CuVoodoo

the sorcery of copper

User Tools

Site Tools


printer_cartridge

This is an old revision of the document!


My Lexmark E323 laser-jet printer was indicating that the toner level was low. I wanted to find out how it knows that, and if I could fool it to think there was still plenty of toner.

cartridge chips

Printers don't actually measure how much toner (or ink) there is left in the cartridge. This would be too complicated, expensive, and isn't actually needed. Instead you just need to store the information of how much toner there was to begin with, and update the value with each print, since you can calculate how much a print will cost. This information (the toner level) is often stored in a chip embedded in the cartridge.

Some printers allow you to still print even when the cartridge is theoretical empty. This is the ideal case if you want to refill the cartridge yourself (toner is not very expensive). Other printers will not allow you to do so, and in this case you need a new cartridge, a new chip, or a chip reseter. You can already find counterfeit chips for most printers (when required).

I could refill the cartridge for my printer without issues, but at some point or another you will still need to replace the cartridge since the other parts (like the OPC drum) also degrade with usage and will cause poor quality prints. At that point it's probably worth to buy a new printer since the main cost is the cartridge itself. Still, I wanted to find out how the chip works.

identifying cartridge chip

To identify the chip I proceeded the following way:

  1. the top marking “33 1004 620B1” didn't yeld any match
  2. the board has only two pads, one for ground and one for power and thus. thus it is probable they are using the 1-Wire protocol
  3. the package (TSOC-6) and pinout (pin 1: ground, pin 2: power+data) match the one of 1-Wire devices
  4. the communication between the printer and chip matches the 1-Wire protocol
  5. the family code (last byte of the ROM ID) “0xb3” (decoded from the trace) doesn't match common lists (mTC002 it a for a thermocouple. a different manufacturer might have used the same family code)
  6. the function commands present in the trace (0x0f, 0xaa, 0xa5) match a couple of devices
  7. the DS2432 matches the usage: 1-Wire (the protocol used) EEPROM (to store the toner level) with SHA-1 authentication (to prevent counterfeit cartridges). The Maxim datasheet is abridged and does not contains family code and function command codes (lame security by obscurity), but the Dallas datasheet does
  8. based on this datasheet I implemented a DS2432 decoder for sigrok, and the capture matches (no bytes missing or exceeded, and the command order make sense). Only the family code does not match: 0x33 for DS2432, 0xb3 for our chip
  9. even the used SHA-1 hash implementation used for authentication matches (I re-implemented and test it with key material I found later)

Thus this chip is a DS2432, either re-branded or cloned. Other printers (here a filament cartridge for the Stratasys UPrint SE 3D printer) also use this chip, but in a non-secure way.

printer_cartridge.1505379112.txt.gz · Last modified: 2024/01/07 17:49 (external edit)