IBM T22 CMOS Battery Connector

  • Thread starter Thread starter Searcher7
  • Start date Start date
Patrick said:
I have found this;
http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/

Hardware-wise it requires a few Resistors and Diodes, another PC with a
SerialPort and a plug to go into said SerialPort.

Here is the address to get the required Software;
http://www.allservice.ro/store/utils/

Or download the two ZIP files from DropBox where I have copied them
https://www.dropbox.com/s/fqrhlue845iruwg/r24rf08_setup.zip?m
https://www.dropbox.com/s/rapgeymaduvewre/setup_ibmpass21.zip?m

The Romanian site (or at least, some Romanian site) used to charge $50 :-)

And when I saw that solution advertised for $50, at the time there
were no details about electrical connections. It was just "give us
the $50 and we give you a solution".

As for the circuit, I had to think about that for a moment.

http://sodoityourself.com/wp-content/uploads/2006/12/circuit.JPG

The Zener diodes, clip the bipolar signals on both sides. The
Zener limits positive going signals to +5V, and in the other direction,
clips to -0.7V. If I was building that circuit, I'd put a Schottky
in parallel with each Zener, as the Schottky can clip a bit lower
than the 0.7V value, and then the 24F08 is better protected against
any potential undershoot. (RS232 can span -25V to +25V, but normally
computer implementations are limited to -12V to +12V by the power supply
available.)

Also, you don't have to solder to the DIP. You could make the
connection with any of several different styles of logic
analyzer clips. You can also get circular leads that slide
over the ends of these clips.

http://www.eleshop.nl/images/product_ZP-icclip1.jpg

We used to have all sorts of these for the lab, even big
ones for the big DIPs they made years ago. This is a better
brand (smooth pins on the top).

http://www.pctestinstruments.com/images/dip_clip.jpg

There are various kinds of grabber clips, and you can
get some along the same lines as these, for clipping to
ICs with closer lead spacing. But these can be expensive.
So this is another way of clipping onto the 8 pin DIP.

http://www.sinequanon.co.uk/images/FD2K4.JPG

Here's another example of a grabber clip in action, so
you don't have to solder to the board.

http://img.auctiva.com/imgdata/1/1/3/9/7/6/3/webimg/404429593_o.jpg

That looks like a fun project.

Paul
 
Patrick said:
I have found this;
http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/

Hardware-wise it requires a few Resistors and Diodes, another PC with
a SerialPort and a plug to go into said SerialPort.

Here is the address to get the required Software;
http://www.allservice.ro/store/utils/

Or download the two ZIP files from DropBox where I have copied them
https://www.dropbox.com/s/fqrhlue845iruwg/r24rf08_setup.zip?m
https://www.dropbox.com/s/rapgeymaduvewre/setup_ibmpass21.zip?m

Something else that I have found is that the significant/relevant chip
(ATMEL 24RF08) is underneath the Memory module bay on the my T22. It's a 7*2
(14) pin chip, (Google the chipname to see 2 versions, 14pin and 8pin).
 
