Author Topic: Lexmark toner chip Ti046b1  (Read 30432 times)

driver_x and 1 Guest are viewing this topic.

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Lexmark toner chip Ti046b1
« on: April 24, 2016, 03:11:48 pm »
I have a Lexmark CS310dn color Laser printer which has 4 cartridges which I bought about 150$.
Each of them has a chip  Ti046b1 which probably counts the number of copies ( I guess but may be wrong)
When the count is over in one cartridge, the printer stops.
A replacement black cartridge is 100$.

What is the real mechanism for this chip protection ?

Where can I find the datasheet or the pinout of the  Ti046b1 ?  I was not able to find it on the web. It seems that it is a FRAM memory, but I am not sure.

How to reset this printer chip ?

There are some chip available on the web, with the lexmark PCB, but rather expensive (about 25 $) while the chip can be available for only 1$ on  aliexpress. Should a simple replacement of the chip on the board work ?
It is a TSSOP 8 chip, and there nothing else on the board except some decoupling caps.

Thanks for any information on these Ti046b1 chips and chip protection mechanism.
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 14896
  • Country: za
Re: Lexmark toner chip Ti046b1
« Reply #1 on: April 24, 2016, 05:09:05 pm »
It is a simple EEProm, used to store the count of pages printed and toner fill state. Also has a key that is used to authenticate the cartridge to the printer, and a cartridge serial number.

Try looking in printer refill suppliers for the compatible chips, which are either a programmed chip or a small micro that always reports the cartridge is full.
 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #2 on: April 24, 2016, 07:44:26 pm »
Thanks, but is it possible to  read and change the values in this eeprom ?

And what is the pinout ?

This is the chip



And from what I have looked I got the following schematics, with the 4 pads  JP1-4 connecting to the printer

« Last Edit: April 24, 2016, 08:00:12 pm by JacquesBBB »
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 4364
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #3 on: April 24, 2016, 08:18:29 pm »
Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #4 on: April 24, 2016, 09:00:13 pm »
Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact

J1 ground
J2 SCL
J3 Vdd
J4 SDA

Then I got the I2C Address : 0x78

What should now be the way to go ?
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 14896
  • Country: za
Re: Lexmark toner chip Ti046b1
« Reply #5 on: April 24, 2016, 09:51:59 pm »
Grab a non empty cartridge and write it's contents back to the empty one, and see the differences in the data as well. Print a few pages and see how the data changes, which might give enough data to simply reset the count, or make it look full again when refilled. Does the printer work without the chip in, some HP cartridges will give an error code but still print, assuming the chip is misaligned with the reader or it has failed, and then relying instead on the low toner optical path for change messages.
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 4364
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #6 on: April 24, 2016, 09:52:40 pm »
Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact

J1 ground
J2 SCL
J3 Vdd
J4 SDA

Then I got the I2C Address : 0x78

What should now be the way to go ?

While I can't discount your pinout findings of course, just be aware that there is an unofficial standard pinout for I2C eeproms, so I'd find it unusual to deviate from that, so you might want to just recheck your wiring.

https://proprojects.files.wordpress.com/2014/11/2014-11_i2c_24fc1025_im01.png

For example, Google the images returned from "i2c eeprom pinout".

Anyway, back to the problem in hand!

Can you probe the device in situ with a bus decoder? This can often reveal a lot.

 

Offline android

  • Regular Contributor
  • *
  • Posts: 131
  • Country: au
Re: Lexmark toner chip Ti046b1
« Reply #7 on: April 24, 2016, 10:08:41 pm »
Grab a non empty cartridge and write it's contents back to the empty one
...It might also be worth permanently enabling the Write Protect pin too, so that ithe EEPROM would always report "1 page printed" and not bother you in future. I've never tried it...just a thought.

I suspect that the stored data is encrypted - making it difficult to guess how the printer firmware would respond to various kinds of tinkering. The manufacturers really want you to buy more  consumables for some reason.
Lecturer: "There is no language in which a double positive implies a negative."
Student:  "Yeah...right."
 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #8 on: April 25, 2016, 01:16:22 am »
@Howardlong : I confirm the pinout that I gave. I have been able to communicate with it with both my arduino based I2C scanner and Bus pirate 3.6 with it.

Now I am trying to dump the eeprom with bus pirate, but I  have never used it before

I can get some reading but I am not really sure of what I am doing.

What is the best way to dump the content of the eeprom ?

Thanks
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 4364
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #9 on: April 25, 2016, 03:34:26 am »
There are some additional confusions here.

The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57 is the common addres range for eeproms. The schematic you gave even shows the address definition bits and WP pin all tied to how I would expect for an eeprom.

I don't know if Bus Pirate supports 10 bit addressing.

I would take a look at how the printer talks to the device before trying to copy it and match that up with known eeprom protocols. Like pinouts, these are reasonably well standardised so that manufacturers can offer plug in replacements.

 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #10 on: April 25, 2016, 04:02:25 am »
The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57

I had this value with my arduino reader, and this is what I get with the bus Pirate

I2C>(1)
Searching I2C address space. Found devices at:
0xF0(0x78 W) 0xF1(0x78 R)

 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #11 on: April 25, 2016, 07:25:32 am »
In order to verify  what I get with the Bus Pirate,
I tried with a more conventional 24FC1026.

