Re: R24rf08 Setup.zip
Rocki Stenger
If you use your laptop at a desk, reduce battery wear by maintaining an appropriate charge level. When possible, remove Li-ion batteries while operating from AC as the notebook gets hot enough inside for that to damage the battery in the long run, even if charging is stopped.
On recent ThinkPads, charging thresholds can be configured in the bundled software. Under Linux, this is supported on recent models by the tp_smapi driver (and even without tp_smapi, if you have a dual-boot setup, you can set the thresholds under Windows and they will be remembered as long as you don't power off your machine with AC disconnected; suspend to RAM is OK). Have a look at How to use UltraBay batteries.
If you have spare Li-ion battery packs, store them at 40% charge in a cool place (15C being a recommended temperature, do not let the batteries freeze). If storing inside a refrigerator, beware of humidity, and be careful with cold spots that can easily freeze the battery if anything goes wrong.
Some people experience sudden drops in their batteries capacity. A way to get these batteries back to full capacity is to run the "Battery Rundown" function of IBMs "PC Doctor for DOS". The program is downloadable from IBMs support site as three floppy disk images. Make sure you get the specific version of program made for your ThinkPad model. For those who do not have a floppy, David Smith prepared a bootable CD image (dead link, a copy is also available here) from the T22 floppy images. For newer ThinkPads there is an official bootable CD image. (Although the instructions on this page (as of May 2008) include details for Linux and refer to a CD image, it is actually provided as a Windows executable. On Linux systems, Wine can execute this file and extract the CD image.) Once extracted, you must mount the iso as a loop device (as root) like so:
I have recently made an interesting discovery, I have an R40 with two main batteries, both of them have aproximately about under 200 cycles and are nowadays 4 years old, projected capacity for R40/R32 main battery is 57Wh, and both my batteries were about 30Wh, then I left my notebook with one of them about a day in a standby mode, as long as it powered off itself because of low battery power, when I turned it on I saw the battery capacity at about 42Wh, then, I did this too for the second battery and I got even about 46Wh, I think I could go even higher with letting the battery discharge completely from 100% in standby, I think this has something to do with low power consumption in standby mode, it may work for you too.
Most ThinkPad models (particularly the A-series and the T-series) tend to accumulate a lot of interior dust which they draw from their ventilation fan. A good dusting every few months is advised. The procedure is as follows.
The IBM ThinkPad uses a small eeprom (ATMEL 24RF08) to store different OEMissues like serial number, UUID, etc. The supervisor password (SVP) is also stored in this eeprom.The 24RF08 is not an ordinary eeprom: it features read protection, which the BIOS uses to lock downaccess to the eeprom contents. Also, the password is written in a special scan code, which needs tobe translated to ASCII to be of any use.
ThinkPads featuring TPCA technology (i.e. a TPM trusted platform module chip), especially T4x, X3x, X4x, X61 and X61T need the W24RF08 eeprom writer program to complete the password recovery procedure, if the passphrase function is enabled in BIOS setup.
Other models such as the 380XD or 600 use 24C01 or 93C46 eeproms, which can be read without special tools.The method is the same like for the models based on 24RF08, only the software to dump the eeprom is different.
No need to unsolder the 24RF08 eeprom, just solder 3 wires to SDA, SCL and GND pins of theeeprom. There are two eeprom layouts (see interface schematics described bellow), corresponding to 8 pin or 14 pin eeproms. Locate the eeprom first according to your model (E.g. T20-23 and T30 have the eeprom underneath TP, and can be accessed by removing the RAM modules cover, no need to dismantle the laptop.) and solder the wires using a soldering iron with a fine tip. Also, you can use 0.15 -0.20 mm enamel coated wires or similar small diameter insulated wires. These wires will be connected later to the interface.Tip: You can use clips to connect the wires or you can solder on the PCB traces leading to theeeprom pins. Once again, be careful and double, triple check the soldering if necessary till you are positively sure you have done the right job. In case of applying too much solder, use flux-impregnated copper-braid "desoldering wick" - this works exceptionally well.
