Resetting the BIOS Supervisor Password With Debug Command

Resetting the BIOS Supervisor Password With Debug Command

To access the BIOS setup when the machine fails to operate, occasionally a drastic move is required. In older computers with battery-backed RAM, removal of the battery and short circuiting the battery input terminals for a while did the job; in some more modern machines this move only resets the real-time clock (RTC). Some motherboards offer a CMOS-reset jumper or a reset button. In yet other cases, the EEPROM chip has to be desoldered and the data in it manually edited using a programmer. Sometimes it is enough to ground the CLK or DTA line of the I²C (Inter-Integrated Circuit) bus of the EEPROM at the right moment during boot, this requires some precise soldering on SMD parts.
If the machine lets one boot but does not want to let the user into the BIOS setup utility, because of the BIOS supervisor password one possible recovery is to deliberately "damage" the CMOS checksum by doing direct port writes using DOS debug.exe command-line tool, corrupting some bytes of the checksum-protected area of the CMOS RAM; at the next boot, the CMOS typically resets its setting to factory defaults.

The Debug command can be executed from booted Windows Command Prompt or from  FreeDOS .

1. Install FreeDOS on a USB flash drive using Rufus or UNetbootin.
2. Download the debug.exe tool and save it to the root of your USB flash drive.
3. Boot up the computer with your USB flash drive and type the following commands: (take note that the second and third commands start with the letter O and not the number zero.)
 

debug
o 70 2E
o 71 FF
quit

4. Restart your computer with Ctrl + Alt + Del and you should encounter an error message like “CMOS checksum error” which is normal. You can now access the CMOS setup without entering a password.



Command Prompt
Within Windows Command Prompt type the following commands: (take note that the second and third commands start with the letter O and not the number zero.)
 

debug
-o 70 10
-o 71 aa
-q

That will write to CMOS (Offset 10h) with the value 0AAh.
Restart your computer. You can now access the CMOS setup without entering a password.

Edited by FreeBooter, 13 June 2016 - 01:37 AM.

If the commands are similar to what cmospwd does to erase the cmos then this will brick a laptop that stores the password in an eeprom. Most desktops will let you reset the password with a jumper. I would not use these commands on any modern laptop.

EEPROM on laptops

On laptops, the password is usually stored in an eeprom on the motherboard and not in the cmos. You need an eeprom programmer/eeprom reader (electronic device) to retrieve the password. If you erase the cmos (ie. cmospwd /k) and if the password is really stored in an eeprom, you won't be able to boot anymore.

You can get/buy eeprom programmer in electronic shops or labs, you need another PC to use it. You can desolder the eeprom with hot air or you can try to "clip" the eeprom. With the eeprom programmer, backup your eeprom and run cmospwd /d /l eeprom_backup. If you don't see the password, you can try to fill the eeprom with zero or FF, don't forget the reset the cmos.

 

The BIOS password are store in ROM BIOS or chipset but setting for password store with CMOS ROM so resetting the CMOS ROM will reset setting for BIOS Supervisor Password. Debug command is not similar as cmospwd writes zero to BIOS ROM which does brick PC Debug command deliberately damages the CMOS checksum by doing direct port writes that will write to CMOS (Offset 10h) with the value 0AAh  corrupting some bytes of the checksum-protected area of the CMOS RAM; at the next boot, the CMOS typically resets its setting to factory defaults. You can try this command with Virtual machines.

Edited by FreeBooter, 13 June 2016 - 07:48 AM.

Thank you for the clarification.

Edited by hamluis, 17 May 2019 - 09:31 AM.

You are very welcome.

Edited by hamluis, 17 May 2019 - 09:30 AM.

I have LenovoT440s laptop that has a locked Bios. This model also has an internal battery as well as the traditional battery. I tried to see if I could use a flash drive to boot using Rufus , but it did not work. The computer boots to windows 10 perfectly . I tried CMOS-De-Animator which is software to unlock Bios . It generated a CMOS checksum error but the bios was still locked. I do not feel comfortable opening the laptop especially since I can't turn internal battery off.

I assume that using debug info above from command prompt w/in windows 10th  would do the same or should I try that .

Does anyone have any other ideas. I just purchased this laptop on Ebay & can return or get partial credit based on likelyhood of unlocking Bios.

Thanks,

Al 

Support.Lenovo.com > Type of password for ThinkPad

Supervisor [Adminstrator] password (BIOS password)

Reset forgotten supervisor password

If you forget your supervisor password, Lenovo cannot reset your password. You must take your computer to a Lenovo Service Provider to have the system board replaced.

Reset forgotten hard disk password

If you forget the user hard disk password, or both user and master hard disk passwords, Lenovo cannot reset your passwords or recover data from the hard disk drive. You must take your computer to a Lenovo Service Provider to have the hard disk drive replaced.