Then the pinout is standard  and I get
I2C>(1)
Searching I2C address space. Found devices at:
0xA0(0x50 W) 0xA1(0x50 R) 0xA2(0x51 W) 0xA3(0x51 R)

Thus the usual address as mentioned by Howardlong

I can then read and write on the chip


I2C>[ 0xa0 0 0 1 3 2 ]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 ACK
WRITE: 0x01 ACK
WRITE: 0x03 ACK
WRITE: 0x02 ACK
I2C STOP BIT
I2C>[ 0xa0 0 0 ] [ 0xa1 r:3 ]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 ACK
I2C STOP BIT
I2C START BIT
WRITE: 0xA1 ACK
READ: 0x01  ACK 0x03  ACK 0x02
NACK
I2C STOP BIT
I2C>

But it does not seem that the sequence is the same for the Ti046b1
As If I try the same sequence on  the Ti046b1 , I get

I2C>(1)
Searching I2C address space. Found devices at:
0xF0(0x78 W) 0xF1(0x78 R)


I2C>[ 0xF0 0 0 1 3 2 ]
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 NACK
WRITE: 0x01 NACK
WRITE: 0x03 NACK
WRITE: 0x02 NACK
I2C STOP BIT

[ 0xF0 0 0 ] [ 0xF1 r:3 ]

I2C>[ 0xF0 0 0 ] [ 0xF1 r:3 ]
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 NACK
I2C STOP BIT
I2C START BIT
WRITE: 0xF1 ACK
READ: 0xFF  ACK 0xFF  ACK 0xFF
NACK
I2C STOP BIT

So the behaviour of this chip is not the same as a standard  eeprom.

If anybody has the proper writing/reading sequence, it would be helpful.
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 4364
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #12 on: April 25, 2016, 07:51:46 am »
10 bit addressing works a little differently to 7 bit addressing, if that is indeed what it's doing. Whatever you're using to talk to the device needs to be 10-bit aware.

Definitely I would sniff out what the printer does to get an idea of what's going on, and look at the I2C specs UM10204 which explain the differences.
 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #13 on: April 25, 2016, 07:44:35 pm »
Thanks for your comments. I have started to look to 10 bit addressing...

But it is difficult to find reasonable information of  Bus Pirate and I2C 10 bit addressing.

I made an experiment by searching all possible addresses on the black cartridge
searching with Bus Pirate for all 256 in bunches like :
[0xF0 0x00]&[0xF0 0x01]&[0xF0 0x02]&[0xF0 0x03]&[0xF0 0x04]&[0xF0 0x05]&[0xF0 0x06]&[0xF0 0x07]

I got only positive answers for  0 and 1



DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
I2C STOP BIT
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x01 ACK
I2C STOP BIT
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x02 NACK
I2C STOP BIT


Then I searched  only for the first 8 addresses  for the other cartridges and found for the possible
second Byte

Black      : 0x00  and 0x01
Cyan      : 0x00  and 0x02
Magenta : 0x00  and 0x03
Yellow     : 0x00  and 0x04

So  this is some progress,  as I understand now how the different cartridges are recognised,
but I am not able to go further. I may need to sniff the I2C port as you recommend, but this will need a setting
that I  cannot do immediately, as I will have to dismount the printer to access the wires.
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #14 on: May 20, 2016, 05:19:08 pm »
you have success ???
I'm trying to get information from the chip , but it does not come out . To search using Bascom code :
Code: [Select]
$regfile = "m328pdef.dat"
$crystal = 8000000

Dim Q As Byte , T As Byte , A As Byte , E As Byte , R As Byte
Config Lcd = 16 * 2
Config Lcdpin = Pin , Rs = Portd.6 , E = Portd.3 , Db4 = Portc.0 , Db5 = Portc.1 , Db6 = Portc.2 , Db7 = Portc.3
Cursor Off
Cls
Locate 1 , 1
Lcd "Start"

Config Sda = Portd.5                                        'I2C Data
Config Scl = Portd.4                                        'I2C Clock
Wait 2

Do
Cls
For R = 0 To 127
 For T = 0 To 128                     
  I2cstart                                           
  Q = R * 2
  I2cwbyte Q                                     
  I2cwbyte T                                     
  E = Q + 1
  I2cstart
  I2cwbyte E                                               
  I2crbyte A , Nack                                     
  I2cstop                                                   
  Locate 1 , 1
  Lcd Q ; " " ; T ; " Read " ; A ; "    "
  If A < 255 Then
  Locate 2 , 1
  Lcd Q ; " " ; T ; " " ; A
  End If
  Wait 2
 Next T
Next R
Loop
End

The answer to all addresses 255. Is there a solution ???
 

Offline Hero999

  • Super Contributor
  • ***
  • Posts: 10962
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #15 on: May 20, 2016, 05:44:48 pm »
There's no way I'd buy a printer like this.

A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #16 on: May 20, 2016, 05:51:26 pm »
A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?
Xerox, samsung.
 

Online Gyro

  • Super Contributor
  • ***
  • Posts: 3514
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #17 on: May 20, 2016, 06:48:13 pm »
Some laser printers have a s/w setting for non-original cartridges, eg Dell.
Chris

"Victor Meldrew, the Crimson Avenger!"
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 14896
  • Country: za
Re: Lexmark toner chip Ti046b1
« Reply #18 on: May 23, 2016, 05:14:23 am »
HP as well, they are refillable, that is why I use them at work. Canon is a brand as well that also has refillable cartridges. The refilled cartridge coasts around 30% of the wholesale price, or around 20% of the retail price. There is a big mark up on cartridges all along the supply chain.

I just ask my refiller first if the cartridges on the printers I am considering are refillable, and this does winnow the list down to a dozen or so to choose from, and then often I look to see if the cartridge is one already in use. Just be aware that often HP and Canon cartridges are exactly the same unit, in a different box with a different part number, and a different price. Lot of Canon printers with me use HP cartridges. Same print quality, same operation and no "non genuine cartridge" message either on the new ones.
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #19 on: May 25, 2016, 04:31:36 pm »
There are still some who have ideas on the independent decision of zeroing chips.  :-BROKE
 

Offline cciollolo

  • Contributor
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #20 on: May 31, 2016, 06:53:10 am »
hi , i have buy a cs310dn printer. i try to sniff with bus pirate but i have store more number with no result. The value changes every start of the printer and is different in all re-check in ready mode . i buy 10 new empty ti046b1 but i haven't idea to proceed . help please
 

Offline cciollolo

  • Contributor
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #21 on: June 01, 2016, 03:25:24 am »
i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available !  :-+ >:D
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #22 on: June 02, 2016, 04:42:58 am »
i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available !  :-+ >:D
Did I understand you correctly??? An attempt to read the memory via a separate device ???

