Difference between revisions of "Maintenance"

From ThinkWiki
Jump to: navigation, search
(External sources)
m (External Sources: IBMDOCURL)
 
(63 intermediate revisions by 20 users not shown)
Line 4: Line 4:
 
Here you can find general hints about keeping your ThinkPad in good shape. Look at your [[:Category:Models|models category page]] for IBMs official maintenance guide for that model.
 
Here you can find general hints about keeping your ThinkPad in good shape. Look at your [[:Category:Models|models category page]] for IBMs official maintenance guide for that model.
 
|}
 
|}
 +
==Assembly/Disassembly instructions==
 +
Lenovo has a website dedicated to servicing ThinkPads, but it only covers the more recent models. For older models check the HMM (Hardware Maintenance Manual) for your ThinkPad.
 +
* http://www.lenovoservicetraining.com/
 +
 
==Battery treatment==
 
==Battery treatment==
 
{| border=1 cellspacing=0 cellpadding=2 style="vertical-align:top;"
 
{| border=1 cellspacing=0 cellpadding=2 style="vertical-align:top;"
Line 43: Line 47:
 
*cool and dry, but '''do not freeze''' them: 10-15C is recommended
 
*cool and dry, but '''do not freeze''' them: 10-15C is recommended
 
|}
 
|}
 +
  
 
===Battery health===
 
===Battery health===
Line 57: Line 62:
  
 
===Reviving batteries===
 
===Reviving batteries===
Some people experience sudden drops in their batteries capacity.  A way to get these batteries back to full capacity is to run the "Battery Rundown" function of IBMs "PC Doctor for DOS".  The program is downloadable from IBMs support site as three floppy disk images.  Make sure you get the specific version of program made for your ThinkPad model.  For those who do not have a floppy, David Smith prepared a [http://www.mypchelp.com/~dsmith/ibmutil/ibm_t22_pcdiag.iso bootable CD image] (dead link, a copy is also available [http://server6.org/~marker/software/ibm_t22_pcdiag.iso here]) from the T22 floppy images. For newer ThinkPads there is an official [http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-56222 bootable CD image].
+
Some people experience sudden drops in their batteries capacity.  A way to get these batteries back to full capacity is to run the "Battery Rundown" function of IBMs "PC Doctor for DOS".  The program is downloadable from IBMs support site as three floppy disk images.  Make sure you get the specific version of program made for your ThinkPad model.  For those who do not have a floppy, David Smith prepared a [http://www.mypchelp.com/~dsmith/ibmutil/ibm_t22_pcdiag.iso bootable CD image] (dead link, a copy is also available [http://server6.org/~marker/software/ibm_t22_pcdiag.iso here]) from the T22 floppy images. For newer ThinkPads there is an official [http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-56222 bootable CD image]. (Although the instructions on this page (as of May 2008) include details for Linux and refer to a CD image, it is actually provided as a Windows executable. On Linux systems, [http://winehq.org Wine] can execute this file and extract the CD image.) Once extracted, you must mount the iso as a loop device (as root) like so:
 +
 
 +
:{{cmdroot|mount -o loop 1ety48ww.iso /mnt/floppy}}
 +
 
 +
Then copy the .IMA file out of that mounted iso:
 +
 
 +
:{{cmdroot|cd /mnt/floppy}}
 +
:{{cmdroot|cp 1ETY48WW.IMA /boot}}
 +
 
 +
(Or to some other suitable directory.) After this, you can follow the same directions that apply for [[BIOS Upgrade|BIOS upgrade]]s.
 +
 
 +
{{NOTE|This will do nothing to improve the performance of a dying battery. It serves only to recalibrate the battery charge controller. The "Battery Rundown" function of IBMs "PC Doctor for DOS" has no intelligence. It merely runs a series of dumb operations to consume battery power, and it cannot detect whether a battery is present or not. If you leave the mains connected while running "Battery Rundown", it will have no effect, as the battery will simply keep charging. The [[tp_smapi]] module, if installed, will report the number of charge cycles the battery has had since it was manufactured. If that number is high, the battery's poor performance is almost certainly due to its age.}}
 +
 
