KM9AUSBPRO

Joe's KeyMaker 9A USB PRO ThinkPad Supervisor Password Recovery or Clear tool.
Can be used unlimited times on unlimited numbers of ThinkPads!

Joe in Australia offers the only Affordable Fully Assembled, Programmed and Tested unlimited use USB based ThinkPad Supervisor Password Recovery or Clear and CRC Repair Tools in the world.

Joe's KeyMaker 9A USB PRO can recover or clear Supervisor Passwords from all current ThinkPad models except SL300,SL400,SL500 and G550 even if TPM/TCPA security has been enabled.

Joe's KeyMaker 9A USB PRO is no longer sold, it has been replaced by the KMX1 PRO

Joe in Australia will NOT ship to Canada, France, Nigeria, Mexico, Turkey.

KM9AUSBPRO compared to KM9AUSB

KM9AUSB is intended for those who have a straight forward password recovery or clear in mind.

KM9AUSBPRO has additional features useful for complicated situations;

Display recovered passwords for English, German and French Keyboards all at the same time.

Reads and displays entire EEPROM contents of LSI, 24RF08, 24C03, 24C01 and 93C46 EEPROMS as Hex and ASCII, not just the recovered passwords.

Reads and displays entire EEPROM contents of LSI, 24RF08, 24C03, 24C01 and 93C46 EEPROMS as an Intel hex file format, which can be saved to a file on the PC and later used as to program an entire EPROM or edited and then used to program an entire EEPROM.

Can program entire LSI, 24RF08, 24C03, 24C01 and 93C46 EEPROMS from an Intel Hex file, for example one that was previously saved and or edited.

Repairs CRC1 and CR2 Errors.

KM9AUSBPRO Top of the KeyMaker 9A USB range - has all possible features to tackle difficult password recovery operations for example when the TP is reporting lots of errors or when you suspect that the TP you purchased at Auction was heavily corrupted by someone before you who had no clue and followed all the incorrect ThinkPad Password recovery ideas to be found on the net.

Allows one to safely try things after one has FIRST backed up the entire contents of the TP EEPROM, with the comforting knowledge that you can always program it back the way you first saved it.

Read and writes entire EEPROM contents to and from Intel HEX files which can be saved on your PC or Laptop, handles ALL EEPROMs found in TPs including LSI, 24RF08, 24C01, 24C03 and 93C46.

Displays recovered SVP for all keyboard languages at the same time.

This a must have tool for any Professional who unlocks a lot of different TPs

No More:

outdated RS-232 ports (which are fast disappearing from all PCs and laptops)

having to build the Interface

spending hours sourcing the components for the interface

spending more hours getting the interface to work

I decided to move away from all the antiquated, difficult stuff and provide a Fully Assembled, Tested and ready to use USB Tool which is powered by the locked ThinkPad and will remove the SUPERVISOR PASSWORD (SVP) from that ThinkPad at the push of a single button. This is indeed a major step forward and, as usual, brought to you FIRST by Joe in Australia.

Joe's KM9AUSBPRO can easily remove Supervisor Password (SVP) from a ThinkPad (TP) without:

requiring the use of a second PC

without you shipping your TP to a total stranger,

without worrying and wondering if you will ever see your TP again.

KM9AUSBPRO does not require you to do a crash course in electronics:

Joe's KM9AUSBPRO can be used to unlock a ThinkPad in two different ways;

Stand Alone Mode - Zaps the SVP unlocking your TP, no need for a second PC or Laptop.

Using another PC or Laptop to display your recovered SVP which you can then type in at the password prompt to unlock your TP.

See more detail below of the 2 different available methods

NOTE: if you already have a KM9AUSBPRO please follow the instructions in the KM9AUSB User's Guide

The instructions below are a simplified OVERVIEW.

Joe's KeyMaker 9A USB PRO being used in Stand Alone mode to Zap the SVP unlocking a TP without requiring the use of another PC or Laptop.

Stand Alone mode simply means that you do not need any other PC or Laptop - just the KM9AUSBPRO board with its ZAP SVP button and power from the USB port of the password locked TP.

You can Zap/unlock an unlimited number of TPs.

You really want to unlock your TP and use it again?

The example below explains how to use KM9AUSB to Zap a SVP using KM9AUSB in Stand Alone mode

Well it doesn't get easier than this!

You can easily do it yourself! NO shipping ,NO wondering and NO worrying if you will ever see your TP again.

NO Electronics crash course to complete, NO endless forums to read, NO guesswork.

Nothing to build and wonder if you got it right.

You don't have to become a Geek to get the job done.

KM9AUSBPRO arrives fully assembled, tested and ready to use - You know it will work when you switch it on.