If they've got any sense they'll be verifying the writes.

It's weird that they'd use an FRAM and not some write-once memory.  :popcorn:
The fact that the chip is written in the page counter. As far as I understand it in these chips is:
1. The number of printing on many targeted chip (I found 10K, 20K)
2. The number of printable pages
3. Region kprintera.
4 for color, he must still be responsible for the color.

My reading of the sample controller chips Samsung alas, not what happened. But I realized that chip crypto protection.
« Last Edit: June 02, 2016, 04:48:22 am by igrok_by »
 

Offline cciollolo

  • Contributor
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #23 on: June 03, 2016, 10:36:18 pm »
no , i turn on the printer and i sniff the initial trasmission that check all chips, and after turn off the printer and repeat for 24 times. the second file is the same procedure with the black cartridge chip removed . i did another test and i attach new file :
senza filo is the 3 initial check without cable off all chips
stamp pagina is the initial check with all chip connected and 2 separate page printed
cartucce mancanti is the recheck without one chip at once.

i made an attempt only with black chip to read the content inside of the chip, but after select the chip address with 0xf0 0x00 , i test to write the address of memory location , but when i read the chip answers always ff when the address is ack
 

Offline nanofrog

  • Super Contributor
  • ***
  • Posts: 5441
  • Country: us
Re: Lexmark toner chip Ti046b1
« Reply #24 on: June 03, 2016, 11:11:30 pm »
A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?
Brother would be another.  :)

Resetting a cartridge is nothing more than moving a gear back to it's start position. And you can refill a genuine cartridge 2- 3x w/ a reset between each refill*.  >:D Makes them the lowest per page cost I'm aware of.  :-+

* Depending on the amount of toner the refill kit contains. Also, replace the fill cap rather than reuse or there's a serious chance it will leak, as they tend to get mangled when removing them (inexpensive & available on eBay and Amazon; new gears too, should you need them).
 

Offline MPOWER

  • Newbie
  • Posts: 1
  • Country: gr
Re: Lexmark toner chip Ti046b1
« Reply #25 on: July 20, 2016, 11:46:51 pm »
Hi, I am new to your forum and found it googling for chip TI046B1.
I am also interested in re-writing my lexmark smart chip with a virgin file.
My MX410de uses this chip in the toner and in the imaging drum. The important thing is that I have an original 602HE 10.000 pages new and boxed cartridge.
So I was thinking that if you help me read its virgin file I could re-write it when the time comes. Of course I would also share the file.

Any suggestion would be highly appreciated

Thanks in advance
Michael
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #26 on: July 21, 2016, 04:48:10 am »
Hello everybody. Recently I ordered a couple of chips to try to fill. They came, until set.
 

Offline cciollolo

  • Contributor
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #27 on: August 02, 2016, 07:28:44 pm »
i tried to read this chip , and i founded for black cartridge chip that there is just one address that contains data ; all the others contains FF or 00 . I found this with bus pirate scanning step by step all address :  first [0xf1 xx , and i found that the only addresses that answer ACK are f1 00 and f1 01 . Second [0xf1 00 xx and [0xf1 01 xx .... at the end the address that answers all ack and return data different from 00 and FF is [0xf1 0 1 0 0.
i attach the content of this address . After i bought another chip ti046b1 and i tried to read the same address ; the content doesn't match . So i tried to write the content of the original chip to the new , but when i try to write the chip answers NACK .
the procedure to read is [0xf1 0 1 0 0 [ r r r r r r r r r r r
i try to write with [0xf0 0 1 0 0 [ data data

 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #28 on: October 11, 2017, 08:38:54 pm »
Hello friends. I hasten to please, this chip succumbed to erasure and everything works as it should. :popcorn:
« Last Edit: October 11, 2017, 08:42:38 pm by igrok_by »
 

Offline bigakis

  • Newbie
  • Posts: 2
  • Country: gr
Re: Lexmark toner chip Ti046b1
« Reply #29 on: October 17, 2017, 12:49:02 am »
I captured the traffic between the printer and the catridge subsystem using a MiniLogic analyzer. Bus Pirate gives erroneous results.
My first notes:
  • The catridges have 10 bit addresses. First byte 0xF0 (W)/0xF1(R), second by 0x01-0x04
  • There is another FRAM attached to the bus having address 0x05
  • The printer communicates to the bus in cycles. When opening and closing the lid, it starts 5 cycles
  • On Each cycle it polls each catridge by sending 0xF0, 0x0x (x=1-5). If it receives an ACK on the second byte that means the catridge is installed, and sends more bytes. If not it tries one more time before moving to the next address.
  • An ACK on the first byte (0xF0) is always sent by the installed 5th FRAM
  • First 4 cycles looks like identification. 5th one is the actual communication
Attached are the SAELAE Logic Capture, the Decoded CSV output, a simple python script to beautify the results and the beutified results.
The data are from a cs310dn printer, no catridges attached, so the communication takes place only between the printer and the internal FRAM.
More to come soon

#update: The 5th FRAM report a S/N CAHxxxxxxxx and part number 38CB0001. It points to a company named sirtec in HK manufacturing toners for Lexmark. But there is no toner installed!
« Last Edit: October 17, 2017, 02:31:05 am by bigakis »
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #30 on: October 17, 2017, 04:25:33 pm »
I can say one thing. chip read and until I got to read and write 1024 bytes open for writing and 1024 closed. In a closed file, there is a number, a model, and many that are not understandable.
While well go into the discharge with a small amount of toner.
I have models 511 and 410. 511 even some with 0 pages went into rewriting.
Under No. 1, there is a toner. Under No. 5 there is a photo drum.
While there are works with the search of the recovery from 0 pages.
Open to HxD.
« Last Edit: October 17, 2017, 04:55:08 pm by igrok_by »
 

Offline organizatie

  • Newbie
  • Posts: 4
  • Country: ro
Re: Lexmark toner chip Ti046b1
« Reply #31 on: October 24, 2017, 06:09:16 am »
Hello ,
igrok_by in your picture R5L16B is a memory chip equivalent is FM25L16 (RAMTRON).i have dump for this (my printer is mx310dn).i'm trying to identify a programmer for ti046b1 but can not find any documentation for this chip.
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #32 on: October 24, 2017, 11:10:09 pm »
there is no documentation for the chip. I asked many who sell them. But it seems to me that this is not just a memory, but a controller programmed to impersonate itself for memory. Because my attempts to return the blocked chips are unsuccessful. I'm waiting for the listener with China to test my theory.