 +
I have recently made an interesting discovery, I have an R40 with two main batteries, both of them have aproximately about under 200 cycles and are nowadays 4 years old, projected capacity for R40/R32 main battery is 57Wh, and both my batteries were about 30Wh, then I left my notebook with one of them about a day in a standby mode, as long as it powered off itself because of low battery power, when I turned it on I saw the battery capacity at about 42Wh, then, I did this too for the second battery and I got even about 46Wh, I think I could go even higher with letting the battery discharge completely from 100% in standby, I think this has something to do with low power consumption in standby mode, it may work for you too.
  
 
===See also===
 
===See also===
Line 76: Line 94:
 
===External Sources===
 
===External Sources===
 
* [http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-4A2P54 Lenovo Support - LCD care and cleaning instructions]
 
* [http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-4A2P54 Lenovo Support - LCD care and cleaning instructions]
* [http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=ibm&lndocid=MIGR-52190 IBM Support - System cleaning instructions]
+
* [http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-52190 Lenovo Support - System cleaning instructions]
  
 
==Cleaning the Interior==
 
==Cleaning the Interior==
Line 123: Line 141:
 
*[http://gamma.nic.fi/~point/win2copy.htm Guide on copying Windows 2000/XP to another partition]
 
*[http://gamma.nic.fi/~point/win2copy.htm Guide on copying Windows 2000/XP to another partition]
  
==Recovering BIOS passwords==
+
==Recovering BIOS passwords.==
Password recovery procedure for IBM ThinkPads
+
Password recovery procedure for IBM ThinkPads using R24RF08 and IBMpass.
using R24RF08 and IBMpass
+
 
 +
(Note: An updated tutorial can always be found [http://www.allservice.ro/forum/viewtopic.php?t=47&start=0 HERE])
 +
 
  
 
'''1. Introduction.'''
 
'''1. Introduction.'''
Line 136: Line 156:
  
 
To recover the password, one can use two different programs: R24RF08 (eeprom reader) and IBMpass
 
To recover the password, one can use two different programs: R24RF08 (eeprom reader) and IBMpass
(password revealer) available at [http://www.allservice.ro http://www.allservice.ro]. Diagrams are included in the reader kit.
+
(password revealer) available at [http://www.allservice.ro/store/utils http://www.allservice.ro/store/utils]. Diagrams are included in the reader kit.
  
 
Models for which R24RF08 and IBMpass are enough to recover the password: 240, 240X, 390E, 390X, 570, 570E,
 
Models for which R24RF08 and IBMpass are enough to recover the password: 240, 240X, 390E, 390X, 570, 570E,
 
600e, 600X, 770Z, A20m, A21e, A21m, a22m, A30, A30p, A31, A31p, G40, G41, R30, R31, R32, R40, R50, R51,  
 
600e, 600X, 770Z, A20m, A21e, A21m, a22m, A30, A30p, A31, A31p, G40, G41, R30, R31, R32, R40, R50, R51,  
Transnote, T20, T21, T22, T23, T30, T40, T40p, T41, T41p, T42, T42p, X20, X21, X22, X23, X24, X30, X31, X40, X41.
+
Transnote, T20, T21, T22, T23, T30, T40, T40p, T41, T41p, T42, T42p, X20, X21, X22, X23, X24, X30, X31, X40, X41, X61.
  
ThinkPads featuring TPCA technology (i.e. a [[Tpm|TPM trusted platform module chip]]), especially T4x, X3x, X4x need the W24RF08 eeprom writer program to complete the password recovery procedure, if the passphrase function is enabled in BIOS setup.
+
ThinkPads featuring TPCA technology (i.e. a [[Tpm|TPM trusted platform module chip]]), especially T4x, X3x, X4x, X61 and X61T need the W24RF08 eeprom writer program to complete the password recovery procedure, if the passphrase function is enabled in BIOS setup.
  
