IBM thinkpad t61 bios hacking

[dave11674]

hi guys

my t61 just went tits up
updated bios and now i get password prompt

ive read up and managed to dump the eeprom
loaded it into IBMtools 2.1 lite but not showing the passy
i can see some ascii text so i know its dumped ok :)
ive checked the lines where it says the password is kept
but its all jargon
so thinking it encrypted

any1 got any ideas or tools

thanks
dave

[Cyrusxxx]

I had simmilar problem.
This might help you.


Service Forum :: View topic - [Tutorial] How to unlock ThinkPad supervisor password (http://www.allservice.ro/forum/viewtopic.php?t=47&sid=2119666e92c0b1c41b20b6699fd88805)


But be warned this can be dangerous.If you are not capable of doing this right dont try it.

[CuteLinux]

Try decode it with IBMpass if you get RF, it's TCPA locked, you will need a patched eeprom dump and a eeprom writer.
Good Luck :)

[yullah]

Try decode it with IBMpass if you get RF, it's TCPA locked, you will need a patched eeprom dump and a eeprom writer.
Good Luck :)

please where is the eeprom located on t61 board, and where can the software be downloaded?

[CuteLinux]

Lenovo T61 save the keypass in a P24S08 EEPROM Chip (24RF08 clone) .

Steps:
1) Dismantle the Laptop, the EEPROM Chip located on the MOBO
T61 EEPROM Location (http://www.allservice.ro/forum/images/T61-1.jpg)
T61 EEPROM Location closer (http://www.allservice.ro/forum/images/T61-2.jpg)

2) Use a serial interface Reader and the R24RF08 program
>> R24RF08 download (http://www.allservice.ro/store/utils/r24rf08_setup.zip)

3 Read the eeprom dump password with IBMpass 2.1
>> IbmPass2.1 download (http://www.allservice.ro/store/utils/setup_ibmpass21.zip)

The interface Schema
>> i2cprog pdf download (http://www.allservice.ro/forum/dl/driven-i2cprog.pdf)

Have a nice Hacking :nurse:

[moldavanin]

ibmpass 2.1 don't work - password in eeprom is:
E3 D9 5E A8 F9 40 99 3E
it (programm) have not valid solution

[moldavanin]

for previous: I have T61P

[ass007]

I got T400, i managed to get hex dump from P24SO8 -- but turns out password in line 0x380 is encripted by some sort of TCPA circut. allservice.ro offers p24SO8 modified hex file, but they ask $55. I like to have some hex dump with unencripted passwords to reverse enginer it myown.

[ass007]

ibmpass 2.1 don't work - password in eeprom is:
E3 D9 5E A8 F9 40 99 3E
it (programm) have not valid solution

If i get example of unencripted password hex dump, i will definitely try to reverse enginere suitable eeprom hex for lenovo t400

[moldavanin]

Type message whith 388-38f data (like me) , I'll try decode
this string.

[deffc0n]

Who read 24RF08 UPA or diffrent programmer this eeprom ?

[mobitel]

ibmpass 2.1 don't work - password in eeprom is:
C1 C2 26 60 94 28 A6 15

[hugo000000]

Hello,
Just wondering if anyone have dump of BIOS for the X120E (X100E) my is in this moment bricked (lost of the power when flashing) so I need to u/p new BIOS.
thank you

[dave11674]

Hello,
Just wondering if anyone have dump of BIOS for the X120E (X100E) my is in this moment bricked (lost of the power when flashing) so I need to u/p new BIOS.
thank you


search on the laptop maker website for a bios image and flash that

worked for me in the past

dave

[hugo000000]

Hi Dave,
The image is for nothing for me, the Thinkpad is dead (as brick) so I can NOT load anything without start at lease little be
hugo

[ghass]

hi i have t61 have a password and i have wellon progrramer but i need the file which i need to replace with the old file on the eeprom ic anyone can help??

[XStoneX]

Hi @ all,

I also have a T400 with a SVP from a collegue which died several weeks ago. Now I successfully dumped the eeprom, but its encrypted.

Is there anybody outside who has a clear T400 eeprom dump to write? In this case I'm happy to receive a private message!

Thanks a lot!

Greetz,

XStoneX

[pkwonder]

Anyone manage to to sort their encypted dump?

[astrovida]

have the same problem here t61 unlock svp

[pckolev]

Hi, this is a new bin file to overwrite T61
DOX.bg - ???? ??????????? ?? ????? ????????? ? ?????????? ?? ??????? (http://dox.bg/files/dw?a=949bfb5927)

[pckolev]

[QUOTE=pckolev;1594629]Hi, this is a new bin file to overwrite T61
DOX.bg - ???? ??????????? ?? ????? ????????? ? ?????????? ?? ??????? (http://dox.bg/files/dw?a=949bfb5927)

[terorero]

Hi, this is a new bin file to overwrite T61
DOX.bg - ???? ??????????? ?? ????? ????????? ? ?????????? ?? ??????? (http://dox.bg/files/dw?a=949bfb5927)

Kolev, how the binary must be written to the EEPROM?
I have used PonyProg to read the data, but I can't write in the chip whit this software. I mean when the chip is soldered on tne MB, and laptop is on and waiting for Supervisor Password.
Must I desolder the chip and write tha data?

