The newest of so far the only two Fully Assembled, Programmed and Tested, ready to use, UNLIMITED USE USB ThinkPad (TP) Password Recovery, Password Clear, CRC1 and CRC2 Repair Tools.

Joe's KeyMaker 8 USB arrives ready to use with Windows, MAC, Linux and Windows CE.NET

KM8USB No longer being sold, replaced by  KM9USB

Optional UNLIMITED CRC1 and CRC2 Repair Product key $25 US delivered by email

When combined with Joe's KeyMaker 8 LCD it doesn't require a second PC or Laptop

Pictured below is Joe's KeyMaker 8 USB in use recovering passwords from the locked ThinkPad on the Right.

Please take careful NOTE - 

The 3 thin red wires disappearing inside the locked TP on the right are connected INSIDE that TP to its EEPROM and NOT to a USB port. 

Only the KeyMaker 8 itself is connected to the USB Port on the TP on the left which is used to power the KeyMaker 8 board as well as to communicate through FREE Terminal software to enable you to interact with the firmware program running inside the KeyMaker 8 board.

This is NOT some new found magical way to unlock a TP without having to connect to an EEPROM inside the locked TP

Physically connecting to the EEPROM inside a locked TP cannot be avoided this is the ONLY way a Password Locked TP can be unlocked.

There is no other way to access the EEPROM inside the locked TP in order to unlock it.

Joe's KeyMaker 8 USB will perform Supervisor Password Recovery and/or Supervisor password clear functions on all the current and the older TP models listed below.

That includes resetting TPCA encrypted passwords on models fitted with TPM/TCPA  which has been enabled.

There is no limit to the number of times you can use the KeyMaker 8!

Recover passwords from as many TPs as you want! 

From all these TP models and more

370C, 380Z, 380XD, 560Z, 600, 760EL, 760LD, 770 series, 770E, 770ED, 240, 240X, 390E, 390X, 570,  600e, 600X, 770Z, A20m, A21e, A21m, A22e, A22m, A30, A30p, A31, A31p, G40, G41, R30, R31, R32,  R40, R400, R50, R500,  R50p, R51, R52, R61, R60, R61i, T20, T21, T22, T23, T30, T40, T40p, T400,  T43, T43p, T500, T41, T41p, T42, T42p, T60, T60p, T61, T61p, TransNote, W500, X20, X200, X21, X22, X23, X24, X30, X200, X300, X301, X31, X40, X41, X41T, X60, X60s, Z60, X61, X61s, X61t,  Z61

You really want to unlock your TP and use it again?

Well it doesn't get easier than this!

You can easily do it yourself! NO shipping ,NO wondering and NO worrying if you will ever see your TP again. 

NO Electronics crash course to complete, NO endless forums to read, NO guesswork.

Nothing to build and wonder if you got it right.

You don't have to become a Geek to get the job done.

KeyMaker 8 arrives fully assembled, tested and ready to use - You know it will work when you switch it on.

You can devote all your effort to the task of actually recovering that pesky password.

You have detailed illustrated instructions right here including details of which EEPROM type is in your model TP and how to gain access to it.

First, you Hook up 3 wires to your Password Protected TP [in some cases you can use clips or sharp probes to make the connections] and Switch your TP ON

For example:

A T60 being unlocked, using Joe's KeyMaker 7 together with Joe's KeyMaker 7 LCD. KeyMaker 8 USB works the same way.

Using two multi meter leads with sharp points hand held [in one hand] for the SDA and SCL connections.

A black clip is being used for the GND connection attached to the CPU heat sink. 

Leaving one hand free to operate the Joystick on the KeyMaker 7 LCD board or the Terminal software on another PC or Laptop, the LCD is an option, you can unlock a TP without it.

Looks easy - because - it is easy when you have the right tools.

You select your TP's  EEPROM type LSI, 24RF08, 24C01, 24C03 or 93C46  from the main menu. 

After a couple of keystrokes on the keyboard, the recovered Supervisor Password will be displayed.

Recovered Passwords ABCDEFG displayed ready to type in a the password prompt using a QWERTY English Keyboard

The Supervisor password (SVP)

The copy of the SVP (CSVP) which on some older models contains the Hard Disk Password (HDP) can also be recovered and displayed.

