IBM LPFK reverse engineering
Michael B. Brutman
mbbrutman-cctalk at brutman.com
Tue Aug 19 20:48:24 CDT 2008
IBM LPFK 6094-020 victims ..
It's been a year, but I finally found what I was looking for. Which is
good because I was about to go mideval on an AIX 4.3 box to get the data
that I needed. ;-) Somebody deep inside the Blue Wall had the docs on a
Here is the quick summary:
Protocol: 9600,O,8,1 with no handshaking
Commands (shown in hex)
0x01: Reset: Similar to the power on reset. Leaves the LPFK in the
'disabled' state with all indicators off.
0x06: Read configuration: Upon getting this byte the LPFK responds with
0x03. Helpful for determining if the LPFK is active on a serial port.
0x08: Enable: Tells the LPFK that it may process and send keystroke data
to the host machine.
0x09: Disable: Keyboard input is disabled. The LPFK will still respond
to Reset and Read Configuration
0x94: Set Indicators: This command is followed by four more bytes which
is a bitmap that represents the indicator lights on the keys. If the bit
for a key is turned on, the light will be turned on. If the bit for a
key is 0, the light will be turned off. Keys are numbered from 0 to 31.
Responses from the LPFK:
0x00 to 0x1F: Keystroke: The corresponding key on the LPFK was hit.
These responses are only sent when the LPFK has been enabled using the
0x80: Retransmit: The LPFK sends this if there was an error on the last
Set Indicators command and it wants the host machine to retransmit it.
0x81: OK: The LPFK sends this if the last Set Indicators command was
All of this is also written up at
http://brutman.com/IBM_LPFK/IBM_LPFK.html for the good of the greater
public. Now I need to figure out how to run 9600 bps on a PCjr .. it
doesn't like anything over 2400. (4800 or 9600 might be ok, as it just
is one byte being received.)
More information about the cctech