联想笔记本 thinkpad BIOS 超级密码 Supervisor Password 清除 破解

一个联想笔记本thinkpad，BIOS 超级密码 Supervisor Password   忘记了，需要清除掉。
查找资料，发现BIOS 超级密码 Supervisor Password   是最麻烦的一种，它是写在硬件芯片中。
第一件事情，找到笔记本主板上的安全硬件芯片位置，这个网站有比较详细的资料  https://www.allservice.ro/forum

其中有一篇帖子，集合多种芯片位置图：
Updated: November 2016
Latest pics will not always be added at the end of this post, so pay attention!

-All new Thinkpads starting with T440, T450, T460, T540, T550, T560, W540, W541, W550s, X1 Yoga, X240, X250, X260, P40, P50, P50s, P70, Thinkpad Yoga 12 and Yoga 15, Helix gen2 and up, etchttp://www.allservice.ro/forum/viewtopic.php?t=3044

We have the confirmation for newer R61, T61 and X61. They don't use a TPM system like T43/R60/X60/T60, they dropped back to P24S08 (24RF08 clone).
Pictures added (as we unlocked them) for: L412, L512, L420, L520, L530, L430, L540, SL410, SL510, R400, R500, T400, T410, T420, T500, T510, T520, T530, X1, X100e, X121e, X201, X300(X200), X220, X230, X301, W500, W510, W520, W530, W701, Edge 13-14-15, Edge E120, Edge E220s, Edge E320, Edge E430, Edge 530, Edge 531, Edge E440, Edge E540, Helix 1st gen.

For eeprom 24RF08/P24S08 and variations like PS08 and L08 you must use R24RF08 - the free 24RF08 eeprom reader - and IBMpass 2.1 lite.

Note: If IBMpass Lite cannot reveal the passoword, then is 100% TCPA locked, in which case W24RF08 (eeprom writer) and our TCPA reset service is required. TCPA algo is changed, is not the same used in the previous models.

If you like us to assist you or to verify the TCPA lock status in order to confim the need of W24RF08 and the TCPA service, simply send the eeprom binary dumps tosupport@allservice.ro

R61:

P24S08 (8pin) is usually located on the frontside of the mainboard, under the keyboard. Is quite easy to get access there.
For 14' widescreen models, the eeprom is on the backside (second picture). 15' 4/3 models have the eeprom under PCcard cage on the frontside.

R61 eeprom here:
http://www.allservice.ro/forum/images/R61.jpg
http://www.allservice.ro/forum/images/r61_14_wide.jpg [14' widescreen]
http://www.allservice.ro/forum/images/r61_15_normal.jpg [15' 4/3]
http://www.allservice.ro/forum/images/r61_15_nvidia.jpg [15' Nvidia]

Courtesy JD Choi - Korea for the 1st photo and Mario Dahn - Germany for 15' ones.

T61:

P24S08 (8 pin) eeprom is on the back of the board, you may need to consult the T61 Hardware Maintenance Manual if you want to dismantle it.

HMM here:

Code:

http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-39298

T61 eeprom here:

http://www.allservice.ro/forum/images/T61-1.jpg
http://www.allservice.ro/forum/images/T61-2.jpg
http://www.allservice.ro/forum/images/T61-3.jpg (T61p-wide. New layout)
http://www.allservice.ro/forum/images/t61-alt.jpg (Alternate layout)

Courtesy R. Katz - USA, for the new T61p images and for all support.

X61:

This is using a small factor PS08 eeprom (24RF08 clone), its position is below the "M" key. It requires the keyboard, front bezel and the modem sub-board to be taken apart.

X61 eeprom here:
http://www.allservice.ro/forum/images/X61.jpg

I wish to express our gratitude to S. Helie (UK) who helped us with the first X61 works, and last but not least, to S. Cyiako (Sweden) who mailed us a perfect X61 mainboard for the tests.