 
Other models such as the 380XD or 600 use 24C01 or 93C46 eeproms, which can be read without special tools.
 
Other models such as the 380XD or 600 use 24C01 or 93C46 eeproms, which can be read without special tools.
 
The method is the same like for the models based on 24RF08, only the software to dump the eeprom is different.  
 
The method is the same like for the models based on 24RF08, only the software to dump the eeprom is different.  
  
Newer T43/T43p, R52, R60, T60/p, X60 and Z60 ThinkPads can be unlocked using PC8394 programming tools that consist in RPC8394 and WPC8394 (reader and writer for TPM chips). The software is available as well on [http://www.allservice.ro http://www.allservice.ro]. IBMpass 2.0 works for any TP model without exceptions.
+
Newer T43/T43p, R52, R60, T60/p, X60 and Z60 ThinkPads can be unlocked using PC8394 programming tools that consist in RPC8394 and WPC8394 (reader and writer for TPM chips).  
 +
The software is available as well at [http://www.allservice.ro/forum/viewtopic.php?p=1061#1061 www.allservice.ro]. IBMpass 2.0 works for any TP model without exceptions.
 +
 
  
  
Line 195: Line 217:
 
'''5. Reveal the password.'''
 
'''5. Reveal the password.'''
  
Now, you have the .bin file but you need to dump in scan code to retrieve the password. IBMpass 2.0 Lite is a free tool that will do the job. Just open the eeprom dump you’ve created before and search for 0x330, 0x340 lines. The password is located on 0x338 (and 0x340 depending on model) in scan code. For 24C01 eeproms the password is located at 0x38, 0x40. If the password won't work for the very first time then your eeprom may use newer IBM scancodes. In this case switch to alternate scan codes to find it. For those who want quick answers the recommended version is IBMpass 1.1. Usage for IBMpass 1.1 (command line only):
+
Now, you have the .bin file but you need to dump in scan code to retrieve the password. IBMpass 2.1 Lite is a free tool that will do the job. Just open the eeprom dump you’ve created before and search for 0x330, 0x340 lines. The password is located on 0x338 (and 0x340 depending on model) in scan code. For 24C01 eeproms the password is located at 0x38, 0x40. If the password won't work for the very first time then your eeprom may use newer IBM scancodes. In this case switch to alternate scan codes to find it. For those who want quick answers the recommended version is IBMpass 1.1. Usage for IBMpass 1.1 (command line only):
  
 
ibmpass mytp.bin – use “/a” switch to see in alternate scan code if needed:
 
ibmpass mytp.bin – use “/a” switch to see in alternate scan code if needed:
Line 221: Line 243:
  
 
The thinkpad power-on/supervisor passwords are a maximum of 7 characters, and are NOT case-sensitive. The allowed characters are restricted to A-Z, 0-9, semicolon, _, - (and perhaps a few others).
 
The thinkpad power-on/supervisor passwords are a maximum of 7 characters, and are NOT case-sensitive. The allowed characters are restricted to A-Z, 0-9, semicolon, _, - (and perhaps a few others).
 +
If  PassPhrase is enabled then the password can be longer than 7 characters.
 +
Models like T43/R52/T60/R60/T60/X60/Z60/Z61 need the TPM chip dumped with [http://www.allservice.ro/forum/viewtopic.php?p=1061#1061 PC8394 programming tools] in order to find password/reset the TCPA lock.
 +
  
  
 
===External Sources===
 
===External Sources===
* [http://www.allservice.ro R24RF08/W24RF08, PC8394 programming tools & IBMpass author's webpage.]
+
* [http://www.allservice.ro/forum R24RF08/W24RF08, PC8394 programming tools & IBMpass author's forums]
* [http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=ibm&lndocid=MIGR-59377 IBM Support - Lost or forgotten password]
+
* {{IBMDOCURL|MIGR-59377|IBM/Lenovo Support - Lost or forgotten password}}
 
* [http://www.allservice.ro/forum/viewforum.php?f=12 Full Service of all ThinkPad models including free password recovery]
 
* [http://www.allservice.ro/forum/viewforum.php?f=12 Full Service of all ThinkPad models including free password recovery]
 
* [http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/ A tutorial on how to do this]
 
* [http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/ A tutorial on how to do this]
 +
 +
[[Category:HOWTOs]]

Latest revision as of 19:49, 18 February 2016

Here you can find general hints about keeping your ThinkPad in good shape. Look at your models category page for IBMs official maintenance guide for that model.

