumpers on the mobo to reset the bios.

dvsjr

Have you tried looking through the user's manual? Clearing a BIOS password is easy on a desktop machine (usually just involves moving a jumper); I'd be surprised if they didn't leave a backdoor to clear it on the laptop. Try looking through the user's manual or Googling something like "ThinkPad [insert model number here] clear BIOS password".

pull the power cord, pull the battery and remove the cmos battery. let it sit for 10 minutes, come back put everything back and turn it on. problem solved

It's a ThinkPad. They usually have much more resiliant password schemes than that.

not realy . all PC's that ive see there is a way to reset the bios either by a jumper reset or removing the clock bettery or AKA cmos battery. some have a battery to remove and some are built in to the laptops removable main battery if the first two optione wont work you might have to dissconnect the battery pack and just let it sit in hopes the cmos or bios battery will die out and reset the bios and hope that is is a replaceable battery or a resistor that holds a charge wile the battery pack is removed.there is almost always to reset a bios. i dont know about flashing is with the password set if it will even work with a password being set.

It's a ThinkPad. They usually have much more resiliant password schemes than that. ;)

What Jon is getting at here is that normally the password is stored in an EPROM or similar device on the motherboard, just pulling the CMOS batteries or whathaveyou isn't going to clear it.

If you can actually boot the machine, and it's just a CMOS setup password, then there's a couple of memory locations you can write to with DEBUG that'll clear most CMOS setup passwords.

The first reult after Googling "Clear ThinkPad BIOS password":

http://www.hackfaq.org/reset-bios-password.shtml

It lists two ways that might work to reset the password -- a backdoor password, and a program that can do it for you.

Google is your friend.

From that other thread pointed out by eeun:

Thinkpads are extra special. The passwords are programmed into an eeprom when they're set. They're *not* in CMOS, nor are they in the main BIOS flash. Something like "killbios" will almost certainly *not* work.

You've probably seen this if you've been Googling:

http://www.ja.axxs.net/unlock/

Good luck.

Seriously, any suggestion involving yanking the CMOS battery or the like isn't going to help you. Read this page. There are several levels of "screwed" depending on which password is lost, but it sounds like in your case you're at the worst one, and on most Thinkpads it can't be fixed without physically violating the motherboard. (as detailed.)

--Peace

Edit: By "several levels of Screwed", basically that means that if you can *boot* the laptop but are locked out of the BIOS there are software solutions. But if you can't boot it without entering a password at that little key prompt on most Thinkpads you have to hack the security chip.

yeah most thinkpads are that easy, unless they are those brand new ones with the smart card security. i used the same method i posted earlier with a thinkpad a few years back and it worked fine

Assuming you're limiting yourself to only 36 possible characters, you're still looking at 36^8 combinations. That expands to 2.82 x 10 ^ 12 combinations.

Incidentally, using the shift key on the 26 letters brings you up to 62 characters, or 2.18 x 10 ^ 14 possibilities.

Do you intend to type them all in by hand?

Edit: I should mention that those quick numbers assume that it /is/ an 8 character password. If it could be up to an 8 character password, not absolutely 8 characters, the number...increases.

Let's make the assumption that we're dealing with the smaller character set so that 2.82x10^12 is not an unreaonably low number. Now assume that one password could be entered a second. Sure, you could do it faster, but since you need to restart the machine after two tries it's a hopelessly optimistic estimate anyhow.

There are 3600 seconds in an hour. There are 24 hours in a day. There are 365 days in a year roughly. 3600 x 24 x 365 comes out to being 3153600 seconds per year. Just a shade over 3 million.

2.82x10^12 tries / 3153600 tries per year = 894,216 years.

If you could limit down the search space quite a bit more (Is he only unsure about the last few letters maybe? Are there letters he /knows/ he didn't use?) then it might be worth a shot, but unless you've got a few hundred millenia to waste it's not the best use of your time.

Edit: A dictionary attack might be worth it though.

That's probably worth paying the nice gouging Internet man $40 to help you unlock the security chip. If it were an old Pentium 90 model then no, but...

--Peace

Paying for the recovery service for a T23 recovery at $45 for the Category 2 service from http://www.ja.axxs.net/unlock/ seems like a worthy prospect, if you have a guarantee that the TP works fine otherwise. I'd guess that the TP is likey worth $200-300 if it's got decent RAM and HDD and a good optical. Check eBay of course... but I'd surely pay the fee if I couldn't find the info from other sources. (ie. offical TP service center employee who is feeling generous, etc)

Have you tryed "merlin" as the password? I think it is a backdoor IBM password IIRC.

http://www.thinkwiki.org/wiki/Maintenance#Recovering_BIOS_passwords

There's an implication there at least that someone's offering the software to fix the problem for free. You still need to build and solder the interface, of course.

