Differences

This shows you the differences between two versions of the page.

--- printer_cartridge [2017/09/14 08:03] – add printer pictures kingkevin
+++ printer_cartridge [2017/09/14 08:50] – add identifying chip kingkevin
@@ Line 22: / Line 22: @@
 {{:printer_cartridge:mini_p1080148.jpg?300|}}
 {{:printer_cartridge:mini_dsc01839.jpg?300|}}
-{{:printer_cartridge:mini_p1080151.jpg?300|}}
 {{:printer_cartridge:mini_dsc01842.jpg?300|}}
 {{:printer_cartridge:mini_p1070752.jpg?300|}}
 {{:printer_cartridge:mini_dsc01849.jpg?300|}}
@@ Line 32: / Line 31: @@
 {{:printer_cartridge:mini_p1070757.jpg?300|}}
 {{:printer_cartridge:mini_p1070760.jpg?300|}}
+==== identifying cartridge chip ====
+{{  :printer_cartridge:mini_p1080151.jpg?300|}}
+To identify the chip I proceeded the following way:
+  - the top marking "33 1004 620B1" didn't yeld any match
+  - the board has only two pads, one for ground and one for power and thus. thus it is probable they are using the 1-Wire protocol
+  - the package (TSOC-6) and pinout (pin 1: ground, pin 2: power+data) match the one of 1-Wire devices
+  - the communication between the printer and chip matches the 1-Wire protocol
+  - the family code (last byte of the ROM ID) "0xb3" (decoded from the trace) doesn't match [[https://github.com/owfs/owfs-doc/wiki/1Wire-Device-List|common lists]] (mTC002 it a for a thermocouple. a different manufacturer might have used the same family code)
+  - the function commands present in the trace (0x0f, 0xaa, 0xa5) [[http://owfs.sourceforge.net/family.html|match]] a couple of devices
+  - the [[https://www.maximintegrated.com/en/products/digital/memory-products/DS2432.html|DS2432]] matches the usage: 1-Wire (the protocol used) EEPROM (to store the toner level) with SHA-1 authentication (to prevent counterfeit cartridges). The [[http://datasheets.maximintegrated.com/en/ds/DS2432.pdf|Maxim datasheet]] is abridged and does not contains family code and function command codes (lame security by obscurity), but the [[http://pdf.datasheetcatalog.com/datasheet/maxim/DS2432.pdf|Dallas datasheet]] does
+  - based on this datasheet I implemented a DS2432 decoder for sigrok, and the capture matches (no bytes missing or exceeded, and the command order make sense). Only the family code does not match: 0x33 for DS2432, 0xb3 for our chip
+  - even the used SHA-1 hash implementation used for authentication matches (I re-implemented and test it with key material I found later)
+Thus this chip is a DS2432, either re-branded or cloned.
+[[https://electronics.stackexchange.com/questions/171329/help-identifying-this-chip-eeprom|Other printers]] (here a filament cartridge for the Stratasys UPrint SE 3D printer) also use this chip, but in a [[https://www.3dprintforums.com/showthread.php/3153-How2-Refill-the-EEPROM-of-the-HP-DesignJet-3D-aka-uPrint|non-secure way]].