(e-mail address removed)2.com wrote: > On Friday, March 22, 2013 3:24:33 AM UTC-4, Paul wrote: >> Patrick wrote: >> >>> (e-mail address removed)2.com wrote: >>>> On Thursday, March 21, 2013 9:37:46 AM UTC-4, Patrick wrote: >>>>> Patrick wrote: >>>>>> (e-mail address removed)2.com wrote: >>>>>>> On Monday, March 18,2013 10:13:47 PM UTC-4, Patrick wrote: >>>>>>>> (e-mail address removed)2.com wrote: >>>>>>>>> I was given an IBM T22 laptop about 4-1/2 years ago and it has >>>>>>>>> been >>>>>>>>> gathering dust ever since. >>>>>>>>> I took it out and powered on, but there is a password set and so >>>>>>>>> I >>>>>>>>Do you mean that the BIOS has a password or that the >>>>>>>> OperatingSystem >>>>>>>> has a >>>>>>>> password ? >>>>>>> I'm guessing the BIOS. >>>>>>> Darren Harris >>>>>>> Staten Island, New York. >>>>>> So what error report do you get when you turn it on, do you perhaps >>>>>> get a blank screenor a screen with a single '-' cursor flashing in >>>>>> the top-left, or; >>>>>> Do you get this screen; >>>>> Sorry, I gave a wrong link, heres the right one ! >>>>> https://www.dropbox.com/s/1tp845a98m8u2jq/DCP00610.JPG?m >>>>>> I have just been messing with mine and the CPU-fan is now working, I>>>>>> am running on AC (Mains). >>>>>> I have disconnected the CMOS-battery to see if it still boots and it >>>>>> does and I get the above Screen. >>>>>> If I press F1 to go into the BIOS, it complains but goes into the >>>>>> BIOS. >>>> Yes. I get that screen. >>>> I decided to pull some more and this time the connector came out with >>>> the red wire. >>>> I put the main battery back in and powered up. But for some reason I >>>> still need apassword regardless of whether I wait, press F1 or F12. >>>> http://i290.photobucket.com/albums/ll257/Statenislander/Computer/IBM1_zps9303f75f.jpg >>>> http://i290.photobucket.com/albums/ll257/Statenislander/Computer/IBM2_zpsd628a163.jpg >>>> http://i290.photobucket.com/albums/ll257/Statenislander/Computer/IBM3_zpsd152c60c.jpg >>> Looks bad, apparently if it's a 'Supervisor Password' the only option is the >>> right PW or a new Mobo. >>> Heres alink to a 'Lenova' T2X forum anyway; >>> http://forum.thinkpads.com/viewforum.php?f=28 >>> http://i290.photobucket.com/albums/ll257/Statenislander/Computer/IBM4_zpsdeb9a7f6.jpg >>>> Thanks. >>>> Darren Harris >>>> Staten Island, New York. >> >> >> There are two kinds of hardware implementations. >> >> >> >> 1) Trivial kind. Both passwords are stored in CMOS RAM. Pull >>>> the battery, and "poof!", no more password. Low security >> >> computers use this method. I like this implementation, >> >> because the user is not lulled into a false sense of security. >> >> >> >> 2) Business people expect high security ( :-) ) computers. >> >> For this purpose, some of the business laptops, use a >> >> separate 2K EEPROM to hold the password. You can pull >> >> the CMOS battery all you want, and you aren't going to >> >> erase that one. For the wily hacker, this is no problem at all. >> >> For the end user, it's a disaster. >> >> >> >> So that's the challenge you could be facing, depending >> >> on the situation. The password can be hiding in an EEPROM. >> >> >> >> And when hacking computers like that, remember that some >> >> of them are wired to self-destruct. For example, some >> >> computer hard drives, the contents are encrypted, and >> >> are *relying* on TPM information to work properly. >> >> If, in your ultimate cleverness, you decide to reset the TPM, >> >> you could forever lose access to the encrypted information. >> >> So some of the implementations in modern computers, if you >> >> "reset them", it could lead to data loss. (The owner of the >> >> computer, was probably too stupid to make the "key disk" to >> >> recover the data in an emergency. Usually situations like that, >> >> the manufacturer provides a second method so there won't be >> >> data loss. You have to prepare the recovery floppy or USB >> >> key in advance.) >> >> >> >> There are even a few computers, where you can't add hard drives >> >> to the computer, without the drive being "branded". So something >> >> is written to the disk, to make it "acceptable" to the computer. >> >> If the end-usergoes to Walmart and buys a hard drive, they >> >> discover it just won't work. >> >> >> >> While for the most part, modern computers are "open" systems, >> >> you will occasionally run into surprises. And the "I can't >> >> erase the password" problem, is one of the more common >> >> surprises. Anda business-class laptop, is more likely >> >> to use the EEPROM method. All my computers I have here, >> >> are the low security kind - pulling the battery, is the >> >> only procedure I need. >> >> >> >> Paul > > Can EPROMSbe de-soldered form the PCB? Or the data intentionally overwritten? (Provided that is my problem). I'd of course have to locate the chip. > > And while we're on the subject of Lenovo PCs, I'll check out that forum Patrick mentioned. > > BTW. I have some disks. Does anyone know what PC uses these?: > http://i290.photobucket.com/albums/...LenovoRescueandRecoveryDiscXP_zps1c781109.jpg > http://i290.photobucket.com/albums/...novoProductRecoverydiscXPSP31_zpsdcfac635.jpg > http://i290.photobucket.com/albums/...novoProductRecoverydiscXPSP32_zps2d00385b.jpg > > Thanks. > > Darren Harris > Staten Island, New York. Discs like that, could be used on more than one model of computer. The software is activated by the presence of "SLIC" info in the Lenovo BIOS. The idea is, if I try to install that disc on my Asus motherboard, then the OS shouldn't activate. Whereas, if a Lenovo BIOS is present on the motherboard, the OS should be activated immediately. Whether that disc works on everything, may depend on drivers. If the BIOS, IDE interfaces are set to Compatible or Enhanced, then the default disk drivers may work immediately. And perhaps you'd need to add video drivers, to make the installation complete (if the computer is different than the one it was intended for). If you were using a newer computer, with the interface jammed into AHCI mode, then maybe it wouldn't boot after installation. I've even heard of a few discs, older ones, where they work with any motherboard (when really, they shouldn't). Undoubtedly, someone out there knows all the ins and outs of those things, where they'll work and won't work. If they're Lenovo branded, then try them on a Lenovo computer. See the "SLIC" section here for more details. SLIC is for "branded OEM" discs. http://en.wikipedia.org/wiki/BIOS#SLIC Paul

