Disclaimer

All trademarks used in this private archive are the property of their respective owners.
All documentation in this archive is for private and non-commercial use.
WARNING
ALL INFORMATION ARE UNTESTED, FLASH AT YOUR RISK!!
I'm NOT RESPONSIBLE for MISTAKES in this archive: BE CAREFUL!!

1. Software Procedures
2. Hardware Procedures

Master Passwords

Master Password

Password Decrypt / Erase CMOS:

Thanks to - Elf Qrin (http://www.elfqrin.com/)

If you can't access to the computer when it's turned on, got to
Step B/Procedure B-3

If you have access to the computer when it's turned on, you could try one of those procedures that try to decrypt password or remove it from the BIOS, by invalidating its cmos memory.

Step A] Password Decrypt

Download "CmosPDW" and "Bios310" from "Utilities"-->"Bios Utilities". Run those utilities on your system and try to decrypt your password: don't use "clear cmos" features !

If you can't decrypt your password, try to discover it using "brute force attak" procedures contained in "Bios310" utility.

Invalidates CMOS RAM : Software Procedure: .

Step B] Erase Cmos

If "brute force" attak don't work and if the password isn't stored in eeprom, you can try to invalidate the cmos system memory area, using various software/hardware procedures.Whether is the method you use, when you clear cmos not only the password, but also all the other configuration data will be reset to the factory defaults, so when you are booting for the first time after a cmos reset , you should enter the CMOS configuration menu and fix up some things. Use Bios310 to backup your cmos-configuration.

Procedure B-1] Clear Cmos using Debug

You can reset the BIOS to its default values using the MS-DOS tool DEBUG (type DEBUG at the command prompt. You'd better do it in pure MS-DOS mode, not from a MS-DOS shell window in Windows). Once you are in the debug environment enter the following commands:

( for AMI/AWARD BIOS )

O 70 17

O 71 17

Q

( for PHOENIX BIOS )

O 70 FF

O 71 17

Q

( for Generic bios )

O 70 2E

O 71 FF

Q

Note that the first letter is a "O" not the number "0". The numbers which follow are two bytes in hex format.

Procedure B-2] Clear Cmos using "CmosPWD /k " or "Bios310" clear cmos features.

Download and use these utilities from "Utilities" -->"Bios Utilities" section.

Invalidates CMOS RAM : Hardware Procedure: .

Procedure B-3] Short or Open "Cmos Clear" jumper

<-- back to Index

Try to found the special jumper "clear cmos" or "reset cmos" on your mainboard user's manual and short (or open) it.

Procedure B-4] Remove the Cmos Battery

If you can't found the "clear cmos" jumper , try to remove cmos battery (sometimes this battery is solded in the RTC component ) . It's a button-size battery somewhere on the motherboard (on elder computers the battery could be a small, typically blue, cylinder soldered to the motherboard, otherwise you'll have to unsolder it and then solder it back). Take it away for 15-30 minutes or more, then put it back and the data contained into the CMOS memory should be volatilized.

Procedure B-5] Short-circuiting the chip

Another way to clear the CMOS RAM is to reset it by short circuiting two pins of the BIOS chip (<ndr> RTC chips ..? ) for a few seconds. You can do that with a small piece of electric wire or with a bended paper clip. Always make sure that the computer is turned OFF before to try this operation.
Here is a list of EPROM chips ( <ndr> RTC chips ..? ) that are commonly used in the BIOS industry. You may find similar chips with different names if they are compatible chips made by another brand. If you find the BIOS chip (<ndr> RTC chips ..? ) you are working on matches with one of the following you can try to short-cicuit the appropriate pins. Be careful, because this operation may damage the chip.

CHIPS P82C206 (square)

Short together pins 12 and 32 (the first and the last pins on the bottom edge of the chip) or pins 74 and 75 (the two pins on the upper left corner).

       gnd
       74
        |__________________
5v 75--|                   |
       |                   |
       |                   |
       |       CHIPS       |
   1 * |                   |
       |      P82C206      |
       |                   |
       |                   |
       |___________________|
        |                 |
        |                 | 5v
        12 gnd            32

OPTi F82C206 (rectangular)

Short together pins 3 and 26 (third pin from left side and fifth pin from right side on the bottom edge).

