Posts tagged laptop repairing institutes
The following post has been taken from great Dogbert’s blog : http://dogber1.blogspot.in/2009/05/table-of-reverse-engineered-bios.html
BIOS Password Backdoors in Laptops
Synopsis: The mechanics of BIOS password locks present in current generation laptops are briefly outlined. Trivial mechanisms have been put in place by most vendors to bypass such passwords, rendering the protection void. A set of master password generators and hands-on instructions are given to disable BIOS passwords.
When a laptop is locked with password, a checksum of that password is stored to a so-called FlashROM – this is a chip on the mainboard of the device which also contains the BIOS code and other settings, e.g. memory timings.
For most brands, this checksum is displayed after entering an invalid password for the third time:
The dramatic ‘System Disabled’ message is just scare tactics: when you remove all power from the laptop and reboot it, it will work just as before. From such a checksum (also called “hash”), valid passwords can be found by means of brute-forcing.
The bypass mechanisms of other vendors work by showing a number to the user from which a master password can be derived. This password is usually a sequence of numbers generated randomly.
Some vendors resort to storing the password in plain text onto the FlashROM, and instead of printing out just a checksum, an encrypted version of the password is shown.
Other vendors just derive the master password from the serial number. Either way, my scripts can be used to get valid passwords.
A few vendors have implemented obfuscation measures to hide the hash from the end user – for instance, some FSI laptops require you to enter three special passwords for the hash to show up (e.g. “3hqgo3 jqw534 0qww294e“, “enable master password” shifted one up/left on the keyboard). Some HP/Compaq laptops only show the hash if the F2 or F12 key has been pressed prior to entering an invalid password for the last time.
Depending on the “format” of the number code/hash (e.g. whether only numbers or both numbers and letters are used, whether it contains dashes, etc.), you need to choose the right script – it is mostly just a matter of trying all of them and finding the one that fits your laptop. It does not matter on what machine the script are executed, i.e. there is no reason to run them on the locked laptop.
This is an overview of the algorithms that I looked at so far:
|Vendor||Hash Encoding||Example of Hash Code/Serial||Scripts|
|Compaq||5 decimal digits||12345||pwgen-5dec.py
|Fujitsu-Siemens||5 decimal digits||12345||pwgen-5dec.py
|Fujitsu-Siemens||8 hexadecimal digits||DEADBEEF||pwgen-fsi-hex.py
|Fujitsu-Siemens||5×4 hexadecimal digits||AAAA-BBBB-CCCC-DEAD-BEEF||pwgen-fsi-hex.py
|Fujitsu-Siemens||5×4 decimal digits||1234-4321-1234-4321-1234||pwgen-fsi-5x4dec.py
|Hewlett-Packard||5 decimal digits||12345||pwgen-5dec.py
|Hewlett-Packard/Compaq Netbooks||10 characters||CNU1234ABC||pwgen-hpmini.py
|Insyde H20 (generic)||8 decimal digits||03133610||pwgen-insyde.py
|Phoenix (generic)||5 decimal digits||12345||pwgen-5dec.py
|Sony||7 digit serial number||1234567||pwgen-sony-serial.py
|Samsung||12 hexadecimal digits||07088120410C0000||pwgen-samsung.py
The .NET runtime libraries are required for running the Windows binary files (extension .exe). If the binary files (.exe) don’t work out for you, install Python 2.6 (not 3.x) and run the .py script directly by double-clicking them. Make sure that you correctly read each letter (e.g. number ‘1’ vs letter ‘l’).
Please leave a comment below on what make/model the scripts work. Also, be aware that some vendors use different schemes for master passwords that require hardware to be reset – among them are e.g. IBM/Lenovo. If you find that your laptop does not display a hash or the scripts do not work for you for whatever reason, try to:
- use a USB keyboard for entering the password for avoiding potential defects of the built-in keyboard,
- run CmosPwd to remove the password if you can still boot the machine,
- overwrite the BIOS using the emergency recovery procedures. Usually, the emergency flash code is activated by pressing a certain key combination while powering on the machine. You also need a specially prepared USB memory stick containing the BIOS binary. The details are very much dependent on your particular model. Also, be aware that this can potentially brick your device and should only be done as a last measure.