--

Support.Lenovo.com > Lost or forgotten password

Affected Configurations - Lenovo, Idea and Think laptops

Administrator password

Forgotten Administrator password

A forgotten Administrator password will prevent access to the BIOS setup utility. To regain access, the system will need to be serviced to have the system board replaced. Proof of purchase is required, and this repair is not covered under the warranty.

The BIOS password are store in ROM BIOS or chipset but setting for password store with CMOS ROM so resetting the CMOS ROM will reset setting for BIOS Supervisor Password. Debug command is not similar as cmospwd writes zero to BIOS ROM which does brick PC Debug command deliberately damages the CMOS checksum by doing direct port writes that will write to CMOS (Offset 10h) with the value 0AAh  corrupting some bytes of the checksum-protected area of the CMOS RAM; at the next boot, the CMOS typically resets its setting to factory defaults. You can try this command with Virtual machines.

so will my pc with eeprom brick with the debug command or is it harmless?

 

The BIOS password are store in ROM BIOS or chipset but setting for password store with CMOS ROM so resetting the CMOS ROM will reset setting for BIOS Supervisor Password. Debug command is not similar as cmospwd writes zero to BIOS ROM which does brick PC Debug command deliberately damages the CMOS checksum by doing direct port writes that will write to CMOS (Offset 10h) with the value 0AAh  corrupting some bytes of the checksum-protected area of the CMOS RAM; at the next boot, the CMOS typically resets its setting to factory defaults. You can try this command with Virtual machines.

so will my pc with eeprom brick with the debug command or is it harmless?

 

I have used the Debug command few times without any problems but i wont promise that it will not cause any problems.

Have tried removing CMOS battery to reset BIOS password?

I performed the solution here on my Toshiba laptop. The Supervisor password could not be bypassed. Even worse, now I can not boot any more. Seems like the Intel booting agent can not boot from any of the media available. Have I just brick my laptop?

Could you please help?

thanks a lot!  

I performed the solution here on my Toshiba laptop. The Supervisor password could not be bypassed. Even worse, now I can not boot any more. Seems like the Intel booting agent can not boot from any of the media available. Have I just brick my laptop?

 

Could you please help?

 

thanks a lot!  

If you cannot power on laptop then you have brick the laptop.

I can still turn on the laptop. I can still get into the limited BIOS access if I press "F11" when prompted to enter the Supervisor password.

But in the limited BIOS, I can't change anything like "booting order" or "reset to default" and most of the items.

If I let the laptop to boot itself, it failed to boot from any media, including SSD and USB drive that has the FreeDOS and debug.exe on it. And that was the one used to perform the instruction here so I knew it is bootable and live.

The "Intel Boot Agent" failed to find any bootable media, then got stuck.

Got any idea about how to fix the problem?

again, thanks a lot!

 

I performed the solution here on my Toshiba laptop. The Supervisor password could not be bypassed. Even worse, now I can not boot any more. Seems like the Intel booting agent can not boot from any of the media available. Have I just brick my laptop?

 

Could you please help?

 

thanks a lot!  

If you cannot power on laptop then you have brick the laptop.

 

 

I can still turn on the laptop. I can still get into the limited BIOS access if I press "F11" when prompted to enter the Supervisor password.

 

But in the limited BIOS, I can't change anything like "booting order" or "reset to default" and most of the items.

 

If I let the laptop to boot itself, it failed to boot from any media, including SSD and USB drive that has the FreeDOS and debug.exe on it. And that was the one used to perform the instruction here so I knew it is bootable and live.

 

The "Intel Boot Agent" failed to find any bootable media, then got stuck.

 

Got any idea about how to fix the problem?

 

again, thanks a lot!

 

 

 

I can't help if you can't boot from bootable media.

Your last option is to disconnect CMOS battery to reset BIOS password.

https://computer-hardware.wonderhowto.com/how-to/replace-laptop-cmos-battery-308932/

Yes, I've thought of that and tried that already. Since your debug.exe is writing something into the CMOS RAM, if I can clear the content of the RAM, I may be able to get back to the default value.

So I unplugged the PSU, unplugged the batteries, both the main one and the RTC/CMOS one. Waited for 1.5 hours, then plugged in again. It first complained that the RTC battery is low and I found the time has been reset inside BIOS. That convinced me the RTC/CMOS had been cleared. But still, I had the same problem.

Looks like the only hope I can do is to login to BIOS with Supervisor password and then reset the BIOS to factory default. But if I have that, I don't even have to come to this stage...  

I got it to work!

There is no media available to boot from within the laptop itself. But at the end it allowed me to boot from the network. I then used that to install Windows on to the SSD. Now I have some control of this laptop, but still have no supervisor password and no way to change the order of booting.

From this point, do you better way to reset the password?

thanks.