[Updated]

X300, X301, X200 and X201, X220, X230, X100e, X120e, X121e, X1...done. They use the same 24RF08 clone like the other 61's (appart from Z61 series that still use TPMs). For X300, the eeprom has alternate connection points located underneath, near the memory socket. X100e has the PS08 mini eeprom like the X61 and X121e features the L08 (same eeprom).

X300 testpoints here:
http://www.allservice.ro/forum/images/x300.jpg

X301 eeprom here:
http://www.allservice.ro/forum/images/x301.jpg
Many thanks to B. Nguyen (USA) for all support.

X200 added (courtesy JD Choi - Korea):
http://www.allservice.ro/forum/images/x200.jpg

X220 added (same location for X230):
http://www.allservice.ro/forum/images/x220.jpg

X201 (thanks to npkub for the first eeprom images):
http://www.allservice.ro/forum/images/x201.jpg

X100e:
http://www.allservice.ro/forum/images/x100e.jpg
And another one (thanks to R. Katz): http://www.allservice.ro/forum/images/x100e-1.jpg

X121e:
http://www.allservice.ro/forum/images/x121e.jpg

X1 (courtesy J. STRNAD - Czech Rep.):
http://www.allservice.ro/forum/images/x1.jpg

X1 Carbon gen1 (generation 2 and 3 use MEC1633L):
http://www.allservice.ro/forum/images/x1-carbon.jpg

T400 & T500 added here, the same story, same eeprom located on the back of the mainboard as in T61.

T400 and T400s eeprom:
http://www.allservice.ro/forum/images/t400.jpg
http://www.allservice.ro/forum/images/t400s.jpg

T500 eeprom:
http://www.allservice.ro/forum/images/t500.jpg

We've tested on 2 mainboards and TCPA algo is again different.

Great thanks to V. Rikalovic (Serbia) and M. Yang (USA) for the nice shots.

R400, R500, W500 and W700 - R400 and W500 have the eeprom underneath. For R500 is the same 24RF08 clone located on the upper side of the motherboard, under the PCcard/ExpressCard cage. The board must be removed form the Mg frame and you have to peel the black sticker that covers the area

R400 eeprom:
http://www.allservice.ro/forum/images/R400.jpg

R500 eeprom:
http://www.allservice.ro/forum/images/R500.jpg

W500 eeprom:
http://www.allservice.ro/forum/images/w500.jpg

W700 eeprom:
http://www.allservice.ro/forum/images/w700.jpg

SL410 & SL510 - Looks like the new SL series switched from AMI to Phoenix FirstBIOS so our old friend (24RF08 - PS08) is back in business once again. R24RF08/W24RF08 is the right software, as usual.
*The older SL400/SL500 still need SPEG programmer to be unlocked.

SL410 eeprom:
http://www.allservice.ro/forum/images/SL410.jpg

SL510 eeprom:
http://www.allservice.ro/forum/images/SL510.jpg

The pictures are courtesy of J.D. Choi - Korea.

T410, T410s and T510
T410 and T510 eeprom here:
http://www.allservice.ro/forum/images/t410.jpg
http://www.allservice.ro/forum/images/t410s.jpg
http://www.allservice.ro/forum/images/t510.jpg (Added)

Thanks to Osman (Netherlands) for earlier T510 pictures.

Edge 13', 14' and 15'
This is an Edge 13 and 15, the rest are pretty similar:
http://www.allservice.ro/forum/images/edge15.jpg
http://www.allservice.ro/forum/images/edge13.jpg

Lenovo L412 / L512
L512 looks similar to Edge15, supposely L412 is also the same design. We'll update the forum shortly:
http://www.allservice.ro/forum/images/l512.jpg

Big thanks go to G. Williams in UK for sending us one of these.

