Author Topic: Lexmark toner chip Ti046b1  (Read 122021 times)

0 Members and 3 Guests are viewing this topic.

Offline MPOWER

  • Newbie
  • Posts: 1
  • Country: gr
Re: Lexmark toner chip Ti046b1
« Reply #25 on: July 20, 2016, 01:46:51 pm »
Hi, I am new to your forum and found it googling for chip TI046B1.
I am also interested in re-writing my lexmark smart chip with a virgin file.
My MX410de uses this chip in the toner and in the imaging drum. The important thing is that I have an original 602HE 10.000 pages new and boxed cartridge.
So I was thinking that if you help me read its virgin file I could re-write it when the time comes. Of course I would also share the file.

Any suggestion would be highly appreciated

Thanks in advance
Michael
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #26 on: July 20, 2016, 06:48:10 pm »
Hello everybody. Recently I ordered a couple of chips to try to fill. They came, until set.
 

Offline cciollolo

  • Newbie
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #27 on: August 02, 2016, 09:28:44 am »
i tried to read this chip , and i founded for black cartridge chip that there is just one address that contains data ; all the others contains FF or 00 . I found this with bus pirate scanning step by step all address :  first [0xf1 xx , and i found that the only addresses that answer ACK are f1 00 and f1 01 . Second [0xf1 00 xx and [0xf1 01 xx .... at the end the address that answers all ack and return data different from 00 and FF is [0xf1 0 1 0 0.
i attach the content of this address . After i bought another chip ti046b1 and i tried to read the same address ; the content doesn't match . So i tried to write the content of the original chip to the new , but when i try to write the chip answers NACK .
the procedure to read is [0xf1 0 1 0 0 [ r r r r r r r r r r r
i try to write with [0xf0 0 1 0 0 [ data data

 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #28 on: October 11, 2017, 09:38:54 am »
Hello friends. I hasten to please, this chip succumbed to erasure and everything works as it should. :popcorn:
« Last Edit: October 11, 2017, 09:42:38 am by igrok_by »
 

Offline bigakis

  • Newbie
  • Posts: 2
  • Country: gr
Re: Lexmark toner chip Ti046b1
« Reply #29 on: October 16, 2017, 01:49:02 pm »
I captured the traffic between the printer and the catridge subsystem using a MiniLogic analyzer. Bus Pirate gives erroneous results.
My first notes:
  • The catridges have 10 bit addresses. First byte 0xF0 (W)/0xF1(R), second by 0x01-0x04
  • There is another FRAM attached to the bus having address 0x05
  • The printer communicates to the bus in cycles. When opening and closing the lid, it starts 5 cycles
  • On Each cycle it polls each catridge by sending 0xF0, 0x0x (x=1-5). If it receives an ACK on the second byte that means the catridge is installed, and sends more bytes. If not it tries one more time before moving to the next address.
  • An ACK on the first byte (0xF0) is always sent by the installed 5th FRAM
  • First 4 cycles looks like identification. 5th one is the actual communication
Attached are the SAELAE Logic Capture, the Decoded CSV output, a simple python script to beautify the results and the beutified results.
The data are from a cs310dn printer, no catridges attached, so the communication takes place only between the printer and the internal FRAM.
More to come soon

#update: The 5th FRAM report a S/N CAHxxxxxxxx and part number 38CB0001. It points to a company named sirtec in HK manufacturing toners for Lexmark. But there is no toner installed!
« Last Edit: October 16, 2017, 03:31:05 pm by bigakis »
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #30 on: October 17, 2017, 05:25:33 am »
I can say one thing. chip read and until I got to read and write 1024 bytes open for writing and 1024 closed. In a closed file, there is a number, a model, and many that are not understandable.
While well go into the discharge with a small amount of toner.
I have models 511 and 410. 511 even some with 0 pages went into rewriting.
Under No. 1, there is a toner. Under No. 5 there is a photo drum.
While there are works with the search of the recovery from 0 pages.
Open to HxD.
« Last Edit: October 17, 2017, 05:55:08 am by igrok_by »
 
The following users thanked this post: Sutan

Offline organizatie

  • Newbie
  • Posts: 4
  • Country: ro
Re: Lexmark toner chip Ti046b1
« Reply #31 on: October 23, 2017, 07:09:16 pm »
Hello ,
igrok_by in your picture R5L16B is a memory chip equivalent is FM25L16 (RAMTRON).i have dump for this (my printer is mx310dn).i'm trying to identify a programmer for ti046b1 but can not find any documentation for this chip.
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #32 on: October 24, 2017, 12:10:09 pm »
there is no documentation for the chip. I asked many who sell them. But it seems to me that this is not just a memory, but a controller programmed to impersonate itself for memory. Because my attempts to return the blocked chips are unsuccessful. I'm waiting for the listener with China to test my theory.

I can recover a chip that is not blocked.
« Last Edit: October 24, 2017, 12:13:09 pm by igrok_by »
 

Offline organizatie

  • Newbie
  • Posts: 4
  • Country: ro
Re: Lexmark toner chip Ti046b1
« Reply #33 on: October 24, 2017, 05:19:50 pm »
in romania some devices can be reset, but they must still contain information.of the scheme seems to be a memory but I think it was labeled with a special series.thanks
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #34 on: October 25, 2017, 05:29:42 am »
in romania some devices can be reset, but they must still contain information.of the scheme seems to be a memory but I think it was labeled with a special series.thanks
Opportunity.
But I had a chip on the verge of blocking. I thought that he allowed the lock and counted again. Global changes nebylo. Recorded contents before blocking. But it did not work. I know that one thing is that he is not confused, but a controller. He has 2 addresses for an answer.
The first one is 0.
The second one depends on where it stands. 1 - if this is the bottom with the drum unit and 5 - if there is toner.
 

