BIOS passwords

Since Notebook-manufacturers know of the problem of forgotten passwords, they often implement easy ways to remove BIOS passwords into their notebooks.

WARNING!
I don't take any responsibility for damages your notebook could get by using these tricks.

Removing the battery

Remove AC power and remove the battery. Now find and remove the BIOS battery for about a minute and then reinsert it. If this doesn't work, try it with 10 minutes or even 20. If you can't easily remove the BIOS battery, you can short it for about 1 to 2 seconds. But never short it for longer because it will get hot and could even explode. The BIOS battery is mostly located somehwere below the notebook's keyboard. To remove the keyboard, there are sometimes only some clips holding the whole thing - but sometimes, you have to disassemble half of the notebook just to get to the inside.

This trick works with almost any notebook - even with the “high secure” Fujitsu-Siemens Lifebook E-series.

baycomwb2_5.jpg

Reset-switch

If you can't get rid of the password by removing the BIOS battery, there often is a Jumper or DIP-switch, which disabled the password. A Jumper could be located in the RAM-extension slot. Also take a look at the mainboard below the keyboard. Sometimes, the Jumpers are even labeled - if not, just try. With DIP-switches - if you found some - you should start trying with the highest switch, because the first ones mostly define the processor speed and you could possibly destroy your processor. You should - with the notebook switched off - switch the highest switch to the opposite position, switch on the notebook, check whether the BIOS password is still requested and an empty password doesn't work (just press ENTER at the prompt). If so, switch off the notebook, switch the highest switch to its initial position and try the same with the next switch. If you found the correct switch, do the following before switching the switch back to its initial position: Go to BIOS-Setup and clear the password there or define a new one. Afterwards, switch off the notebook, switch the DIP-switch to its initial position and reassemble the notebook.

acer203tx3.jpg

DELL notebooks

DELL-notebooks store the BIOS-password in an 24C02-EEPROM and therefore, the password can't be deleted by removing the BIOS-battery. Also, there's no Jumper or DIP-switch, which resets the password. But you will notice a so-called “Service Tag” at the password prompt. With it, the DELL-Hotline is able to generate an unlock-password. If you want to save the stress with the Hotline, you can find programs in the Internet which generate an unlock-password from the Service-Tag. Sadly, I only found a password-generator for Service-Tags ending with -D35B. If your notebook has a different Service-Tag, there's an alternative: You can manually erase the EEPROM. But you have to find it first. Somewhere on your mainboard should be an 8-pin IC with “24C02” printed on it. Sometimes, it's located near the CD-ROM or Touchpad. If you found it, notice the manufacturer and go to his homepage to download the datasheet of that IC. There should be mentioned the correct pin for “clear” or “reset”. Short-circuit this pin to ground. There could be a test-contact near the IC leading to the appropriate pin. Just short it to ground for some seconds. But pay attention not to short the wrong pin to ground - this could destroy the notebook. After this procedure, the BIOS password should be deleted. This homepage contains a really good explanation of this procedure. Some more infos are on the DELL page.

The password prompt of DELL notebooks. Here you can see the service tag.

Standard password

By the way: Notebooks of the first generation used to have standard passwords to enable access to them. For AWARD-BIOS there were e.g. “LKWpeter” and “aLLy” - depending on the BIOS' version. You can find lists of such standard passwords on the net. For current BIOS-variants and -versions, there are no known standard passwords.

Special handling

If everything fails

If you can still boot and only need the password to the BIOS-setup, Christophe Grenier's CmosPwd will help you in most cases. It reads out the CMOS-memory and tries to decrypt the password stored there. For SONY Vaio notebooks, look here.


blog comments powered by Disqus
know-how/hacking/bios-password/start.txt · Last modified: 2013-03-16 17:26.44 (external edit)
 
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial-Share Alike 3.0 Unported
Recent changes RSS feed Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki Contents powered by Club-Mate Contents powered by BassDrive.com Labelled with ICRA