NOTE: on newer models, Hard Disk Password cannot be recovered from anywhere inside the TP, the Hard Disk itself internally looks after the HD Password.

RSC The type of Scan code decoded, in this case R series Scan Code. Will also decode Normal Scan Codes NSC

A quick lesson: IBM and Lenovo used three different key layouts for country specific keyboards:

QWERTY   for US English
QWERTZ   for DE German
AZERTY     for FR French

Since some keys are in different places, the password could be different for each keyboard if those keys were used.

Now that you KNOW what the Supervisor Password is.

Your TP is asking you to enter the Supervisor Password? 

Well now you have it!  

You simply type in your recovered SVP 
and press the ENTER key.

Your TP is now unlocked,  as a reward, you are greeted by this welcome sign of an UNLOCKED TP

Time to congratulate yourself on a job well done.

To permanently remove the Supervisor Password,  follow the instructions for turning off the password option in the setup.

I would recommend that you set a new Supervisor Password, one you can remember. If you don't set one someone else can and you may have to do this all over again, much easier to set your own password so no one else can set one and frustrate you.

To avoid confusion between different language keyboards, you can select which Keyboard language you wish to use to display your recovered passwords, see sample Screen Shots further down at the foot of this webpage. 

If the optional TPM/TCPA  Security (encryption) was enabled, then the SVP cannot be recovered - it isn't a word or phrase that can be displayed.  In that case you would see something like this instead of your recovered SVP,  *BADCS* as per the image below, you may also see *NVPC**

THIS is NOT a problem!

As you can see in the screen shot above, command 2 lets you Clear SVP.

This will clear ANY password including the encrypted TPM/TCPA  SVP or as some people call it Reset TCPA.

You press the 2 key, a message appears asking you if you are ready to Clear SVP, you type Y for Yes.

A few seconds later there is no longer an encrypted SVP and TCPA has been reset.

 After the Clear SVP operation is completed, if you press 1 for Fast SVP Recovery
 you will see the screen below, see - NO SVP, gone as if it never existed.

Switch OFF your TP, switch it back ON again and it will NOT ask you for a SVP, as if it never existed.

Another quick lesson;

In the display above *BLANK* means that there is no SVP set, the * on both sides of a MESSAGE is used to indicate that the word displayed is not a recovered password.

Same thing with the previous screen shot *BADCS*

The * character can never be typed in as a password character on any TP, so it is used on either side of a useful message when you go looking at the recovered SVP.

KeyMaker 8 USB never leaves you in any doubt about whether you are seeing a displayed password or a message telling you it is a non recoverable encrypted password *BADCS* [which stands for Bad Checksum] or that there is no SVP set *BLANK*

Final quick lesson;

When using KeyMaker 8 USB connection leads to the EEPROM inside a TP can be connected whilst the TP is switched OFF or ON, the leads can be left connected while the TP is being switched ON and OFF.

If you are new to TP unlocking you might be thinking - so what! well read on and you will see what a significant difference that can make.

RS-232 based simple interfaces when connected to the EEPROM inside a TP impose a substantial load on the EEPROM's signal lines and if left connected will interfere with the power on and power off functions of the TP. 

Which means that when using an old RS-232 interface the EEPROM leads  must be disconnected while the TP is powering up, connected to perform a function then disconnected again before switching the TP OFF. 

When using an old RS-232 interface the EEPROM leads can ONLY be connected after the TP has been switched ON and has completed its power up functions.

KeyMaker 8 USB's EEPROM connections do NOT have those restrictions because the KeyMaker 8 USB's EEPROM connection points are High Impedance, they do not load down the signals, therefore they can be left connected at all times without affecting TP power up or power down.

A lot of TP unlock operations require that you Power Cycle the TP, in other words Switch OFF, Switch ON the TP, having to disconnect leads from the EEPROM and  reconnect those EEPROM leads each time the TP is switched ON or OFF becomes tedious and can lead to mistakes.

Another plus for Joe's KeyMaker 8 USB.