Offline organizatie

  • Newbie
  • Posts: 4
  • Country: ro
Re: Lexmark toner chip Ti046b1
« Reply #35 on: October 27, 2017, 04:53:49 am »
Hello,
igrok, where you ordered the chip??for what printer is it??I found that ic's "2850" is a TI controller in the series MSP430FR57XX.
 
The following users thanked this post: AndreiKenig

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #36 on: October 30, 2017, 08:03:25 am »
Hello,
igrok, where you ordered the chip??for what printer is it??I found that ic's "2850" is a TI controller in the series MSP430FR57XX.
Hello. These chips were bought by our marketer.
The listener came from China. So far as I thought, it's not a memory controller. You need to get a lot of data to write your controller with reset counter. If you do not care to reset the lock of chips.
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #37 on: November 03, 2017, 02:01:15 pm »
Hello, friends.
 I did not write for a long time, I was busy trying to understand what kind of animal it was.  :phew: :horse:
I recently offered to share with you.
1 is not just a memory, but a controller or memory that can generate encryption.
2 Yes, yes. Encryption. The algorithm is similar to "AES". This leads to his long attempts at deciphering without knowing the algorithm. Can anyone work with AES, help me understand how this works.
I took off my hat near the development of this chip. This works well. :clap:
 

Offline stj

  • Super Contributor
  • ***
  • Posts: 2153
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #38 on: November 03, 2017, 11:36:30 pm »
wouldnt it be simpler to hack the printer formware to fake the check result?
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #39 on: November 04, 2017, 06:07:30 am »
wouldnt it be simpler to hack the printer formware to fake the check result?
as far as I know, I was told, I did not check that the printer is updating the encryption algorithm from the chip. Unfortunately, I do not have a printer firmware :-//.
 

Offline bigakis

  • Newbie
  • Posts: 2
  • Country: gr
Re: Lexmark toner chip Ti046b1
« Reply #40 on: November 06, 2017, 04:26:10 pm »
I'm also pretty sure this memory has embedded security. It is probably the case of this lawsuit https://www.eff.org/document/sixth-circuit-opinion
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #41 on: December 04, 2017, 09:53:37 am »
Hello. I see that the information does not appear.  :popcorn:. I want to boast that the "beast" has been trained. The chip fits perfectly into the reset  :-/O. All informatics can be given for a reward. :popcorn:
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #42 on: December 07, 2017, 05:26:33 am »
How?
After a long training =)
There is no documentation for the chip. I found how it works. And now there is a solution that allows me to restart the mx/ms 410/511 chips.
I think that the others work on the same algorithm.
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #43 on: December 07, 2017, 01:01:10 pm »
How?
After a long training =)
There is no documentation for the chip. I found how it works. And now there is a solution that allows me to restart the mx/ms 410/511 chips.
I think that the others work on the same algorithm.
Dear igrok_by, I'm very glad that you have succeeded, But, could you chance, forget how it's done, or break your computer, accidentally format the hard drive. Hope for understanding.
With respect! :)
   
Only after Lexmark agrees that the money spent on protection in vain.
And will cut 10 times the prices of consumables
« Last Edit: December 07, 2017, 01:10:47 pm by igrok_by »
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #44 on: December 08, 2017, 05:19:38 am »
this sounds like a paypal solution to me... I think I am saddled with this pox as well.
Chinese friends offer good chips at good prices. True, these chips are clones of the original :). I was surprised when I got five chips with the same number.
 

Offline organizatie

  • Newbie
  • Posts: 4
  • Country: ro
Re: Lexmark toner chip Ti046b1
« Reply #45 on: December 14, 2017, 11:39:17 am »
Hi igrok_by
what amount you are talking about igrok_by?? :clap:
regards
i'm waiting for the message in pm
 

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #46 on: December 15, 2017, 06:24:11 am »
Hello, organized.
I did not understand what you want to hear from me? :-//
I do not understand English well  :popcorn:
« Last Edit: December 15, 2017, 06:25:53 am by igrok_by »
 

Offline kees

  • Newbie
  • Posts: 1
  • Country: nl
Re: Lexmark toner chip Ti046b1
« Reply #47 on: January 01, 2018, 11:10:43 am »
Hello. After studying the Lexmark cs410 printer, one can find extended firmware logs:
Code: [Select]
http://<IPaddressOfPrinter>/seAdditionally one can finger the printer in a standard linux shell via
Code: [Select]
nc <IPaddressOfPrinter> 79and issue commands like setup, firewalld, info, history, dnstable, backend, alerts, t30log
Edit: Attached log might be of any value. Search for keywords like osikey, osi debug, bios debug. And find the inner working register values   :-+

« Last Edit: January 01, 2018, 03:40:36 pm by kees »
 

Offline Siryu

  • Newbie
  • Posts: 3
  • Country: es
Re: Lexmark toner chip Ti046b1
« Reply #48 on: January 09, 2018, 12:53:19 pm »

Good to all, I am new to this, I have a laser printer and the toner that uses also carries the Ti046B1 chip but I can not do anything with it, I have arduino and I have logic analyzer but I can not do anything or I can not interpret the data, I would appreciate some help to see if I could read and record the chip or if on the contrary the shots do not go around, thanks in advance, regards.  :palm:
 

Offline JacquesBBBTopic starter

  • Frequent Contributor
  • **
  • Posts: 829
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #49 on: January 09, 2018, 03:03:21 pm »
Hello All,

I am glad to see this thread active again. I have no time at present to resume my searches  to decipher this  chip,
but will be very attentive to any progress that could help to shunt this protection.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf