newest of so far the only
two Fully Assembled,
Programmed and Tested,
ready to use, UNLIMITED USE
USB ThinkPad (TP) Password Recovery, Password Clear, CRC1 and CRC2 Repair
8 USB arrives
ready to use with Windows, MAC, Linux and Windows
longer being sold, replaced by KM9USB
UNLIMITED CRC1 and CRC2 Repair Product key $25
combined with Joe's KeyMaker 8 LCD it doesn't
require a second PC or
Pictured below is Joe's KeyMaker
8 USB in
use recovering passwords from the locked ThinkPad on the Right.
Please take careful NOTE -
The 3 thin red wires disappearing
inside the locked TP on the right are connected INSIDE that
TP to its EEPROM and
NOT to a USB port.
Only the KeyMaker 8 itself is connected to the USB
Port on the TP on the left which is used to power the KeyMaker 8 board as well as to communicate through FREE Terminal software to
enable you to interact with the firmware program running inside the KeyMaker
This is NOT some new found
magical way to unlock a TP without having to connect to an EEPROM inside the locked TP
Physically connecting to the EEPROM inside a locked TP
cannot be avoided this is the
ONLY way a Password Locked TP can be unlocked.
There is no other way to access
the EEPROM inside the locked TP in order to unlock it.
Joe's KeyMaker 8 USB will perform
Supervisor Password Recovery and/or Supervisor password clear functions on all the
current and the older TP models listed below.
That includes resetting TPCA encrypted passwords
on models fitted with TPM/TCPA which has been enabled.
There is no limit to the number of times you
can use the KeyMaker 8!
Recover passwords from as many TPs as you want!
all these TP models and more
370C, 380Z, 380XD, 560Z, 600, 760EL, 760LD,
770 series, 770E, 770ED, 240, 240X, 390E, 390X, 570,
A20m, A21e, A21m, A22e, A22m, A30, A30p, A31, A31p, G40, G41, R30, R31, R32,
R40, R400, R50, R500, R50p,
R51, R52, R61,
R60, R61i, T20, T21, T22, T23, T30, T40, T40p, T400,
T43, T43p, T500, T41, T41p, T42, T42p, T60, T60p, T61, T61p, TransNote, W500, X20,
X22, X23, X24, X30, X200, X300, X301, X31, X40, X41, X41T, X60, X60s,
Z60, X61, X61s, X61t, Z61
You really want
to unlock your TP and use it again?
Well it doesn't get easier than this!
You can easily do it yourself! NO shipping ,NO wondering and
NO worrying if you will ever see your TP again.
NO Electronics crash course to complete, NO endless forums to
read, NO guesswork.
Nothing to build and wonder if you got it right.
You don't have to become a Geek to get the job done.
KeyMaker 8 arrives fully assembled, tested and ready to use
- You know it will work when you switch it on.
You can devote all your effort to the task of actually
recovering that pesky password.
You have detailed illustrated instructions
right here including details of which EEPROM type is in your model TP and
how to gain access to it.
First, you Hook up 3 wires to your Password Protected TP
[in some cases you can use clips or sharp probes to make the connections] and Switch your
A T60 being unlocked,
using Joe's KeyMaker 7 together with Joe's KeyMaker 7 LCD. KeyMaker 8 USB works
the same way.
Using two multi meter
leads with sharp points hand held [in one hand] for the SDA and SCL connections.
A black clip is being
used for the GND connection attached to the CPU heat sink.
Leaving one hand free
to operate the Joystick on the KeyMaker 7 LCD board or the Terminal software on
another PC or Laptop, the LCD is an option, you can unlock a TP without it.
Looks easy - because - it
is easy when you have the right tools.
You select your TP's EEPROM type
LSI, 24RF08, 24C01, 24C03 or 93C46 from the main menu.
After a couple of keystrokes on the keyboard,
the recovered Supervisor Password will be displayed.