Assembly/Disassembly instructions

Lenovo has a website dedicated to servicing ThinkPads, but it only covers the more recent models. For older models check the HMM (Hardware Maintenance Manual) for your ThinkPad.

Battery treatment

Battery life expanding guide
Battery Type NiCd NiMH Lithium ion
General
  • always do complete discharge/charge cycles
  • avoid exposing the battery (or notebook) to excessive heat
  • always do complete discharge/charge cycles
  • avoid exposing the battery (or notebook) to excessive heat
  • avoid deep discharges except when resetting fuel gauge or reconditioning a battery; partial dis-/recharges are better for the battery lifetime (note: fuel gauge will slowly get inaccurate over time)
  • remove battery when on AC (due to heat)
  • avoid exposing the battery (or notebook) to excessive heat
Charging
  • discharge before charging
  • discharge before charging
  • avoid charging if battery is nearly full, unless you will need its full capacity soon; keep it on the 30%-85% charged range
  • keep notebook off while charging due to heat
  • fully discharge, then fully charge battery when needed to recalibrate fuel gauge; newer battery pack models require this less often, old ones might need it as often as every 30 cycles
Storage
  • almost discharged
  • cool and dry
  • almost discharged
  • cool and dry
  • never fully charged or discharged, ideally at about 40%
  • cool and dry, but do not freeze them: 10-15C is recommended


Battery health

Batteries, especially of the modern Li-Ion type, wear out quicker when they hold a large charge or are subject to higher temperatures (see above).

If you use your laptop at a desk, reduce battery wear by maintaining an appropriate charge level. When possible, remove Li-ion batteries while operating from AC as the notebook gets hot enough inside for that to damage the battery in the long run, even if charging is stopped.

On recent ThinkPads, charging thresholds can be configured in the bundled software. Under Linux, this is supported on recent models by the tp_smapi driver (and even without tp_smapi, if you have a dual-boot setup, you can set the thresholds under Windows and they will be remembered as long as you don't power off your machine with AC disconnected; suspend to RAM is OK). Have a look at How to use UltraBay batteries.

If you have spare Li-ion battery packs, store them at 40% charge in a cool place (15C being a recommended temperature, do not let the batteries freeze). If storing inside a refrigerator, beware of humidity, and be careful with cold spots that can easily freeze the battery if anything goes wrong.

The problem with 600 series batteries

ThinkPad 600 power management causes batteries to die before they should. Read more about this on the associated problem page.

Reviving batteries

Some people experience sudden drops in their batteries capacity. A way to get these batteries back to full capacity is to run the "Battery Rundown" function of IBMs "PC Doctor for DOS". The program is downloadable from IBMs support site as three floppy disk images. Make sure you get the specific version of program made for your ThinkPad model. For those who do not have a floppy, David Smith prepared a bootable CD image (dead link, a copy is also available here) from the T22 floppy images. For newer ThinkPads there is an official bootable CD image. (Although the instructions on this page (as of May 2008) include details for Linux and refer to a CD image, it is actually provided as a Windows executable. On Linux systems, Wine can execute this file and extract the CD image.) Once extracted, you must mount the iso as a loop device (as root) like so:

# mount -o loop 1ety48ww.iso /mnt/floppy

Then copy the .IMA file out of that mounted iso:

# cd /mnt/floppy
# cp 1ETY48WW.IMA /boot

(Or to some other suitable directory.) After this, you can follow the same directions that apply for BIOS upgrades.