Thanks.

I'll have to look into what I may get that would make these discs useful. I'd hate to have to throw them out.

Darren Harris
Staten Island, New York.
 
(e-mail address removed)2.com wrote: > On Friday, March 22, 2013 3:24:33 AM UTC-4, Paul wrote: >> Patrick wrote: >> >>> (e-mail address removed)2.com wrote: >> >>>> On Thursday, March 21, 2013 9:37:46 AM UTC-4, Patrick wrote: >> >>>>> Patrick wrote: >> >>>>> >> >>>>>> (e-mail address removed)2.com wrote: >> >>>>>>>On Monday, March 18, 2013 10:13:47 PM UTC-4, Patrick wrote: >> >>>>>>>> (e-mail address removed)2.com wrote: >> > > Can EPROMS be de-soldered form the PCB?Or the data intentionally > overwritten? (Provided that is my problem). I'd of course have to > locate the chip. I have found this; http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/ Hardware-wise it requires a few Resistors and Diodes, another PC with a SerialPort and a plug to go into said SerialPort. Here is the address to get the required Software; http://www.allservice.ro/store/utils/ Or download the two ZIP files from DropBox where I have copied them https://www.dropbox.com/s/fqrhlue845iruwg/r24rf08_setup.zip?m https://www.dropbox.com/s/rapgeymaduvewre/setup_ibmpass21.zip?m >

Thanks.

It looks like that might be my only option.

Darren Harris
Staten Island, New York.
 
(e-mail address removed)2.com wrote: > On Friday, March 22, 2013 3:24:33 AM UTC-4, Paul wrote: >> Patrick wrote: >> >>> (e-mail address removed)2.com wrote: >> >>>> On Thursday, March 21, 2013 9:37:46 AM UTC-4, Patrick wrote: >> >>>>> Patrick wrote: >> >>>>> >> >>>>>> (e-mail address removed)2.com wrote: >> >>>>>>>On Monday, March 18, 2013 10:13:47 PM UTC-4, Patrick wrote: >> >>>>>>>> (e-mail address removed)2.com wrote: >> > > Can EPROMS be de-soldered form the PCB?Or the data intentionally > overwritten? (Provided that is my problem). I'd of course have to > locate the chip. On my T22, I found the chip (ATMEL 24RF08CT) to be under the MemoryBay cover, please see these pictures, one with a memory card and the other with the MemCard removed. https://www.dropbox.com/sh/bamxk31w7qnauup/VkQb2norJo?m#/

So I can only assume that it is in the same location on mine.

I was curious. On this page I saw some apps that are basically password finders. (Some links don't work and you have to plug the info into Google to find latest versions).

http://www.bioscentral.com/misc/downloads.htm

Is it plausible I maight find an option like that to use?

Thanks.

Darren Harris
Staten Island, New York.
 
