760XL bios password woes

[solidpro]

Right, I'm being a little bit lazy. I can't remember for the life of me what particular password symbol this is:



It's not the HDD password, as no HDD is in the machine. Is it POP, Supervisor, or something else?

It's a 760XL and, whilst I have the gear to clip onto certain chips and discover, I'd rather not, if this particular 760-series machine, being the XL, has a simpler solution.... Does anyone out there with more recent experience of the 760 have any tips for me?

Thanks

[solidpro]

Worked out that it's a Power On Password (POP) but it always confuses me how these work. Pressing enter (no password entered) makes the machine boot from floppy, or it will happily F1 into Easy Setup, the the security icon greyed out - so I can't space-bar away the POP. I wonder if a firmware upgrade via FDD would do it (assuming I can find a working battery)....

It says in a few places, you can short two pins under the floppy drive, next to the second battery connector to disable or remove the POP but this doesn't seem to do anything. The pins I'm shorting actually look like where something would physically connect though - is this little white connector the disguised pins to be jumpered?



It's weird that shorting this does not stop the password prompt appearing. Which i can only conlude that it's not a POP. But if no HDD is present, it can't be a HDP either which leaves supervisor, in which case i doubt it would let me into the EASY setup by just pressing space. Totally confused.

[RealBlackStuff]

If it is only a POP, remove/disconnect all power, incl. CMOS and backup-battery (if present).
Leave it like that for a few minutes.
Reconnect and you should be good to go.

That white connector looks like it is for a CMOS battery.
Is it the same as described below (found on the web)?
"If the system has a Power-on password set, you can remove it by installing a
jumper on the two pins left of the second-battery connector under the diskette/CD
drive. Just power on with the jumper in place."

If it's an SVP, PM me.

[solidpro]

Hi

I married it up here: http://ps-2.kev009.com/eprmhtml/epr2c/h5309.htm and confirmed it does appear IBM built a jumper that looks like a connector. I think it was so engineers could 'plug in' a shorted connector easily and get around a POP from a customer who hadn't removed it (for servicing). I think the CMOS is dead, but I'll remove that for a few minutes and see how it goes.

The SVP *should* have the image of a figurehead, but I think on some thinkpads it doesn't display the right icon!

Thanks

[DarkSamus9000]

Hello, 760EL owner here to chime in. I have a password set on my new 760EL, too, and after some digging it appears to be a supervisor password.

At first I thought it was a power-on password (POP), so I tried what people online suggested - shorting those 2 pins under the FDD and unplugging all batteries for a few minutes. Nothing changed.

I determined it was actually an SVP when I tried installing a new hard drive. The system refused to boot and threw code "158" which, according to the 760E manual from IBM, means:

A hard disk drive without a hard disk password is installed when a supervisor password is set.

(This also explains why I could never mount the original hard disk on any other computer - it has a HDD password set that matches the SVP on the thinkpad.)
I am required to enter the password at this screen. Pressing "Enter" with a blank password results in a big X and it prompts me to retry. So I am confident this unit has a supervisor password.

Does anybody know how to clear the SVP on this thing? Maybe it is possible to retrieve the matching password from the hard disk??

[RealBlackStuff]

You need to take the motherboard out and look for an 8-pin (or 14-pin) ATMEL chip with marking 24RF08 (or 24C01).
Once you found it, go here, read the first post carefully and download R24RF08 and IBMpass mentioned in Part 1.

[DarkSamus9000]

Thanks for the response. I spent today tearing down the laptop & searching for the EEPROM. I finally found it - it's an 8-pin STM C46C1. As far as I can tell, it's a kind of 93C46 EEPROM.

Yesterday while researching further, I learned of the SDA & SCL short trick that you can do to reset the SVP on ivy bridge thinkpads or older. I performed an SVP reset on an R500 yesterday using this method.
(I'm sure you already know of this, but for reference: https://milaq.net/thinkpad-password-rem ... nkpad-r500 and https://davidzou.com/articles/bios-password-bypass)

I was planning on doing this trick until I read your reply. Do you know if this trick works on the 760 models? Is the IBMpass method easier?
Looks like I would need to clamp on to the EEPROM chip, read it, and use IBMpass to find the password. Then I could hook up the minimum necessary components to power the machine up & enter the password I found...
I can give this a try tomorrow. Sounds promising!

[RealBlackStuff]

Hunting around on the Allservice Forum, I found this.
I have removed hundreds of passwords over the years, but never on a 93C46, have fun!

[solidpro]

I can't remember what happened with my original problem (I'm OP), but I've a feeling the 760 base with the password is still on the shelf as I hadn't yet worked out the proceedure for clearing on 93C46.

