1) Identify your BIOS manufacturer (usually displayed at boot-up)
2) Start in DOS, or start a DOS session in Windows 95/98/ME.
For Windows NT or Windows 2000 boot from a DOS or Windows 95/98 boot
disk (you can find boot disks at
www.AnswersThatWork.com), and run
CMOSPWD from your boot floppy (or another floppy).
3) C: [Enter]
cd \CMOSPWD [Enter]
4) Type CMOSPWD at the DOS prompt and press Enter.
5) CMOSPWD will display a list of possibilities. Use the possibilities
itemised against your BIOS manufacturer.
Remember :
a) For AWARD BIOSes, use the Numeric Keypad (with NumLock ON).
b) AWARD 4.50PG BIOS always accepts "AWARD_SW", or "d8on",
or "589589".
c) Old Phoenix BIOSes will accept "phoenix".
6) If the standard method does not work, then try to kill
the CMOS password with CMOSPWD /K (and press Enter),
and then see if you can get into the CMOS without a password.
If you can, you successfully "killed" the old CMOS password.
DO NOT KILL THE CMOS ON LAPTOPS!
|General Usage (List of commands) |
---------------------------------------------------
---------------------------------------------------
cmospwd [/d]
cmospwd [/d] /[rlw] cmos_backup_file restore/load/write
cmospwd /k kill cmos
cmospwd /m[01]* execute selected module
/d to dump cmos in ascii and scan code
/m0010011 to execute module 3,6 and 7
Keyboard:
/kfr French AZERTY
/kde German QWERTY
default is US QWERTY
---------------------------------------------------
---------------------------------------------------
|Laptops |
---------------------------------------------------
---------------------------------------------------
On laptops, the password is usually stored in an eeprom on the motherboard,
you need an eeprom programmer (electronic device) to retrieve it.
Acer 630: eeprom 93c56 ?
Compaq M700: eeprom 24C02
Dell Inspirion 7500: eeprom 24c164
Dell Inspirion 8100: eeprom 24c02
Dell Latitude C600: eeprom 24c02, password in scan code at 0x00, 0x10 and
0x90
Dell Latitude C610: eeprom 24c02, password in scan code at 0x00, 0x10, 0x80
and 0x90
Dell Latitude CPI: eeprom 24c02, password in scan code at 0x00, 0x10, 0x80
IBM Thinkpad X20: eeprom 24RFC08CN, password in scan code at 0x338
IBM TP 240: eeprom ?, password in scan code at 0x338.
IBM TP 380Z: eeprom 24c01, password in scan code at 0x38 and 0x40
IBM TP 390: eeprom 24c03 (be carrefull, there are two eeprom)
IBM TP 560X: eeprom 24c01, password in scan code at 0x38 and 0x40
IBM TP 570: eeprom ?, password in scan code at 0x338 and 0x3B8.
IBM TP 750C,755CX,760C,765D: eeprom 93c46, password in scan code at 0x38 and
0x40
OKI M811b may be written on the chip. Search near pcmcia slot or
adjacent the floppy connector on the top side of the board
IBM TP 770: eeprom 24c01
IBM TP 600E, T21, T23: 14 PIN 24RF08
IBM TP T20: 24RF08, password in scan code at 0x338 and 0x3B8
HP Omnibook 900,2100,4150,7150: eeprom AT24c164, 0x6D-0x7F area, unknow algo
put a 00 at 0x7F to clear admin password
HP Omnibook 6000: eeprom 24c08 or 24c164 0x50-0xBF area
(maybe 0x50-0x6F only), unknow algo
HP Omnibook 6100: eeprom 24c08
HP Omnibook XE3: eeprom 24c16
HP Omnibook 770x: eeprom 24c01
HP Pavilion ze4455ea: eeprom 24c08
HP VECTRA VL18:
http://h200001.www2.hp.com/bc/docs/s...3/lpv06673.pdf
Sony pcg-fx950: eeprom 93c46 ?
Toshiba 74600C: eeprom 93c56
VAIO 641: eeprom 24c02, Cmospwd can decrypt the password, otherwise
write zero at 0x0
be carrefull, there are two eeprom you must unsolder one to the pci
controler it is in the down side of the bord
VAIO 8851
eeprom 24c02 (ic 903), Cmospwd can decrypt the password, otherwise
write zero at adress 0x0
the down side of the board
VAIO srx 87: eeprom 2408, Cmospwd can decrypt the password, otherwise
write zero at 0x0
the ic is behind the modem in the top side of the board
You can get/buy eeprom programmer in electronic shops or labs, you need
another PC to use it.
You can desolder the eeprom with hot air or you can try to "clip" the
eeprom. With the eeprom programmer, backup your eeprom and run
"cmospwd /d /l eeprom_backup". If you don't see the password, you can try
to fill the eeprom with zero or FF, don't forget the reset the cmos.
---------------------------------------------------
---------------------------------------------------
|Toshiba |
---------------------------------------------------
---------------------------------------------------
Differents passwords give the same 32-bit CRC, so CmosPwd can only give one
of them.
To reset the password of an old Toshiba, you can use KeyDisk. (cf my web
page)
If this doesn't work, you can try to build the Toshiba Parallell loopback.
To make a simple device that you connect to your parallell port, a lot of
Toshiba computers remove the password when you boot it up.
The device, named "loopback" by some, could be made out of any
parallell wire with 25pins connectors (db25). You should connect
these pins: 1-5-10, 2-11, 3-17, 4-12, 6-16, 7-13, 8-14, 9-15, 18-25.
A db25 looks like:
1 13
_______
\_____/
14 25
--
The best live web video on the internet
http://www.seedsv.com/webdemo.htm
Sharpvision simply the best
http://www.seedsv.com
"pcbutts1" <> wrote in message
news:TnTce.3940$ m...
> You need to copy it to a floppy and run it from there, the dos version.
>
> --
>
>
> The best live web video on the internet http://www.seedsv.com/webdemo.htm
> Sharpvision simply the best http://www.seedsv.com
>
>
>
> "boogle" <> wrote in message
> news:Xns9648974D34F80mineyourscom@198.161.157.145. ..
>> "pcbutts1" <> wrote in news:qLSce.3032$zu.905
>> @newssvr13.news.prodigy.com:
>>
>>> http://www.cgsecurity.org/index.html?cmospwd.html
>>
>> thats no good either seeing i cant get passed the password to boot the
>> system
>
>