W510/W520/W530/W701
Same eeprom location area for W510, W520 and W530
http://www.allservice.ro/forum/images/w510.jpg
http://www.allservice.ro/forum/images/w520-w510.jpg

T420, T420s, T520, T530
All of them use the tiny L08 eeprom. These models have passprase always active, and they require TCPA unlock service and W24RF08. T530 has the eeprom covered by the black stickers

http://www.allservice.ro/forum/images/t420.jpg
http://www.allservice.ro/forum/images/t420s.jpg
http://www.allservice.ro/forum/images/t520.jpg and the alternate layouthttp://www.allservice.ro/forum/images/t520-2.jpg
http://www.allservice.ro/forum/images/t530.jpg

Thinkpad Edge E120, E320
L08 eeprom again:
http://www.allservice.ro/forum/images/e120.jpg

Thinkpad Edge E220s,E531
P24S08 eeprom:
http://www.allservice.ro/forum/images/e220s.jpg
http://www.allservice.ro/forum/images/e531.jpg

Lenovo E420, E520
These ones use SP08 eeprom (same as 24RF08).
http://www.allservice.ro/forum/images/e420.jpg

Lenovo E530, E540
Same 24RF08 clone.
http://www.allservice.ro/forum/images/e530.jpg
http://www.allservice.ro/forum/images/e540.jpg

Thinkpad Helix
L08 eeprom again:
http://www.allservice.ro/forum/images/helix.jpg
Helix new generations are using MEC1633L
http://www.allservice.ro/forum/viewtopic.php?t=3044

Thinkpad T430 and T430s
http://www.allservice.ro/forum/images/t430.jpg
http://www.allservice.ro/forum/images/t430s.jpg

Thinkpad T431 (s)
http://www.allservice.ro/forum/images/t431s.jpg

Lenovo L420 / L520
Same location for both
www.allservice.ro/forum/images/l420.jpg

Lenovo L430 / L530
Same location for both
www.allservice.ro/forum/images/L430.jpg

Lenovo L540
L08 (24RF08)
www.allservice.ro/forum/images/L540.jpg

Note:
All images are property of allservice.ro or their authors passed the publishing rights to allservice.ro. You are allowed to use or publish them but not to edit them or to remove their original watermarks
_________________
Victor Voinea
ALLservice HQ, Romania.

//----------------------------------------------------------------------------------------------------------------



这是我的笔记本安全芯片的位置， 还必须找出SCL和SDA引脚。

接下来就是打开笔记本，我的是在触摸板的下面，所以打开笔记本比较彻底一点，拿下了键盘。
请注意键盘的排线，或其它需要断开的排线，排线的拆解方式不是用蛮劲，而是有一个拨片，让它转动，排线自然就开了，接上也是反操作。



暴露芯片后，再接好键盘（电源开关排线也重接过），一切准备就绪，不用黄花电烙铁，我准备直接用螺丝刀直接短接SCL和SDA引脚。

参考贴纸：
https://forum.51nb.com/thread-1600971-1-1.html
这个帖子最重要：
https://forum.51nb.com/thread-1715205-1-1.html

操作描述：
1、笔记本正常开机。
2、大约2秒后，看到屏幕上电白色，马上用螺丝刀短接SCL和SDA引脚。
3、屏幕上提示数据错误，马上按F1进BIOS（螺丝刀可以拿掉了），这时BIOS已经没有 Supervisor Password ，  是全功能的BIOS了，然后你把SVP清掉，保存。搞定。

这个原理应该是，BIOS启动后来读安全芯片，但是因为短接，安全芯片不能提供数据，BIOS就放弃了安全芯片功能，默认进入了全功能正常界面。

如果你在开机前就一直短接SCL和SDA引脚，BIOS被设置为无法运行，不允许开机。所以要在中途短接来这么一下子。
网上的方法都很复杂，螺丝刀短接应该是最最优雅的方法了吧，哈哈哈哈啊哈。。。。

这个应该是联想thinkpad安全芯片的设计缺陷吧，突然想到哥曾经也在联想工作过几天，；）