printer_cartridge
Differences
This shows you the differences between two versions of the page.
Next revision | Previous revisionNext revisionBoth sides next revision | ||
printer_cartridge [2017/09/13 16:33] – created kingkevin | printer_cartridge [2017/09/14 08:51] – [identifying cartridge chip] add link kingkevin | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | {{ : | ||
+ | |||
My Lexmark E323 laser-jet printer was indicating that the toner level was low. | My Lexmark E323 laser-jet printer was indicating that the toner level was low. | ||
I wanted to find out how it knows that, and if I could fool it to think there was still plenty of toner. | I wanted to find out how it knows that, and if I could fool it to think there was still plenty of toner. | ||
Line 17: | Line 19: | ||
At that point it's probably worth to buy a new printer since the main cost is the cartridge itself. | At that point it's probably worth to buy a new printer since the main cost is the cartridge itself. | ||
Still, I wanted to find out how the chip works. | Still, I wanted to find out how the chip works. | ||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | ==== identifying cartridge chip ==== | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | To identify the chip I proceeded the following way: | ||
+ | - the top marking "33 1004 620B1" didn't yeld any match | ||
+ | - the board has only two pads, one for ground and one for power and thus. thus it is probable they are using the 1-Wire protocol | ||
+ | - the package (TSOC-6) and pinout (pin 1: ground, pin 2: power+data) match the one of 1-Wire devices | ||
+ | - the communication between the printer and chip matches the 1-Wire protocol | ||
+ | - the family code (last byte of the ROM ID) " | ||
+ | - the function commands present in the trace (0x0f, 0xaa, 0xa5) [[http:// | ||
+ | - the [[https:// | ||
+ | - based on this datasheet I implemented a DS2432 decoder for sigrok, and the capture matches (no bytes missing or exceeded, and the command order make sense). Only the family code does not match: 0x33 for DS2432, 0xb3 for our chip | ||
+ | - even the used SHA-1 hash implementation used for authentication matches (I re-implemented and test it with key material I found later) | ||
+ | |||
+ | Thus this chip is a DS2432, either re-branded or cloned. | ||
+ | [[https:// |
printer_cartridge.txt · Last modified: 2024/01/07 17:49 by 127.0.0.1