Recovered Passwords ABCDEFG displayed
ready to type in a the password prompt using a QWERTY English Keyboard
The Supervisor password (SVP)
The copy of the SVP (CSVP) which on some older models contains the
Hard Disk Password (HDP) can also
be recovered and displayed.
NOTE: on newer models, Hard
Disk Password cannot be recovered from anywhere inside the TP, the Hard Disk
itself internally looks after the HD Password.
RSC The type of Scan code decoded, in this case R
series Scan Code. Will also decode Normal Scan Codes NSC
A quick lesson: IBM and Lenovo used three different key layouts for
country specific keyboards:
QWERTY for US English
QWERTZ for DE German
AZERTY for FR French
Since some keys are in different places, the password could be
different for each keyboard if those keys were used.
Now that you KNOW what the Supervisor Password is.
Your TP is asking you to enter the Supervisor Password?
now you have it!
You simply type in your recovered
press the ENTER key.
Your TP is now
unlocked, as a reward, you are greeted by this
welcome sign of an UNLOCKED TP
Time to congratulate yourself on a
job well done.
To permanently remove the Supervisor Password, follow
the instructions for turning off
the password option in the setup.
I would recommend that you set a new
Supervisor Password, one you can remember. If you don't set one someone else
can and you may have to do this all over again, much easier to set your own
password so no one else can set one and frustrate you.
To avoid confusion between different language keyboards, you
can select which Keyboard language you
wish to use to display your recovered passwords, see sample Screen Shots further
down at the foot of this webpage.
If the optional TPM/TCPA Security
(encryption) was enabled, then the SVP cannot be recovered - it isn't a word or
phrase that can be displayed. In that case you would see something like
this instead of your recovered SVP, *BADCS* as per the image below, you
may also see *NVPC**
is NOT a problem!
As you can see in the screen shot
above, command 2 lets you
This will clear ANY password
including the encrypted TPM/TCPA SVP
or as some people call it Reset TCPA.
You press the 2 key, a message appears
asking you if you are ready to Clear SVP, you type Y for Yes.
A few seconds later there is no longer
SVP and TCPA has been reset.
After the Clear SVP
operation is completed, if you press 1 for Fast SVP Recovery
you will see the screen below, see - NO SVP, gone as if it
Switch OFF your TP,
switch it back ON again and it will NOT ask you for a SVP, as
if it never existed.
Another quick lesson;
In the display above *BLANK*
means that there is no SVP set, the * on both sides of a MESSAGE is used to
indicate that the word displayed is not a recovered password.
Same thing with the previous
screen shot *BADCS*
The * character can never be
typed in as a password character on any TP, so it is used on either
side of a useful message when you go looking at the recovered SVP.
KeyMaker 8 USB never leaves
you in any doubt about whether you are seeing a displayed password or
a message telling you it is a non recoverable encrypted password *BADCS*
[which stands for Bad Checksum] or that there is no SVP set *BLANK*
Final quick lesson;
When using KeyMaker 8 USB connection
leads to the EEPROM inside a TP can be connected whilst the TP is
switched OFF or ON, the leads can be left connected while the TP is being switched ON and OFF.
If you are new to TP
unlocking you might be thinking - so what! well read on and you
will see what a significant difference that can make.
RS-232 based simple interfaces
when connected to the EEPROM inside a TP impose a substantial load on the
EEPROM's signal lines and if left connected will interfere with the
power on and power off functions of the TP.
Which means that when using
an old RS-232 interface the EEPROM leads must be
disconnected while the TP is powering up, connected to perform a
function then disconnected again before
switching the TP OFF.
When using an old RS-232
interface the EEPROM leads can ONLY be connected after the TP has been
switched ON and has completed its power up functions.
KeyMaker 8 USB's EEPROM
connections do NOT have those restrictions because the KeyMaker 8 USB's EEPROM connection
points are High Impedance, they do not load down the signals, therefore
they can be left connected at all times without affecting TP power up
or power down.
