Lenovo T410 Bios Password Reset

[Argenta Sugden]

youhave to open up the back, and short the Eprom Bios reader use a magnifying glass, find it, and it is pin 5 and 6 on the eprom, (SDA) and (SDL) the eprom is the first selection of the motherboard that when booted, it checks security on the system, be carefull powering on the Notebook with the back cover off, turn the laptop on it's side, boot the power on button, look for Circuit print (U46) that should be the Eprom, (see pictures Below of the two different eproms you may have) usually the eprom is adjacent halfway next to the hard drive, some other thinkpads they are located under the ram, or next to the BIOS battery.

So With your Thinkpad rear cover removed, check to see if you can see the bios battery and the chipsets, if so, it should be there on that side of the circuit board....if not....then it's on the other side which means you have to remove the entire back cover to get at it, i would suggest you just remove the rear slide cover first or palm pad screws, and check before removing your entire back cover for no reason.

What we need to do, is.... while booting up turning the power button on at the same time holding a fine screwdriver to both pin 5 and 6 (the right hand two pins solders on the top end of the eprom.. doesnt matter which way your looking at your circuit board, it will still be the top last two in the right of the eprom, as they correspond and switch over inside the eprom chip so you will be shorting either the two "in'" or the 2 "outs"of the eprom chip....so doesn't make a difference, you will still be shorting the circuit before or after it goes to the next chip along the circuit board down th track, as long as it's the top right two prong solders your touching on the eprom chip (SEE PIC) ......do this short for only 2 seconds max.... this should fail both the security Supervisor Password, and power on Password and reset your Cmos.

What your initially trying to achieve by doing this is to make the System forget to check Security settings during a few attempted boot ups this way.....all you need is the System to forget once and your in.

an eprom is the tiny chip that has 4 inbound solders and 4 outbound solders on the Eprom chip, ("again inside this eprom chip they switch over so they aren't a direct pass through to the otherside of the eprom chip"), so just make sure your touching the two top right end solders of the eprom located on the circuit board, usually marked with a fine print stamp on the eprom saying (Ps4508) or something like (ATMEL G 282) orsimillar. Usually on the thinkpads it is located next to the yellow Bios Battery cable under the tape, or under the ram, if it is under the ram, take the ram out, you wont need the ram to get into Bios anyway, once you think you have acheived it...check your boot Bios menu whilst the pc is still on its side and select along into the security settings and see if Supervisor and Power on passwords are enterable to change.....if so you were succesful.

Most of the Lenovo Thinkpads can be cracked this way....but be warned you only need to create a short circuit for just a second.... and by short circuit i mean strike those pins i mentioned for just a second on reeboot, (only a low amp of 3 watts from the bios battery comes through it) holding the screw driver any longer than 5 seconds will fry your ALTMEL Chip on your motherboard.....you only need to basically strike or swipe those pins for a second a during reeboot.

There is no backdoor or secret password or Boot CD software or anything like that can break this or unlock it with the click of a mouse or keyboard, most of the thinkpads are like that also, you will have to replace the motherboard if your thinkpad is locked if you don't wish to try this proceedure. Lenovo do however charge you to unlock the Eprom, but a proof of purchase or reciept either new or second hand is nessecary.

i should also mention another type of lockout on these , another which many students get is the HDD LOCKOUT.......this happens when too many wrong passwords are entered, if you don't know the BIOS passwords DO NOT TRY AND GUESS IT...You only have 3 attempts in one session.....if you have entered too many times you will see the boot icon lock has a number 1 or 2 on boot up, this it is not your BIOS, but your Hard Drive that is locked, best option is taking out your HDD and putting it into another laptop that fits the hard drive and get in and unlock or remove the Hard Drive lock and then put it back into your thinkpad.

My ThinkPad L420 has an unknown supervisor password on it. It regularly booted into Windows without asking for any password for the last two years except the BIOS security page was not accessible. Two months ago, it did a Lenovo System Update all by itself. It booted into BIOS only right after update and asked for the supervisor password which I don't have. All settings on the BIOS pages are grayed out. I used your method by shorting out pin SCL and SDA of the BIOS EEPROM. It worked and I could see the supervisor password was disabled. But upon saving and booting back, the supervisor password was just enabled by itself again. No joy. I went ahead replaced the BIOS chip. Hey you know what, it locked itself again upon re-booting back. So there gotta to be another companion chip that keeps the password and dumps the password on to the BIOS chip during POST. But I don't know where is this special chip located on the motherboard.