- Some dell service tags are missing the suffix – just try the passwords for all suffices by adding -595B, -2A7B and -D35B to your service tags.
- The passwords for some HP laptops are breakable with this script.
- Unlocking methods for some Toshiba laptops are described here.
- Some older laptop models have service manuals that specify a location of a jumper / solder bridge that can be set for removing the password.
#1.Toshiba Satellite A205-SP4077, Core 2 Duo. While replacing cracked LCD tried several panels
with no success. Then noticed LVDS RX2- signal from motherboard is missing.
It is the north bridge dry joint, it is common fault of this model. Do BGA reworking on north bridge, and replace the north bridge if bga reworking doesn’t work.
#2. Machine: HP G6000(same mainboard as V6000)
Laptop will not power up.The machine has been water damaged. It does not have system standby power, which are 3V and
Solutions: Check Max8724(the battery charging chip) first, because to make system has standby power
this chip must work correctly. This is a 28 pin chip, we only need to test 1, 2, 4, 8, 10,7
11 pin. They are VIN(main power for chip), LDO(provide 3.3V for chip itself in order to set
REF voltage, also provide signal to drive 2 MOS to charge battery), REF(set reference
voltage of the chip), SHDN#(enable/disable chip, a switch), ACIN(indicate the power supply
has plugged in), ACOK#(power adaptor ok with mainboard).Everything ok except 10 pin, ACIN is 0V. This is incorrect, mainboard doesn’t detect there is an adaptor! Trace it backward and find it is very simple – mainboard use 2 resistors to
pull the input voltage(19V, directly from dc socket) down to about 4V, so test the first
resistor and find it opened. Change it and 3V/5V power come up and mainboard be able to
Then the trouble start when I try to charge the battery. The charging current never go
beyond 0.15A and after 10 seconds the charging light start to flashing. Also can’t switch on
from battery. First, change Max8724, still same problem. Next check all the resistors around
max8724 and change it if it has any sign of watering, still no good. Then change
KB3926(EC/KBC, chip monitors the statue of battery), still same. This is the fault that I
never dealt with before.Decide to check MBDATA and MBCLCK, 2 signals that send battery information from battery to
KB3926 before I give up. I find the MBDATA is short!Finally, find there are 2 pins stick together on CN10(the connector of multimedia switchboard). Fix it and it start to charging battery. Switch on with power adaptor, ok. Remove
the power adaptor once switch on, battery keep the mainboard running, ok. But still can’t
switch on from battery once remove the power adaptor. Think, think, do I miss something here
or there? Oh, the CMOS battery not installed, put the CMOS battery back and everything work
perfectly. The battery part of troubleshooting takes me about 3 hours.
Remember, system may not run if you don’t have CMOS battery or CMOS battery is low for some
AMD cpu mainboard.
#3.I have problem with Toshiba S1900-102.I bought a new battery about 5 months ago, then the laptop did not work on battery and it’sstill at 35% and did not charge any more.so I bought a used battery, and when I first connect it, plug the power cable and turn onthe laptop, I open Windows Power Meter. it’s work and begin charging till 60%, so I want to
try it I unplugged power cable and the laptop still works, and when I plug the power cable
again the Power Meter status said: AC Power. not charging I unplugged the power cable and
the laptop turn offI disassembled the battery to see what going on inside, I see M37516M6 microcomputer with a white shade around it.
Note: the second Battery still at 60% charge and didn’t increase or decrease
Sol: Most end users have no means to test battery. We test battery by monitoring the charging 10
current. The battery is ok if we see the charging current goes up, say to over 1A and hold
for a while. To check the battery condition, we firstly run the battery flat. Plug the power
supply which has current meter, see how long the charging current drop to normal standby
current. If we see it just take 30 min to drop to standby current, the battery may only last
10 min during normal usage.
