A friend of mine have found a fun way to bypass the bios password of thinkpads. With some trial and errors, you short some pins on bios eeprom at the right time so it will read all 0xff’s. It just happen to be that all 0xff’s means the bios password is not set.