Thanks in advance!

[euroscan]

- read manual from w24rf08.
- must read APP -> Access Protection Page.
- problem is how to correct eeprom

[rjinsun7]

have the same problem here t61 unlock svp

[pckolev]

Hey, who wants to send bin file read by eeprom I'll fix it and return it by mail this is my mail pckolev@abv.bg

[tod00Rs]

Hi.
Can anyone tell me how to read bin file from eeprom chip?
My laptop is Lenovo R60.

[stevie155]

i have t410 s08 dump dont know if that will help

[soakdigital]

As others have reported, my T400 eeprom seems to have an encrypted SVP. Would writing a dump from a T400 with no SVP set do the unlock?

[khalidali230]

HI
I need dump thinkpad r60 bios

[tantum]

hello for alll i have the same problem wuth the t61
can any one send the software to me
R24RF08 v2.0b
IBMpass v2.1 Lite

and tell me how to remove the supervisour password

[witek]

Does anybody know if s08 from R400 is good for R61 ?

I have working R400, but is it worth disassembly to read eeprom and write it to R61 ?

[Widisgudd]

Hi to all. I have a r400 model 7439-bd9. Before doing anything I would like to know if the SVP for this TP is TCPA protected. Thanks.

[ferretuk]

There is a chap on ebay who will sell you a bios chip you tell him your model he sends you the chip you solder it in and it works

[babina]

hello, i have Lenovo T61, dumped eeprom and now i need patch and write back, is avaiable patcher for this?must be patched invidualy eeprom or patched eeprom is universal??thanks

[pckolev]

Hey, who wants to send bin file read by eeprom I'll fix it and return it by mail this is my mail


No emails please

[largi]

Anyone have some details on how to modify an eeprom dump correctly?

[amourh59]

hello , i ahve a IBM T400
I have password , i have read the eeprom and i decode dump with ibm pass 2.1 lite
the password is in the line 0x330
i have founde somme like thiS : F 9f Y
I TRY THIS PASSWORD MANY TIMES but it's not word

can you help me please ?
this is the dump :
270430270430270430

[rithien]

hello , i ahve a IBM T400
I have password , i have read the eeprom and i decode dump with ibm pass 2.1 lite
the password is in the line 0x330
i have founde somme like thiS : F 9f Y
I TRY THIS PASSWORD MANY TIMES but it's not word

can you help me please ?
this is the dump :
270430270430270430

Your file doesn't have plain password. If long passwords is enabled only password hash is stored in eeprom memory
Write attachment to memory and your password will be 1234567
270596

[amourh59]

GREAT THANKS rithien (http://www.digital-kaos.co.uk/forums/members/359796-rithien/)
IT'S WORK

[jjjj72]

I am able to read my eprom from T500 using simple i2cprog connector but password has funny looking characters.
I edited bin file with with password 123457 but when I try to use w24rf08 to rewrite eprom. The program shows error "unable to open source file". Please help

[rithien]

I am able to read my eprom from T500 using simple i2cprog connector but password has funny looking characters.
I edited bin file with with password 123457 but when I try to use w24rf08 to rewrite eprom. The program shows error "unable to open source file". Please help

Ponyprog doesn't read correctly 24rf08
As I remember all eeprom pages is doubled.
Send me your dump to: bios(at)biospassword.eu

[JoeeC]

Hey, Hey,

same on my T400: w24rf08 say "unable to open source file" even if I just try to unlock with the /P switch.

Can I use the previous posted hex file ibm_1234567.bin or do I need a special one?

Here is my eeprom dump:
277322


Greetz from Oktoberfest ;-)

[AndromedaC]

@Rithien - you are a legend:-)!

I was about to send my eeprom dump to allservice.ro, when I came across this thread.
I had already tried inserting ff into 0x338 to 0x33f, and 0x340 to 0x347. when I uploaded using w24rf08, the laptop entered the bios with a simple 'enter', but NONE of the features were editable at all.
I had also tried changing the data to a name(i.e. david) but that gave a 170 error-bad SVP checksum.

Finally I cut and pasted your code from 0x338 - 0x33f and 0x340 - 0x347 to the same place in my dump, uploaded with w24rf08 and bingo! The SVP was 1234567!

My laptop is an R500 BTW

[AndromedaC]

@JoeeC

I have edited your uploaded eeprom to add the 1234567 password, see attached?
284261

[onkeltom]

Hi,

i read eeprom from my T61 with simple-i2cprog and USB to serial converter.
But when I open dump file with ibmpass the line 0x330 shows something like f `,
I can't enter it as SVP. Or is the SVP set with other keyboard layout? My keyboard layout is german.
Please tell me what to do. Any hints?
Please see attached dump.
284636

Greetings,
onkeltom

[AndromedaC]

@Onkeltom

I edited my dump to add Rithiens code at the above mentioned addresses, I have done this for yours also. You will need to program the attached dump with W24RF08:
284672.
Once uploaded the password should be 1234567!

