The whole project started with the acquisition of the mentioned IBM770. After opening all possible slots there was even a CMOS Clear-Jumper, .. that also nicely deleted everything in the CMOS, .. butnot the password.
IBM has done a good job here, typing it once and forgetting means here -> throwing a laptop out of the window. It was clear that we wouldn’t do that, of course … so we found a tutorial to read the EEPROM directly from the board with a simple RS232 interface which is soldered directly to the IC via a few diodes.
The PC is started for the purpose of supplying voltage to the IC and then it is read, .. yes that would be nice, .. did not work. Mad.M, the owner of the 770 left late at night, .. and I was already on my way to bed when I thought, .. NAH !!. So … I have made up my mind and build an eeprom reader on my own
I bought the components the next day, … soldered together, unsoldered the EEPROM from the board, put it into operation, read the fucking password, decrypted it with a tool -> Voila !! Password: CEMOS … very imaginative, … EEPROM soldered back to the mainboard, put everything together, power up, enter password, -> UNLOCKED this fucker !
Just been made aware of this article 22 years after it was created. I too was fighting a 770X machine for SVP passwords. I used a powered MAX232 reader board which I built to read off the SCA and SCL pins. However this article is definitely not handling a 770X board – it must have been another 770-series machine. The 770X has 3 SODIMM slots and the one in the pics above only has 2.
The 770X has two ATMEL chips for storing BIOS information. The 24C01 chip is commonly remarked as ‘the’ chip in this machine and is visible inside the memory bay door. The 770X has the weird and unique case of having 3 jumper pins in the memory bay and the hardware manual explains how you can short one of these to reset the POP. Right next to it is a 24C01 chip. However this does not hold other information and was not being used in the case of my two machines.
The ‘real’ BIOS chip was a 24RF08 chip which is very close to the RAM sticks but completely buried. I think the 770X is unique in that it is the only thinkpad I’ve seen that uses two ATMEL chips to store BIOS information. The whole machine needs to be stripped down and the RF shielding removed from the BOTTOM of the mainboard – which is really the last thing to come off, held on by about 5 little screws around the top of the mainboard and also things like the PCMCIA card bay is holding it on. Once you remove the RF shielding you can see the 24RF08 chip next to the crystal sound card
hi alex! you may be right, well its 1000 years ago since i made this 😉 maybe i mixed something up with the type of the thinkpad. but i guess the artice can be a inspiration for people like us …