Lost Supervisor Password (SVP) - IBM Thinkpad

The supervisor password SVP) on the IBM Thinkpad is stored in an ATMEL chip(On most models the chip is an 8 pin DIL and is labelled 24RF08). It can not be reset by any normal means and even the IBM service manual (hardware maintenance manual) suggests that if SVP is lost, you must replace the motherboard in the laptop to overcome the issue.

However, we know that the motherboard does not need to be replaced! You can simply read the data stored in the ATMEL chip and decipher the SVP. - Well I say simply, but you will have to pull your laptop apart and solder three wires to the motherboard, which is far from simple.

Before you start this procedure, Read this whole page thoroughly and make sure you have all the parts in place and that you are confident to do the job. Also understand that if you mess it up, you could destroy your laptop. Proceed at your own risk!

NOTE:- If you have any suspision about the laptop being stolen contact your local police. This page is for people who have genuinly forgotten the SVP on the laptop that they own. Do not use this info to hack stolen laptops!

How To

1. Get a Hardware Maintenance Manual for your laptop

Search the internet to try and find a hardware maintenance manual (service manual) for your laptop as this will tell you specifically how to pull the laptop apart without damaging it, and may also give you a clue as to where the ATMEL chip is located.

2. Build the EEPROM reader hardware

You will need these parts:
2 x 2.2K Resistors, 2 x C5V1 Zener diodes
1 x 9 Pin D-Sub Female Plug (to plug into serial port on PC)

Put the parts together following the simplified diagram.

This can all be built onto the back of the D-sub connector if you're tidy with the soldering. Make the wires coming from the three points about 1 - 2 meters long, remembering that they need to reach from the laptop to a second computer nearby for when you read the chip

3. Now the hard part, soldering the wires inside the laptop

Following the Hardware Maintenance Manual (if you found one), open the laptop and locate the ATMEL chip on the motherboard.

Solder a wire to any ground point on the board (make this wire long enough to stick out from the laptop when it's temporarily put back together). Solder wires to SCL and SDA on the ATMEL chip

Check and double check that you have not shorted the SCL and SDA pins on the chip. Maybe put some tape over the SCL and SDA wires to help to hold them secure. Leave the wires hanging out of the laptop - don't connect them to the reader yet, but make sure that the wires can't short to each other or ground. Temporarily rebuild laptop enough so that it will boot up. Boot up the laptop and Press F1 to enter the BIOS. At the password prompt, leave the laptop and prepare the second computer.

4. Preparing the second computer

Download and install these 2 bits of software on second computer: Reader Software - 794kb | Decoder Software - 392kb

!Sorry, Due to suspected Malware Infection, I have had to block the download of the reader software temporarily!
The software is called ' r24rf08_setup.exe' and can be found on many other sites, however I have tested 5 different downloads and they were all infected, so use at your own risk... Avast! Anti-virus detects the threat as 'Win32:Malware-gen'.

Here is some software that may work: http://www.lancos.com/prog.html. I have not tested this, so if you try it and it works for you, please let me know!

Plug in the EEPROM reader (but do not connect wires from the reader to the laptop wires yet). Bring up a Command Prompt and navigate to the folder where you installed the reader software, then type in: R24RF08 dump.bin - Don't hit enter yet!

5. Reading the ATMEL Chip

Connect the wires hanging out from the laptop to the wires coming from the EEPROM reader in this order (while its all still turned on): Ground first, then SDA and finally SCL. When all the connections are made, go to second computer and hit enter. Hopefully now you will have a file on the second computer called dump.bin

6. Decoding the Supervisor Password:

Run the IBM Pass 2.0 Lite Decoder Software on the second computer and load up the dump.bin file you just created. Scroll down to the memory address of 0×330 and read the password!

If the password is not there, press the Translate button.

7. Testing the password

Unplug and disconnect the EPROM reader from the laptop and second computer. (Leave the wires soldered inside the laptop). Type your newly gained password into the laptop and try to go into the BIOS. Try to change any setting in the BIOS to confirm you now have full control!

8. Rebuild laptop

Turn laptop off and disconnect all power, de-solder the three wires carefully - you got this far, you don't wanna kill the laptop now. Put laptop back together. Just do the reverse of what you did to get it apart. - You're Done!

DISCLAIMER: Normsweb.com is the personal, not-for-profit website of Norman Green in the UK, which is run as a hobby only. Neither Normsweb.com or Norman Green will be held responsible for any damage to any software, hardware or persons that may arise from using this site. Use this site and the data therein at your own risk. Whilst every effort has been taken to ensure any available downloads have been scanned for viruses and are safe, this process can sometimes fail. I have no control over the content of other sites listed on the links page and cannot be held responsible for their content. If it is brought to my attention that a linked site contains content which is not considered legal and decent, it will be removed forthwith. E&OE.

Custom website design, Copyright of N.D.Green (normsweb.com) 01-11-2009 - Do Not Reproduce without permission.