I can recover a chip that is not blocked.
« Last Edit: October 24, 2017, 11:13:09 pm by igrok_by »
 

Offline organizatie

  • Newbie
  • Posts: 4
  • Country: ro
Re: Lexmark toner chip Ti046b1
« Reply #33 on: October 25, 2017, 04:19:50 am »
in romania some devices can be reset, but they must still contain information.of the scheme seems to be a memory but I think it was labeled with a special series.thanks
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #34 on: October 25, 2017, 04:29:42 pm »
in romania some devices can be reset, but they must still contain information.of the scheme seems to be a memory but I think it was labeled with a special series.thanks
Opportunity.
But I had a chip on the verge of blocking. I thought that he allowed the lock and counted again. Global changes nebylo. Recorded contents before blocking. But it did not work. I know that one thing is that he is not confused, but a controller. He has 2 addresses for an answer.
The first one is 0.
The second one depends on where it stands. 1 - if this is the bottom with the drum unit and 5 - if there is toner.
 

Offline organizatie

  • Newbie
  • Posts: 4
  • Country: ro
Re: Lexmark toner chip Ti046b1
« Reply #35 on: October 27, 2017, 03:53:49 pm »
Hello,
igrok, where you ordered the chip??for what printer is it??I found that ic's "2850" is a TI controller in the series MSP430FR57XX.
 
The following users thanked this post: AndreiKenig

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #36 on: October 30, 2017, 07:03:25 pm »
Hello,
igrok, where you ordered the chip??for what printer is it??I found that ic's "2850" is a TI controller in the series MSP430FR57XX.
Hello. These chips were bought by our marketer.
The listener came from China. So far as I thought, it's not a memory controller. You need to get a lot of data to write your controller with reset counter. If you do not care to reset the lock of chips.
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #37 on: November 04, 2017, 01:01:15 am »
Hello, friends.
 I did not write for a long time, I was busy trying to understand what kind of animal it was.  :phew: :horse:
I recently offered to share with you.
1 is not just a memory, but a controller or memory that can generate encryption.
2 Yes, yes. Encryption. The algorithm is similar to "AES". This leads to his long attempts at deciphering without knowing the algorithm. Can anyone work with AES, help me understand how this works.
I took off my hat near the development of this chip. This works well. :clap:
 

Offline stj

  • Super Contributor
  • ***
  • Posts: 1873
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #38 on: November 04, 2017, 10:36:30 am »
wouldnt it be simpler to hack the printer formware to fake the check result?
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #39 on: November 04, 2017, 05:07:30 pm »
wouldnt it be simpler to hack the printer formware to fake the check result?
as far as I know, I was told, I did not check that the printer is updating the encryption algorithm from the chip. Unfortunately, I do not have a printer firmware :-//.
 

Offline bigakis

  • Newbie
  • Posts: 2
  • Country: gr
Re: Lexmark toner chip Ti046b1
« Reply #40 on: November 07, 2017, 03:26:10 am »
I'm also pretty sure this memory has embedded security. It is probably the case of this lawsuit https://www.eff.org/document/sixth-circuit-opinion
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #41 on: December 04, 2017, 08:53:37 pm »
Hello. I see that the information does not appear.  :popcorn:. I want to boast that the "beast" has been trained. The chip fits perfectly into the reset  :-/O. All informatics can be given for a reward. :popcorn:
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #42 on: December 07, 2017, 04:26:33 pm »
How?
After a long training =)
There is no documentation for the chip. I found how it works. And now there is a solution that allows me to restart the mx/ms 410/511 chips.
I think that the others work on the same algorithm.
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #43 on: December 08, 2017, 12:01:10 am »
How?
After a long training =)
There is no documentation for the chip. I found how it works. And now there is a solution that allows me to restart the mx/ms 410/511 chips.
I think that the others work on the same algorithm.
Dear igrok_by, I'm very glad that you have succeeded, But, could you chance, forget how it's done, or break your computer, accidentally format the hard drive. Hope for understanding.
With respect! :)
   
Only after Lexmark agrees that the money spent on protection in vain.
And will cut 10 times the prices of consumables
« Last Edit: December 08, 2017, 12:10:47 am by igrok_by »
 

Offline metrologist

  • Super Contributor
  • ***
  • Posts: 1478
  • Country: 00
Re: Lexmark toner chip Ti046b1
« Reply #44 on: December 08, 2017, 07:23:36 am »
this sounds like a paypal solution to me... I think I am saddled with this pox as well.
 
The following users thanked this post: mojalan

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #45 on: December 08, 2017, 04:19:38 pm »
this sounds like a paypal solution to me... I think I am saddled with this pox as well.
Chinese friends offer good chips at good prices. True, these chips are clones of the original :). I was surprised when I got five chips with the same number.
 