A lot of TP unlock operations
require that you Power Cycle the TP, in other words Switch OFF,
Switch ON the TP, having to disconnect leads from the EEPROM
and reconnect those EEPROM leads each time the TP is switched ON
or OFF becomes tedious and can lead to
Another plus for Joe's KeyMaker
Remember All operations can be performed an
number of times on an
number of TPs.
and CRC2 Repairs on applicable 24RF08 EEPROM based TP models Can be
performed after that
option is activated by purchasing a One Time Option Product Key should you need
it. Most people will NEVER need this.
Screen shot of 24RF08 Menu with Optional
CRC1 and CRC2 Repair Product key
Screen shot of standard 24RF08 Menu
Joe's KeyMaker 8 USB is shipped
Fully Assembled, Programmed and Tested ready to use;
Included with Joe's KeyMaker
Seeduino Mega ATmega1280 board fully assembled, tested and
programmed with Joe's KeyMaker 8 USB Firmware.
6 way cable. with 6 sockets at each ends.
ONLY used when unlocking an unsoldered 93C46 EEPROM
4 way cable with 4 combined sockets at one end and 4
individual sockets at the other end.
ONLY 3 pins of this cable are used by most people.
Short length of thin diameter enamelled copper wire to be used
for connecting to EEPROMs.
Used IF you prefer to solder connections to the EEPROM.
Clips [not supplied] can be used if you wish to do no soldering at all to
6 x female headers, not used for
TP unlocking, they can be used to populate the board if you wish to make use
of the board's Arduino functionality.
6 pin male header used when
unlocking an unsoldered 93C46 EEPROM which is only found on some real old TP
Documentation, right here on this web
User's Guide, which includes detailed illustrated instructions on
how to connect it to ALL the applicable TP
You will need to source your own Mini USB cable
you most likely already have a few of those.
longer being sold, replaced by KM9USB
which has same functionality plus Zap feature
Joe's KeyMaker 8
USB with supplied 4 way cable plugged in over the I2c connector, this cable will do
99% of all TP models.
You also receive
this 6 wire cable and long pin, 6 pin header which is ONLY for use with
the very old 93C46 EEPROM, found in really old TPs, you will likely never
KeyMaker 8 USB Key Features
NO MORE excuses for not turning that Password
Locked door-stop back into a working TP.
Designed and programmed entirely by Joe in
Australia who has been unlocking TP's for the past 8 years and who has 30+ years experience in Microcontroller hardware and
Joe's first innovation in TP unlocking (back in
2002) was to unlock TP's without having to unsolder the EEPROM.
Many have copied that and other innovations from Joe in Australia. Some even
like to pretend
they thought of it first.
Just remember: you ALWAYS see it here first. Joe's KeyMaker 8 USB is
yet another first.
USB ports are everywhere, antiquated RS-232
ports are almost extinct.
Joe's KeyMaker 8 USB arrives in your hands
FULLY assembled, programmed and tested, you KNOW
it is going to work and can concentrate on starting to unlock your TP.
No need to waste time and money sourcing parts
that, depending on where you buy them, can easily
cost a lot MORE than the assembled and tested Joe's KeyMaker 8 USB.
Ready to go - it does not get easier than that.
You can start work immediately on unlocking
your TP instead of being forced to do a short Electronics
crash-course before you can even start.
You can keep it REALLY SIMPLE and just display
the SVP if it can be recovered or clear it if it can't, all done by pressing a numeric key on your keyboard, no charts to consult at
all, no guesswork.
It isn't fudged by using bit-banging, it is
done properly with a fully compliant i2c hardware interface.
The entire Program runs inside the onboard
ATmega1280 Microcontroller. To interact with you, it
only requires that you install the appropriate USB driver for your system
and any one of the numerous freely available "Terminal Software programs" on your PC,
MAC or Linux System.
