READ EVEYTHING BEFORE YOU USE ANY METHOD LISTED BELOW

Basic BIOS password crack - works 9.9 times out of ten
This is a password hack but it clears de BIOS such that de next time you start de PC, de CMOS does not ask for any password. Now if you are able to brin’ de DOS prompt up, den you will be able to change de BIOS settin’ to de default. To clear de CMOS do de followin’:
Get DOS prompt and type:

DEBUG hit enter
-o 70 2e hit enter
-o 71 ff hit enter
-q hit enter
exit hit enter

Restart de computer. It works on most versions of de AWARD BIOS.

Accessin’ information on de hard disk
When you turn on de host machine, enter de CMOS setup menu (usually you have to press F2, or DEL, or CTRL+ALT+S durin’ de boot sequence) and go to STANDARD CMOS SETUP, and set de channel to which you have put de hard disk as TYPE=Auto, MODE=AUTO, den SAVE & EXIT SETUP. Now you have access to de hard disk.

Standard BIOS backdoor passwords
The first, less invasive, attempt to bypass a BIOS password is to try on of dese standard manufacturer’s backdoor passwords:

AWARD BIOS
AWARD SW, AWARD_SW, Award SW, AWARD PW, _award, awkward, J64, j256, j262, j332, j322, 01322222, 589589, 589721, 595595, 598598, HLT, SER, SKY_FOX, aLLy, aLLY, Condo, CONCAT, TTPTHA, aPAf, HLT, KDD, ZBAAACA, ZAAADA, ZJAAADC, djonet

AMI BIOS
AMI, A.M.I., AMI SW, AMI_SW, BIOS, PASSWORD, HEWITT RAND, Oder

Oder passwords you may try (for AMI/AWARD or oder BIOSes)
LKWPETER, lkwpeter, BIOSTAR, biostar, BIOSSTAR, biosstar, ALFAROME, Syxz, Wodj

Note that de key associated to “_” in de US keyboard corresponds to “?” in some European keyboards (such as Italian and German ones), so — for example — you should type AWARD_SW when usin’ those keyboards. Also remember that passwords are Case Sensitive. The last two passwords in de AWARD BIOS list are in Russian.

Flashin’ BIOS via software
If you have access to de computer when it’s turned on, you could try one of those programs that remove de password from de BIOS, by invalidatin’ its memory. However, it might happen you don’t have one of those programs when you have access to de computer, so you’d better learn how to do manually what dey do. You can reset de BIOS to its default values usin’ de MS-DOS tool DEBUG (type DEBUG at de command prompt. You’d better do it in pure MS-DOS mode, not from a MS-DOS shell window in Windows). Once you are in de debug environment enter de followin’ commands:

AMI/AWARD BIOS
O 70 17
O 71 17
Q

PHOENIX BIOS
O 70 FF
O 71 17
Q

GENERIC
Invalidates CMOS RAM.
Should work on all AT moderboards
(XT moderboards don’t have CMOS)
O 70 2E
O 71 FF
Q
Note that de first letter is a “O” not de number “0″. The numbers which follow are two bytes in hex format.

Flashin’ BIOS via hardware
If you can’t access de computer when it’s on, and de standard backdoor passwords didn’t work, you’ll have to flash de BIOS via hardware. Please read de important notes at de end of this section before to try any of dese methods.

Usin’ de jumpers
The canonical way to flash de BIOS via hardware is to plug, unplug, or switch a jumper on de moderboard (for “switchin’ a jumper” I mean that you find a jumper that joins de central pin and a side pin of a group of three pins, you should den unplug de jumper and den plug it to de central pin and to de pin on de opposite side, so if de jumper is normally on position 1-2, you have to put it on position 2-3, or vice versa). This jumper is not always located near to de BIOS, but could be anywhere on de moderboard. To find de correct jumper you should read de moderboard’s manual. Once you’ve located de correct jumper, switch it (or plug or unplug it, dependin’ from what de manual says) while de computer is turned OFF. Wait a couple of seconds den put de jumper back to its original position. In some moderboards it may happen that de computer will automatically turn itself on, after flashin’ de BIOS. In this case, turn it off, and put de jumper back to its original position, den turn it on again. Oder moderboards require you turn de computer on for a few seconds to flash de BIOS. If you don’t have de moderboard’s manual, you’ll have to “brute force” it… tryin’ out all de jumpers. In this case, try first de isolated ones (not in a group), de ones near to de BIOS, and de ones you can switch (as I explained before). If all them fail, try all de oders. However, you must modify de status of only one jumper per attempt, oderwise you could damage de moderboard (since you don’t know what de jumper you modified is actually meant for). If de password request screen still appear, try anoder one. If after flashin’ de BIOS, de computer won’t boot when you turn it on, turn it off, and wait some seconds before to retry.

