Service Forum

[bodger98]

I have a Toshiba Tecra M2 with an unknown password at power on. I have built the i2c easy circuit at www.lancos.org but I need to know where to go next.

I think I have located the eeprom, it is labeled 2402w6 and is located just underneath the touch pad. Which pins do i need to connect to my i2c reader to read the data?

[bodger98]

Made some progress, i ended up desoldering the 2402w6 eeprom and wiring it up to my easy i2c reader.

Using pony programmer I managed to extract a 256byte bin.

I hav opened this file in an editor and can't see anything obvious, is the password encrypted?

[bodger98]

I have uploaded a new eeprom bin to the 2402 and resoldered it, but when i power the laptop up I get nothing.

The power light comes on when you press the power button but nothing else happens

Could a bad resolder of the 2402 cause this?

[bob]

Yes, that is the cause for sure. check that there are no solder bridges between adjacent eeprom pins and see that the eeprom has been positioned correctly

[Shef]

Hi,

I have been solving this one for a while. In the eeprom is just a hash of the password.

It's two lines - 8 and 8 characters (double chars in hex).


Do not mess with the other part of eeprom or you will get a security mismatch error. That eeprom is actualy paired with the reneas keyboard firmware storage chip (starting with M2...the big one).

If you delete the 2 lines, you will get what you need. It's working, proven on 4 notebooks.

If you will need more help or actual dumps, send me mail on rareshop at rareshop dot org.


Enjoy,

Shef

[victor]

For M2, the hashes are located at 0x10-0x17 and 0x20-0x27. First hash is the length and the second one is quite the password. (Thanks to P. Silhanek for all the tests at that time)

Put blanks on those 2 zones and that is it.
_________________
Victor Voinea
ALLservice HQ, Romania.

[moonboy33]

I have a Toshiba Tecra M1 and I have a problem removing the User-Password.

I already managed to read both eeproms (the first, at the keyboard connector looked like 4321.bin (http://allservice.ro/forum/viewtopic.php?t=786#3197), the other one, near the red button, is FFed from 0x20 till the end) and deleted 0x10-0x17 and 0x20-0x27 in both.

It didnt work in any way i´ve tryed (1st eeprom 00ed out, 2nd eeprom original and the other way round; both zeroed out)

Here are my original Dumps:

1st eeprom (keyboard connector):
http://tinyurl.com/tecra1-bak2-bin

2nd eeprom (red power button):
http://tinyurl.com/tecrasec1-bin

Please look at the dumps and see what you can do

[bodger98]

Hi Folks,

I have made some progress. I have desoldered and resoldered the eeprom and the laptop now boots. But I get the following message

ALERT : System protection failure!
Password =

Then i try entering 1234 and i get the following error

Not certified, system is shutting down

I have also tried just pressing enter but it gives me the same results. Any idea what has gone wrong?

[micomp]

Hi,

I have the same problem with tecra M2. I read eeprom and delete two lines 0x10-0x17 and 0x20-0x27 and I have a message:

ALERT : System protection failure!
Password =

What am I doing wrong?