Power-On Password
Solution:  Clear CMOS/NVRAM settings.

Supervisor Password:
Solution:  Read password in keyboard scan-code format from system board serial EEPROM.  Maybe can use CMOSPWD to decode.
Solution:  Read EEPROM data via RFID on RFID-EEPROM equipped boards

HDD Password on non-ATA3 drives:
Solution:  Scan to last sector, look backwards in zero areas until the password
	in keyboard scan-code format is found.  Do this in a non-Thinkpad
	machine, or else (dangerous) hotswap with an unlocked drive with
	identical geometry after booting.
Solution:  Use bd980211.bin recovery disk.

HDD Password on ATA3 drives:
Solution:  Recover supervisor password from EEPROM.  ATA password is a
	mangled version of it.
Solution:  Hack firmware to ignore password.
Solution:  Brute force ATA password.  May require a firmware hack to prevent
	drive shutting down after 3 attempts.
Solution:  Swap drive PCB with an identical unlocked drive.
Solution:  (Dangerous) Swap drive PCB with an identical unlocked drive
	AFTER both drives have powered up successfully.
Solution:  Dump drive EEPROM and recover password from it (probably
	doesn't work since pw can be stored on disk).


If your TP hangs at any stage and the Power Switch does NOT switch it off.

Try this procedure, works on most TP's.

While Holding down the power button, press F1, F2, F3, F4, F5, F6 then back and forth F5, F4, F3, F2, F1, repeat till it switches off.

This is safer than removing main battery as removing main battery while TP is hung can corrupt eeprom contents leading to CRC errors and a useless TP.

Never power off a TP during POST since the EEPROM can easily be corrupted.

Use IBM hard disk tools with MINI-IDE
adapter for clean password on travelstar
(F2 hex command), or use new hard disk. (??)

Joe in Australia Key Maker reader produces an encrypted dump.  Just read with
standard Serial EEPROM reader instead.


One is a 16 bit 93cxx (760 series)
The others are 8 Bit Atmel 24C (most others)

You need an 8 bit reader, or a 16 bit reader, depending on which chip.

As someone else had suggested, pressing Ctrl+D while in the Config section of Easy-Setup brings you to a manual BIOS editor. Cycle through the screens with F7/F8 until you see one which says "Base 64x2 EEPROM." I can see that this screen contains two serial numbers and the model number in plaintext, and two other lines of seven characters that I suspected to be passwords. However, those two lines as they appear do not work as the supervisor password. Does anyone know if the Thinkpad 770e 24c01 EEPROM encrypts passwords and if so, how to decipher them (preferrably for free?)

I have IBM Maint Disk ver. 1.20, 1.41, 1.50, 1.60, 1.69. I need ver. 1.61 and/or 1.62. Appreciate any replys.

240,390,570,600 A2x , etc are use standerd keyboard scan code but R30 is deffrence

- If you want to program a brute force crack it is easy check the ATA standard, use DOS to keep it simple and reset after every 5 attempts (power off hdd or reset line) which you could automate by making a symple cct attached to line #1 (^RESET) to drive it low by sending a signal from the parallel port. It will take forever on average still.