Turn Disk Utility's Debug menu on, mount the recovery partition, run firmware password tool from the recovery image. Useful when display is fried, sorting via VNC.