The following users thanked this post: mojalan

Offline organizatie

  • Newbie
  • Posts: 4
  • Country: ro
Re: Lexmark toner chip Ti046b1
« Reply #46 on: December 14, 2017, 10:39:17 pm »
Hi igrok_by
what amount you are talking about igrok_by?? :clap:
regards
i'm waiting for the message in pm
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #47 on: December 15, 2017, 05:24:11 pm »
Hello, organized.
I did not understand what you want to hear from me? :-//
I do not understand English well  :popcorn:
« Last Edit: December 15, 2017, 05:25:53 pm by igrok_by »
 

Offline kees

  • Newbie
  • Posts: 1
  • Country: nl
Re: Lexmark toner chip Ti046b1
« Reply #48 on: January 01, 2018, 10:10:43 pm »
Hello. After studying the Lexmark cs410 printer, one can find extended firmware logs:
Code: [Select]
http://<IPaddressOfPrinter>/seAdditionally one can finger the printer in a standard linux shell via
Code: [Select]
nc <IPaddressOfPrinter> 79and issue commands like setup, firewalld, info, history, dnstable, backend, alerts, t30log
Edit: Attached log might be of any value. Search for keywords like osikey, osi debug, bios debug. And find the inner working register values   :-+

« Last Edit: January 02, 2018, 02:40:36 am by kees »
 

Offline Siryu

  • Newbie
  • Posts: 3
  • Country: es
Re: Lexmark toner chip Ti046b1
« Reply #49 on: January 09, 2018, 11:53:19 pm »

Good to all, I am new to this, I have a laser printer and the toner that uses also carries the Ti046B1 chip but I can not do anything with it, I have arduino and I have logic analyzer but I can not do anything or I can not interpret the data, I would appreciate some help to see if I could read and record the chip or if on the contrary the shots do not go around, thanks in advance, regards.  :palm:
 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #50 on: January 10, 2018, 02:03:21 am »
Hello All,

I am glad to see this thread active again. I have no time at present to resume my searches  to decipher this  chip,
but will be very attentive to any progress that could help to shunt this protection.
 

Offline igrok_by

  • Contributor
  • Posts: 18
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #51 on: January 11, 2018, 09:43:53 pm »
Hello all. ;)

Sorry if I offended someone  :'(. It turns out the goods on the Chinese site can cost 3 times more than they actually are. I complete the instruc- tion about the chip until the end of the week. I suggest that you talk again about receiving instructions.
I'm not a magician while I'm studying. The chip must not be blocked. How to do this I will describe.
« Last Edit: January 11, 2018, 09:51:48 pm by igrok_by »
 

Offline AlexandruG

  • Newbie
  • Posts: 1
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #52 on: January 23, 2018, 11:33:37 pm »
Hello all,

What about that instructions igrok? Can you help us with a tutorial "how is made"?

Thank you.  :D
« Last Edit: February 03, 2018, 12:15:29 am by AlexandruG »
 
The following users thanked this post: desrem01

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #53 on: February 14, 2018, 08:43:20 am »
Hello, any news about the instructions?
 

Offline dokimos33

  • Newbie
  • Posts: 1
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #54 on: March 05, 2018, 05:05:51 pm »
Hello all. ;)

Sorry if I offended someone  :'(. It turns out the goods on the Chinese site can cost 3 times more than they actually are. I complete the instruc- tion about the chip until the end of the week. I suggest that you talk again about receiving instructions.
I'm not a magician while I'm studying. The chip must not be blocked. How to do this I will describe.

Write to me in PM please, I am ready to reward  |O
 

Offline Ronyy

  • Newbie
  • Posts: 1
  • Country: br
Re: Lexmark toner chip Ti046b1
« Reply #55 on: April 03, 2018, 12:24:35 am »
Is there any solution to the problem? I have an MS810dn lexmark and would like to know if it is possible to re-record the TI046B1 chip. I'm spending roughly $ 454, 32 per month only with the purchase of chips.
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #56 on: April 07, 2018, 03:31:23 am »
Hi everybody,

With a 70 MIPS DSPIC 33EP512 MC 502, and few days of hard labor, we succeeded in having all the communication between the printer and its cartridges intercepted without any bit of error !

The Buspirate was just a Joke as it was unable to spy on a normal 100kHz I²C bus, and for those who tried, it had no chance to give anything meaningful. New versions are maybe approaching 100kHz but micro controller is 16 MIPS.

With an Arduino Mega 2560 (16MIPS), we were too slow, too (even with a lot of optimizations). Indeed, it's impossible to use the internal I²C functionalities of any micro controller since theses functionalities necessarily interact with the bus (too bad, since they are 400KHz compatible !).

How does it works :
First time is recording into enormous buffers, second time (after few time with no data on SDA/SCL) is the sending of the results to the computer (with a simple serial port).
Finally, with a Qt written program, we formatted all the series of S (Starts/Restarts), E (Stops/Ends), and 0/1 (with 7 or 10 bits addresses supported, ACK, Read/Writes etc) in order to have CSV files. We sorted a little bit those files in order to recognize I²C Writes, I²C Questions, and I²C Responses. And splitted the 4 cartridges into different colors.

And yes, Howardlong was right, cartridges are 10 bits addressed.

Enjoy !
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete-1sur2.xlsx
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete-2sur2.xlsx

And raw data from micro controller : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/capture-complete-raw.txt

If some of you are interested in having more details and created programs for the occasions, we are going to clean it a little bit and put it on our website (https://www.pixconfig.fr/)

Now we have to ask ourself one question : what do all those registers contains and says ? Because there is a lot, lot of data exchange between the master (printer) and its slaves (cartridges). For information, the magenta cartridge is empty into the recorded I²C frames.

Also, we have a fifth cartridge and we don't really know what is this cartridge but the way it communicates is the same that for the 4 other cartridges.

Thank you in advance !
 
The following users thanked this post: maxic81, Siryu

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #57 on: April 07, 2018, 08:57:20 pm »
I successfully understood some information about the used protocol, by printing the full series of Questions/Answers/Writes into 1 page (for magenta, firstly) and looking about what it asks, what it answers, and marking everything meaningful with my pen.


I compared the results between cartridges and it is the same protocol, registers and bytes number used at each time. ACK and NACK are just where they should be, Starts Stops and restart too. But content of the 14 bytes questions and the 16 bytes answers change every time... !