Remember All operations can be performed an UNLIMITED number of times on an UNLIMITED number of TPs.

UNLIMITED CRC1 and CRC2 Repairs on applicable 24RF08 EEPROM based TP models Can be performed after that option is activated by purchasing a One Time Option Product Key should you need it. Most people will NEVER need this.

Screen shot of 24RF08 Menu with Optional CRC1 and CRC2 Repair Product key 

Screen shot of standard 24RF08 Menu

Joe's KeyMaker 8 USB is shipped Fully Assembled, Programmed and Tested ready to use;

 Included with Joe's KeyMaker 8

1. Seeduino Mega ATmega1280 board fully assembled, tested and programmed with Joe's KeyMaker 8 USB Firmware.

2. 6 way cable. with 6 sockets at each ends. ONLY used when unlocking an unsoldered  93C46 EEPROM

3. 4 way cable with 4 combined sockets at one end and 4 individual sockets at the other end.  
   ONLY 3 pins of this cable are used by most people.

4. Short length of thin diameter enamelled copper wire to be used for connecting to EEPROMs.
   Used IF you prefer to solder connections to the EEPROM.
   Clips [not supplied] can be used if you wish to do no soldering at all to the EEPROM.

5. 6 x female headers, not used for TP unlocking, they can be used to populate the board if you wish to make use of the board's Arduino functionality.

6. 6 pin male header used when unlocking an unsoldered 93C46 EEPROM which is only found on some real old TP models.

7. Documentation, right here on this web site KM8 User's Guide, which includes detailed illustrated instructions on how to connect it to ALL the applicable TP models.

You will need to source your own Mini USB cable NOT SUPPLIED, you most likely already have a few of those.

KM8USB No longer being sold, replaced by  KM9USB which has same functionality plus Zap  feature

Joe's KeyMaker 8 USB

Joe's KeyMaker 8 USB with supplied 4 way cable plugged in over the I2c connector, this cable will do 99% of all TP models.

You also receive this 6 wire cable and long pin, 6 pin header which is ONLY for use with the very old 93C46 EEPROM, found in really old TPs, you will likely never use this.

KeyMaker 8 USB Key Features

1. NO MORE excuses for not turning that Password Locked door-stop back into a working TP.

2. Designed and programmed entirely by Joe in Australia who has been unlocking TP's for the past 8 years and who has 30+ years experience in Microcontroller hardware and software design.

3. Joe's first innovation in TP unlocking (back in 2002) was to unlock TP's  without having to unsolder the EEPROM. Many have copied that and other innovations from Joe in Australia. Some even like to pretend  they thought of it first.
   
   Just remember:  you ALWAYS see it here first.  Joe's KeyMaker 8 USB is yet another first.

4. USB ports are everywhere, antiquated RS-232 ports are almost extinct.

5. Joe's KeyMaker 8 USB arrives in your hands FULLY assembled, programmed and tested, you KNOW  it is going to work and can concentrate on starting to unlock your TP.

6. No need to waste time and money sourcing parts that, depending on where you buy them, can easily cost a lot MORE than the assembled and tested Joe's KeyMaker 8 USB. Ready to go - it does not get easier than that.

7. You can start work immediately on unlocking your TP instead of being forced to do a short Electronics crash-course before you can even start.

8. You can keep it REALLY SIMPLE and just display the SVP if it can be recovered or clear it if it can't, all done by pressing a numeric key on your keyboard, no charts to consult at all, no guesswork.

9. It isn't fudged by using bit-banging, it is done properly with a fully compliant i2c hardware interface.

10. The entire Program runs inside the onboard ATmega1280 Microcontroller. To interact with you, it  only requires that you install the appropriate USB driver for your system and any one of the numerous freely available "Terminal Software programs" on your PC, MAC or Linux System.

11. Can handle all TP models, can handle all the EEPROM types ever used in TPs including LSI, 24RF08 family,  24C01, 24C03 and the really old 93C46, it does them ALL and it does them as fast as the EEPROMS are capable of operating.   NOTE: 93C46 EEPROMS can only be read or written to when unsoldered from the system board as the 93C46 EEPROM does not have a BUS that can be shared on the System Board.