4. Remove the palm rest / touch pad assembly - Remove the four screws on the bottom of the machine as shown. Turn the system over and open the cover. Carefully lift the palm rest up, then open and disconnect the ZIF connector and the touchpad/microphone connector. Remove the palm rest.

8. Remove the motherboard - Disconnect the speaker cable, camera cable, and LCD connector screw and ZIF connector. Remove the five motherboard retaining screws, then remove the PCI Express slot filler, if necessary. Pull out slightly on the edge of the plastic frame to release the motherboard, then carefully lift the motherboard out of the chassis.

You guys are talking about the battery pack that powers your laptop, these instructions are to remove the small backup battery that powers the clock and bios ROM while the power is off, and should last year's.

There is a lot of information on the web about reading the I2C EEPROMs and reading the scancodes using a program called IBMPass. I managed to read the EEPROM (first using an Arduino Nano, and then using a simple RS232 I2C reader). Alas IBMPass would not provide the correct translations for the scan codes.

This procedure worked for me for an R61. I was able to remove a supervisor password using this procedure. I had previously removed a power on password (POP) using a procedure from . This procedure got me out of having to buy a KeyMaker to remove the SVP!

Good Afternoon. after purchasing a used r61i i tried changing the boot order and discovered the SPV password was set. i used your suggestions and was able to reset it successfully. many thanks

Best regards

I confirm that I have removed Supervisor passwords using your method on Lenovo T500. You did a remarkable discovery. I really appreciate it. I removed T510 passwords using your method as well whereas a bit different methods as follows:

For Lenovo T510:

1. Keep the pins shorted once from getting into BIOS till you are in menu of changing supervisor password, i.e security -> Passwords -> Supervisior Password and this time it will not ask for old password, will give you only new password option, hit Enter twice then release pins and hit F10 save and you are done, Supervisor password is gone.

For T500 and T510, EEPROM are at the bottom side of motherboards, i had to take motherboard out, Parts connected at that time was CPU FAN with heat sink on CPU, Screen cable, Keyboard, RS232 BIOS (Yellow) Battery and Adaptor power cable, it was hard to manage but you can do it.

Thanks a million.

i was able to reset the supervisor password using the procedure above for lenovo thinkpad r61,the procedure was as above,except that for me i booted the machine with the pins already shorted,pressed f1 twice ,and there it booted into bios menu,am based in uganda,and no technician in our capital city has this knowledge,i was contemplating shipping it to joe in australia,thank u so much,

Hi,

It does not work for my T61. I've tried to find the NXP P24S08 on my motherboard and short the pin 5 and pin6, and then switched on, then pressed F1. It did show some error on the screen, but suddenly the "LOCK" icon show up!

How can I solve the problme?! Thanks for your sharing!

unbelivable.............. i f*** around the whole day with the serial interface from allservice and got my dump file... used ibmpass and had where the password should be a few weired letters encrypted i guess.......... then i found this here no hardware no nothing just a skalpel to bridge and bamm dude u rock it worked now i get get the 15 TPs back in service i owe u big time !!!!!!!

After taking the CMOS-battery out in order to delete the SVP I had the same problem. I tried it as you said, set a new pw but nevertheless it does not work. When I restart after having set a new pw and saving it, the machine boots by showing some errors (e.g. time and date error) than it shows the SVP screen but accepts just enter and lets me into bios. But after waiting a few minutes and rebooting it is like before and does not accept enter or my new set pw... What should I do? ://

I got this SVP problem after buying a second hand TP W510 and releasing the CMOS-battery. Since then it asks for the SVP. I tried your trick and successfully removed the SVP, set a new one and booted without problems - for 2 or 3 times (everytime he asked for the SVP, although I disabled it after setting it new, but just pressing "enter" was sufficient). After waiting for a few minutes and trying it again, it didn't accept neither "enter" nor the new SVP I had set before. So to cut it short, it does not last with my model. Any new ideas? Besides it shows permanently the data and time error and several other ones.

3a8082e126