In your case, I could not say what is wrong because I have to see if there is charging
#4.I’ve got a stuffed Toshiba Satellite A100 I’m trying to diagnose at the moment.
A100 as series has many different version, I don’t know which one you have. I just tell you
the common problems of this model.First, it does not power up at all. The charging light flashes and nothing on the screen. I
am still trying to find out what faulty of such kind.Second, it powers up but nothing on the screen. The power up sequence of working machine islike: 0.2A – 1.0A – 0.75A – 0.9A – 1.2A. Most time the faulty machines will stop at 1.0A or
0.75A, the cpu is not hot. In such case, the North Bridge does not send cpu rst signal to do
hardware reset. So this is north bridge problem.
Third, it only run on one memory.
This is also north bridge problem.
#5.HP pavilion dv5-1010tx
1) The computer overheats REALLY easily now
2) I use dual screens (laptop screen + Benq E2200HD via HDMI) and the external monitor will
occasionally flick. (every 10-15 seconds it will go black for half a second)
Solution: Yes, that is overload to vga chip.I still remember that back about 3 years ago I saw people modified their IBM Thinkpad, theyuse QXGA(resolution is 2048×1536) to replace original sxga(1400×900). The result of doing
this is vga chip get overheat and kill machine fast, usually not over one year. But for the
people can do such modify is no problem to fix their motherboard – resolder the vga chip, or
replace vga chip.The more calculation of vga chip carried, the more heat it generated. Think about how many
calculation jobs that vga chip has to do in your situation, not only the internal lcd, but
also the external lcd. Much more than those people change lcd from sxga to qxga.
#6.I have been repairing HpDVxxxx laptop with the video problem for a few years and havegotten very good at reballing/replacing the chip. I am now trying to figure out the NO powerat all or wont charge the battery EX Compaq C700 I have about 50 of these laptops will runon good battery windows shows it is charging the battery screen gets bright when you plug in20the ac charger goes dimm when you unplug it but it will not charge. I would like to know
what chip to start with I also have several DV9000 and dv6000 MB that do not get any power
at all. Any help on what chips to look at would be great.
C700’s charging chip is 39A126, DV6000/9000’s charging chip is max8724 or max8725. Check the
working conditions of those chips. such as VIN, ACIN, ACOK, LDO, REF, SHDN.
Charging problem is second hardest problem on notebook repairing, the first one is signal
level – everything looks ok but just no display.
#7.I would like to repair a system board in a compaq M2217AP (EE504PA) laptop. I believe theprotection circuit has failed and with my basic knowledge of electronics have located thefailed component. I require a copy of the circuit diagram or if you aren’t able to supply, a correct identification for part PC75. Can you assist?
Solution: PC75 is a capacitor, which is on the main power circuit. Luckily I have a such board in hand,
and I have checked where is the PC75 already. don’t worry about this capacitor, just take it
off if you think it is faulty. Pay attention to PQ24, PQ26, PQ25, PC68-70, PC16-19, PC48,
PC45, PC35, PC110-112. There is a guideline in here, all these components are located on
main power. There is also a guide when you check – check all the inductors and make sure
they are not short.
#8.The problem of machine is cannot power up at all.
Sol: Doing routine check:
1. system power: 3V, 5V all presented -ok
2. NBSWON signal: 3.3V presented – ok
3. press power button, NBSWON pull down to 0V, ok
4. check DNBSWON while press power button, no response. – problem.
in here I made a mistake, I didn’t pay attention of the voltage of DNBSWON, this mistake
waste me the next few days time. It should be 3.3V, but only about 1V.