12. All operations can be repeated an UNLIMITED NUMBER OF Times, on any number of different TPs.

13. Can either Recover Supervisor passwords (SVPs) or clear SVPs, an unlimited number of times, including recovering or clearing LSI encrypted passwords from any number of different TPs.

14. Will instantly display the recovered SVP ready to type in using either a QWERTY, QWERTZ or AZERTY keyboard, no guessing, no charts to consult, no files to email.

15. Diagnostics to test the integrity of the IO pins used to read and write the EEPROMS, you simply connect the provided cable to the pins as prompted by the firmware program and run the diagnostics in order to be 100% sure that any problems you may encounter are not caused by a hardware fault on the board's IO or damage to the board IO pins. Again, no guessing involved.

16. Meaningful detailed error messages with helpful suggestions listing all the things to check, not just a
    simple "not responding" or "not found" message.

17. Opportunity to back out of write operation by prompting do you wish to proceed, requiring a Y or N reply before the operation commences.

18. Every KeyMaker 8 USB already comes programmed with firmware to handle KeyMaker 8 LCD, which  means that a locked TP can power the KeyMaker 8 USB and KeyMaker 8 LCD combination while that locked TP it is being unlocked, no second  PC or Laptop required to get the job done.

19. You will be hard pressed to find anything that even comes close to Joe's KeyMaker 8 USB in one quality state of the art feature rich convenient USB powered TP unlocking tool that does it ALL.

Close-up view of Joe's KeyMaker 8 USB, how is it connected. 

Mini USB cable [not supplied] connects to the Mini USB connector [top left] to your PC, MAC or Linux system and the supplied 4 way cable connects the 4 pin I2C header [bottom right] to the EEPROM in your ThinkPad.

Only 3 connections GND, SCL and SDA are used 99% of the time. 

The supplied 6 way cable is for use with old TP models which have a 93C46 EEPROM.

Those are ALL the required connections.

You are NOT excluded if you have a MAC or prefer to run Linux 

The reason, is Joe's KeyMaker 8 USB is a powerful state of the art Microcontroller based board with an USB interface, ALL THE WORK is done ON the board by the Microcontroller and my firmware program,  you ONLY need a Personal Computer of some kind to interact with the program running on the board and display the results. 

All you need to install on your PC, MAC or Linux Personal Computer is;

1. USB drivers for the FTDI FT232RL USB chip, Detailed installation guides for FTDI USB drivers

2. Any one of the many FREE Terminal Software programs, GOOGLE for "Free Terminal Software".
   I prefer to use Tera Term for Windows, actual software download is here.

FTDI USB Drivers are compatible with the following operating systems; 

Windows Server 2008 R2

Windows 7

Windows 7 x64

Windows Server 2008

Windows Server 2008 x64

Windows Vista

Windows Vista x64

Windows Server 2003

Windows Server 2003 x64

Windows XP

Windows XP x64

Windows 2000

Windows ME

Windows 98

Linux

Mac OS X

Mac OS 9

Mac OS 8

Windows CE.NET (Version 4.2 and greater)

Screen shots

All the sample screen shots obtained by using Joe's KeyMaker 8 USB connected to a Windows  PC USB port running Tera Term which is a free Windows Terminal program, it allows one to customize the appearance on screen, I chose a Blue Background with White Text

Main Menu

Keyboard Selection Menu

 

Notice below, how the SAME Recovered SVP can be very different depending on the keyboard's country.

KeyMaker 8 USB does all the work for you, no guessing, no charts to consult, Recovered SVP  ready to type in on YOUR Keyboard.

Recovered SVP displayed after US English Keyboard selected 

The same recovered SVP displayed after DE German Keyboard selected 

The same recovered SVP displayed after FR French Keyboard selected 

Disclaimer

I make no warranty that any of my information is correct, or safe, or does or does not breach any warranty clause,  or anything else, it is up to you to decide if you will follow all or any of the instructions to recover the Supervisor Password from a TP. It is up to you to decide, I am not responsible for the results or for any consequential or incidental damages whatsoever.

  If you have any questions, email Joe at