Service Forum

[victor]

- R24RF08 2.0b + Add-Ons (Freeware) - reader for ATMEL 24rf08 eeproms used in IBM ThinkPad.
The kit includes now the R24C01 (24C01 reader) and ITester (interface testing utility).
- W24RF08 2.1a (30 US$) - writer for ATMEL 24RF08 (CRC recovery assistance. TCG/TCPA chip reset)
- PC8394T programming tools ($110) - Software for flashing TPM/secure storage chips in new TP models.
Suitable for R52, R60, T43, T60, X60, Z60 series, Z61 series.
- IBMpass 2.1 Lite (Freeware) - Scancode editor/decoder for eeprom dumps. Can be used for IBM, Dell, Sony Vaio, etc.
- SPEG -Universal Serial Flash Programmer ($89) - Software for programming Serial Flash BIOS chips used in modern PCs. Suitable to unlock Lenovo SL300/400/500 series, HP laptops, and more. SPEG is also the recommended tool for BIOS repair and we offer support for Thinkpad BIOS recovery (4 beeps error, 0192 error, etc) for SPEG licensees.


A tutorial can be found HERE!

IBMpass 1.1c screenshot.


W24RF08 "in action".



The programs have been tested by many users since 2004 and have been presented for the first time on security-forums.com

[victor]

We can announce a new release - IBMpass 2.0

IBMpass 2.0 Professional is a complete tool for editing eeprom dumps. The free version IBMpass 2.0 Lite is available to download.
Many thanks also to all friends who tested the beta version.

Updated feb.2006
Now includes support for ACER and SONY VAIO password encoding. This option is available only in IBMpass Professional for the moment.

IBMpass 2.0 beta preview
.

[victor]

We are pleased to introduce you the version 2.0 of the well known 24RF08 tools, by now. The main changes for R24RF08 and W24RF08 are:

-Improved support for other serial interfaces with the possibility to adjust the logical level for SDA and SCL signals.
-Some issues with the timer that have been solved.
-A new improved eeprom reset procedure.

Many thanks to my colleagues and also to the testers.

[victor]

We are glad to announce other two releases:

RPC8394 and WPC8394 are the first versions of two software designed for reading and respecively writing
the PC8394T-VJG super IO & TPM chip. That is used in T43 and R52 Thinkpads to store the supervisor password.

The software is available now!

[victor]

Our last tests confirmed that PC8394 Tools are suitable to unlock the new Lenovo T series like Thinkpad T60.

Now PC8394 Tools kit includes documentation to unlock T60.

Z60 support will be added soon.

[victor]

It was confirmed that PC8394 Tools are suitable to read/write the security chips in Z60t/Z60m. The following Thinkpad models can be unlocked using RPC8394/WPC8394:

-T43/p
-R52
-T60/p
-Z60t/m

IBMpass can reveal the password from the chips binary. However, a new version, IBMpass 2.1 is to be launched soon and will be presented in two versions, freeware and commercial.

[victor]

R60 and X60 are the new models added in the PC8394 Tools list:

I have to thank personally to Jonas Barna (Dex Lab) for the latest test on ThinkPad X60.

PC8394 Tools compatilbility list:

-T43/p
-R52
-T60/p
-Z60 series
-Z61 series
-R60
-X60
_________________
Victor Voinea
ALLservice HQ, Romania.

[victor]

IBMpass 2.1 Lite available. It has support for SONY VAIO SHR1 encoding.

IBMpass 2.1 Editor (commercial) coming soon.
_________________
Victor Voinea
ALLservice HQ, Romania.

[victor]

Updated: November 2019
Latest pics will not always be added at the end of this post, so pay attention!

-All new Thinkpads starting with T440, T450, T460, T540, T550, T560, W540, W541, W550s, X1 Yoga, X240, X250, X260, P40, P50, P50s, P70, Thinkpad Yoga 12 and Yoga 15, Helix gen2 and up, etc http://www.allservice.ro/forum/viewtopic.php?t=3044

We have the confirmation for newer R61, T61 and X61. They don't use a TPM system like T43/R60/X60/T60, they dropped back to P24S08 (24RF08 clone).
Pictures added (as we unlocked them) for: L412, L512, L420, L520, L530, L430, L540, SL410, SL510, R400, R500, T400, T410, T420, T500, T510, T520, T530, X1, X100e, X121e, X201, X300(X200), X220, X230, X301, W500, W510, W520, W530, W701, Edge 13-14-15, Edge E120, Edge E220s, Edge E320, Edge E430, Edge 530, Edge 531, Edge E440, Edge E540, Helix 1st gen.

