Service Forum

[Disabled]

Hello everybody,
I have a Toshiba Libretto U105 with a password set, as soon as I turn it on it asks for a password. Doing some research about this particular model, found a site that has some information as to which locations of the EEPROM memory to modify in order to bypass the User and Supervisor password. According to that site the EEPROM 24C02W8 is under the notebook keyboard chip, but so far I haven't find it. Since it's a small laptop, it has some components that are smaller than usual, I've been thinking that one of those 8 pin chips could be the EEPROM I'm looking for, but the part numbers on them are hard to read or haven't found information of them.

At first the laptop would let me type up to three passwords, after that it would automatically shut down. Pressing the CTRL-TAB-CTRL-ENTER keys would show me a screen with the serial number and a challenge code, and a prompt for a response code. Yesterday a new message appeared on top of the screen: "ALERT: System protection failure!" and under it the Password= prompt, now I can only type one password and after that it shuts down. Pressing CTRL-TAB-CTRL-ENTER the laptop now shows the model number (U100) as the serial number and a challenge code.

I need help from someone that can point me in the right direction. I couln't find the full maintenance manual (only Chapter 4 - Replacement procedures), but found another manual for a previous libretto model that mentions that the password it's stored in the Flash chip. This laptop has a M50FW080 TSOP32-14mm flash chip. Can someone confirm this, where's the password stored? and if anyone has an image file of the flash chip or a way of how to extract it from the Toshiba firmware update executable so I can remove the firmware chip and overwrite it? I have an Enhanced Willem programmer that with the proper adapter I may be able to use.

Thanks in advance,
DRGN997

[Disabled]

Hello,
I was able to take a reading of the Flash chip, a ST M50FW080 8Mbit before I paid for a service to remove the password. All the information indicates that the password is stored in the Flash chip (00000-FFFFF), to be more precise in Sector with address D0000-DFFFF. Here's a file compare that I did, the first file don't have a password and the second one has a known user and supervisor password.

000D0210: 7C 6A
000D0211: 0B DF
000D0212: BC F4
000D0213: BE F1
000D0214: 25 ED
000D0215: 60 6C
000D0216: B0 38
000D0217: 2E 2D
000D0218: 00 BF
000D0219: 00 6D
000D021A: 00 6C
000D021B: 00 81
000D021C: 00 9E
000D021D: 00 C9
000D021E: 00 75
000D021F: 00 B0
000D0220: 00 AD
000D0221: 00 1E
000D0222: 00 41
000D0223: 00 CE
000D0224: 00 BD
000D0225: 00 43
000D0226: 00 E6
000D0227: 00 4A
000D0228: FF F1
000D022A: CF CE
000D0230: FF F1
000D0232: CF CE
000D0238: 00 03
000D0FFF: 47 2B

This information may work if applied to a Tosh.. laptop that stores the passw.. on the Flash chip and doesn't have an EEPROM on the motherboard. Just get two or three readings of the flash chip of your pw protected laptop to compare them and make sure the flash image file it's correct before you modify the contents and store it in a safe place, you don't want to corrupt your BIOS. Then replace the values of the first column on the Dxxxx original memory positions to see if that overrides your pw.

I must mention that on the first approach, I did set sector D0000-DFFFF memory positions all to FF's, did this twice, and every time it would go back to the original memory contents before I set everything to FF's, copied from I don't know where. If this doesn't work, then the next approach would be to replace the whole sector (D0000-DFFFF) on your original flash image file.

DRGN997

[bob]

Thank you.

Which password is in the second row?

[Disabled]

[bob]

Thank you again for sharing.

To be found easier, this topic has been linked to fredzofbrum's sticky one:
http://www.allservice.ro/forum/viewtopic.php?p=4007#4007

Keep up the good job.