On my T22, I found the chip (ATMEL 24RF08CT) to be under the MemoryBay

cover, please see these pictures, one with a memory card and the other with

the MemCard removed.

https://www.dropbox.com/sh/bamxk31w7qnauup/VkQb2norJo?m#/

I found mine in the same location.

http://i290.photobucket.com/albums/ll257/Statenislander/Computer/ATMELF24RF08CT0051_zps554bb7be.jpg

The problem now is that it is the 14 pin chip. I'm not sure what size wire I should be using, but I have tons of 18 and 20 gauge, which are obviously too large. Not to mention my lately unsteady hands.

(If small wire is not sold at Radio Shack I have a problem).

Darren Harris
Staten Island, New York.
 

Good picture that!

Heres a few pictures that might be usefull and that you may not have seen!
(Like the one where the 'mask' is used to protect rest of the PCB (like
doing medical-surgery :) ))
..
The problem now is that it is the 14 pin chip. I'm not sure what size
wire I should be using, but I have tons of 18 and 20 gauge, which are
obviously too large. Not to mention my lately unsteady hands.

(If small wire is not sold at Radio Shack I have a problem).

On the forum where it is discussed, the best idea seemed to be to connect
the Gnd wire to the VGA screw, and then to solder needles to the other two
wires from the interface and use them as probes to the IC until the program
has finished. (assistant needed to press 'Enter' etc.,)
 
Heres a few pictures that might be usefull and that you may not have seen!

(Like the one where the 'mask' is used to protect rest of the PCB (like

doing medical-surgery :) ))

.







On the forum where it is discussed, the best idea seemed to be to connect

the Gnd wire to the VGA screw, and then to solder needles to the other two

wires from the interface and use them as probes to the IC until the program

has finished. (assistant needed to press 'Enter' etc.,)

I didn't see what pics you were referring to, but the instructions on how to do this assume that you know what is and how to use a command prompt, so I have to figure that out and following these instructions:

--------------------------------------------------------------------------------
"Fire up a command promt(Start->run type cmd) and navigate to the folder where you installed R24RF08 v2.0b. Type in (don’t hit Enter):
r24rf08 dump.bin"
--------------------------------------------------------------------------------

What doesn't make sense is #4 of the following instructions:

--------------------------------------------------------------------------------
1) Turn on your ThinkPad with all the wiring you just soldered.
2) Press F1 during the startup to enter the BIOS.
3) Wait untill all activity stops, blinking HDD leds and such.
4) Connect the ATMEL Chip reader. GND first then the SDA and SCL.
5) Now go to your spare PC and Hit enter on the command prompt.
--------------------------------------------------------------------------------

If everthing is already connected to the serial port, which is connected toyour spare pc, then what is #4 for?

(I'm certain I'll hit another roadblock after this).

Thanks.

Darren Harris
Staten Island, New York.
 
I didn't see what pics you were referring to, but the instructions on how to do this assume that you know what is and how to use a command prompt, so I have to figure that out and following these instructions:

--------------------------------------------------------------------------------
"Fire up a command promt(Start->run type cmd) and navigate to the folder where you installed R24RF08 v2.0b. Type in (don’t hit Enter):
r24rf08 dump.bin"
--------------------------------------------------------------------------------

What doesn't make sense is #4 of the following instructions:

--------------------------------------------------------------------------------
1) Turn on your ThinkPad with all the wiring you just soldered.
2) Press F1 during the startup to enter the BIOS.
3) Wait untill all activity stops, blinking HDD leds and such.
4) Connect the ATMEL Chip reader. GND first then the SDA and SCL.
5) Now go to your spare PC and Hit enter on the command prompt.
--------------------------------------------------------------------------------

If everthing is already connected to the serial port, which is connected to your spare pc, then what is #4 for?

(I'm certain I'll hit another roadblock after this).

Thanks.

Darren Harris
Staten Island, New York.

This step on the one PC (capturing PC), prepares a command, but
doesn't start executing or anything. It would not start executing,
until you hit Enter. You've been asked, *not* to press Enter yet.

Type in (don’t hit Enter): r24rf08 dump.bin

That is the program which is going to record some serial information
into dump.bin.