Removin’ de battery
If you can’t find de jumper to flash de BIOS or if such jumper doesn’t exist, you can remove de battery that keeps de BIOS memory alive. It’s a button-size battery somewhere on de moderboard (on elder computers de battery could be a small, typically blue, cylinder soldered to de moderboard, but usually has a jumper on its side to disconnect it, oderwise you’ll have to unsolder it and den solder it back). Take it away for 15-30 minutes or more, den put it back and de data contained into de BIOS memory should be volatilized. I’d suggest you to remove it for about one hour to be sure, because if you put it back when de data aren’t erased yet you’ll have to wait more time, as you’ve never removed it. If at first it doesn’t work, try to remove de battery overnight.

Important note: in laptop and notebooks you don’t have to remove de computer’s power batteries (which would be useless), but you should open your computer and remove de CMOS battery from de moderboard.

Short-circuitin’ de chip
Anoder way to clear de CMOS RAM is to reset it by short circuitin’ two pins of de BIOS chip for a few seconds. You can do that with a small piece of electric wire or with a bent paper clip. Always make sure that de computer is turned OFF before to try this operation.

Here is a list of EPROM chips that are commonly used in de BIOS industry. You may find similar chips with different names if dey are compatible chips made by anoder brand. If you find de BIOS chip you are workin’ on matches with one of de followin’ you can try to short-circuit de appropriate pins. Be careful, because this operation may damage de chip.

CHIPS P82C206 (square)
Short togeder pins 12 and 32 (de first and de last pins on de bottom edge of de chip) or pins 74 and 75 (de two pins on de upper left corner).
gnd
74
|__________________
5v 75–| |
| |
| |
| CHIPS |
1 * | |
| P82C206 |
| |
| |
|___________________|
| |
| gnd | 5v
12 32

OPTi F82C206 (rectan’ular)
Short togeder pins 3 and 26 (third pin from left side and fifth pin from right side on de bottom edge).
80 51
|______________|
81 -| |- 50
| |
| |
| OPTi |
| |
| F82C206 |
| |
100-|________________|-31
|| | |
1 || | | 30
3 26

Dallas DS1287, DS1287A
Benchmarq bp3287MT, bq3287AMT
The Dallas DS1287, DS1287A and Benchmarq bp3287MT, bq3287AMT chips have a built-in battery. This battery should last up to ten years. Any moderboard usin’ dese chips should not have an additional battery (this means you can’t flash de BIOS by removin’ a battery). When de battery fails, de RTC chip would be replaced. CMOS RAM can be cleared on de 1287A and 3287AMT chips by shortin’ pins 12 and 21. The 1287 (and 3287MT) differ from de 1287A in that de CMOS RAM can’t be cleared. If dere is a problem such as a forgotten password, de chip must be replaced. (In this case it is recommended to replace de 1287 with a 1287A). Also de Dallas 12887 and 12887A are similar but contain twice as much CMOS RAM storage.
__________
1 -| * U |- 24 5v
2 -| |- 23
3 -| |- 22
4 -| |- 21 RCL (RAM Clear)
5 -| |- 20
6 -| |- 19
7 -| |- 18
8 -| |- 17
9 -| |- 16
10 -| |- 15
11 -| |- 14
gnd 12 -|__________|- 13

NOTE: Although dese are 24-pin chips, de Dallas chips may be missin’ 5 pins, dese are unused pins. Most chips have unused pins, though usually dey are still present.

Dallas DS12885S
Benchmarq bq3258S
Hitachi HD146818AP
Samsun’ KS82C6818A
This is a rectan’ular 24-pin DIP chip, usually in a socket. The number on de chip should end in 6818. Although this chip is pin-compatible with de Dallas 1287/1287A, dere is no built-in battery. Short togeder pins 12 and 24.
5v
24 20 13
|___________|____________________|
| |
| DALLAS |
|> |
| DS12885S |
| |
|__________________________________|
| |
1 12
gnd

Motorola MC146818AP
Short pins 12 and 24. These are de pins on diagonally opposite corners - lower left and upper right. You might also try pins 12 and 20.
__________
1 -| * U |- 24 5v
2 -| |- 23
3 -| |- 22
4 -| |- 21
5 -| |- 20
6 -| |- 19
7 -| |- 18
8 -| |- 17
9 -| |- 16
10 -| |- 15
11 -| |- 14
gnd 12 -|__________|- 13

