Thinkpad supervisor password removal

[Andy Cuffe]

I was playing around with a junk Thinkpad 390E laptop I've had for a
while. It's one which had the supervisor password set and ended up
being used as a parts donor. The supervisor password is stored on an
EEPROM and can't be bypassed, or removed without replacing the
motherboard, or using a password recovery service, or buying and
installing a new preprogrammed EEPROM. None of these options are cost
effective for such an old laptop.

Just for fun I decided to remove the password EEPROM from the
motherboard to see what happened. Much to my surprise it powered up
and let me into BIOS setup without asking for a password, or reporting
any errors. I installed a hard drive and it booted to windows without
any problems. I went into setup again and set a supervisor password,
then rebooted. Not surprisingly it reported no password set when I
enter setup.

I haven't had a chance to test it much, but it seems like it look like
it would function fine. I can't believe it's this easy and no one has
posted this as a way to save a password protected thinkpad. I wonder
if this would work for other models?
Andy Cuffe
[email protected]

 

[William R. Walsh]

Hi!

This might work just fine on the Thinkpads, but there is a "gotcha" on some
of its full grown relations like the late model IBM PS/2 systems. Replacing
the offending chip seems to help, but eventually a "VPD" error occurs. I've
not experienced this problem personally (because I don't set those kind of
passwords!) but I've heard of other folks encountering it.

You may have nailed exactly what is done...but be watching for this error.

William

 

[Andy Cuffe]

Hi!

This might work just fine on the Thinkpads, but there is a "gotcha" on some
of its full grown relations like the late model IBM PS/2 systems. Replacing
the offending chip seems to help, but eventually a "VPD" error occurs. I've
not experienced this problem personally (because I don't set those kind of
passwords!) but I've heard of other folks encountering it.

You may have nailed exactly what is done...but be watching for this error.

William

Thanks for the warning. I'll be curious to see if there are any
hidden side effects. I plan to use this as spare that I can use in
situations where I wouldn't want to risk my good laptop. I will post
back if anything unusual happens. I'm wondering what might happen
when I update the BIOS. I also wonder if replacing the EEPROM, or
erasing it would allow the password to work? I had read that there
was some kind of checksum on the EEPROM to prevent you from just
erasing it. Although, I would actually prefer not to have the
supervisor password option at all. If you set it you risk forgetting
it and if you don't set it you risk someone else locking you out of
your own computer.
Andy Cuffe
[email protected]

 

[Rich.Andrews]

Thanks for the warning. I'll be curious to see if there are any
hidden side effects. I plan to use this as spare that I can use in
situations where I wouldn't want to risk my good laptop. I will post
back if anything unusual happens. I'm wondering what might happen
when I update the BIOS. I also wonder if replacing the EEPROM, or
erasing it would allow the password to work? I had read that there
was some kind of checksum on the EEPROM to prevent you from just
erasing it. Although, I would actually prefer not to have the
supervisor password option at all. If you set it you risk forgetting
it and if you don't set it you risk someone else locking you out of
your own computer.
Andy Cuffe
[email protected]

While I don't recommend it, I have heard of some people plugging in the
old eeprom while powered up and in the bios password change section. Re-
assigning a new password would be trivial provided it didn't ask for the
old password before setting the new one.

r

 

[Tim]

Would like to try it out myself. Where do I find the EEPROM. I am
following the hardware manual instructions to remove/replace the system
board. Am I on the right track here?

 

[Andy Cuffe]

While I don't recommend it, I have heard of some people plugging in the
old eeprom while powered up and in the bios password change section. Re-
assigning a new password would be trivial provided it didn't ask for the
old password before setting the new one.

r

I was curious about that today and tried soldering the EEPROM back in
except for the SDA pin. I can get into setup and it lets me set a
password, but I haven't been able to get it to write it to the EEPROM.
I've tried reconnecting the SDA pin at various times in the process,
but it never seems to write anything to the EEPROM. I think it must
double check the old password just before it writes the new one. The
EEPROM used (24RF08) is designed for RFID systems as it has a built in
RF interface which isn't used in the thinkpad. If I had time I would
build a circuit to let me download its contents into my PC.
Andy Cuffe
[email protected]

 

[Andy Cuffe]

Would like to try it out myself. Where do I find the EEPROM. I am
following the hardware manual instructions to remove/replace the system
board. Am I on the right track here?

The IC is a 24RF08 and is located on the motherboard just to the left
of the LCD connector. You have to remove the LCD, keyboard and entire
top cover to get to it.
Andy Cuffe
[email protected]

 

[Tim]

Thanks so much, Andy. I managed to remove the IC, and there you go: No
password! I have been using the system with a Linux OS for the last few
days - no problems whatsover. Thanks, again!