You can devote all your effort to the task of actually Zapping/Clearing that pesky Supervisor Password even if encrypted TPM/TCPA has been enabled.

You have access to detailed illustrated instructions right here including details of how to identify which TP model you have, which EEPROM type is in your model TP and how to gain access to it.

First, you Hook up 3 wires to your Password Protected TP, you can use clips or sharp probes to make the connections, then Switch your TP ON

Your TP is asking you to enter the Supervisor Password?

Well now you have the tools to Clear the Supervisor Password!

Even if the optional TPM/TCPA Security (encryption) was enabled, not a problem.

You simply depress the Zap SVP button on your KM9AUSBPRO

The green EEPROM activity LED will light up on the board which lets you know that the EEPROM is being accessed, the LED will remain lit for about 15 seconds while the SVP is cleared.

The green LED will briefly turn OFF.

If the operation was successfully completed the LED will turn ON for 1/2 second, OFF for 1/2 second and back ON for 1/2 second, in other words 2 SLOW flashes of the green LED means all is OK. Your pesky SVP is GONE!

If the operation fails you will see a FAST burst of flashes from the green LED signifying the SVP was not cleared which usually means your 3 EEPROM connections are wrong or became disconnected during the operation. You can check the connections and try again.

Switch OFF your TP, switch it back ON again and it will NOT ask you for a SVP, as if it never existed.

Your TP is now unlocked

Time to congratulate yourself on a job well done.

Below are photos of an R52 being unlocked, using Joe's KeyMaker 9A USB PRO (KM9AUSBPRO) in Stand Alone mode.

The R52 has been opened and placed on its side to allow access to the ON/OFF push button and also to allow access to the underside of the R52.

The Memory cover underneath the R52 has been removed to allow access to the EEPROM connection points, only 1 screw to undo.

KM9AUSBPRO is powered by the USB port of the R52 which is being unlocked

Making the 2 probes used is described here

No other PC or anything else is required.

A black clip is being used for the GND connection attached to the metal clip which normally holds the Memory in place.

Leaving one hand free to operate the Zap SVP button.

Looks easy - because - it is easy when you have the right tools.

You can find the EEPROM location and connection points for the R52 in this case on the EEPROM Locations page, there you can find the R52 page which has the photo below of the R52 EEPROM connections.

The 2 probes held in place, GND clip visible at bottom of photo.

The Zap SVP button is pressed.

Your ThinkPad's Supervisor (SVP) is gone as if it never existed! Your ThinkPad is now unlocked

Now you have full access to your TP

Time to congratulate yourself on a job well done.

Please take careful NOTE -

3 wires are connected INSIDE the locked TP to its EEPROM, NOT to a USB port.

Only the KeyMaker 9A USB PRO itself is connected to the USB Port on the locked TP. In the Stand Alone mode the USB cable is only used to supply power to the KM9AUSBPRO board.

When used with a second PC or Laptop to display recovered SVP, the USB connection is also used to interact with the firmware (program) inside the ATMega328 Microcontroller on the KM9AUSBPRO board and also to display progress and results on your PC or laptop Screen.

This is NOT some new found magical way to unlock a TP without having to connect to an EEPROM inside the locked TP

Physically connecting to the EEPROM inside a locked TP cannot be avoided this is the ONLY way a Password Locked TP can be unlocked.

There is no other way to access the EEPROM inside the locked TP in order to unlock it.

Joe's KeyMaker 9A USB PRO being used with a second PC or Laptop to display the Recovered SVP.

Read more here about using KM9AUSBPRO with a second PC or Laptop

Below are photos of an R52 being unlocked using another R52 to run the Terminal software and power the KM9AUSB.

The password locked R52 has been opened and placed on its side to allow access to the ON/OFF push button and also to allow access to the underside of the R52.

The Memory cover underneath the R52 has been removed, the Memory has also been removed to allow access to the EEPROM connection points, only 1 screw to undo.

KM9AUSB is powered by the USB port of the second R52, the one running the Terminal Software to communicate with KM9AUSB.

Making the 2 probes used is described here

Nothing else is required.

A black clip is being used for the GND connection attached to the metal clip which normally holds the Memory in place.

Leaving one hand free to operate the Terminal Software, in some case you may need 2 persons.

Looks easy - because - it is easy when you have the right tools.

You can find the EEPROM location and connection points for the R52 in this case on the EEPROM Locations page, there you can find the R52 page which has the photo below of the R52 EEPROM connections.

The 2 probes held in place, GND clip not visible clipped to finger on left that holds memory in place.

Recovered Password ABCDEFG displayed ready to type in at the password prompt using a QWERTY English Keyboard

or QBCDEFG using an AZERTY keyboard etc.