Change EC as usual, because I thought the EC has problem. Then the big trouble comes – it
auto power up once I plug in the power but stop in 0.04A current. Check and find no S5_ON
signal, which indicate south bridge has problem, so change south bridge. But still same
problem and still no S5_ON. I was going to give up. I take a close look before I call
customer to say need to change motherboard, and I find that the EC I change is kb3926A
rather than kb3926C. In most case, this is no problem but in very rare occation…
So I find a 3926C and put on. Now the motherboard is back to the same problem while I first
start to check! So I change a wrong EC and this time I change a correct one, and also EC has
Because EC will start to read bios once the power plug in(not as people think, once you
press power button). I check BIOS chip, BIOS_CS should have a countinue wave form but it
just one stright line. BIOS chip is faulty! Take me 3 days to find out. If I could think
more when I check DNBSWON, if I could checked BIOS_CS before I change EC, if I could
replaced with a kb3926c not kb3926a.
#9. Have you repaired any Compaq C700 laptops that will not charge the battery or run off AC
charger? You put in a charged battery and plug in the AC cord the blue light on the DC jack
will light up it says it is charging windows will show as plugged in and charging. But it
28does not if you remove the battery it will turn off. Plug in the charger with the battery
removed the Blue DC jack light will not come on. I have a stack of these that all do the
same. I am just now getting some time to mess with them. This is what I have found so far.
Putting a jumper wire from the DC Jack + wire to the first battery fitting (far left with
the laptop face down battery compartment away) this will let the computer run on the AC
power cord with the battery removed. I had to compare readings to a DV6000 as none of my
C700 will run on the Charger. The readings from a working DV6000 at the battery pins left to
right are (plugged in NO battery)
0v 3.35v 3.35v 0v 3.35v 0v
Battery plugged in and plugged to charger
12.36v 3.35v 3.35v 0v 2.26v 0v
C700 with AC cord and jumper wire installed
19.2v 5.56v 3.35v 0v 4.26v 0v
I have not tried putting in the jumper wire with charger and battery I do not know if it
would charge the battery or if it would blow up.there are thousands of these with the same issue so it is most likely the same problem onall of them just wondering if you have fixed any of these. But we have found solution
On the upper left right by where the DC jack plugs in there is a mosfet that on the working
board I get 19v on all 8 legs on the one with no power I get -.01v.
That is normal, it is a p channel mosfet – so control leg( the 4th pin) should be low
voltage. There is no power on m/b if you find this pin is high. But it also depend on the
verson of motherboard, with DV6000, some have n channel mosfet – in the case of N channel
29 mosfet the pin 4 must be high voltage. use p channel or n channel depends on protection
circuit. I can write you the info about how the power goes in and generate 3/5V system
standby power if you could tell me the motherboard project code.
#10 . No power on at all on some DV6000 motherboards.
Motherboard test readings
Dv6000 no power voltage test on good working board listed first then voltage on non working
These are next to MAX8734A chip 2 mosfets on left side this is good board
PQ39 mosfet 19.6v across one side all 4 legs
5.14 across the other side
Mosfet right beside it I could nor read the number
0v across the top side
5.14 across the bottom
On the other side of the MAX8734a there are 2 more mosfet side by side
The first one
PU10 19v across the left side all 4 term
3.39 on all 4 right terminals
The mosfet right by it
First 3 term on left are 0 v and the 4th is .07v
the other 4 terminals are 3.39v
The above readings are the working board not turned on but plugged into ac charger
NO the board that will not power on
PQ39 19.6 across the top 4
1.9v across the bottom 4
The mosfet right below it 0v across the top 4
1.9 on first 3 and 1.6 on last
18.26 on the left side 4
.05 on the right side 4
The one beside it
0v on the 4 on left
.05 on the 4 on the right
DV6000 no power
Max8734A readings good board
Top side Left to right
0v 0v 0v 2.0v 0v 0v 2.0v 0v 0v 0v 5.0v 5.0v 0v 0v
Bottom side Left to right
5.13v 5.13v 1.36v 5.13v 0v 18v 5.16v 3.40v .07v 3.4v 3.39v 3.38v 8.03v
Board with no power
Top side left to right
1.6v 0v 0v 0v .19v 0v 0v 0v 0v .17v 1.89v 1.83v 0v 0v
Bottom side left to right
1.65v 1.39v 1.68v 0v 1.66v .04v 0v 0v 0v 0v 0v 0v 0v 1.45v
You can check the datasheet of max8734, 20 pin is VIN – should have 18V input, after you
have 18V input the chip will output a 5V and send to pin 3 and 4 to switch on the chip to
output 3.3V and 5V.