[onkeltom]

@Onkeltom

I edited my dump to add Rithiens code at the above mentioned addresses, I have done this for yours also. You will need to program the attached dump with W24RF08:
284672.
Once uploaded the password should be 1234567!

Thank you AndromedaC

I sent private message.
Greetings,
onkeltom

[AndromedaC]

No problem Onkeltom:)!

You also have a PM!

[RCS]

Your file doesn't have plain password. If long passwords is enabled only password hash is stored in eeprom memory
Write attachment to memory and your password will be 1234567
270596

would this dump work for t42 (code from 0x338 - 0x33f and 0x340 - 0x347)?

[AndromedaC]

It's worth a shot to cut and paste the code from the address range shown, but only if you have w24rf08 to program. If it fails you can always re-flash the original dump and no harm done!

This was a T61 thread and it sorted my R500 SVP out!

[tccomp]

i need bios eeprom for IBM T61 please....

[Tuever1]

Hello. I am new here and come from germany.
I have a T400 with SVP. I have read the EEPROM, but IBM pass 1.2 light show only S 7f.
Can someone send me the ibm_pass1234567.rar?
Many Thanks to you!

[mrbaa]

Hi,

Can I use the T400 file on my T40 ?




Hello. I am new here and come from germany.
I have a T400 with SVP. I have read the EEPROM, but IBM pass 1.2 light show only S 7f.
Can someone send me the ibm_pass1234567.rar?
Many Thanks to you!

[block23]

please help me, does anybody have a T61 Bios rom or bin file?... i really need the dump file

Thanks in advanced

[mirkoslav]

I also need some help, have X61 Tablet EEPROM with TCPA, could anybody help me to make the laptop usable again? Bought without supervisor password, really need the laptop for studies, please help...

[drutort]

it took a lot of searching, there is so much confusion, im still trying to figure it out. Who would have thought that t60 would differ so much with t61's? and chips being all over the place sheesh. Though its very nice to have all this, be it some of these laptops are getting quite old, they are still nice for basic stuff

[drutort]

Lenovo T61 save the keypass in a P24S08 EEPROM Chip (24RF08 clone) .

Steps:
1) Dismantle the Laptop, the EEPROM Chip located on the MOBO
T61 EEPROM Location (http://www.allservice.ro/forum/images/T61-1.jpg)
T61 EEPROM Location closer (http://www.allservice.ro/forum/images/T61-2.jpg)

2) Use a serial interface Reader and the R24RF08 program
>> R24RF08 download (http://www.allservice.ro/store/utils/r24rf08_setup.zip)

3 Read the eeprom dump password with IBMpass 2.1
>> IbmPass2.1 download (http://www.allservice.ro/store/utils/setup_ibmpass21.zip)

The interface Schema
>> i2cprog pdf download (http://www.allservice.ro/forum/dl/driven-i2cprog.pdf)

Have a nice Hacking :nurse:

those pics wont load, but there is another site that has for a few models the chip location

T61 T61p (http://ja.axxs.net/t61_t61p.htm)

and another one for reference
? Hacking IBM Thinkpad Bios Password : SoDoItYourself.com (http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/)

also browse there forums, might find more clues? Its not as straightforward as one might think, because of updates and changes/discoveries for which ones work, were the chip could be etc..

http://www.allservice.ro/forum/viewforum.php?f=12

[drutort]

I also need some help, have X61 Tablet EEPROM with TCPA, could anybody help me to make the laptop usable again? Bought without supervisor password, really need the laptop for studies, please help...

don't see on x61 tablet listed only see
X60 Tablet (http://ja.axxs.net/x60tablet.htm)
X61 X61s X61t (http://ja.axxs.net/x61_s_t.htm)

the first battle is finding the chip and having the pin locations for SDA SCL

[sejhaj]

I've got a bunch of T400 thinkpads from a srap. SOme of them are working, some are for parts and some has SVP password set. Do you think if I read the P24S08 from my own working T400 and write the content into an other one it will work? Or is the EEPROM content is somehow linked to something else in the computer?
Thanks.

[jr59]

possible to read/write 24RF08 with UPA 1.2 clone?

[mogien]

Anybody tried to hack R61?

[shakaboonga]

Hi! Can anyone please help me with a clean (password free) dump for the ThinkPad T43?

[joujou12]

SALEM
Please pass off IBM R30 24FR08.
MERCI388712

[FreddyPL]

Hello,
I have R61, and I read chip with R24RF08 soft, but ibmpass2.2 lite doesn't work.
Psw is: 74 c5 e3 3d 84 35 f3 af
Can anybody help me with this password?

Can I use corret dump in any R61, or only with this one?
Can I try to use dum T61?

regards Freddy

[forex69]

Hello,
I have R61, and I read chip with R24RF08 soft, but ibmpass2.2 lite doesn't work.
Psw is: 74 c5 e3 3d 84 35 f3 af
Can anybody help me with this password?

Can I use corret dump in any R61, or only with this one?
Can I try to use dum T61?

regards Freddy
i have same problem with think pad t61 laptop passward