Your type in the recovered SVP at the password prompt

Your TP is now unlocked, as a reward, you are greeted by this welcome sign of an UNLOCKED TP

Now you have full access to your TP

Time to congratulate yourself on a job well done.

Once you have unlocked your TP, I would recommend that you set a new Supervisor Password, one you can remember. If you don't set one someone else can and you may have to do this all over again, much easier to set your own password so no one else can set one and frustrate you.

A quick lesson;

When using KM9AUSBPRO connection leads to the EEPROM inside a TP can be connected whilst the TP is switched OFF or ON, the leads can be left connected while the TP is being switched ON and OFF.

If you are new to TP unlocking you might be thinking - so what! well read on and you will see what a significant difference that can make.

RS-232 based simple interfaces when connected to the EEPROM inside a TP impose a substantial load on the EEPROM's signal lines and if left connected will interfere with the power on and power off functions of the TP.

Which means that when using an old RS-232 interface the EEPROM leads must be disconnected while the TP is powering up, connected to perform a function then disconnected again before switching the TP OFF.

When using an old RS-232 interface the EEPROM leads can ONLY be connected after the TP has been switched ON and has completed its power up functions.

KM9AUSBPRO

A lot of TP unlock operations require that you Power Cycle the TP, in other words Switch OFF, Switch ON the TP, having to disconnect leads from the EEPROM and reconnect those EEPROM leads each time the TP is switched ON or OFF becomes tedious and can lead to mistakes.

Another plus for Joe's KeyMaker 9A USB PRO.

KM9AUSBPRO, in "Stand Alone Mode" - will easily Zap/Remove SVP an unlimited number of times, from all the TP Models listed below, that is all models that have either a 24RF08 or LSI EEPROM, at the push of a button even if encrypted TPM/TCPA is enabled without needing a second PC or Laptop.

ThinkPads that will work with the KM9AUSBPRO in "Stand Alone Mode"

24RF08 and LSI EEPROM TP MODELS

240, 240X, 390E, 390X, 570, 600e, 600X, 770Z, A20m, A21e, A21m, A22e, A22m, A30, A30p, A31, A31p, G40, G41, R30, R31, R32, R40, R50, R50p, R51, R52, R61, R60, R61, R61i, R400, R500, SL410, SL510, T20, T21, T22, T23, T30, T40, T40p, T41, T41p, T42, T42p, T43, T43p, T400, T500, T60, T60p, T61, T61p, TransNote, W500, X20, X21, X22, X23, X24, X30, X31, X40, X41, X41T, X60, X60s, X61, X61s, X61t, X200, X300, X301, Z60, Z61

That is: EVERY ThinkPad made by IBM that has the 24RF08, LSI, or similar security chip installed. 93C46 based ThinkPad owners (560) will have to read a little more:

KM9AUSBPRO, when connected to a second PC or Laptop will easily Display SVP from LSI and 24RF08 models listed above if not TPM/TCPA encrypted, it displays SVP from 24C01, 24C03, 9A3C46 models listed below, it Clears SVP passwords on LSI and 24RF08 models listed above even if encrypted TPM/TCPA is enabled.

24C01, 24C03 and 93C46 EEPROM TP Models

370C, 380Z, 380XD, 390, 560Z, 600, 760EL, 760LD, 770 series, 770E, 770ED

What makes the KM9AUSBPRO different from KM9AUSB

What about Errors like 0188, 0189, CRC1, and CRC2, Reading and saving the entire EEPROM contents to a file on your PC, editing that file and Writing the edited file or the Original back to the EEPROM in the TP.

Joe's KeyMaker 9A USB PRO does all that and more

Full Read/Write/SAVE/Edit access to the contents of the Security Chip and CRC Repair level

Joe's KeyMaker 9A USB PRO is for the professional repair company. it allows full access to the security chip so they can manipulate the data as they deem necessary. With this version, you can really get to the heart of the security chip but you can also really screw things up, so this is really for the service professional who has a deep understanding of the functions of the security chip.

The CRC repair is a basic routine that corrects the CRC error caused by illegal data ending up in the wrong place - improper power off or other hardware caused issues (A2x owners know about this).

EEPROM contents displayed in Intel HEX Format which can be saved as a file

Remember All operations can be performed an UNLIMITED number of times on an UNLIMITED number of TPs.

Joe's KeyMaker 9A USB PRO is shipped Fully Assembled, Programmed and Tested ready to use;

Joe's KeyMaker 9A USB PRO (KM9AUSBPRO) $152 AUD + $16 AUD Worldwide Postage and Handling

How do I buy it? - you got the Buy Products page .