Addresses :
  • 0x001 is the black
  • 0x002 is the cyan
  • 0x003 is the magenta
  • 0x004 is the yellow
  • 0x005 is the imaging drum

Registers that are being read :
  • 0x01>0x20>0x04 is the Color Register. It gives a series of 0x0N and 0x00 that repeats itself, N being 1, 2, 3, 4, or 5 (same as the address)
  • 0x01>0x40>0x04 is an big register that is read on 448 bytes (but for each cartridge, only the 297 first ones contains something, the following bytes are 0x00. First bytes looks like ASCII with only slight differences between cartridges)
  • 0x01>0x00>0x06 is an big register that is read on 256 bytes (all of them contains something)
  • 0x01>0x20>0x00 is an average sized register that is read on 56 bytes (most of the contains 0x00 or 0xFF but not all of them)
  • 0x01>0x90>0x00 is an big register that is read on 208 bytes (First bytes looks like ASCII with only slight differences between cartridges)
  • 0x82 is a kind of Status Register that the printers reads before asking anything else.
    • status 0x38 is "nothing more to say, please enter something into 0x81"
       
    • status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
    • status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
       
    • status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
    • status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09

  • 0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time

Registers that are being write :
  • 0x04 is the first register that is called on each cartridge, with a Stop occuring during ACK (there is no ACK or NACK bit), followed by a useless start stop, observed by oscilloscope too. Let's guess this is useless. But it's common to the 5 cartridges (well, 4 cartridge and 1 imaging drum).

  • 0x81 is the only one register that is written after closing the lid. It's a command register that influences the status register (0x82) and define what will be read into 0x80. We can see single byte writes on it (0x08 or 0x09) for selecting what looks like a mode, then a 14 bytes question write (with something that looks like it's totally unpredictable) before being able to read 16 bytes into 0x80 (16 bytes that also looks like they are totally unpredictable).

That's the complete summary of the exchanges between the master and it's slaves. We have only one missing thing : what is written when we print a page ? Since our Magenta cartridge is empty, we can't print anything.

Now I think I need some experts attention : Does anybody recognize this kind of dialog ?
I'm going to look for possible intepretation of those values (4 bytes sized floats, 8 bytes sized double, integer, unsigned integer, ascii...) but may be somebody already recognize what I'm looking for.

Do not hesitate to consult the Excel files we gave on the previous message, it's really clear to read !

I'm really happy with what we got from the 70 MIPS DSPic (fast enough to immediately mark the values SDA/SCL when there is a SCL/SDA change notification interrupt, then interpret it quickly enough to see the next SDA/SCL change in time) and the way we formatted the data into the Excel. At the beginning, we were looking after 1 and 0 on the oscilloscope so you see, it's lightyear better that way ;D
It's also a chance that it's 48 kB RAM memory sized because there is a lot, lot of bytes, starts and stops position to record before being able to slowly send this into the serial port.

« Last Edit: April 07, 2018, 09:11:49 pm by pixconfig »
 
The following users thanked this post: maxic81, Siryu

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #58 on: April 08, 2018, 01:23:27 am »
We saw that after the 2 streams of recorded communication with the printer, we had 3 series of Write + Read into 0x005.
I made a pretty cool discovery while looking at it : part of the chip is an EEPROM and the printer auto-control what have been written :

It writes a 1st time 96 bytes into 0x02>0x20>0x00, and read it back into 0x01>0x20>0x00 (with no single bit change)

It writes a 2nd time 96 bytes into 0x02>0x80>0x00 and read it back into 0x01>0x80>0x00 (with no single bit change)

In the two writes (and the two reads back) there is no change : same thing written into 0x02>0x20>0x00 and 0x02>0x80>0x00.

Finally, it writes 128 bytes of data into 0x02>0xE0>0x00 and read it back into 0x01>0xE0>0x00

Here is a picture of the analysis, it's a little bit loaded but


I've placed an updated version of the Excel files as ODS file at this address : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete.ods
The 1st, 2nd and 0x005 Write are into 3 different sheets on the bottom of the document.
Formatting of the 2 communication are the same so now it's easier to place the same view on each side, and switch between them to see what is changing.
 
The following users thanked this post: maxic81, Siryu, Alan.B

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #59 on: April 08, 2018, 03:05:50 am »
AAAnnnd the winner is....  ;D (not so fast, my understanding of the situation still should be verified experimentally)

I have just noticed that for the first headers (big registers read before exchanges on 0x80 / 0x81 / 0x82) that I documented this morning, they are something more to know about the following ones :
  • 0x01>0x20>0x00 is an average sized register that is read on 56 bytes (most of the contains 0x00 or 0xFF but not all of them)
  • 0x01>0x90>0x00 is an big register that is read on 208 bytes (First bytes looks like ASCII with only slight differences between cartridges)

Those headers are for 0x001, 0x002, 0x03, 0x004, but not for 0x005.

For 0x05, those first registers reading are replaced by
0x01>0x20>0x00 : read during 96 bytes
0x01>0xE0>0x00 : read during 128 bytes

Yes, the same register that we saw the printer write in my previous message, so we know what the printer reads at the beginning : it reads things that can be written  :-+

This is probably those registers that the master is writing in order to update the status, and the one that the master reads in order to know the current status of the imaging drum.

I guess that the way the master writes the toner level on 0x001, 0x002, 0x003 and 0x004 is the same (replacing the 0x01 by 0x02) but it should be verified while watching the printer writing into those registers.
And may be everything addressed by 0x01>0xNN>0x00 can be addressed and written, who knows. I wonder what it contains when the cartridge is brand new ! I'll try to watch that in the following week.