--Peace

Don't know if you stumbled across this or not. It has links to some BIOS crackers.

http://www.i-hacked.com/content/view/36/42/

Jack

If you know how to take it apart, then open it up and take out the CMOS battery (usually round) and unplug the laptop, remove the main battery, and let it sit for about 5 minutes or so. Put everything back in, and the password should be gone.

Lets get this done. What have you tried? What operating system is on the thinkpad (Or cant you tell since you cant get past the BIOS?) What version and make BIOS is it using?

did you try this? http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=156

or this: http://www.tech-faq.com/reset-bios-password.shtml

d

I use to work on ThinkPads while I worked as helpdesk at Ogilvy & Mather based in NYC - these guys are the Global Advertisers of IBM...
Now what you are asking is basically going to be answered by paying the piper to remove this password.

The problem you are attempting is something IBM has spent money to implement as a feature so that they could be used by the government to secure laptops to prevent access. Of course only those with the hardware/software and know how could break in... and that's not something most of us can do.

There is a service offered I recall investigating when someone at O&M set up a bios bootup password and forgot it... I recall after contacting IBM that they did not offer any service to recover from the laptop. Remember the newer security features also offer locking the harddrive which makes it a nice small paper weight too.

Pay the piper if you are serious about using this laptop. I don't recall who I contacted about it but they did offer a guarantee regarding being able to remove the password or it was free except needing to pay for the shipping to and back...

And I know my laptops... because a two executives there on two ocassions drove over their X20. The laptop screen was a broken glass rainbow after it happen on one of them but I was able to recover the data off the harddrive...(oh it was a Jauguar that rolled over the X20 and the other was a Taxi is Paris IIRC) I was able to rebuild a working laptop out of two X20's eventually after asking to play with them...

I digress, the security is tough. IF you hae to the know how OR can pay for it then you can use the laptop... however IF you want an old ThinkPad as a Trade I'd consider it thought the shipping if you were too far would be very prohibitive...

HTH clear up the questions... The main thing to resolve this issue though as a short cut for your is to get a replacment mother board for a broken ThinkPad of the same FRU/Model Famliy - or Pay the Piper - much cheaper paying the Piper if the cost is $45...

One of my friends, the guy who worked out how to enable safe-sleep on non-hires-powerbooks, also has a page on hacking ThinkPad passwords at http://matt.ucc.asn.au/thinkpad.html

I have thinkpad it has the same prblem but dad knows pass just wont tell
me remove the battery & there is a 2nd smaller try to remove that.:-)(-:

I have thinkpad it has the same prblem but dad knows pass just wont tell
me remove the battery & there is a 2nd smaller try to remove that.:-)(-:

Did you even read the rest of this thread before bringing it back from the dead?

Please try not to revive threads more than a few weeks old unless you have something very valuable to add.

I took out the batteries (main plus backup) and let it sit over night. Still got the same thing with the added bonus of a "check date and time" error when it starts up. Then I was reading about some harddrive stuff and on and on so I pulled the HD. I booted it without the HD and found that it wouldn't go into BIOS or anything. A ray of hope. So I put the TP HD in another laptop and did a fresh install of Windows. Shoved it back in the TP and.....................................after POST it asked me for a password (which by the way I still don't know).

Burried but breathing....

You mention that the machine doesn't prompt for the Password if there's no hard drive in there.

I had an old Compaq Armada that stored the BIOS interface, as well as the password, on an ~8MB partition at the beginning of the Hard Drive. My brother set a power-on password on it (the little bugger) and then forgot what it was. I put the drive into another laptop, removed the partitions and set them up again using FDISK and DELPART in DOS. I had to restore the BIOS GUI from the rescue disks, but that wasn't a big deal.

The point to that big ramble is that based on what I've heard, perhaps the security is on the drive itself, and not the laptop. I realize that you've already wiped the drive clean and installed a fresh install of Windows on there, but you may have just wiped the Windows partition clean, and not the entire disk.

If you're comfortable with FDISK, boot up another laptop with a Windows 98 boot floppy with the Thinkpad HD installed in that laptop. Poke around in FDISK and see what partitions are on the drive.

Conversely, you could try *another* drive in the Thinkpad to see if you get any luck with that.

It's a long shot, but ya never know...

