Toshiba NB500 (Compal LA-6856P) Laptop Schematics

Toshiba NB500 (Compal LA-6856P) Laptop Schematics Toshiba NB500 (Compal LA-6856P) Free Laptop Schematics

Charging Circuit VIN PQ204  AO4407A SO8 , CHG B+ PQ201  AON7408L PQ202 AON7408L, PU200 ISL6251AHAZ
+3VALW TO +3VS Q18 SI7326DN ( N-Channel 30-V (D-S) Fast Switching MOSFET)
+5VALW TO +5VS Q19 SI7326DN ( N-Channel 30-V (D-S) Fast Switching MOSFET)
Notebook System Power PU330 TPS51125ARGER (Input Voltage Range: 5.5 V to 28 V , Output Voltage Range: 2 V to 5.5 V)
CPU core Chipset DRAM and Other low-voltage Supplies 0.75V PU150 G5603RU1U
PWM Controller for CPU Core/GFX Power Supply PU500 RT8165BGQW

HP COMPAQ HP430 HP431 HP435 HP630 CQ43 CQ57 (Foxconn Chicago) Laptop Schematics
Toshiba Satellite L700 L745 (Quanta TE5) Laptop Schematics
Acer Aspire E1-421 (Quanta ZQZ) Laptop Schematics

BIOS Password Backdoors in Notebooks

BIOS Password Backdoors in Laptops

 
Synopsis: The mechanics of BIOS password locks present in current generation laptops are briefly outlined. Trivial mechanisms have been put in place by most vendors to bypass such passwords, rendering the protection void. A set of master password generators and hands-on instructions are given to disable BIOS passwords.HPCompaq-InsydeH20-Bios-Password-Service-with-8-digit-HashCode-HPCompaq-Master-Passwor

When a laptop is locked with password, a checksum of that password is stored to a so-called FlashROM – this is a chip on the mainboard of the device which also contains the BIOS code and other settings, e.g. memory timings.

For most brands, this checksum is displayed after entering an invalid password for the third time:

The dramatic ‘System Disabled’ message is just scare tactics: when you remove all power from the laptop and reboot it, it will work just as before. From such a checksum (also called “hash”), valid passwords can be found by means of brute-forcing.

The bypass mechanisms of other vendors work by showing a number to the user from which a master password can be derived. This password is usually a sequence of numbers generated randomly.

Some vendors resort to storing the password in plain text onto the FlashROM, and instead of printing out just a checksum, an encrypted version of the password is shown.

Other vendors just derive the master password from the serial number. Either way, my scripts can be used to get valid passwords.

A few vendors have implemented obfuscation measures to hide the hash from the end user – for instance, some FSI laptops require you to enter three special passwords for the hash to show up (e.g. “3hqgo3 jqw534 0qww294e”, “enable master password” shifted one up/left on the keyboard). Some HP/Compaq laptops only show the hash if the F2 or F12 key has been pressed prior to entering an invalid password for the last time.

Depending on the “format” of the number code/hash (e.g. whether only numbers or both numbers and letters are used, whether it contains dashes, etc.), you need to choose the right script – it is mostly just a matter of trying all of them and finding the one that fits your laptop. It does not matter on what machine the script are executed, i.e. there is no reason to run them on the locked laptop.
This is an overview of the algorithms that I looked at so far:

Vendor Hash Encoding Example of Hash Code/Serial Scripts
Compaq 5 decimal digits 12345 pwgen-5dec.py
Windows binary
Dell serial number 1234567-595B
1234567-D35B
1234567-2A7B
Windows binary&source
Fujitsu-Siemens 5 decimal digits 12345 pwgen-5dec.py
Windows binary
Fujitsu-Siemens 8 hexadecimal digits DEADBEEF pwgen-fsi-hex.py
Windows binary
Fujitsu-Siemens 5×4 hexadecimal digits AAAA-BBBB-CCCC-DEAD-BEEF pwgen-fsi-hex.py
Windows binary
Fujitsu-Siemens 5×4 decimal digits 1234-4321-1234-4321-1234 pwgen-fsi-5x4dec.py
Windows binary
Hewlett-Packard 5 decimal digits 12345 pwgen-5dec.py
Windows binary
Hewlett-Packard/Compaq Netbooks 10 characters CNU1234ABC pwgen-hpmini.py
Windows binary
Insyde H20 (generic) 8 decimal digits 03133610 pwgen-insyde.py
Windows binary
Phoenix (generic) 5 decimal digits 12345 pwgen-5dec.py
Windows binary
Sony 7 digit serial number 1234567 pwgen-sony-serial.py
Windows binary
Samsung 12 hexadecimal digits 07088120410C0000 pwgen-samsung.py
Windows binary

The .NET runtime libraries are required for running the Windows binary files (extension .exe). If the binary files (.exe) don’t work out for you, install Python 2.6 (not 3.x) and run the .py script directly by double-clicking them. Make sure that you correctly read each letter (e.g. number ‘1’ vs letter ‘l’).

Вячеслав Бачериков has also converted my scripts to javascript so you can calculate the passwords with your browser: http://bios-pw.org/ (sources).

Please leave a comment below on what make/model the scripts work. Also, be aware that some vendors use different schemes for master passwords that require hardware to be reset – among them are e.g. IBM/Lenovo. If you find that your laptop does not display a hash or the scripts do not work for you for whatever reason, try to:

  • use a USB keyboard for entering the password for avoiding potential defects of the built-in keyboard,
  • run CmosPwd to remove the password if you can still boot the machine,
  • overwrite the BIOS using the emergency recovery procedures. Usually, the emergency flash code is activated by pressing a certain key combination while powering on the machine. You also need a specially prepared USB memory stick containing the BIOS binary. The details are very much dependent on your particular model. Also, be aware that this can potentially brick your device and should only be done as a last measure.
  • Some dell service tags are missing the suffix – just try the passwords for all suffices by adding -595B, -2A7B and -D35B to your service tags. 
  • The passwords for some HP laptops are breakable with this script.
  • Unlocking methods for some Toshiba laptops are described here. 
  • Some older laptop models have service manuals that specify a location of a jumper / solder bridge that can be set for removing the password.