[rescue] Bypassing Password Protected NVRAM on SS4

[Loomis, Rip]

All the research/testing I've done indicates that there's
no way to bypass that password protection from the keyboard--
and that's by design.

There are three modes for the password protection
(A/K/A "security-mode" in the OBP):
  none
  command
  full

If you get a box that has its security-mode set to
"command", then all you have to do is substitute your
preferred boot device for whatever it's trying to use...
I've been able to set a CD-ROM to SCSI target 3 and
recover a box this way.  As long as you can boot off
a disk with a known root password, you can just do a
  # eeprom security-mode=none
and you're home free.

Not saying that the chip-pulling method won't work...
but there might be a simpler method.  OTOH, if the
security-mode is set to full, then it's time to pull
a chip...

  --Rip
  
 
> > Isn't there a way to do it from the keyboard as well?  Hold 
> down STOP-N
> > while the machine is booting...or something like that.
> 
>   If there is, I've never heard of it.  It certainly wouldn't be a
> very secure password system if that's the case. ;)