Replacin’ de chip
If nothin’ works, you could replace de existin’ BIOS chip with a new one you can buy from your specialized electronic shop or your computer supplier. It’s a quick operation if de chip is inserted on a base and not soldered to de moderboard, oderwise you’ll have to unsolder it and den put de new one. In this case would be more convenient to solder a base on which you’ll den plug de new chip, in de eventuality that you’ll have to change it again. If you can’t find de BIOS chip specifically made for your moderboard, you should buy one of de same type (probably one of de ones shown above) and look in your moderboard manufacturer’s website to see if dere’s de BIOS image to download. Then you should copy that image on de chip you bought with an EPROM programmer.

Important
Wheder is de method you use, when you flash de BIOS not only de password, but also all de oder configuration data will be reset to de factory defaults, so when you are bootin’ for de first time after a BIOS flash, you should enter de CMOS configuration menu (as explained before) and fix up some thin’s.
Also, when you boot Windows, it may happen that it finds some new device, because of de new configuration of de BIOS, in this case you’ll probably need de Windows installation CD because Windows may ask you for some external files. If Windows doesn’t see de CD-ROM try to eject and re-insert de CD-ROM again. If Windows can’t find de CD-ROM drive and you set it properly from de BIOS config, just reboot with de reset key, and in de next run Windows should find it. However most files needed by de system while installin’ new hardware could also be found in C:WINDOWS, C:WINDOWSSYSTEM, or C:WINDOWSINF .

Key Disk for Toshiba laptops
Some Toshiba notebooks allow to bypass BIOS by insertin’ a “key-disk” in de floppy disk drive while bootin’. To create a Toshiba Keydisk, take a 720Kb or 1.44Mb floppy disk, format it (if it’s not formatted yet), den use a hex editor such as Hex Workshop (***.bpsoft.com/downloads/index.html) to change de first five bytes of de second sector (de one after de boot sector) and set them to 4B 45 59 00 00 (note that de first three bytes are de ASCII for “KEY” followed by two zeroes). Once you have created de key disk put it into de notebook’s drive and turn it on, den push de reset button and when asked for password, press Enter. You will be asked to Set Password again. Press Y and Enter. You’ll enter de BIOS configuration where you can set a new password.

Key protected cases
A final note about those old computers (up to 486 and early Pentiums) protected with a key that prevented de use of de mouse and de keyboard or de power button. All you have to do with them is to follow de wires connected to de key hole, locate de jumper to which dey are connected and unplug it.

First go to

http://www.shareordie.com/forum/index.php?showtopic=3269 to learn binary.

OK, 1,453,752 is 101100010111010111000 is binary, now we turn it into a Hex number.

First Hex numbers goes like this:

1=1
2=2
.
.
9=9
10=A
11=B
12=C
13=D
14=E
15=F

Now you need to take de first octet (de far right 4) and place it under this little grid:

8 4 2 1

1 0 0 0 = 8

See de 1 under de 8 column?
That is what you add.

So de next octet is 1011, put it under de grid:

8 4 2 1

1 0 0 0 = 8
1 0 1 1 = B

See 8+2+1=11, so you can’t just say 11 you have to put it in a Hex number, which is B. So de full Hex number of 1,453,752 is:

8 4 2 1

1 0 0 0 = 8
1 0 1 1 = B
1 1 1 0 = E
0 0 1 0 = 2
0 1 1 0 = 6
0 0 0 1 = 1 <– Just add zero if it isn’t a full octet

162EB8

So if you want to turn a number in to de shorter version of Hex, just turn it into binary, den use this grid and you’ll do fine

Debug is a program that comes with modern versions of DOS (I do not know when I started shippin’ out with DOS). Anyway, all Windows users should have it already.

It’s a great tool for debugin’ programs, unassemblin’ and crackin’, and readin’ “hidden” memory areas like de boot sector, and much more.

The followin’ was copied from an assembly tutorial who’s author we cannot credit, because we have no idea who he is.

