You can bypass and remove the supervisor password from ThinkPads by shorting two pins on an EEPROM at the right time during boot.
Don't believe it? I didn't either; it never worked for me. It turns out that's only because the contemporary instructions for how to do it are wrong, or rather, they've mutated into a form that only works on some machines. As originally discovered, the hack reliably unlocks any* ThinkPad up to and including the Ivy Bridge models.
*The SL300, SL400, SL500, and G550 do not store the supervisor password in EEPROM, so they're the only exceptions of which I'm aware.
DISCLAIMER: Any discussion of how to crack security on even vintage machines is banned on most ThinkPad forums. So much as mentioning this page can get you banned in some places.
SOME BACKGROUND:
ThinkPads have three types of security passwords.
A 'Supervisor' password (SVP) locks access to portions of the BIOS setup. The machine will still boot to OS., but if the CMOS battery is temporarily removed or dies, the SVP will also lock all power-on access to the machine. It's stored encrypted in a non-volatile EEPROM along with other asset information.
The 'Hard Drive' password protects access to the hard drive. The drive will be physically inaccessible to any machine without the password. [I don't address the Hard Drive password at all here.]
Lastly, a 'Power On' aka 'User' password (UP) locks boot access the machine. It's stored in volatile CMOS settings. Disconnecting the round yellow CMOS battery clears it.
A machine with a User password will almost certainly also have a Supervisor password. Clearing the UP by disconnecting the CMOS battery will cause the machine to demand the SVP at next boot. The password prompt icons for the UP and SVP are the same on older machines, so if it seems like clearing the User password didn't work, it did-- but now the machine is asking for the Supervisor password instead.
FINALLY THE INSTRUCTIONS:
Step 1: You might as well make life easier by disconnecting the CMOS battery for a few seconds to clear any user password that may be present. Count to 15, reconnect the battery and proceed...
Step 2: Find the physical EEPROM that holds the supervisor password. These EEPROMs have varying numbers of pins. A few examples: On the T23, the chip is a 14-pin Atmel 28RF08. On the X31, the EEPROM is an 8-pin Atmel AT28RF08. On an X61, it's an 8-pin Philips 24S08. On a T60 it's a 40-pin Atmel 8356908.
On some machines you can access the EEPROM just by lifting the keyboard. On other machines, you'll have to disassemble the entire laptop. Locations of many ThinkPad EEPROM chips can be found at http://www.ja.axxs.net/eeprom_location.htm if you don't want to hunt for it.
Step 3: Locate the PROT and GND pins. These are the pins we'll short to subvert the ThinkPad's access to the supervisor password. On a 14-pin Atmel 28RF08, these are pins 5 and 6. On (I think all) 8-pin EEPROMs, these are pins 3 and 4. On the 8356908, it's pins 31 and 32 (pin 32 is actually the write-protect pin, but it will be grounded).
Personally I solder small-gauge wires to the pins to avoid any fumbling around while bypassing the password. If the chip is easily accessible, you can just short the pins with tweezers or a precision screwdriver. Either way, be careful not to short anything you don't mean to short.
[Note: I know I'm telling you to use different pins than virtually all the other instructions on the web. When this hack was first discovered, descriptions simply listed pin numbers for a few models, but it's clear from context that the intended pins were PROT and GND.
At some point, for some reason, reposts started saying to short SCL and SDA instead, possibly due to mixing up pins between 8 and 14 pin EEPROM variants. The mistake was probably cemented by the fact that shorting SCL and SDA does work on some models.]
Step 4: Boot the machine. Upon the 'ThinkPad' logo boot screen appearing, immediately short the pins and press the appropriate key to enter the BIOS (F1 on most models). The BIOS may take longer to appear than normal, and the machine will throw one or more errors; that's expected. It may also ask you to press F1 again (do so). Keep the pins shorted until you're in the BIOS screen, then release the short.
Step 5: Navigate to the BIOS 'Security' menu, then arrow down to the 'Supervisor password' selection, which should currently read 'Enabled'.
Step 6: Short the pins again. While holding the short, press Enter to select the Supervisor password entry, then release the short. It should not ask for the old password, only to enter a new password twice. After releasing the short, press Enter twice to disable the password.
Step 7: Press F10 to save and exit.
Step 8: Before reassembling or desoldering any temporary wires, reboot and test that you can enter the BIOS without any password.
Done!
