Removing the BIOS Administrator Password on a ThinkPad Takes Timing

This would be a bad time to slip. (Credit: onionboots, YouTube)
In the olden days, an administrator password on a BIOS was a mere annoyance, one quickly remedied by powering off the system and pulling its CMOS battery or moving a jumper around. These days, you’re more likely to find a separate EEPROM on the mainboard that preserves the password. This, too, is mostly just another annoyance, as [onionboots] knew. All it takes is shorting out this EEPROM at the right time to knock it offline, with the ‘right time’ turning out to be rather crucial.

While refurbishing this laptop for a customer, he thought it’d be easy: the guide he found said he just had to disassemble the laptop to gain access to this chip, then short out its reset pin at the right time to make it drop offline and keep it shorted. Important here is that you do not short it when you are still booting the system, or it won’t boot. This makes for some interesting prodding of tiny pins with a metal tool.

What baffled him was that although this method worked, and he could now disable the password, on the next boot, it would be enabled again. As it turns out, to actually save the new supervisor password status to the EEPROM, you should stop shorting its pin, else you cannot write to it. Although the guide said to keep shorting it, this was, in hindsight, a clear case of relying too much on instructions and less on an obvious deduction. Not like any of us are ever guilty of such an embarrassing glitch, natch.

At any rate, it was still infinitely faster than trying to crack such a password with a brute-force method, even if helped by an LLM.

youtube.com/embed/AOAA6aWwplM?…

hackaday.com/2026/02/15/removi…

Hackaday Links: February 15, 2026

It probably won’t come as much of a surprise to find that most of the Hackaday staff aren’t exactly what you’d call sports fanatics, so we won’t judge if you didn’t tune in for the Super Bowl last week. But if you did, perhaps you noticed Ring’s Orwellian “Search Party” spot — the company was hoping to get customers excited about a new feature that allows them to upload a picture of their missing pet and have Ring cameras all over the neighborhood search for a visual match. Unfortunately for Ring, the response on social media wasn’t quite what they expected.
Nope, don’t like that.
One commenter on YouTube summed it up nicely: “This is like the commercial they show at the beginning of a dystopian sci-fi film to quickly show people how bad things have gotten.” You don’t have to be some privacy expert to see how this sort of mass surveillance is a slippery slope. Many were left wondering just who or what the new system would be searching for when it wasn’t busy sniffing out lost pups.

The folks at Wyze were quick to capitalize on the misstep, releasing their own parody ad a few days later that showed various three-letter agencies leaving rave reviews for the new feature. By Thursday, Ring announced they would be canceling a planned expansion that would have given the divisive Flock Safety access to their network of cameras. We’re sure it was just a coincidence.

Speaking of three-letter agencies, the Environmental Protection Agency has announced this week that they will no longer incentivize the inclusion of stop-start systems on new automobiles. The feature, which shuts off the engine when the vehicle comes to a stop, was never actually required by federal law; rather, the EPA previously awarded credits to automakers that added the feature, which would help them meet overall emission standards. Manufacturers are free to continue offering stop-start systems on their cars if they wish, but without the EPA credits, there’s little benefit in doing so. Especially since, as Car and Driver notes, it seems like most manufacturers are happy to be rid of it. The feature has long been controversial with drivers as well, to the point that we’ve seen DIY methods to shut it off.

An incredible story ran in The Washington Post yesterday (free to read archive) that’s so wild that it’s almost hard to believe. In fact, if it wasn’t from The Washington Post, we’d be sure it was some kind of conspiracy theory fanfic. The short version goes like this: a Norwegian researcher who was so confident the “Havana syndrome” wasn’t the result of a directed energy weapon decided to prove it by not only building some sort of pulsed RF device based on leaked classified documents, but fired the thing at himself as a test. We’re not sure what the Norwegian equivalent to the “Shocked Pikachu Face” meme is, but we’ll give you one guess as to what happened.

If that wasn’t crazy enough, the article goes on to casually mention that the US Department of Homeland Security secretly purchased a similar pulsed-energy weapon for several million dollars on the black market during the Biden administration, and is currently studying it. Despite it apparently containing Russian components, the Feds have yet to determine who actually built the thing. You’ll have a hard time finding a bigger proponent for the free exchange of information than Hackaday, but even we have to admit…maybe there are some things it’s better we don’t know about.
Perfect for Meshtastic
Of course, if you’re looking to really maximize the effects of your black market pulsed-energy weapon, you’ll need to get it up high (maybe, what the hell do we know). Or perhaps you’re just a radio enthusiast. In either event, if you’re within driving distance of Tennessee, you’ll want to keep an eye on this government auction for an 80-foot-tall mobile communications tower. According to the listing posted by the Madisonville Police Department, the towable rig was built in 2016, weighs in at a little over 10,000 pounds, and has been kept in storage. It just needs some air in the tires to get it moving again.

As of this writing, the high bid is just $565, but with 18 days left to go on the auction, we suspect that number will be considerably higher when the gavel drops. We’ll check back next month to see what it sold for, and on the off-chance that any of you actually buy it, please let us know.

If all this talk of mass surveillance and shady government dealings has you down, perhaps a quick game of web-based Descent will lighten the mood. It’s the product of a port to Three.js by [mrdoob], completed with the aid of Claude. We know many of you are critical of AI-produced code, and not without good reason, but the results in this case are pretty slick.