According to some folks, there is another thing that is set/locked somewhere else when the cartridge become completely empty. Probably something that could be found by watching the printer doing it's final emptying ? Who knows, it's a shame that we are there, looking again and again to repeat and find what some people already found and kept, those people who find solutions against venal obscurantism in order to finally put moral to the garbage, and ask for dollars too.  :clap:

But I digress, let's keep on studying this I²C component  :) - as you can see, I'm not trying to do anything else but studying a component we all bought, just for me and the others to know how does it works.
« Last Edit: April 08, 2018, 03:07:39 am by pixconfig »
 
The following users thanked this post: maxic81, Siryu, Alan.B

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #60 on: April 08, 2018, 07:42:46 pm »
Congratulation for this nice work, pixconfig. I hope that will end up with a solution for resetting these chips.
 

Offline Siryu

  • Newbie
  • Posts: 3
  • Country: es
Re: Lexmark toner chip Ti046b1
« Reply #61 on: April 08, 2018, 11:19:36 pm »
If wonderful work now I know because I could not read or interpret the data with arduino, hopefully we can do something at last, thanks pixconfig :-+
« Last Edit: April 08, 2018, 11:21:26 pm by Siryu »
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #62 on: April 09, 2018, 01:16:25 am »
Hi !

In fact I have good news for everyone who wants to communicates (Read/Write) with those chips and an Arduino as master (or any other kind of I2C master, like RPi or VGA card) : I think it is completely possible ! (Just take care about 3.3v). But I didn't tried.
I Guess you should also tells you Arduino that the address you want to write is 0x78 (0b111 1000) + W and then the first data byte you send should be 0x01, 0x02, 0x03, 0x04 or 0x05.

Before any read, you will also need to write 0x78 + W, 0x0N (1 2 3 or 5), your desired register(s), and Restart, then just 0x78 + R (on a read, you're only able to write 1 byte of address before receiving, so you can't put the full 10 bit address. But the slave chip will recognize himself since just before the restart, you were talking to it).

What we don't succeeded in, with the Arduino, was to watch as input only into the operating bus between printer and cartridges and being able to catch everything sent/received between everybody without any interaction and without any bit of error : coding a software read-everything using software poll and/or interrupt on PD0 / PD1 changes was to slow to :
 - copy of the SDA/SCL value (PORTD) immediately on any change
 - interpret the copy by looking at the 2 values with some if/else and masks (0x02, 0x01, 0x03)
 - putting the results into a dedicated buffer
 - and to be ready for the next change at time

Of course, sending the values by Serial Port should be done in a second time because it's very long too (talking about too many µs of course, not minutes  ;)).

We were loosing a lot of bits, starts and stops. Copying the SDA/SCL values on another output port and seeing the time offset with a 2-way oscilloscope revealed that we had no chance to be fast enough to do everything in time because SDA was changing too fast after an SCL change and vice-versa (we were often reading the PORT D too late).

May be some Assembly's kings would have done better than us, but anyway, that's why we said it was pretty impossible without a faster controller (and I discovered 70MIPS dsPIC, it solved the problem, but it's a little bit complicated to code with : lot of registers to set everywhere to do any simple thing).

I've tried to interpret the data on the big headers as ASCII. That's a little bit poor because it's mainly binary, but there is some ASCII information anyway. It seems that those are serial number, and the model of the compatible printer.
There is also a check on the Imaging Drum reference : CAH171303CD6 is written into the Imaging drum's chip but also in the cartridge's chips.

Pretty interesting, after all ! May be it's for a compatibility check with what's installed into the printer.

Black :
   CAH171331C86
   38C4237
   6MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de

Blue :
   CAH1713218DA
   38C4234
   6MBF46MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Magenta :
   CAH171350F7B
   38C4235
   6MBF46MBF46MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Yellow :
   CAH1713208AA
   38C4236
   6MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Imaging Drum :
   CAH171303CD6
   38CB0001
« Last Edit: April 09, 2018, 01:18:38 am by pixconfig »
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #63 on: April 09, 2018, 11:08:27 pm »
Hi !

I can now confirm that the Arduino (Mega 2560 at least) is able to be master and communicate, and read into the 10 bits TI046B1 (using 10k + 5.2k + 2k between ground and SDA and same between ground and SCL, in order to have 3.3v and no 5v)

Here is a sample code in order to address (by write) the 0x01 > 0x20 > 0x00 register, and read it during 56 bytes after a restart EDIT : it's also able to write, now

I used arduino's twi.h and twi.c in order to understand what I was doing on the bus, because Wire.h and Wire.cpp overlay was a little bit strange to understand; anyway it should work too

https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/twi-all-included.h
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Read.ino

EDIT : the goal is to read those registers and send it trough serial port, in order to copy it into C declaration, and write it back, for example.
We will first try to read the chips on the same values that the printer does, and see if we are able to see the same things, before trying to write anything.
« Last Edit: April 10, 2018, 02:20:05 am by pixconfig »
 
The following users thanked this post: maxic81, Siryu

Offline Siryu

  • Newbie
  • Posts: 3
  • Country: es
Re: Lexmark toner chip Ti046b1
« Reply #64 on: April 10, 2018, 04:06:48 am »
Thank you Pixconfig for your excellent work.  :clap: :clap: :-+
Indeed with the Mega ADK I have managed to read a chip of the Monochrome printer with a single cartridge of toner and another drum. Now the interesting thing would be to be able to write on the chip.  |O
 

Offline cciollolo

  • Contributor
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #65 on: April 12, 2018, 07:45:12 am »
Thank you Pixconfig for your excellent work.  :clap: :clap:
I started doing tests of reading the chips with buspirate posting various files, then failing to find anything I bought MSP430F5529 launchpad and I tried to read the chip, but appears "the debug interface to the devices has been secured".
I'm not very practical in data communication and I abandoned everything for a hardware change: disconnect the power supply to all 4 chips after the first verification phase at the printer and sending the document to be printed. In the printing phase the processor must be so busy that it checks the cartridges (almost always) at the end of the print (even if many pages, even if on the back side) to subtract pages from the toner counter, so finished printing I turn off the whole printer and re-lighting it after a few seconds with the reactivated pultant. Change that I do not know why it does not work so much, because the toner level keeps going down; perhaps for a cross check that does between printed pages from the machine and toner residue, I do not know. I saw that instead you have come a long way in the part of communication and I wanted to understand how to help you with the means I have, if possible.
 