(I can see a reference to 24RF08 here, a part I'm not familiar with...

http://www.thinkwiki.org/wiki/AT24RF08 )

The other instructions 1) to 5), prepare the target machine. Connecting
the ATMEL Chip reader, now your target SDA (data) and SDL (clock) are
connected to something.

Going back to the recording machine, where the "r24rf08 dump.bin"
is sitting in the command prompt, you haven't hit "Enter" yet.
When you hit Enter, the program you're about to run, assumes the
ATMEL Chip reader is already connected, and it's going to run SDA and SCL
until some device is dumped. Apparently "r24rf08 dump.bin" collects
data immediately, which is why you don't hit Enter until everything
is wired up (and the target machine is in a known state, quiet in
the BIOS).

Paul
 
I didn't see what pics you were referring to, but the instructions on how to
do this assume that you know what is and how to use a command prompt, so I
have to figure that out and following these instructions:
Sorry, I may have given wrong link!
Here are the pictures alltogether;
https://www.dropbox.com/sh/9jgu35n7iwvnliw/jPK6H0HjAF

Here are the pictures individually;
Picture showing wires connected to 24RF08
https://www.dropbox.com/s/3r5mud3ka0v9rw6/24RF08.jpg

Picture of the 14pin version of the 24RF08
https://www.dropbox.com/s/reolj65ix7ih4pz/24rf08_14_pinOUT.jpg

Picture of 8pin version of 24RF08
https://www.dropbox.com/s/cyt4kk2k8stqgrt/24RF08_eeprom.jpg

Another picture of 14pin 24RF08
https://www.dropbox.com/s/gwh70cn5pbp0hsi/24rf08closea.jpg

Diagram of both versions (15 and 8 pin)
https://www.dropbox.com/s/zskvym9ohfibxem/EEPROMpic.gif

Picture of the MoBo being Masked with insulating-tape but leaving the
24RF08 clear
https://www.dropbox.com/s/5w59st80fbw8emv/imagesCAG3IWR0.jpg

Picture of (somepersons) finished connector
https://www.dropbox.com/s/d5xwstvw9xdaxri/rimg0201ra5.jpg

Picture of the T22 with (3) wires soldered to the 24RF08
https://www.dropbox.com/s/0427j78jtxnm8l3/T22_case.jpg


--------------------------------------------------------------------------------
"Fire up a command promt(Start->run type cmd) and navigate to the folder
where you installed R24RF08 v2.0b. Type in (don’t hit Enter): r24rf08
dump.bin"
--------------------------------------------------------------------------------

What doesn't make sense is #4 of the following instructions:

--------------------------------------------------------------------------------
1) Turn on your ThinkPad with all the wiring you just soldered.
2) Press F1 during the startup to enter the BIOS.
3) Wait untill all activity stops, blinking HDD leds and such.
4) Connect the ATMEL Chip reader. GND first then the SDA and SCL.
5) Now go to your spare PC and Hit enter on the command prompt.
--------------------------------------------------------------------------------

If everthing is already connected to the serial port, which is connected to
your spare pc, then what is #4 for?

(I'm certain I'll hit another roadblock after this).

As far as I understand, if the T22 and the work PC are connected before
both machines are Booted, then they may interfere with each other. Thus
you would connected the wires after both are booted and the PC is ready
to run the Program (GND can be be preconnected though).

See as in the pictures, you have wires from the T22 just dangling and
ready to be connected to the Alligator-clips that are on the
'Interface' plugged into the (Service) PC.
 
This step on the one PC (capturing PC), prepares a command, but

doesn't start executing or anything. It would not start executing,

until you hit Enter. You've been asked, *not* to press Enter yet.



Type in (don’t hit Enter): r24rf08 dump.bin



That is the program which is going to record some serial information

into dump.bin.



(I can see a reference to 24RF08 here, a part I'm not familiar with...



http://www.thinkwiki.org/wiki/AT24RF08 )



The other instructions 1) to 5), prepare the target machine. Connecting

the ATMEL Chip reader, now your target SDA (data) and SDL (clock) are

connected to something.



Going back to the recording machine, where the "r24rf08 dump.bin"

is sitting in the command prompt, you haven't hit "Enter" yet.

