SixFoisNeuf

Totally irregular blog on computers and security


ThinkPad X230: clearing an unknown Supervisor password

Posted on Apr 6, 2023

It might be obvious from the title of this post, but I bought a used Lenovo ThinkPad X230 from LeBonCoin without checking if it had a Supervisor password set. This means that everything worked fine until I wanted to tinker with the BIOS to change the boot options, when I was greeted with this scary-looking screen.

BIOS lock screen

After trying the usual “1234”, “0000”, and “password”, I decided to ask the seller. Unfortunately, they assured me that the machine had been “reset”, and that there was no password…

The Startup password and Hard Drive access password can be easily reset by removing all power sources, the CMOS battery, and holding the Power button down for 30 seconds. The Supervisor password is much more resilient, and is stored in an EEPROM on the motherboard. It is possible to read it directly from there, but that looked really complicated, and involved buying an EEPROM programmer and soldering wires to 3 pins.

Thankfully, it is possible to skip the Supervisor password check by shorting together two of the EEPROM pins, which can be done with a screwdriver or a paperclip. This doesn’t work on every ThinkPad model, but it does on the X230!

First, shut down your laptop, take out its battery, and remove the screws from the bottom marked with a “keyboard” icon. I have highlighted them in red.

bottom screws

Then, flip the laptop right side up and open it. Push the keyboard towards the top of the laptop, and use a tool to lift it up (I’m using the iFixit picks). You should be able to almost take the keyboard out, with only a ribbon cable holding it to the laptop.

picks to lift the keyboard

Pull the keyboard down, and rest it on the palm rest. This is so that you can access a specific area of the motherboard, protected by black tape, which houses the EEPROM.

keyboard down, motherboard almost visible

Lift up the tape with tweezers. In my case, the tape was already taken out (someone probably had a go at it beforehand). The EEPROM we’re interested in sits at the top-left of the plastic square.

the eeprom

In order to short the pins, put your screwdriver between the two pins at the top-left of the EEPROM, like in the picture.

shorting the pins

The steps to bypass the BIOS Supervisor password are as follows:

  1. Plug your computer to the wall
  2. Press the power button
  3. Right after that, short the pins, and keep them shorted
  4. Press the Enter key or ThinkVantage button to enter the BIOS setup screen
  5. If everything goes right, you should get in without any password asked
  6. Go to the “Security” > “Password” section, and change the Supervisor password to nothing
  7. “Supervisor password” > “Status” should read “Disabled”

Once this is done, you can stop shorting the pins, and press F10 to save and exit. Don’t forget to make sure that the BIOS doesn’t ask you for a password before putting everything back in place!

Send your comment via e-mail