That jumper masquerading as a connector never did anything for me.

If you figure out how to do it, please can you fill us all in here, as I would be keen to know. Meanwhile if I have time, I'll do my own research.

cheers

[DarkSamus9000]

Going down the allservice forum, I believe I am on the right track. I have found a schematic for a circuit that I supposedly need in order to read the EEPROM correctly: https://www.allservice.ro/forum/dl/93CXX-prog.pdf This will require me to desolder the EEPROM from the board & connect it to the pictured circuit.

This will be my first foray into circuit-building! I have purchased some 5V zener diodes, some 4.7k ohm resistors, and a breadboard to create the circuit. I will need to power the chip somehow - the diagram depicts connecting 3 1.5 V batteries in series to create a 4.5V power supply - but according to the datasheet for this chip (which I found here: https://www.alldatasheet.com/datasheet- ... 3C46A.html), the chip operates from 4.5V to 5.5V; so I am planning to connect VCC of the EEPROM to a 5V pin on my raspberry pi. (it is my understanding that the Zener diodes help keep the voltage level at 5V)

Yes, for now I am planning to use a Raspberry Pi 4b to do the work. Another forum user on allservice had success reading this particular chip using the circuit I mentioned above and some software called "ponyprog"(https://github.com/lancos/ponyprog). Ponyprog claims to support Linux SysFS GPIO. Unless I'm mistaken, that means it could use the GPIO pins on my Raspberry Pi. And that would make breadboard wiring so much easier since I already have dupont wires to connect the Pi to a breadboard.

As a backup approach, I do have an old IBM i-series Thinkpad with Windows 98 and a DB9 RS-232 port (and yes, I did install a version of ponyprog on that machine that explicitly supports the 93C46!) But the Pi seems like it might be an easier solution at the moment.

[DarkSamus9000]

Exactly one month later, I finally have what I need & I am able to read the 93C46. I was able to build & run ponyprog on Gentoo Linux on my raspberry pi, but I couldn't get it to read the chip to save my life. I ended up using a Teensy 4.0 and an Arduino sketch (https://github.com/0xJoey/Arduino_93C46/tree/master) to perform the read, and I kept the Pi around to provide 5V input to the 93C46.

Now I've hit a snag. I don't see the password in the EEPROM dump. I'm not sure if I made a mistake in reading the chip or what. I have made a post on the Allservice forum to see if the wizards of that site can help me.

I get a bit more into the details in the allservice forum post: https://www.allservice.ro/forum/viewtopic.php?p=13175
IBMpass screenshot (64x16): https://drive.google.com/file/d/1W-9LiA ... sp=sharing
IBMpass screenshot (128x8): https://drive.google.com/file/d/1GlL1Dg ... bw/preview
EEPROM dump (64x16): https://drive.google.com/file/d/1ui7R-h ... sp=sharing
EEPROM dump (128x8): https://drive.google.com/file/d/1cvKhwS ... sp=sharing

Almost there!! Let me know if you have any ideas.

[RealBlackStuff]

Victor appears to be very helpful (again).

[DarkSamus9000]

Yes, victor being helpful as always...

We got the supervisor password! In the end it was "NCD"
It felt so good to finally boot up the computer & reset the password
Now the HDD password is gone, too!


At the end of the day, the successful read I made was done using an Arduino Mega 2560 (pictured below) but any microcontroller should work.

I used this github code to read the chip: https://github.com/0xJoey/Arduino_93C46/tree/master
The "read" sketch in the example code got me started, but at first it was giving me garbage data. By cross-referencing the 93C46 spec sheet I learned this code had a critical flaw; it was sending 8 bits of the address in the read command (for 64x16 mode), but it should only be sending 6. One line of code was all I had to change to get it working.
(line 139 of 93C46.cpp, for reference; change to "send_bits(addr, 6)")

Once I made this change, I attached my clip to the EEPROM chip (de-soldered from the mainboard) & plugged the arduino into my computer. I fired up GNU screen on the serial console and took a screenshot of the output given by the arduino; then I used hexedit to manually key in the bytes & save the dump. (Next time I do this I need to find a way to read the bytes directly from the serial device & output those to a file... I did it the hard way this time!)

OP, if you have an Arduino lying around (or something compatible with Arduino IDE like a Pi Pico or a Teensy), then let us know if you give this a try!

[RealBlackStuff]

Great stuff!
That went way beyond my pay-grade.
Funny though, all my working life I was a systems analyst/mainframe programmer and I never even finished high school!
On our (then) grading system (0-10 where 10 is best) my mathematics never went beyond a 5.
(But I learned 6 languages in school, and a few more later on).