ALLservice Service Forum
support board, PC repair, unlocking solutions
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Thinkpad 600 - which circuit?

 
Post new topic   Reply to topic    Service Forum Forum Index -> IBM/Lenovo ThinkPad Password Help Center (EN)
View previous topic :: View next topic  
Author Message
Pirat007
Interesat


Joined: 28 Nov 2006
Posts: 15
PostPosted: Sat Dec 02, 2006 1:04 am    Post subject: Thinkpad 600 - which circuit? Reply with quote
HI!

I have an old Thinkpad 600 with a 24C01A EEPROM installed.
I wanted to read the eeprom in circuit.
Can I use 2 zener-diodes or must I use a MAX232?

Thanks
Pirate
Back to top
View user's profile Send private message
victor
S.F. Boss


Joined: 07 Mar 2004
Posts: 2581
Location: Staff
PostPosted: Sat Dec 02, 2006 1:50 am    Post subject: Reply with quote
If you plan to do it "in system", MAX232 all the time.
Back to top
View user's profile Send private message
Pirat007
Interesat


Joined: 28 Nov 2006
Posts: 15
PostPosted: Sat Dec 02, 2006 2:04 am    Post subject: Reply with quote
Thank you!
Back to top
View user's profile Send private message
bob
S.F. Moderator


Joined: 07 Mar 2004
Posts: 802
Location: Staff
PostPosted: Mon Dec 04, 2006 9:46 pm    Post subject: Reply with quote
Message moved here, trying to clear the forum a bit:

Pirate007 wrote:
Thanks for the hint!

Here an update, maybe useful for some people:

Modified:
Thinkpad 600 – guide for reading the Supervisor Password (with ponyprog):

1. remove the mainboard (Hardware maintenance manual page 87)
2. locate EEPROM 24C01A
3. solder 3 wires to pin 4, 5 and 6 of 24C01A
4. build schematic: driven-i2cprog.pdf
5. connect driven-i2cprog to com port of PC
6. install ponyprog2000 2.05a Beta
7. Select from menu "Device>I2C bus 8 bit eeprom>2401".
8. setup > Interface Setup: seriel, SI Prog API, select com port
9. In "Setup> Interface Setup" invert the D-in, D-out and SCLK.
10. change PONYPROG2000.INI: modify the line: I2CBaseAddress=0xA0 to I2CBaseAddress=0xAE
11. Save PONYPROG2000.INI
12. Setup > calibrate ….
13. connect AC adapter to the TP 600 mainboard (mainboard without any other boards)
14. connect GND wire of driven-i2cprog to pin 4 of 24C01A (GND also can be connected to any GND pad of the mainboard)
15. press power button of the TP 600 mainboard
16. connect SDA to pin 5 and SCL to pin 6 of 24C01A
17. read eeprom with ponyprog
18. store the bin-file
19. install ibmpass2
20. open stored bin file with ibmpass2
21. at impass press button “AA” – on
22. view: scancode translation classic
23. For 24C01 eeproms the password is located at 0x38, 0x40 – read password starting at 0x38 – ending at ????
24. note password
25. disconnect SDA and SCL wires
26. switch off the mainboard
27. disconnect GND wire


Thinkpad 600 – guide for reading the Supervisor Password (with R24C01 that comes with R24RF01 kit):

1. remove the mainboard (Hardware maintenance manual page 87)
2. locate EEPROM 24C01A
3. solder 3 wires to pin 4, 5 and 6 of 24C01A
4. build schematic: driven-i2cprog.pdf
5. Install R24RF01
6. connect driven-i2cprog to com port of PC
7. connect AC adapter to the TP 600 mainboard (mainboard without any other boards)
8. connect GND wire of driven-i2cprog to pin 4 of 24C01A (GND also can be connected to any GND pad of the mainboard)
9. press power button of the TP 600 mainboard
10. connect SDA to pin 5 and SCL to pin 6 of 24C01A
11. Run R24C01.exe
12. Use command: r24c01 your.bin /x /d /i
13. install ibmpass2
14. open your.bin file with ibmpass2
15. at impass press button “AA” – on
16. view: scancode translation classic
17. For 24C01 eeproms the password is located at 0x38, 0x40 – read password starting at 0x38 – ending at ????
18. note password
19. disconnect SDA and SCL wires
20. switch off the mainboard
21. disconnect GND wire

Pirate
Back to top
View user's profile Send private message
ubik
Nou Venit


Joined: 12 Dec 2005
Posts: 9
PostPosted: Wed Mar 07, 2007 3:03 am    Post subject: Simple_i2cProg sufficient for 24c01a ? Reply with quote
Hallo

Sorry if my question has been answered before, tried to find it but didnt really succeed.
Think this was the best hit, but i`m still not sure wether the driven one is necessary .


