IBM ThinkPad R40 Supervisor Password Recovery

NOTICE:
I did not take responsibility for any loses due to the usage of the information from this blog post. Please take extreme precaution while following this procedure. Thank You.

[Lihat Bahasa Melayu]

IBM / Lenovo save password (POP and Supervisor Password) in a EEPROM Chip call ATMEL 24RF08. These password couldn't be remove simply by resetting any jumper or unplugging any battery or backup battery. The only way is to read the password stored in the chip. To achieve this, you have to send in the laptop to the manufacturer together with prove of ownership.

But, we can hack this (by reading the EEPROM chip using homebrew EEPROM Reader and reader software from ALLservice.ro.

Thing we need:

1. EEPROM Reader (homebrew)
   
   Parts:
   1. D-Sub 9pin female COM header,
   2. 2 units 5.1v Zener Diod
   3. 2 units 2.2 Kilo Ohm Resistor
   
   
2. Software
   Get the software from http://www.allservice.ro/ iaitu r24rf08_setup.zip and setup_ibmpass21.zip
   
   details as follow:
   http://www.allservice.ro/forum/viewtopic.php?t=61 – r24rf08 - Reader http://www.allservice.ro/forum/viewtopic.php?t=56 – IBMpass 2.1 Lite

Build the EEPROM Reader

EEPROM Reader schematic.

Figure 1: EEPROM ATMEL 24RF08 Reader Diagram.

Attach the Reader to ATMEL 24RF08 EEPROM

From the site where I first get the information about hacking this BIOS password, it is suggested that we solder two wire to EEPROM pins to connect the reader. I thought it will be disasterous and would void the warranty.

Photo #1: EEPROM Reader,
all component soldered to d-sub female connector