Can handle all TP models, can handle all the
EEPROM types ever used in TPs including LSI, 24RF08 family,
24C01, 24C03 and the really old 93C46, it does them ALL and it does them as
fast as the EEPROMS are capable of operating. NOTE:
93C46 EEPROMS can only be read or written to when unsoldered from the system board as the 93C46 EEPROM does not have a BUS that can be shared
on the System Board.
All operations can be repeated an UNLIMITED
NUMBER OF Times, on any number of different TPs.
Can either Recover Supervisor passwords (SVPs)
or clear SVPs, an unlimited number of times, including recovering or clearing LSI encrypted passwords from any number of
Will instantly display the recovered SVP ready
to type in using either a QWERTY, QWERTZ or AZERTY keyboard, no guessing, no charts to consult, no files to email.
Diagnostics to test the integrity of the IO
pins used to read and write the EEPROMS, you simply connect the provided cable to the pins as prompted by the firmware program and
run the diagnostics
in order to be 100% sure that any problems you may encounter are not caused by a
hardware fault on the board's IO or damage to the board IO pins. Again, no guessing involved.
error messages with helpful suggestions listing all the things to check, not
simple "not responding" or "not found" message.
Opportunity to back out
of write operation by prompting do you wish to proceed, requiring a Y or N reply before the operation commences.
Every KeyMaker 8 USB already comes programmed with firmware to handle KeyMaker
8 LCD, which
means that a locked TP can power the KeyMaker 8 USB and KeyMaker 8 LCD
combination while that locked TP it is being unlocked, no second PC or Laptop required to get the
You will be hard
pressed to find anything that even comes close to Joe's KeyMaker 8 USB in
one quality state of the art feature rich convenient USB powered TP unlocking tool
that does it ALL.
Close-up view of Joe's KeyMaker 8 USB,
how is it connected.
Mini USB cable [not supplied] connects to the Mini USB
connector [top left] to your PC, MAC or Linux system and the supplied 4 way
cable connects the 4 pin I2C header [bottom right] to
the EEPROM in your ThinkPad.
Only 3 connections GND, SCL and SDA
are used 99% of the time.
The supplied 6 way cable is for use with old TP models which
have a 93C46 EEPROM.
Those are ALL the required connections.
You are NOT excluded if you have a MAC or prefer to run Linux
The reason, is Joe's KeyMaker 8 USB is a powerful state of
the art Microcontroller based board with an USB interface, ALL THE WORK is done ON the board by the Microcontroller and my
you ONLY need a Personal Computer of some kind to interact with the program
running on the board and display the results.
All you need to install on your PC, MAC or Linux Personal
for the FTDI FT232RL
guides for FTDI USB drivers
Any one of the many FREE Terminal Software programs,
for "Free Terminal Software".
I prefer to use Tera
Term for Windows, actual software download
FTDI USB Drivers are compatible with the following operating systems;
Server 2008 R2
Server 2008 x64
Server 2003 x64
CE.NET (Version 4.2 and greater)
All the sample screen shots obtained by using Joe's KeyMaker
connected to a Windows PC USB port running Tera
Term which is a free Windows Terminal
program, it allows one to customize the appearance on screen, I
chose a Blue Background with White Text
Keyboard Selection Menu
Notice below, how the SAME Recovered SVP can be very
on the keyboard's country.
KeyMaker 8 USB does all the work for you, no guessing, no
charts to consult, Recovered SVP
ready to type in on YOUR Keyboard.
Recovered SVP displayed after US English Keyboard
The same recovered SVP displayed after DE German
The same recovered SVP displayed after FR French
I make no warranty that any of my
information is correct, or safe, or does or does not breach any
warranty clause, or anything else, it is up to you to decide if
you will follow all or any of the instructions to recover the
Supervisor Password from a TP. It is up to you to decide, I am not
responsible for the results or for any consequential or incidental
If you have any questions, email Joe at