To solve the board with no power, first you have to make VIN to max8734. I don’t think
max8734 has problem in here, problem is in some other place.
- 6x86Fast: Raises the performance of Cyrix/IBM 5×86 and 6×86 CPUs between 5% and 10%. It is not guaranteed that this software will work with MII or 6x86MX CPUs.
- 6x86Opt: Package containing optimization software and Windows 95 fix for Cyrix CPUs (6×86, 6x86MX and MII).
- Advanced WindowsCare: Optmizes and remove errors from your PC.
- Cacheman: Correctly adjusts the disk cache under Windows 9x/ME/XP.
- Centrino Hardware Control: Controls many features of your Centrino (Pentium M) CPU.
- MemTurbo: Memory manager, frees up system memory. Excellent to use in computers with low RAM memory available.
- Rambooster: Memory manager, frees up system memory. Excellent to check how much RAM memory is being used right now.
- WcpuL2: Changes the L2 cache latency from 6th generation Intel CPUs (Celeron, Pentium II and Pentium III), raising the PC performance.
- AMD CPU Info: Software from AMD to correctly detect the installed AMD CPU on your PC.
- AMD CPUID: Software from AMD to detect the CPU clock, L1 and L2 memory cache, model, revision and supported instruction sets.
- AMD OverDrive: Program for identifying, monitoring and overclocking AMD CPUs.
- AMI Motherboard ID Utility: Finds out your motherboard manufacturer if its BIOS is from AMI.
- BIOS Agent: Software that identifies everything about your BIOS and the need of a BIOS upgrade.
- Cpuid: Identifies the installed CPU.
- Cpuidw: Identifies the installed CPU.
- CPU-Z: Identifies the installed CPU.
- CD-R Identifier: Identifies the CD-R media brand name. It is necessary to install ForceASPI first, which is also available at this link.
- Codec Check: Small utility that detects which audio codec your motherboard has, allowing you to install the correct audio driver on your system.
- Ctbios: Finds out your motherboard manufacturer.
- Ctbios 1.5: Ctbios more updated version. Besides recognizing your PC motherboard manufacturer, it gives you a lot of information about it. The only problem is that this is software is in german.
- Ctp2info: Checks if your Pentium II or Pentium III processor is counterfeit or not.
- Ctpci: Lists all PCI devices installed on your PCI. Very usefull to find out your motherboard real chipset.
- Dimm_id: Checks if the type of SDRAM memory installed on your PC is PC-66 or PC-100.
- EVEREST Home Edition: Indentifies your PC hardware, including your motherboard manufacturer and model.
- GPU-Z: Program that reports all features from your video card graphics chip (GPU).
- Hwinfo: Excelente indentification software. Very useful to determine your motherboard manufacturer, model and chipset. More updated than Ctbios.
- Intel Turbo Boost Monitor: Small utility to monitor Turbo Boost tecnology.
- MobileMeter: Program for monitoring the temperature, clock rates and battery charge/discharge from your laptop.
- PC-Config: Identifies all components from your PC.
- PC Wizard: Program that identifies all hardware parts installed on your PC.
- Sandra: Identification, test and benchmarking software.
- Unknown Device Identifier: Software for identifying unknown devices installed on your PC, excellent to find out more information about devices Windows isn’t able to correctly detect.
- Wcpuid 3.0: Identifies the installed CPU, giving you detailed info about it.