Included with Joe's KeyMaker 9A USB PRO

KM9AUSB board fully assembled, tested and programmed with Joe's KeyMaker 9A USB PRO Firmware.
4 way cable with 4 combined sockets at one end and 4 individual sockets at the other end.
ONLY 3 pins of this cable are used by most people.
4 way dual male header, used for attaching custom made cables.
Documentation, right here on this web site KM9A User's Guide, which includes detailed illustrated instructions on how to connect it to ALL the applicable TP models.

NOTE: Clips [not supplied] can be used if you wish to do no soldering at all to the EEPROM. See section on clips options.

You will need to source your own Mini USB cable NOT SUPPLIED, you most likely already have a few of those.

Joe's KeyMaker 9A USB with supplied 4 way cable depicted above plugged in over the I2c connector, this cable will do 99% of all TP models.

KeyMaker 9A USB PRO Key Features

NO MORE excuses for not turning that Password Locked door-stop back into a working TP.

Designed and programmed entirely by Joe in Australia who has been unlocking TP's for the past 8 years and who has 30+ years experience in Microcontroller hardware and software design.

Joe's first innovation in TP unlocking (back in 2002) was to unlock TP's without having to unsolder the EEPROM. Many have copied that and other innovations from Joe in Australia. Some even like to pretend they thought of it first.

Just remember: you ALWAYS see it here first. Joe's KeyMaker 9A USB PRO with its unique ZAP SVP feature is yet another first.

USB ports are everywhere, antiquated RS-232 ports are almost extinct.

Joe's KeyMaker 9A USB PRO arrives in your hands FULLY assembled, programmed and tested, you KNOW it is going to work and can concentrate on starting to unlock your TP.

No need to waste time and money sourcing parts that, depending on where you buy them, can easily cost a lot MORE than the assembled and tested Joe's KeyMaker 9A USB PRO. Ready to go - it does not get easier than that.

You can start work immediately on unlocking your TP instead of being forced to do a short Electronics crash-course before you can even start.

You can keep it REALLY SIMPLE and just zap that pesky Supervisor Password by pressing the ZAP SVP button on the board, no charts to consult at all, no guesswork.

It isn't fudged by using bit-banging, it is done properly with a fully compliant i2c hardware interface.

The entire Program runs inside the onboard ATmega328 Microcontroller. To interact with you, it only requires that you install the appropriate USB driver for your system and any one of the numerous freely available "Terminal Software programs" on your PC, MAC or Linux System.

Can handle all LSI and 24RF08 EEPROM based TP models.

All operations can be repeated an UNLIMITED NUMBER OF Times, on any number of different TPs.

Can either ZAP Supervisor passwords (SVPs) an unlimited number of times or Recover and Display SVP, including clearing LSI encrypted passwords from any number of different TPs.

You will be hard pressed to find anything that even comes close to Joe's KeyMaker 9A USB PRO in one quality state of the art feature rich convenient USB powered TP unlocking tool that does it ALL.

Close-up view of Joe's KeyMaker 9A USB PRO, how is it connected.

Mini USB cable [not supplied] connects to the Mini USB connector [top left] to your PC, MAC or Linux system and the supplied 4 way cable connects the 4 pin I2C header [bottom right] to the EEPROM in your ThinkPad.

Only 3 connections GND, SCL and SDA are used 99% of the time.

Those are ALL the required connections.

You are NOT excluded if you have a MAC or prefer to run Linux

The reason, is Joe's KeyMaker 9A USB PRO is a powerful state of the art Microcontroller based board with an USB interface, ALL THE WORK is done ON the board by the Microcontroller and my firmware program, you ONLY need a Personal Computer of some kind to interact with the program running on the board and display the results whilst performing Initial Activation or if you wish to perform more advanced operation which require a 2nd PC.

All you need to install on your PC, MAC or Linux Personal Computer is;

USB drivers for the FTDI FT232RL USB chip, Detailed installation guides for FTDI USB drivers

Any one of the many FREE Terminal Software programs, GOOGLE for "Free Terminal Software".
I prefer to use Tera Term for Windows, actual software download is here.

FTDI USB Drivers are compatible with the following operating systems;

Windows Server 2008 R2

Windows 7

Windows 7 x64

Windows Server 2008

Windows Server 2008 x64

Windows Vista

Windows Vista x64

Windows Server 2003

Windows Server 2003 x64

Windows XP

Windows XP x64

Windows 2000

Windows ME

Windows 98

Linux

Mac OS X

Mac OS 9

Mac OS 8

Windows CE.NET (Version 4.2 and greater)

Disclaimer

I make no warranty that any of my information is correct, or safe, or does or does not breach any warranty clause, or anything else, it is up to you to decide if you will follow all or any of the instructions to recover the Supervisor Password from a TP. It is up to you to decide, I am not responsible for the results or for any consequential or incidental damages whatsoever.

If you have any questions, email Joe at