Finally, we’ll go out on a limb and guess that more than a few in the audience are fans of the film Short Circuit, which turns 40 years old this year. In celebration, an event is being planned for June in Astoria, Oregon, where parts of the movie were filmed. As if you needed any other reason to meet Steve Guttenberg, you’ll also get the chance to pose for pictures with Johnny 5 and sit in on Q&A discussions with the cast and crew. There’s even going to be licensed merch for sale, which we can only hope means you’ll be able to buy one of those miniature J5’s from Short Circuit 2. It’s not the sort of event Hackaday generally covers, but we’re certainly tempted.

youtube.com/embed/BO3KBwCXS-0?…

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line, we’d love to hear about it.

hackaday.com/2026/02/15/hackad…

Software Development on the Nintendo Famicom in Family BASIC

Back in the 1980s, your options for writing your own code and games were rather more limited than today. This also mostly depended on what home computer you could get your hands on, which was a market that — at least in Japan — Nintendo was very happy to slide into with their ‘Nintendo Family Computer’, or ‘Famicom’ for short. With the available peripherals, including a tape deck and keyboard, you could actually create a fairly decent home computer, as demonstrated by [Throaty Mumbo] in a recent video.

After a lengthy unboxing of the new-in-box components, we move on to the highlight of the show, the HVC-007 Family BASIC package, which includes a cartridge and the keyboard. The latter of these connects to the Famicom’s expansion port. Inside the package, you also find a big Family BASIC manual that includes sprites and code to copy. Of course, everything is in Japanese, so [Throaty] had to wrestle his way through the translations.

The cassette tape is used to save applications, with the BASIC package also including a tape with the Sample 3 application, which is used in the video to demonstrate loading software from tape on the Famicom. Although [Throaty] unfortunately didn’t sit down to type over the code for the sample listings in the manual, it does provide an interesting glimpse at the all-Nintendo family computer that the rest of the world never got to enjoy.

youtube.com/embed/oGMEF-zbh_k?…

hackaday.com/2026/02/15/softwa…

Dealing With Intermittent Water Utilities

In many places, municipal water from a utility is something that’s often taken for granted. A local government or water utility will employ a water tower or pumping facility to ensure that there’s always water available to every home and business connected to it, all day, every day, and at a relatively constant pressure. This isn’t true the world over, though, and in [Sameer]’s home of Rajasthan he has to deal with a particularly onerous problem with the local water supply. Although he is connected to a utility, there is only water available at certain times of day, and not on a reliable schedule or at a particularly high pressure. This causes all kinds of problems, but he was able to employ an ESP32 to solve some of the headaches.

Most of [Sameer]’s neighbors install small pumps on the water main to pull water into reservoirs when it’s available. This creates two major problems, the first of which is that with all these pumps running, they can sometimes pull a vacuum on the water main, which can draw in contaminants and cause cavitation in the pumps. The second is that, if these pumps are on a timer and run when there’s no water available, they can damage themselves. [Sameer]’s solution pairs a flow sensor with a pump that is controllable via an automation tool like Home Assistant. He also includes a hydraulic analysis of this particular situation, such as placing the sensor on the output side of the pump rather than the inlet, as well as making sure that there is a laminar flow of water in the pipe it is installed on to ensure that it is taking valid measurements.

With everything set up and running, the water pump can automatically detect if there is water available, pump it to the reservoir as long as it lasts, and then automatically turn off the pump to avoid any thermal damage from running dry. [Sameer] even includes a complete Home Assistant setup for those who would like to replicate his work. We also think that this has utility outside of household water supplies as well, perhaps those watering their gardens with stored rainwater or those using other unique, semi-automated water catchment systems.

hackaday.com/2026/02/15/dealin…

Can a Scan Tool Kill a Car?

It’s no real secret that modern-day cars are basically a collection of computers on wheels, which also means that we get all the joys of debugging complex computer systems and software with cars these days. Rather than a quick poke under the hood to rebuild a carburetor and adjust the engine timing by hand, you’ll be pulling out a scan tool to gain access to the computer and figure out why the darn thing won’t start after someone else used a scan tool on it, as happened to [DiagnoseDan].

The question was whether the third-party scan tool that was used by the owner had done something to the software settings that would prevent the engine of this 2012 Renault Megane RS from starting, such as erasing keys, or if it was something more subtle. With no stored fault codes and the engine having healthy fuel, spark, and cam sensor readings, the conclusion was that the ECU was not doing its fuel injector things for some reason.

Ultimately, the root cause was that the ECU had been modded, with a re-mapping performed in 2020, meaning that the scan tool that [Dan] was using couldn’t properly interact with the ECU. Reflashing the ECU with the original manufacturer’s firmware was thus the next step, which is pretty involved in itself.

Reinstalling the OS on the car proved to be the solution. Likely, the modded firmware had stored some fault codes, as the ECU normally doesn’t start the engine if there are active codes stored. The third-party scan tool was thus likely blameless, but the inability to just clear fault codes was the real issue.

youtube.com/embed/biS8vC-13uE?…

hackaday.com/2026/02/15/can-a-…