    80              51
     |______________|
81 -|                |- 50
    |                |
    |                |
    |      OPTi      |  
    |                |
    |     F82C206    |
    |                |
100-|________________|-31
     ||           | |
   1 ||           | | 30
      3           26

Dallas DS1287, DS1287A
Benchmarq bp3287MT, bq3287AMT

The Dallas DS1287 and DS1287A, and the compatible Benchmarq bp3287MT and bq3287AMT chips have a built-in battery. This battery should last up to ten years. Any motherboard using these chips should not have an additional battery (this means you can't clear cmos by removing a battery). When the battery fails, the RTC chip would be replaced.
CMOS RAM can be cleared on the 1287A and 3287AMT chips by shorting pins 12 and 21.
The 1287 (and 3287MT) differ from the 1287A in that the CMOS RAM can't be cleared. If there is a problem such as a forgotten password, the chip must be replaced. (In this case it is recommended to replace the 1287 with a 1287A). Also the Dallas 12887 and 12887A are similar but contain twice as much CMOS RAM storage.

         __________
     1 -| *  U     |-  24 5v
     2 -|          |-  23
     3 -|          |-  22
     4 -|          |-  21 RCL (RAM Clear)
     5 -|          |-  20
     6 -|          |-  19
     7 -|          |-  18
     8 -|          |-  17
     9 -|          |-  16
    10 -|          |-  15
    11 -|          |-  14
gnd 12 -|__________|-  13

NOTE: Although these are 24-pin chips,
the Dallas chips may be missing 5 pins,
these are unused pins.
Most chips have unused pins,
though usually they are still present. 

Dallas DS12885S
Benchmarq bq3258S
Hitachi HD146818AP
Samsung KS82C6818A

This is a rectangular 24-pin DIP chip, usually in a socket. The number on the chip should end in 6818.
Although this chip is pin-compatible with the Dallas 1287/1287A, there is no built-in battery.
Short together pins 12 and 24.

 5v
 24          20                   13
 |___________|____________________|
|                                  |
|             DALLAS               |
|>                                 |
|            DS12885S              |
|                                  |
|__________________________________|
 |                                |
 1                                12
                                  gnd

Motorola MC146818AP

Short pins 12 and 24. These are the pins on diagonally opposite corners - lower left and upper right. You might also try pins 12 and 20.

          __________
     1  -| *  U     |-  24 5v
     2  -|          |-  23
     3  -|          |-  22
     4  -|          |-  21
     5  -|          |-  20
     6  -|          |-  19
     7  -|          |-  18
     8  -|          |-  17
     9  -|          |-  16
    10  -|          |-  15
    11  -|          |-  14
gnd 12  -|__________|-  13

Tips&Triks about single machines to disable Power-on Password and Setup Password

Thanks to :

- Christophe GRENIER
grenier@nef.esiea.fr
http://www.esiea.fr/public_html/Christophe.GRENIER/

- IBM Thinkpad informations service
http://servicepac.mainz.ibm.com

Note : CmosPWD is a powerfull tool : download it from "Utilities" --> "Bios Utilities"

or use connector J13 (2-pin connector)

To reset the password of a Toshiba, you can use KeyDisk. (see CmosPWD tool)
If this doesn't work, you can try to build the Toshiba Parallell loopback.
To make a simple device that you connect to your parallell port, a lot of Toshiba computers remove the password when you boot it up.
The device, named "loopback" by some, could be made out of any parallell wire with 25pins connectors (db25). You should connect these pins: 1-5-10, 2-11, 3-17, 4-12, 6-16, 7-13, 8-14, 9-15, 18-25.

A db25 looks like:

Note: The "KeyDisk Creation Utility" is contained in "CmosPWD" tool (downloadable from "Utilities"--> "Bios Utilities" section ). However. to manually create a Toshiba Keydisk, take a 720Kb or 1.44Mb floppy disk, format it , then use a hex editor such as Hex Workshop to change the first five bytes of the second sector (the one after the boot sector) and set them to 4B 45 59 00 00 (note that the first three bytes are the ASCII for "KEY" :) followed by two zeroes). Once you have created the key disk put it into the notebook's drive and turn it on, then push the reset button and when asked for password, press Enter. You will be asked to Set Password again. Press Y and Enter. You'll enter the BIOS configuration where you can set a new password