NOTE!
This will do nothing to improve the performance of a dying battery. It serves only to recalibrate the battery charge controller. The "Battery Rundown" function of IBMs "PC Doctor for DOS" has no intelligence. It merely runs a series of dumb operations to consume battery power, and it cannot detect whether a battery is present or not. If you leave the mains connected while running "Battery Rundown", it will have no effect, as the battery will simply keep charging. The tp_smapi module, if installed, will report the number of charge cycles the battery has had since it was manufactured. If that number is high, the battery's poor performance is almost certainly due to its age.

I have recently made an interesting discovery, I have an R40 with two main batteries, both of them have aproximately about under 200 cycles and are nowadays 4 years old, projected capacity for R40/R32 main battery is 57Wh, and both my batteries were about 30Wh, then I left my notebook with one of them about a day in a standby mode, as long as it powered off itself because of low battery power, when I turned it on I saw the battery capacity at about 42Wh, then, I did this too for the second battery and I got even about 46Wh, I think I could go even higher with letting the battery discharge completely from 100% in standby, I think this has something to do with low power consumption in standby mode, it may work for you too.

See also

External sources

Cleaning the Display

If you discover markings that look like they originate from the TrackPoint or keyboard, or for information on how to avoid these, look at this page.

External Sources

Cleaning the Interior

ATTENTION!
The following instructions are not appropriate for all ThinkPad models. Please consult the hardware maintenance guide or on-line disassembly instructions for your model.

Most ThinkPad models (particularly the A-series and the T-series) tend to accumulate a lot of interior dust which they draw from their ventilation fan. A good dusting every few months is advised. The procedure is as follows.

ThinkPad T4x series

See IBM's keyboard removal instructions and movie.

ThinkPad T6x series

See IBM's keyboard removal instructions and movie.

Other models (which?)

  1. Unplug the computer.
  2. Remove the battery.
  3. Turn the ThinkPad over and find two to three screws with upraised double-arrows pointing to them.
  4. Unscrew these screws and set them aside.
  5. Press the silver area underneath where the battery used to be. The front of the keyboard will pop up.
  6. Turn the ThinkPad right side up and gently remove the keyboard, pulling it toward you.
  7. There is one connector between the ThinkPad and the keyboard. Disconnect it, and set the keyboard aside.
  8. If there is a small black plastic separator under the keyboard, remove it and set it aside.
  9. The fan should be visible in the upper left. That entire area will likely be dusty. With a can of compressed air (and only with a can of compressed air), dust that area and the surrounding area.
  10. Replace the small black plastic separator, then reconnect the keyboard.
  11. Slide the keyboard back into place, then press down on the Fn and right-arrow keys until it pops into place.
  12. Replace the keyboard screws and battery.

Dealing with spilling accidents

  1. Don't panic.
  2. Don't flip or tilt the computer to prevent the liquid from spreading all over the inside of the case.
  3. Shut down the OS and turn off the power:
    1. Unplug the computer.
    2. Remove the battery.
  4. Tilt the computer so that everything that leaked into the case can flow out the same way.
  5. Allow the computer to dry before switching it on again.
  6. For minor accidents this might already be sufficient. For major flooding you should either bring the computer to a dealer who knows how to open and clean it from inside. Or you can read the Hardware Maintenance Manual, open, clean, and dry the computer yourself.

See also Act quickly, carefully if you spill on laptops on MoneySense.ca (link broken as of 2006-09-18, the article is still available via web.archive.org).

Harddisk Backup / Upgrade

External Sources

Recovering BIOS passwords.

Password recovery procedure for IBM ThinkPads using R24RF08 and IBMpass.

(Note: An updated tutorial can always be found HERE)


1. Introduction.

The IBM ThinkPad uses a small eeprom (ATMEL 24RF08) to store different OEM issues like serial number, UUID, etc. The supervisor password (SVP) is also stored in this eeprom. The 24RF08 is not an ordinary eeprom: it features read protection, which the BIOS uses to lock down access to the eeprom contents. Also, the password is written in a special scan code, which needs to be translated to ASCII to be of any use.