Cheers,

The Czar

While that is true, esp. for older MCA-based IBMs, the one in question is much newer, a T23 which can include the Embedded Security Subsystem and is also much newer than any PC laptop that stores BIOS on the HDD that I know of.

Had same problem. Had pass word but didn't seem to want to unlock system. Boot holding down F1 key go to password. Try the password you think it is, HIT THE SPACE BAR after each attempt NOT the enter key. I found out that to remove the password even if you have it, there is no indication you have the correct one untill you hit the SPACE BAR. It will then give you the option to enter a new password, just hit the SPACE BAR again. This is the only way to remove the password without a soldering iron and another chip. By the way the password for the pc I got from work was 4gadats or 4gadat

There is no way to clear the bios password using the normal remove the battery methods. The password is stored in a eeprom on the motherboard that does not rely upon battery for power. Once it is stored, it's there until you remove it or get access to it to set it as blank. Okay, what to do. Either deep six it or find "joe in Australia" on the net. Make the eeprom reader, pull the dump from the eeprom, save as a .bin file. Joe in Australia's software will be read by the bloke and then you will pay the piper to get it back. DO NOT REPLACE THE EEPROM CHIP AS IT WILL GIVE CRC ERRORS. Just an FYI, I have recovered two boards from the depths of the trash can by using the information and hardware that "joe in Australia" has provided.

Good luck!

So am I totally screwed because I don't know the password? I got this Thinkpad from my neighbor and I don't care about any of the data on it at all...I just want to use it. I promised that if I couldn't figure it out that we could take it out and shoot it.

Couple of things:

The next one of these I crack will not be my first.

Go easy on Joe in Australia. He is a good, honest guy and a very respected member of the Thinkpad cracking community.

Now re your Thinkpad:

If as you say you have tried battery removal without success

and

if as you say your Thinkpad is too early to have a supervisor password

then

you have a hard drive password and not a BIOS or CMOS password.

There is good news and bad news:

You can totally get around this password by hard drive replacement

but

you will not be able to salvage the old hard drive without the IBM master password . . . .

which sorry to tell you I do not know.

For those who might be unaware:

The IBM master password for hard drives does not, IT DOES NOT, allow you to access and read data from someone else's password-protected hard drive. If you want to compromise another person's security you need their user password. Good luck on that one. This is not something I ever have done.

If you are like me and most other breakers you could not care less about stealing another person's information. What you care about is salvaging perfectly good, but locked, hard drives. To do this you need the IBM master password. The IBM master password allows you to erase only, to format only, a user password-protected hard drive. In the process the user password is removed, along with the data it was protecting. You never get to access or read the protected data prior to its destruction.

I do not know the IBM master password. But I sure WISH I knew it. IBM holds it pretty tight since it allows them to sell a PILE of new hard drives, or at least it used to before Lenovo.

Cracking EEPROMs is not a problem. Breaking the IBM master hard drive password, now THAT'S a problem!

Can't you just downlaod the BIOS flash utility, burn it, and boot from the CD?
We have had some trouble with Acer Aspire notebooks BIOS, and Acer sent us a BOIS flash download, which the notebook booted from and the BOIS was flashed.. I'm not sure whether this will reset the password though.. Maybe you could try contacting IBM? Whether they would still offer support for that notebook is another issue.. Otherwise try contacting a notebook repair specialist..

Good luck anyways. Macintrash

I recenty used the eeprom methods above to locate and decode the password in a P4 sony vaio. I found the two eeproms on the motherboard with a multimeter (you know that certain pins will be grounded, one at v+). I then used a eeprom reader and soldered it to the eeproms. You don't even have to remove the eeprom from the motherboard, just power up the machine and read the eeprom using the programmer.

The hardest part is locating the correct eeprom and soldering to the tiny pins.

I dont know if this is the "offical" thinkpad manual but it provides a method on How to remove the power-on password.

To remove a POP that you have forgotten, do the following:
If no SVP has been set:

1. Turn off the computer.
2. Remove the battery pack.
3. Remove the backup battery.
4. Turn on the computer and wait until the POST ends. After the POST ends, the password prompt does not appear. The POP has been removed. 5. Reinstall the backup battery and the battery pack.

The manual provides detailed descriptions and diagrams on how to do this...

If this is the offical maual then surely this should work?

I believe they are trying to remove the SVP and not the POP

Great!!!

IBM BIOS Setup ThinkPad T23

To clear supervisor password,
or
To Clear IBM Security Chip.

Hey Guys,
This website might help you out? www.passwordmethod.com

i do this all the time. it costs $20.00 with shipping paid both way by the owner.