Service Forum

[DarkSamus9000]

Greetings everybody,

After a long journey, I believe I have finally succeeded in reading the EEPROM off of my Thinkpad 760EL. The chip is a 93C46, and I read it using an arduino and the circuit described here: http://www.allservice.ro/forum/dl/93CXX-prog.pdf

I opened the dump in IBMpass Lite (2.2), but it's not obvious to me where the supervisor password is located. I have tried all 3 scancodes, but I don't see anything obvious as to what might be my password. I am absolutely confident I do have an SVP because the HDD has a matching HDD password; and thus I am not able to connect any other hard drive to this machine, nor can I connect the HDD to any other computer.

I have also read the following two threads:
https://www.allservice.ro/forum/viewtopic.php?t=47
https://www.allservice.ro/forum/viewtopic.php?t=200
I am aware the password should be around 0x38 and 0x40, but what I'm seeing in the attached screenshot doesn't quite look right to me.

Attached is a screenshot of my dump and the dump file itself. I've also included a copy of my Arduino code, because I'm concerned I may have made an error with my read.
Arduino code here: https://drive.google.com/drive/folders/1oTkgx2F2qML30yNim3lnik3zlQPjpXkV?usp=sharing
Screenshot: https://drive.google.com/file/d/1W-9LiABW3lyHp6lkZFq5C2d7dQ-5LNTD/view?usp=sharing
EEPROM dump: https://drive.google.com/file/d/1ui7R-hNFzOOFcRSgAD12ECGeW0vdwpuv/view?usp=sharing

The arduino code came from here: https://github.com/0xJoey/Arduino_93C46/tree/master
However, I did modify it a little bit, because the output it gave me didn't include the correct number of leading zeroes & confused me at first. The actual code I used is attached.

I would be in your debt if you could help me figure this out I feel like I'm 99% there... I could be looking the password dead in the eyes & not realize it.

Thank you & have a great day!
_________________
What's life if you don't live it?

[DarkSamus9000]

I realized I could try reading the chip as 128x8 instead of 64x16. So, per the datasheet (https://www.alldatasheet.com/datasheet-pdf/pdf/23849/STMICROELECTRONICS/ST93C46A.html), I connected the ORG pin to ground. I modified the arduino code (setting longMode to EEPROM_93C46_MODE_8BIT in my setup function), powered everything on, and pulled a couple reads.

128x8 dump: https://drive.google.com/file/d/1cvKhwS9OquFzCTzkB0HGI8xPH2zZe4NC/view?usp=sharing
IBMpass screenshot: https://drive.google.com/file/d/1GlL1Dg1AjVqWg4-n7QwNyDBc2ZmMg7bw/preview

But I still don't see anything that looks like a pasword.
What am I missing here?
_________________
What's life if you don't live it?

[victor]

The dump file is just some random junk.

If you use the interface as per that schematic then I would suggest you PonyProg that is freeware and still online
https://www.lancos.com/ppwin95.html


And make sure the COM Port is real or if USB based then must be using a UART chip as COM1..COM4. You have to setup PonyProg for the COM port from its Setup Menu and then click calibration.
Select Microwire 16 and 9346
_________________
Victor Voinea
ALLservice HQ, Romania.

[DarkSamus9000]

Hello Victor,

Thanks a lot for your response. I previously tried using ponyprog on my raspberry pi 4, but it could not detect any chip with the probe function; so I pulled out an old thinkpad with Windows 98 and a physical DB9 serial port, and bought a $7 DB9 breakout connector for the project. But ponyprog won't detect any chip on the physical serial port, either.

Maybe there is something wrong with my circuit? It's my first time working with a breadboard & building a circuit... as far as I can see, I've followed everything to a tee (except I am providing 5V power using my raspberry pi 4 instead of a series of 1.5V batteries)

My setup:https://drive.google.com/file/d/1FVkHuLKKrBMOwJjmx-C_dV6FpqlJy1EZ/preview
(after taking this picture I did notice a 10th pin on my DB9 breakout connector labeled "ground", so I grounded it & tried again, but with no success)

Ponyprog: https://drive.google.com/file/d/1Fb-6GOB0g7bNoCKphXGouZ9Up03sCahF/preview
I tried both available COM ports, SI Prog API, SI Prog I/O, and Easy I2CBus.

Do you see any issue with this circuit setup?
Thank you for your help
_________________
What's life if you don't live it?

[victor]

I believe to be an issue with the com port or the driver to bypass Windows direct IO restrictions (that comes with PonyProg) is not installed or else.

But forget all about this, buy a cheap CH341, download AsProgrammer and do this mod here https://youtu.be/hPKckby54uA?si=YwzmTRuvX5l6yoPR

CH341 is a junk but for 9346 it works. One thing to keep in mind: these eeproms must be desoldered from the host, you won't be able to read-write them in-system
_________________
Victor Voinea
ALLservice HQ, Romania.

[DarkSamus9000]

Well, for now I am still stubbornly trying to bitbang this chip myself. The CH341A is cheap enough, but I want to see if I can use the tools at my disposal for now.

How will I know when I have a successful read? Do you have an example of what a successful read might look like? At least then I might know when I finally have a good read.

I pulled another read today after fixing an apparent mistake in the Arduino code. This time 0x38 -> 0x40 held something more interesting, but in scancode it just translates to "CN" followed by apparent garbage?
Also, the 8 bytes between 0x38 -> 0x40 are repeated from 0x40 -> 0x48.

2E 31 00 20 00 00 7F 00

But it seems odd that there's nothing larger than 0x7F in my entire dump. Maybe there are still errors in the bitbang code. Hoping I can work on the code & validate what I'm doing before I buy another tool for this job.

I am being a bit stubborn because it would be fun to learn
_________________
What's life if you don't live it?

[victor]

I think you did it.

The password is Little _Endian mode, each pair of bytes is switched.

12345678
21436587

"NCD"
_________________
Victor Voinea
ALLservice HQ, Romania.

[DarkSamus9000]

OMG you're right, that's it! NCD!

I re-assembled the laptop enough to power it on & check, and sure enough that's it!

I will come back from work today & clear the password with the hard drive plugged in, so hopefully I can clear the HDD password, too.

Thanks for your help!
_________________
What's life if you don't live it?

[victor]

You’re welcome!
_________________
Victor Voinea
ALLservice HQ, Romania.