IBM LPFK reverse engineering

Michael B. Brutman mbbrutman-cctalk at
Tue Aug 19 20:48:24 CDT 2008

IBM LPFK 6094-020 victims ..

It's been a year, but I finally found what I was looking for.  Which is 
good because I was about to go mideval on an AIX 4.3 box to get the data 
that I needed. ;-)  Somebody deep inside the Blue Wall had the docs on a 

Here is the quick summary:

Protocol: 9600,O,8,1 with no handshaking

Commands (shown in hex)

0x01: Reset: Similar to the power on reset. Leaves the LPFK in the 
'disabled' state with all indicators off.

0x06: Read configuration: Upon getting this byte the LPFK responds with 
0x03. Helpful for determining if the LPFK is active on a serial port.

0x08: Enable: Tells the LPFK that it may process and send keystroke data 
to the host machine.

0x09: Disable: Keyboard input is disabled. The LPFK will still respond 
to Reset and Read Configuration

0x94: Set Indicators: This command is followed by four more bytes which 
is a bitmap that represents the indicator lights on the keys. If the bit 
for a key is turned on, the light will be turned on. If the bit for a 
key is 0, the light will be turned off. Keys are numbered from 0 to 31.

Responses from the LPFK:

0x00 to 0x1F: Keystroke: The corresponding key on the LPFK was hit. 
These responses are only sent when the LPFK has been enabled using the 
Enable command.

0x80: Retransmit: The LPFK sends this if there was an error on the last 
Set Indicators command and it wants the host machine to retransmit it.

0x81: OK: The LPFK sends this if the last Set Indicators command was 
received successfully.

All of this is also written up at for the good of the greater 
public.  Now I need to figure out how to run 9600 bps on a PCjr ..  it 
doesn't like anything over 2400.  (4800 or 9600 might be ok, as it just 
is one byte being received.)


More information about the cctech mailing list