To recover the password, one can use two different programs: R24RF08 (eeprom reader) and IBMpass (password revealer) available at http://www.allservice.ro/store/utils. Diagrams are included in the reader kit.

Models for which R24RF08 and IBMpass are enough to recover the password: 240, 240X, 390E, 390X, 570, 570E, 600e, 600X, 770Z, A20m, A21e, A21m, a22m, A30, A30p, A31, A31p, G40, G41, R30, R31, R32, R40, R50, R51, Transnote, T20, T21, T22, T23, T30, T40, T40p, T41, T41p, T42, T42p, X20, X21, X22, X23, X24, X30, X31, X40, X41, X61.

ThinkPads featuring TPCA technology (i.e. a TPM trusted platform module chip), especially T4x, X3x, X4x, X61 and X61T need the W24RF08 eeprom writer program to complete the password recovery procedure, if the passphrase function is enabled in BIOS setup.

Other models such as the 380XD or 600 use 24C01 or 93C46 eeproms, which can be read without special tools. The method is the same like for the models based on 24RF08, only the software to dump the eeprom is different.

Newer T43/T43p, R52, R60, T60/p, X60 and Z60 ThinkPads can be unlocked using PC8394 programming tools that consist in RPC8394 and WPC8394 (reader and writer for TPM chips). The software is available as well at www.allservice.ro. IBMpass 2.0 works for any TP model without exceptions.


2. Locating the ATMEL 24RF08 eeprom. Soldering.

No need to unsolder the 24RF08 eeprom, just solder 3 wires to SDA, SCL and GND pins of the eeprom. There are two eeprom layouts (see interface schematics described bellow), corresponding to 8 pin or 14 pin eeproms. Locate the eeprom first according to your model (E.g. T20-23 and T30 have the eeprom underneath TP, and can be accessed by removing the RAM modules cover, no need to dismantle the laptop.) and solder the wires using a soldering iron with a fine tip. Also, you can use 0.15 -0.20 mm enamel coated wires or similar small diameter insulated wires. These wires will be connected later to the interface. Tip: You can use clips to connect the wires or you can solder on the PCB traces leading to the eeprom pins. Once again, be careful and double, triple check the soldering if necessary till you are positively sure you have done the right job. In case of applying too much solder, use flux-impregnated copper-braid "desoldering wick" - this works exceptionally well.


3. Choose and build the interface.

Since version 2.0, R24RF08 and W24RF08 (eeprom writer) are compatible with a wide range of eeprom programmers. By default, both programs set the COM port signals to use direct logic level to access I2C bus. We provide here 2 schematics that are relevant for direct logic signals and for inverse logic signals (simple-i2cprog.pdf and driven-i2cprog.pdf). Also, depending of the interface you build, you can invert the logics for SDA-In, SDA-Out, and SCL COM port signals by some command line parameters described later in this document. a) The file simple-i2cprog.pdf contains the schematic diagram of a simple interface (known as SIPROG)based on 2 zeners and 2 resistors. This is a classic, easy to build circuit and works with soldered or unsoldered eeproms. The purpose of the 2 zeners is to convert RS232 levels (+/- 5V) to TTL levels, needed by the eeprom. It uses direct logic signals to I2C eeprom and is powered by the COM port. However, this interface works with in-system eeproms but is dependant on COM port current and eeprom bus impedance. R24RF08 works natively with this circuit, no need to change the lines signals with command line parameters. This circuit works pretty well with almost all ThinkPads series. b) The second interface is described in driven-i2cprog.pdf. The circuit uses MAX 232 as a RS232 to TTL driver and its main purpose is to work with soldered eeproms. The advantage of MAX232 is the TTL outputs that are more reliable and more powerful when work with soldered, in-system eeproms (dependency free from the COM port current). Due of the internal inverters of MAX232 the interface responds to an inverse signal logic level. R24RF08 needs /x, /d, /i switches to be specified in the command line.