For eeprom 24RF08/P24S08 and variations like PS08 and L08 you must use R24RF08 - the free 24RF08 eeprom reader - and IBMpass 2.1 lite.

Note: If IBMpass Lite cannot reveal the passoword, then is 100% TCPA locked, in which case W24RF08 (eeprom writer) and our TCPA reset service is required. TCPA algo is changed, is not the same used in the previous models.

If you like us to assist you or to verify the TCPA lock status in order to confim the need of W24RF08 and the TCPA service, simply send the eeprom binary dumps to support@allservice.ro

R61:

P24S08 (8pin) is usually located on the frontside of the mainboard, under the keyboard. Is quite easy to get access there.
For 14' widescreen models, the eeprom is on the backside (second picture). 15' 4/3 models have the eeprom under PCcard cage on the frontside.

R61 eeprom here:
http://www.allservice.ro/forum/images/R61.jpg
http://www.allservice.ro/forum/images/r61_14_wide.jpg [14' widescreen]
http://www.allservice.ro/forum/images/r61_15_normal.jpg [15' 4/3]
http://www.allservice.ro/forum/images/r61_15_nvidia.jpg [15' Nvidia]

Courtesy JD Choi - Korea for the 1st photo and Mario Dahn - Germany for 15' ones.

T61:

P24S08 (8 pin) eeprom is on the back of the board, you may need to consult the T61 Hardware Maintenance Manual if you want to dismantle it.


HMM here:

[victor]

We are proud to announce our new release for programming Serial Flash BIOS ROMs.

[Edit]
SPEG is available now!
Special thanks to R. Katz (USA) for his impressive work on testing the package with Lenovo T and R series BIOS and B. Nguyen (USA) for all support and ideas. Many thanks to the support team as well.
[/Edit]

The program is SPEG - Universal serial flash programmer and is able to process almost all new serial flashes used nowadays for BIOS in almost everything, even in iphone 3G.
We've paid a special attention to SST chips, they are a bit different from the rest.

Note: SPEG is the right solution to unlock Lenovo SL300, SL400, SL500 and G550. These models keep the password in BIOS serial flash that must be read, cleaned up and reflashed. We offer a free cleaning service/ BIOS repair service with every SPEG purchase .

For the moment this is the current device list:
http://www.allservice.ro/forum/dl/SPEG_device_list.txt

And the list may continue...
_________________
Victor Voinea
ALLservice HQ, Romania.

[victor]

Surely, you've heard of Intel Anti-Theft system. This new technology used in latest Thinkpads is very similar to Computrace and despite they claim that has no relation with the AMT, this is not exactly true. Here is an example of one disabled machine we received from a customer (It's a T400 model wired up on an external monitor)

Well, now we can recover the Thinkpads from this thing. The laptop needs a serious BIOS code rework (and also the eeprom 24RF08/P24S08 must be modified, in some cases) and it will be like new. The service is available for SPEG users now.
_________________
Victor Voinea
ALLservice HQ, Romania.

[victor]

We can announce now that all HP models, based on serial flash BIOS can be unlocked by our team and that is final. The required software is SPEG programmer in order to read the BIOS and email us the binary to be fixed.

We also worked on various models coming from Fujitsu. We mean those that couldn't be unlocked via codes such as the new models with 6x4 digits hash. All of them could be unlocked after we patched the BIOS.

Some other news is that we could unlock some Macbook Pro in the same manner.

Tests will be carried out so if you have any questions contacts us.
_________________
Victor Voinea
ALLservice HQ, Romania.

[victor]

We finished the tests on unlocking MAcbook Pro and Air, models 2008-2013 (that includes late 2013 retina models) succesfully. We can reset the firmware lock (firmware password and pin lock) without altering the orignal BIOS code or credentials.

See the updates here:
http://www.allservice.ro/forum/viewtopic.php?t=2724
_________________
Victor Voinea
ALLservice HQ, Romania.

[victor]

IBMpass Editor and Lite has been upped to 2.2.

Some issue fixed with the fonts in Win Vista/7 and up, where special characters were not displayed correctly in unicode.
_________________
Victor Voinea
ALLservice HQ, Romania.

[victor]

SPEG updated to version 1.2
http://www.allservice.ro/forum/viewtopic.php?t=1311

Macbook and iMac BIOS chip locations more pictures added
http://www.allservice.ro/forum/viewtopic.php?p=10545#10545
_________________
Victor Voinea
ALLservice HQ, Romania.