Service Forum

[BillH]

Sony Vaio VGN-S660, PCG-6K1L, user password set. Three wrong password entries generates "System Disabled" message.

I found only one 24C02 eeprom on top of the board. I have not searched the bottom of the board. The eeprom found on top is labeled 402WP, outlined in red:

EDIT Jan 17, 2010. The next two photos were posted initially with the wrong chip circled. This has been corrected. The wrong chip is X'd out, and the W402WP chip has been circled and labeled. Apologies.







Using a driven circuit with sewing needle probes, I read the 402WP with
r24c02.exe.

Address settings in r24c02.ini produced the following:

base_address=$AE: eeprom error message on three tries at reading it.
base_address=$00: found eeprom at A0h, and yielded a 128 byte bin file.
base_address=$A0: yielded a 128 byte bin file that looks identical to the first one. I sent the bin files to Allservice support.

I checked the 402WP voltage. Pins 1, 2, 3, 4, and 7 were 0. Pins 5, 6, and 8 were about 3 volts (I didn't look real close at the meter).

All of this indicates to me that the 402WP I probed has address A0h, which I understand is not the traditional Sony password chip address. With the probes on 402WP, r24c02.exe could not find anything at $AE.

I could not see anything useful when reading either dump with ibmpass2,
switching amongst all translation settings. Here's a typical untranslated ibmpass2 readout:



I read the dump with Sony Vaio 0x57 Analyzer, and got what looked like a UID and at least part of a MAC address, but nothing else useable:



At this point, I can't be certain whether TCPA is locked, or if 402WP is the password chip and just has the new encryption Bob mentioned in an Allservice Forum thread (sony vaio password vgn-bx195sp). I'm hesitant to write zeros to the first 16 bytes until I'm as sure as I can be that 402WP is the password chip, that it's just encryption that ibmpass2 can't translate, and that TCPA is not locked.

I would appreciate any ideas or advice on what to do now. If I ever find the password, I'll post the solution here.

[Disabled]

Hello BillH,
in my opinion that's not the eeprom chip where the password is stored by looking at the contents. Which eeprom is the one that you read, is it the one close to the memory stick slot? I tell you what, provide me the 15-digit serial number of the laptop and I'll give you the master password. I believe I have the algorithm for this VGN-S model.

*12345678 1234567*

DRGN997

[sanndo]

Hi BillH

are u removed password? i'm interested too

i have sony pcg, but when read and analyze dump there is no password set...

regards,
Aleksandar

[victor]

In a VAIO there's usually two eeproms, one set at 0xA0 and one set at 0xAE (pins 1-2-3 are logic 1). The 0XAE eeprom has the password and serials. In this case its the other one.
_________________
Victor Voinea
ALLservice HQ, Romania.

[sanndo]

i again,

i read firs one, but there is password, was I say..
but when i read second the programmer give me error reading (24c02)...

when i solder back eeprom laptop is not power on.. I thing i'm erased chip

some pictures:

http://www.gis.bg/pictures/P1020777.jpg

first and second eeproms

http://www.gis.bg/pictures/P1020780.jpg

this is first with no password
http://www.gis.bg/pictures/P1020778.jpg

second....


can everyone give mi dump..

Moderator's note: Don't embbed large picture in the forum!

[victor]

Better check out how you soldered that eeprom. It is surely not erased, if you're just trying to read up. And you can't just write anything there...
_________________
Victor Voinea
ALLservice HQ, Romania.