Service Forum

[oneillsite]

Hi all,
Any advise how to unlock a T61 with AMTEL TPM ?

[agardim]

[victor]

I replied to you, agardim.
_________________
Victor Voinea
ALLservice HQ, Romania.

[novalis]

Helllo,
I'm trying to unlock T61 too, could you send me the email with instructions where to connect the interface or post it here?
And does PC8394 Tools work with this model? I only found notice about T60/p

Thanks very much,
Novalis

[bob]

We work on T61, but anyway the information will be available only for PC8394 tools registered users.
When it will be tested, we will update the compatibility list. Please do not ask till then.

[novalis]

OK,
thanks I'll buy those tools, also with the interface when it is done (may be I could do some testing for you if you want). But is there any (at least estimated) date when it could be finished?

Thanks.

[victor]

We have the confirmation for T61. It doesn't use a TPM system like T60, they dropped back to P24S08. Very disipointing to see that Thinkpads are really "made in China" junks now, we would have been expected a lot more from them (Lenovo & friends)...

For PCA 24S08 simply use the free 24RF08 eeprom reader and IBMpass 2.1 lite (do not forget to donate )

If someone wants pictures or details - email us or PM (if you're from China, don't bother ).

[Edit]

Here are the pictures that all of you requested, I hope my PM inbox will take a short break .
The eeprom is on the back of the board, you may need to consult the T61 Hardware Maintenance Manual if you want to dismantle it.

HMM here:
http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-39298

T61 eeprom here:

http://www.allservice.ro/forum/images/T61-1.jpg
http://www.allservice.ro/forum/images/T61-2.jpg

[Edit]
and another layout:

http://www.allservice.ro/forum/images/t61-alt.jpg
[/Edit]
_________________
Victor Voinea
ALLservice HQ, Romania.

[quang]

[victor]

Use R24RF08, that is made to read in system eeproms.
Oh, I forgot to mention that T61 is using a different TCPA algo( is not the old used till now) and is quite possible that you may find passphrase enabled.

TCPA reset service will be the only chance and is only $25( available only for W24RF08 licensees, of course)
_________________
Victor Voinea
ALLservice HQ, Romania.

[hound]

Hi Victor,

I would just like to thank you very much for this resource. It really saved my T61 (model 7659-1NU) and got me back up and running quickly. My problem started when I could not clear a power-on password because a supervisor password was set. Unfortunately, the SVP was not what I thought it was and after I cleared the POP, it would not boot except for the SVP.

In any event, opened it up and found the chip on the underside of the system board (also not quite where your picture had it). It was just a bit from the I/O ports, in line with the dual USB interfaces. It was also partially covered by some black tape. The instructions for soldering the leads were perfect and we used a solderless breadboard to make up the circuit.

Initially, the program wouldn't run but after checking our components we found that one of the zener diodes were bad. After replacing it, all went splendidly. Once again, my heartfelt thanks and highest commendation for your comprehensive instruction.

I have one tip for those of you attempting to follow the Lenovo HMM to take apart your computer. When carrying out the steps to get to the system board you can safely skip "1140 Fan assembly", "1150 CPU" as well as "1180 Structure frame". The first two can be skipped because they will only cause you to expose the CPU and its thermal grease to unnecessary contaminants and these components are not required to be removed to get the base cover off (just watch the antenna wires and left speaker). The last step can be skipped since we only need to expose the EEPROM chip.

The entire computer ran for me with only the CPU, fan assembly, keyboard and LCD reconnected. No other components were required to get into the BIOS. I just made sure to use a soft surface in the absence of the base cover since I was concerned that the soldered wires might break off since we didn't use a lot of solder.

All in all, the entire disassembly, soldering, circuit building, decoding, unlocking and then reassembly took about four hours (I was being extra careful).

Best regards,
Michael

[victor]

Hi Michael,

Thank you very much for your input. Yes, there are two layouts as far as I know, I posted this picture as a reference, here we go again:
www.allservice.ro/forum/images/t61-alt.jpg

The chip is the same as you pointed out.
_________________
Victor Voinea
ALLservice HQ, Romania.

[grubbi44]

Hi all,

i tried to get the data out of the Eprom chip: NXP P24S08 (A423 n6738) with my builded simple i2cprog. but when i started C:\ALLservice\24RF08\r24rf08.exe <mybin> i get an error message:

ERROR: Unable to create the file!




my i2cprog has needles for better connection.
with itester i got: 0,004 V with 0 status, 0,053 V with 1 status (between scl and sda) - don't know if this might be the reason?!?

hope to get it running with ur help ... in germany its not easy to find people like u to unlock! and students have less money, too!

[victor]

That is clearly the reason. Don't try it again until your circuit works, and I strongly advice you to build the driven programmer on this one.
_________________
Victor Voinea
ALLservice HQ, Romania.

[grubbi44]

Thank you for the fast reply!

i now got the parts to build the driven serial programmer!

but i have a question: i have got the MAX 232N with 8 pins each side!... is this the same as MAX 232* ?!? If not, what condensators do i need?! i bought the 1 uF now! and where is pin 1, 2, 3, .... ?!?

thanks in advance for help!

[victor]

1uF are good. Please refer to Practice section in this forum, you'll find there all info you need.

http://www.allservice.ro/forum/viewtopic.php?t=123&start=0
_________________
Victor Voinea
ALLservice HQ, Romania.