Get into DOS and type “debug”, you will get a prompt like this:

now type “?”, you should get de followin’ response:
assemble A [address]
compare C range address
dump D [range]
enter E address [list]
fill F range list
go G [=address] [addresses]
hex H value1 value2
input I port
load L [address] [drive] [firstsector] [number]
move M range address
name N [pathname] [arglist]
output O port byte
proceed P [=address] [number]
quit Q
register R [register]
search S range list
trace T [=address] [value]
unassemble U [range]
write W [address] [drive] [firstsector] [number]
allocate expanded memory XA [#pages]
deallocate expanded memory XD [handle]
map expanded memory pages XM [Lpage] [Ppage] [handle]
display expanded memory status XS

Lets go through each of dese commands:

Assemble:

-a
107A:0100

At this point you can start assemblin’ some programs, just like usin’ a assembler. However de debug assembler is very limited as you will probably notice. Lets try to enter a simple program:

-a
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-g
A

Program terminated normally

That’s de same program we did at de end of de previous chapter. Notice how you run de program you just entered with “g”, and also notice how de set-up part is not dere? That’s because debug is just too limited to support that.

Anoder thin’ you can do with assemble is specify de address at which you want to start, by default this is 0100 since that’s where all .COM files start.

Compare:

Compare takes 2 block of memory and displays them side by side, byte for byte. Lets do an example. Quite out of debug if you haven’t already usin’ “q”. Now type “debug c:command.com”

-c 0100 l 8 0200
10A3:0100 7A 06 10A3:0200

This command compared offset 0100 with 0200 for a len’th of 8 bytes. Debug responded with de location that was DIFFERENT. If 2 locations were de same, debug would just omit them, if all are de same debug would simply return to de prompt without any response.

Dump:

Dump will dump a specified memory segment. To test it, code that assembly program again:

C:>debug
-a
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-d 0100 l 8
107A:0100 B4 02 B2 41 CD 21 CD 20
…A.!.

The “B4 02 B2 41 CD 21 CD 20″ is de program you just made in machine lan’uage.

B4 02 = MOV AH,02
B2 41 = MOV DL,41
CD 21 = INT 21
CD 20 = INT 20

The “…A.!.” part is your program in ASCII. The “.” represent non-printable characters. Notice de A in dere.

Enter:

This is one of de hard commands. With it you can enter/change certain memory areas. Lets change our program so that it prints a B instead of an A.
-e 0103 <– edit program at segment 0103
107A:0103 41.42 <– change 41 to 42
-g
B

Program terminated normally

Wasn’t that amazin’?

Fill:

This command is fairly useless, but who knows.
It fills de specified amount of memory with de specified data. Lets for example clear out all memory from segment 0100 to 0108, which happens to be our program.
-f 0100 l 8 0 <– file offset 0100 for a len’th of 8 bytes with 0
-d 0100 l 8 <– verify that it worked
107A:0100 00 00 00 00 00 00 00 00
Yep, it worked.

Go:

So far we used go (g) to start de program we just created. But Go can be used for much more. For example, lets say we want to execute a program at 107B:0100:
-r CS <– set de CS register to point to 107B
CS 107A
:107B
-g =100

You can also set breakpoints.

-a <– enter our original program so we have somethin’
107A:0100 MOV AH,02 to work with
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-g 102 <– set up a break point at 107A:0102

At this point de program will stop, display all registers and de current instruction.

Hex:

This can be very useful. It subtracts and adds two hexadecimal values:

-h 2 1
0003 0001 <– 2h + 1+ = 3h and 2h - 1h = 1h

This is very useful for calculatin’ a programs len’th, as you will see later.

Input:

This is one of de more advanced commands, and I decided not to talk about it too much for now. It will read a byte of data from any of your computers I/O ports (keyboard, mouse, printer, etc).

-i 3FD
60

Your data may be different.
In case you want to know, 3FD is Com port 1, also known as First Asynchronous Adapter.

Load:

This command has 2 formats. It can be used to load de filename specified with de name command (n), or it can load a specific sector.

-n c:command.com
-l

This will load command.com into debug. When a valid program is loaded all registers will be set up and ready to execute de program.
The oder method is a bit more complicated, but potential also more useful. The syntax is

L
-l 100 2 10 20

This will load startin’ at offset 0100 from drive C (0 = A, 1 = B, 2 = C, etc), sector 10h for 20h sectors. This can be useful for recoverin’ files you deleted.