I`m a liitle bit in selfmade trouble, promised my friend a functioning TP600 in the next days,
but the original motherboard has an urepairable break and my only spare is this &$%?*mobo
(had put it in the cellar, never wanted to take it out an see it agin:D )

The mobo shows IMO strange behaviour,
the password prompt has the laptop symbol, as far as i know indicating a POP
So i shortened the pads as instructed in the HMM, but the password promt did not dissappear
I can now bypass it by hitting enter, but that only leads to the next screen
showing "error 161 + 163" , the code for an empty bios battery
(a new one is connected, no 192 ;)

This leads to the questions:
Is that normal behaviour for a TP600 or
a: might the eeprom be corrupted,
b: am i wrong that it was only the POP,
and can i read 24c01 with the simple one ?
and last not least: are the Dumps of 24rf08 and 24c01 schematically identical?
If not, where can i find a 24c01 dump, it must not be complete or fully functional, hope schematics will serve ..

Thanks for your interest,
any suggestions are appreciated

Ubik
___
safe when taken as directed







(did it several times with rf2408)
Back to top
View user's profile Send private message
bob
S.F. Moderator


Joined: 07 Mar 2004
Posts: 802
Location: Staff
PostPosted: Wed Mar 07, 2007 11:32 pm    Post subject: Reply with quote
you wrote:
Is that normal behaviour for a TP600 or
a: might the eeprom be corrupted,
b: am i wrong that it was only the POP,
and can i read 24c01 with the simple one ?
and last not least: are the Dumps of 24rf08 and 24c01 schematically identical?
If not, where can i find a 24c01 dump, it must not be complete or fully functional, hope schematics will serve ..


The answers:
- Is normal, the errors appear due to the DATE/TIME reset, you need to enter Setup to set the Time and the errors should be gone.
- a: No,
- b: It is the SVP.
- You can use SIPROG but you have to use a strong serial port. Better to use the driven programmer (MAX232)
To read the 24C01 (only TP 600, 600E and 600X use 24RF08), you can use R24C01 instead of PonyProg.
- 24RF08 and 24C01 are totally different, so they have different contents. Your eeprom is not corrupt so is not the case to write it.
Back to top
View user's profile Send private message
ubik
Nou Venit


Joined: 12 Dec 2005
Posts: 9
PostPosted: Thu Mar 08, 2007 2:36 am    Post subject: Reply with quote
Hi bob

Thank you very much for your reply !

Think i`ll first try it with the simple one and good ol`600e,
the iron is already heating up :D

btw, do you know any indications that short cables work better ,
specially in this case ?

ubik
Back to top
View user's profile Send private message
bob
S.F. Moderator


Joined: 07 Mar 2004
Posts: 802
Location: Staff
PostPosted: Sat Mar 10, 2007 10:54 am    Post subject: Reply with quote
For SIPROG 20-30Cm is enough. Watch out, 600e has 24RF08 not 24c01
Back to top
View user's profile Send private message
ubik
Nou Venit


Joined: 12 Dec 2005
Posts: 9
PostPosted: Sun Mar 11, 2007 3:43 pm    Post subject: Reply with quote
bob wrote:
For SIPROG 20-30Cm is enough. Watch out, 600e has 24RF08 not 24c01


:)
Sorry, my mistake/bad english:
siprog is connected to rs232 of "good old 600e" , reading 24c01 of 600

however, thanks a lot !
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Service Forum Forum Index -> IBM/Lenovo ThinkPad Password Help Center (EN) All times are GMT + 2 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



Powered by phpBB © 2001, 2005 phpBB Group