What these switches mean: /x - invert serial clock, also known as SCL; /d - invert serial data output, also known as SDA-Out; /i - invert serial data input, also known as SDA-In. All those can be used in any combination to meet any interface specification.

Note that the "standard" serial port programmer probably won't work with a USB-Serial adapter, but requires the full nominal voltage of a hardware serial port. [Example: the A22p's serial port works fine here.]


4. Dump the EEPROM:

Prepare your technician PC by connecting the interface to the COM1 port (don’t connect the wires to eeprom yet). Turn on the ThinkPad and press F1 to enter BIOS Setup. When you are prompted for the password and there’s no other activity like HDD access or so, connect the wires (GND first!, SDA, SCL) to the corresponding wires from the interface (attached before to COM1) and execute R24RF08:

-for SI-PROG interface (as described in 3.a above): r24rf08.exe <filename.ext>. where filename.ext is the file where eeprom content will be stored. Example: r24rf08 mytp.bin

-for MAX232 driven I2C interface (as described in 3.b above): r24rf08.exe <filename.ext> /x /d /i. where /x /d /i are command line parameters (switches) for this kind of interface. Example: r24rf08 mytp2.bin /x /d /i

Use exactly the instructed switches to avoid possible damages to your eeprom data! The file should be created in the same folder. Finally, disconnect the wires (GND last!) and turn off the ThinkPad by pressing on/off switch.

Dump the EEPROM data at least twice, and do a bytewise compare with `cmp`. Both files should be identical, and 1024 bytes long. Otherwise, you probably have a serial port problem.

Note: the r24rf08.exe program automatically sets the serial port parameters. It also works fine with Wine under Linux - provided that a symlink (com1) exists in the .wine/dos_devices directory, and points to the /dev/ttySX for the actual serial port.


5. Reveal the password.

Now, you have the .bin file but you need to dump in scan code to retrieve the password. IBMpass 2.1 Lite is a free tool that will do the job. Just open the eeprom dump you’ve created before and search for 0x330, 0x340 lines. The password is located on 0x338 (and 0x340 depending on model) in scan code. For 24C01 eeproms the password is located at 0x38, 0x40. If the password won't work for the very first time then your eeprom may use newer IBM scancodes. In this case switch to alternate scan codes to find it. For those who want quick answers the recommended version is IBMpass 1.1. Usage for IBMpass 1.1 (command line only):

ibmpass mytp.bin – use “/a” switch to see in alternate scan code if needed: ibmpass mytp.bin /a

For some old models like 570 or 770Z you need to execute the eeprom patcher first. This will reset the read protection on the password offset. To do that just execute patcher.exe before the reading operation, without rebooting the laptop:

-for SI-PROG: patcher.exe , then immediately r24rf08.exe <filename.ext>

-for Driven-I2C (Max232) you must insert the switches: patcher.exe /x /d /i, then immediately r24rf08.exe <filename.ext> /x /d /i

W24RF08, the writer version, has included the complete APP reset operation you don’t need to use patcher.

Moreover, there are a new encrypting algos used with some new security chips (AT97SC3201, AT97SC3203) that are very secured. The password is not in scancode and in some cases not even in the eeprom. To unlock the machine, the dump should suffer some changes and the eeprom must be reprogrammed using W24RF08. This operation works for all IBM TCG/TCPA secured laptops w/o exceptions.


Remember, use 3 wires from the interface and 3 wires from eeprom! Connect them after your ThinkPad is powered and disconnect them right after you read the content, before you switch off the laptop.

6. Password format

The thinkpad power-on/supervisor passwords are a maximum of 7 characters, and are NOT case-sensitive. The allowed characters are restricted to A-Z, 0-9, semicolon, _, - (and perhaps a few others). If PassPhrase is enabled then the password can be longer than 7 characters. Models like T43/R52/T60/R60/T60/X60/Z60/Z61 need the TPM chip dumped with PC8394 programming tools in order to find password/reset the TCPA lock.


External Sources