Since version 2.0, R24RF08 and W24RF08 (eeprom writer) are compatible with a wide range of eeprom programmers. By default, both programs set the COM port signals to use direct logic level to access I2C bus. We provide here 2 schematics that are relevant for direct logic signals and for inverse logic signals (simple-i2cprog.pdf and driven-i2cprog.pdf). Also, depending of the interface you build, you can invert the logics for SDA-In, SDA-Out, and SCL COM port signals by some command line parameters described later in this document.a) The file simple-i2cprog.pdf contains the schematic diagram of a simple interface (known as SIPROG)based on 2 zeners and 2 resistors. This is a classic, easy to build circuit and works with soldered or unsoldered eeproms. The purpose of the 2 zeners is to convert RS232 levels (+/- 5V) to TTL levels, needed by the eeprom. It uses direct logic signals to I2C eeprom and is powered by the COM port. However, this interface works with in-system eeproms but is dependant on COM port current and eeprom bus impedance. R24RF08 works natively with this circuit, no need to change the lines signals with command line parameters. This circuit works pretty well with almost all ThinkPads series.b) The second interface is described in driven-i2cprog.pdf. The circuit uses MAX 232 as a RS232 to TTL driver and its main purpose is to work with soldered eeproms. The advantage of MAX232 is the TTL outputs that are more reliable and more powerful when work with soldered, in-system eeproms (dependency free from the COM port current). Due of the internal inverters of MAX232 the interface responds to an inverse signal logic level. R24RF08 needs /x, /d, /i switches to be specified in the command line.
What these switches mean:/x - invert serial clock, also known as SCL;/d - invert serial data output, also known as SDA-Out;/i - invert serial data input, also known as SDA-In.All those can be used in any combination to meet any interface specification.
Note that the "standard" serial port programmer probably won't work with a USB-Serial adapter, but requires the full nominal voltage of a hardware serial port. [Example: the A22p's serial port works fine here.]
Use exactly the instructed switches to avoid possible damages to your eeprom data!The file should be created in the same folder. Finally, disconnect the wires (GND last!) and turn off the ThinkPad by pressing on/off switch.
Note: the r24rf08.exe program automatically sets the serial port parameters. It also works fine with Wine under Linux - provided that a symlink (com1) exists in the .wine/dos_devices directory, and points to the /dev/ttySX for the actual serial port.
For some old models like 570 or 770Z you need to execute the eeprom patcher first. This will reset the read protection on the password offset. To do that just execute patcher.exe before the reading operation, without rebooting the laptop:
Moreover, there are a new encrypting algos used with some new security chips (AT97SC3201, AT97SC3203) that are very secured. The password is not in scancode and in some cases not even in the eeprom. To unlock the machine, the dump should suffer some changes and the eeprom must be reprogrammed using W24RF08. This operation works for all IBM TCG/TCPA secured laptops w/o exceptions.
Remember, use 3 wires from the interface and 3 wires from eeprom! Connect them after yourThinkPad is powered and disconnect them right after you read the content, before you switch off the laptop.
Google is blocking my pages!.
Google claim my pages have duplicates and I have not selected which should be used.
They state my pages have: 'Duplicate without user-selected canonical'. My pages do not have duplicates on my site, there is only one copy of each page.
The only thing I can think of is that they are detecting normsweb.com & www.normsweb.com and treating that as duplicates although they are the exact same pages. I await a reply from Google.
The supervisor password (SVP) on the IBM Thinkpad is stored in an ATMEL chip (On most models the chip is an 8 pin DIL and is labelled 24RF08). It can not be reset by any normal means and even the IBM service manual (hardware maintenance manual) suggests that if SVP is lost, you must replace the motherboard in the laptop to overcome the issue.
However, we know that the motherboard does not need to be replaced! You can simply read the data stored in the ATMEL chip and decipher the SVP. - Well I say simply, but you will have to pull your laptop apart and solder three wires to the motherboard, which is far from simple.
Before you start this procedure, Read this whole page thoroughly and make sure you have all the parts in place and that you are confident to do the job. Also understand that if you mess it up, you could destroy your laptop. Proceed at your own risk! I am not responsible for any damage to you or your laptop from trying this fix.
Download and install these softwares on second computer. Reader software - r24rf08_setup.exe or PonyProg, Decoder software - setup_ibmpass21.zip. These softwares can easily be found with any search engine.
Turn laptop off and disconnect all power, de-solder the three wires carefully - you got this far, you don't wanna kill the laptop now. Put laptop back together. Just do the reverse of what you did to get it apart. - You're Done!
I've tried "Ponyprog" from Lancos on an EEPROM unsoldered from a dead T40. I used the interface circuit described on your website, and settings of "2402-16" and "24XXAuto". The Supervisor password is at 0x338 to 0x33e and again at 0x340 to 0x346, followed in each instance by a checksum byte. The page structure of the 24rf08 means that certain information appears twice in the dump: the serial numbers in particular.
b1e95dc632