When you hit Enter, the program you're about to run, assumes the

ATMEL Chip reader is already connected, and it's going to run SDA and SCL

until some device is dumped. Apparently "r24rf08 dump.bin" collects

data immediately, which is why you don't hit Enter until everything

is wired up (and the target machine is in a known state, quiet in

the BIOS).



Paul

Ok, after some research I found that all I have to do is put "cmd" in "Run"and a command prompt box pops up.

I'll ust (try to) make up the harness and then plug it into the spare pc *after* boot-up.

(Back to the harness).

Thanks.

Darren Harris
Staten Island, New York.
 
Sorry, I may have given wrong link!

Here are the pictures alltogether;

https://www.dropbox.com/sh/9jgu35n7iwvnliw/jPK6H0HjAF



Here are the pictures individually;

Picture showing wires connected to 24RF08

https://www.dropbox.com/s/3r5mud3ka0v9rw6/24RF08.jpg



Picture of the 14pin version of the 24RF08

https://www.dropbox.com/s/reolj65ix7ih4pz/24rf08_14_pinOUT.jpg



Picture of 8pin version of 24RF08

https://www.dropbox.com/s/cyt4kk2k8stqgrt/24RF08_eeprom.jpg



Another picture of 14pin 24RF08

https://www.dropbox.com/s/gwh70cn5pbp0hsi/24rf08closea.jpg



Diagram of both versions (15 and 8 pin)

https://www.dropbox.com/s/zskvym9ohfibxem/EEPROMpic.gif



Picture of the MoBo being Masked with insulating-tape but leaving the

24RF08 clear

https://www.dropbox.com/s/5w59st80fbw8emv/imagesCAG3IWR0.jpg



Picture of (somepersons) finished connector

https://www.dropbox.com/s/d5xwstvw9xdaxri/rimg0201ra5.jpg



Picture of the T22 with (3) wires soldered to the 24RF08

https://www.dropbox.com/s/0427j78jtxnm8l3/T22_case.jpg


















As far as I understand, if the T22 and the work PC are connected before

both machines are Booted, then they may interfere with each other. Thus

you would connected the wires after both are booted and the PC is ready

to run the Program (GND can be be preconnected though).



See as in the pictures, you have wires from the T22 just dangling and

ready to be connected to the Alligator-clips that are on the

'Interface' plugged into the (Service) PC.

I spent hours trying to solder the leads to that chip. (And I have relatively steady hands).

I'll now have to get some solder off that is bridging a couple of the legs,and then try again. Though I may have already toasted the chip because theiron brushed over it a couple times. (That needle idea just doesn't work).

And now after seeing those pic links you posted I realized that I've been attempting to solder the leads to the incorrect legs anyway. (sigh).

Thanks.

Darren Harris
Staten Island, New York.
 
now have to get some solder off that is bridging a couple of the legs,
and then try again. Though I may have already toasted the chip because
the iron brushed over it a couple times. (That needle idea just
doesn't work).

-
Get an extra set of 4 tips for free shipping (got the soldersucker,
shrinkwrap, flux, tip rejuvinator paste, solder, 3rd-hands, etc. -
best prices from Singapore).

I've done minature 9- and 6- pin toggle switches and the tip's
adaptable and controllable - reasonably, there's no actual temp sensor
in the tip for something a quarter the price of a variable temp
soldering station. Very fine and close to whatever you're doing, I'd
imagine - I had to use magnifiers and lights to see the connects. It's
the very fine tip I mostly use among 4 provided.

I've $6 irons for beaters and up to a plumber's grade iron for big
stuff.

http://www.amazon.com/Soldering-Station-Features-Continuously-Variable/dp/B0029N70WM
 
Slew of bad reviews more of recent (bought mine awhile ago and it's
older) - bad Chinese assembly QC, localised to the wand with the wires
too long and abutting the heater element, where they shouldn't.
Evidently causes the unit to short and burns it out.

Took apart my wand and don't see the wiring issues, so hard to
describle what the fix is. Works great, as also follows many other
reviews.

Anyway, it required a two special screws to get the wand apart.
Luckily I had the right screw tip in a $3 Chinese cellphone
disassembly kit:

HOSHE HS-6036A (found it on Ebay's Singapore market).
 
Back
Top