Hacking Your Password - Password Checking Option and Clearing Chips

Hacking Your Password -
Password Checking Option and Clearing Chips

Password Checking Option

You can use a password during the computer's startup sequence. The options are:

Always, which means every time the system is started.
Setup, which only protects the BIOS routine from being tampered with, or
Disabled.

You can still boot from a floppy and alter things with a diagnostic program, though.
The original AMI BIOS did not encrypt the password, so any utility capable of reading the CMOS should be able to edit it. The AMI WinBIOS uses a simple substitution system.

You get three attempts to get in, after which the system will have to be rebooted. The default is usually the manufacturer's initials (try ami), or biostar, biosstar, AWARD?SW, AWARD?PW, LKWPETER, 589589, aLLy, condo, djonet, lkwpeter, j262 SWITCHES?SW, AWARD_SW, or Shift + S Y X Z for Award (before 19 Dec 96), but if this doesn't work, or you forget your own password, you must discharge the CMOS. One way to do this is simply to wait for five years until the battery discharges (ten if you've got a Dallas clock chip)! You could also remove the CMOS chip or the battery and just hang on for twenty minutes or so. Look for the chips mentioned below, under Clearing Chips.

You could try flooding the keyboard buffer to crash the password routine -
just wait for the password prompt, then keep pressing esc.

Note: Since 19 Dec 96, Award Software has not used a default password, leaving it for OEMs. Discharging the battery will not clear the OEM password.

Note: When CMOS RAM loses power, a bit is set which indicates this to the BIOS during the POST test. As a result, you will normally get slightly more aggressive default values.

If your battery is soldered in, you could discharge it enough so the CMOS loses power, but make sure it is rechargeable so you can get it up to speed again. To discharge it, connect a small resistor (say 39 ohms, or a 6v lantern lamp) across the battery and leave it for about half an hour.

Some motherboards use a jumper for discharging the CMOS; it may be marked CMOS DRAIN. Sometimes, you can connect P15 of the keyboard controller (pin 32, usually) to GND and switch the machine on. This makes the POST run, which deletes the password after one diagnostic test. Then reboot.

Very much a last resort is to get a multi-meter and set it to a low resistance check (i.e. 4 ohms), place one probe on pin 1 of the chip concerned, and draw the other over the other pins. This will shock out the chip and scramble its brains. This is not for the faint hearted, and only for the desperate-use a paperclip or desolder the battery first! We assume no responsibility for damage!

The minimum standby voltage for the 146818 is 2.7v, but your settings can remain even down to around 2.2v. Usually, the clock will stop first, as the oscillator needs a higher voltage to operate. 3v across a CMOS is common with 3.6v nicad & lithium batteries, as the silicon diodes often used in the battery changeover circuit have a voltage drop of 0.6v (3.6v-.6v = 3v). If your CMOS settings get lost when you switch off and the battery is OK, the problem may be in the changeover circuit - the 146818 can be sensitive to small spikes caused by it at power down.

Clearing Chips
The CMOS can mostly be cleared by shorting together appropriate pins with something like a bent paperclip (with the power off!). You could try a debug script if you are able to boot:

A:\DEBUG
- o 70 2E
- o 71 FF
- q

The CMOS RAM is often incorporated into larger chips:

P82C206 (Square)
Also has 2 DMA controllers, 2 Interrupt controllers, a Timer, and RTC (Real-Time Clock). It's usually marked CHIPS, because it's made by Chips and Technologies. Clear by shorting together pins 12 and 32 on the bottom edge or pins 74 and 75 on the upper left corner.

F82C206 (Rectangular)
Usually marked OPTi (the manufacturer). Has 2 DMA Controllers, 2 Interrupt Controllers, Timer, and Real Time Clock. Clear by shorting pins 3 and 26 on the bottom edge (third pin in from left and 5th pin from right).

Dallas DS1287,DS1287A
Benchmarq bp3287MT, bq3287AMT.
The DS1287 andDS1287A (and compatible Benchmarq bp3287MT and bq3287AMT chips) have a built-in battery, which should last up to 10 years. Clear the 1287A and 3287AMT chips by shorting pins 12 and 21-you cannot clear the 1287 (and 3287MT), so replace them (with a 1287A!). Although these are 24-pin chips, the Dallas chips may be missing 5, which are unused anyway.

Motorola MC146818AP or compatible.
Rectangular 24-pin DIP chip, found on older machines. Compatibles are made by several manufacturers including Hitachi (HD146818AP) and Samsung (KS82C6818A), but the number on the chip should have 6818 in it somewhere. Although pin-compatible with the 1287/1287A, there is no built-in battery, which means it can be cleared by just removing it from the socket, but you can also short pins 12 and 24.

Dallas DS12885S or
Benchmarq bq3258S
Clear by shorting pins 12 and 20, on diagonally opposite corners; lower right and upper left (try also pins 12 and 24).

For reference, the bytes in the CMOS of an AT with ISA bus are arranged thus:

00 Real Time Clock
10-2F ISA Configuration Data
30-3F BIOS-specific information
40-7F Ext CMOS RAM/Advanced Chipset info

The AMI password is in 37h-3Fh, where the (encrypted) password is at 38h-3Fh. If byte 0Dh is set to 0, the BIOS will think the battery is dead and treat what's in the CMOS as invalid.

One other point, if you have a foreign keyboard (that is, outside the United States) - the computer expects to see a USA keyboard until your keyboard driver is loaded, so DON'T use anything in your password that is not in the USA keyboard!

This is an article from Phil Croucher, author of "The BIOS Companion" Phil has a way of explaining in "plain" English. The information is well presented and is well above A+ standard. For more info on all of his works, go to "The BIOS Companion" Home Page.