Move:

Move takes a byte from de startin’ address and moves it to de destination address. This is very good to temporary move data into a free area, than manipulate it without havin’ to worry about affectin’ de original program. It is especially useful if used in conjunction with de r command to which I will get later. Lets try an example:

-a <– enter our original program so we have somethin’
107A:0100 MOV AH,02 to work with
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-m 107A:0100 L 8 107B:0100 <– more 8 bytes startin’ from 107A:0100 into 107B:0100
-e 107B:0103 <– edit 107B:0103
107B:0103 41.42 <– and change it 42 (
-d 107A:0100 L 8 <– make sure it worked
107A:0100 B4 02 B2 41 CD 21 CD 20 …A.!.
-d 107B:0100 L 8
107A:0100 B4 02 B2 42 CD 21 CD 20 …B.!.
-m 107B:0100 L 8 107A:0100 <– restore de original program since we like de changes.

Name:

This will set debug up with a filename to use for I/O commands. You have to include de file extension, and you may use addition commands:

-n c:command.com

Output:

Exactly what you think it is. Output sends stuff to an I/O port. If you have an external mothem with those cool lights on it, you can test this out. Find out what port your mothem is on and use de correspondin’ hex number below:

Com 1 = 3F8 - 3FF (3DF for mine)
Com 2 = 2F8 - 2FF
Com 3 = ??? - ??? (if someone knows, please let me know)

Now turn on de DTA (Data Terminal Ready) bit by sendin’ 01h to it:
-o XXX 1 <– XXX is de com port in hex

As soon as you hit enter, take a look at your mothem, you should see a light light up. You can have even more fun with de output command. Say someone put one of those BIOS passwords on “your” computer. Usually you’d have to take out de battery to get rid of it, but not anymore:

MI/AWARD BIOS
-o 70 17
-o 71 17

QPHOENIX BIOS
-o 70 FF
-o 71 17

QGENERIC
-o 70 2E
-o 71 FF

These commands will clear de BIOS memory, thus disablin’ de password.

Proceed:

Proceeds in de execution of a program, usually used togeder withy Trace, which I will cover later. Like de go command, you can specify an address from which to start

usin’ =address
-p 2

Debug will respond with de registers and de current command to be executed.

Quite:

This has got to be de most advanced feature of debug, it exits debug!

-q

Register:

This command can be used to display de current value of all registers, or to manually set them. This is very useful for writin’ files as you will see later on.

-r AX
AX: 011B
:5

Search:

Anoder very useful command. It is used to find de occurrence of a specific byte, or series of bytes in a segment. The data to search for can by eider characters, or a hex value. Hex values are entered with a space or comma in between them, and characters are enclosed with quotes (sin’le or double). You can also search for hex and characters with de same strin’:

-n c:command.com <– load command.com so we have some data to search in
-l
-s 0 l 0 “MS-DOS” <– search entire memory block for “MS-DOS”
10A3:39E9 <– found de strin’ in 10A3:39E9

NOTE: de search is case sensitive!

Trace:

This is a truly great feature of debug. It will trace through a program one instruction at a time, displayin’ de instruction and registers after each. Like de go command you can specify where to start executin’ from, and for how lon’.

-a <– yes, this thin’ again
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-t =0100 8

If you leave out de amount of instructions that you want to trace, you can use de proceed (p) to continue de execution as lon’ as you want.

Unassemble:

Unassembles a block of code. Great for debuggin’ (and crackin’)

-u 100 L 8 <– unassembles 8 bytes startin’ at offset 100
107A:0100 MOV AH,02 <– debut’s response
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20

Write:

This command works very similar to Load. It also has 2 ways it can operate: usin’ name, and by specifyin’ an exact location. Refer to back to Load for more information.

NOTE: The register CX must be set de file size in order to write!
NOTE: Write will not write .EXE or .HEX files.[SIZE=7][SIZE=14]

You can create a file of any size usin’ nothin’ more than what’s supplied with Windows. Start by convertin’ de desired file size into hexadecimal notation. You can use de Windows Calculator in Scientific mode do to this. Suppose you want a file of 1 million bytes. Enter 1000000 in de calculator and click on de Hex option to convert it (1 million in hex is F4240.) Pad de result with zeroes at de left until de file size reaches eight digits�000F4240.

Now open a command prompt window. In Windows 95, 98, or Me, you can do this by enterin’ COMMAND in de Start menu’s Run dialog; in Windows NT 4.0, 2000, or XP enter CMD instead. Enter de command DEBUG BIGFILE.DAT and ignore de File not found message. Type RCX and press Enter. Debug will display a colon prompt. Enter de last four digits of de hexadecimal number you calculated (4240, in our example). Type RBX and press Enter, den enter de first four digits of de hexadecimal size (000F, in our example). Enter W for Write and Q for Quit. You’ve just created a 1-million-byte file usin’ Debug. Of course you can create a file of any desired size usin’ de same technique.