The following users thanked this post: pixconfig

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #66 on: April 15, 2018, 02:57:09 am »
Hi !

After reading the following registers on a new out of the box cartridge's chip that haven't be connected to the printer for the moment :
  • 01_40_04[448]
  • 01_00_06[256]
  • 01_20_00[56]
  • 01_90_00[208]

And after trying to write the good one, out of the box content into another chip (not the good cartridge, I mean of course it's the good cartridge, but the chip says "no, go buy another one") :
  • 02_40_04[448]
  • 02_00_06[256]
  • 02_20_00[56]
  • 02_90_00[208]

I've tried to read the content again but no byte changed...  :-\ it's still the old content.

What should I try ?
I'm going to place the cartridge and his new chip inside the printer, and to observe, but if anybody is inspired, feel free to share your ideas  ;)
 
The following users thanked this post: maxic81

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #67 on: April 15, 2018, 11:34:28 am »
I cleaned a little bit the code of our dsPIC I2C observer

https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/main.h
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/main.c

It's for a dsPIC 33 EP512 MC502, there is two buffers in order to keep recording while sending the previous results trough UART, and a buffer overflow protection now  :)
Comments are in english too.

Also, there is a Qt code in order to change the series of letters into a viewable CSV, but it does not interpret anything else than I2C (in fact, apart from the Arduino 10bits  master reader/writer I gave the other day, there is nothing linked to the Lexmark products into any of these codes, they can be used for any other thing).
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/Qt-I2C-Read.zip

Does anybody know if there is a patent describing the communication process between the cartridge and the printer ? Such patents could be really important for Lexmark to ensure no concurrent can sell anything that is patented by their own technology, but such patent are also helpful into understanding the product as customers and developers as we are, for interoperability, modification, but without spending too much time into retro-engineering if everything is already described somewhere  ;D

I guess I'm ready to put the new cartridge into the printer and to watch what it gives !
« Last Edit: April 15, 2018, 11:48:50 am by pixconfig »
 
The following users thanked this post: maxic81

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #68 on: April 18, 2018, 10:06:50 pm »
Hi,

Thanks to a very interesting discussion and idea exchange about patent, here is some information :

I searched a little bit on http://www.suppliespatents.info/ (official Lexmark list of patents for their cartridges), and Google Patent, as patents are publicly available on Google, I succeeded in having a lot how them about our cartridge and communication, by seeing the website indicated on the cartridge, and by some research. But not all of them seems to be what we are looking for.

https://patents.google.com/patent/US7258558
https://patentimages.storage.googleapis.com/d9/d2/7c/787cbf35f9fdf2/US7258558.pdf

https://patents.google.com/patent/US7272336
https://patentimages.storage.googleapis.com/2c/9b/24/3466ec9fd84210/US7272336.pdf

https://patents.google.com/patent/US7321739
https://patentimages.storage.googleapis.com/9d/81/1d/74aa37e5d35ee4/US7321739.pdf

https://patents.google.com/patent/US7606520
https://patentimages.storage.googleapis.com/25/cf/fc/f6b00f8489ff68/US7606520.pdf

https://patents.google.com/patent/US7672624
https://patentimages.storage.googleapis.com/1c/c4/95/0dcc721952358c/US7672624.pdf

https://patents.google.com/patent/US8401437
https://patentimages.storage.googleapis.com/b6/09/25/9092a07fda3453/US8401437.pdf

https://patents.google.com/patent/US8948660
https://patentimages.storage.googleapis.com/79/ff/2c/62c12f00eb9e0d/US8948660.pdf


Doing some manual research :

https://patents.google.com/patent/US8966193
https://patentimages.storage.googleapis.com/9c/38/4d/f75c5b3c04f954/US8966193.pdf

https://patents.google.com/patent/US9400764
https://patentimages.storage.googleapis.com/ec/90/37/616b217d32e47a/US9400764.pdf

https://patents.google.com/patent/EP2226809B1
https://patentimages.storage.googleapis.com/b2/9c/c8/1ef00d503cdace/EP2226809B1.pdf

https://patents.google.com/patent/US9245591
https://patentimages.storage.googleapis.com/71/b8/db/58443002ccc33f/US9245591.pdf

https://patents.google.com/patent/US20170163641
https://patentimages.storage.googleapis.com/7a/7d/01/b2b076d57ecd92/US20170163641A1.pdf

https://patents.google.com/patent/US7426613
https://patentimages.storage.googleapis.com/01/03/f5/87cfecdb866b32/US7426613.pdf

https://patents.google.com/patent/US8099791

On the National Institute of Standards and Technology (NIST https://www.nist.gov/) into the Computer Security Resource Center, some part of the Lexmark cryptographic module validation program documentation has also been made available for public too :
https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2444.pdf
But it doesn't talk about the i2c toner chip at all

I don't have a lot of time this week, so if anybody feel ready to eat all these documents, feel free !

I watched the result of 1 print with the new cartridge but there is nothing special to see, it just written 0x005 and did a lot of communication with 0x80, 0x81 and 0x82 on every cartridge... May be a I should print more copies before seeing a cartridge write ?

I will come back as soon as a have new time and information
 
The following users thanked this post: maxic81

Offline cciollolo

  • Contributor
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #69 on: April 20, 2018, 04:49:12 am »
hi pixconfig, can you explain me how I can save the communication between printer and cartridges? with any arduino with library that you posted? with a pic? if I can understand how you did, I can equip and post printer data different from yours
in the meantime, I ask you some questions:
puoi verificare che ad ogni accensione (prima comunicazione ) i dati scambiati sono sempre gli stessi ? e ad ogni controllo successivo , a distanza di circa 1 minuto, sempre gli stessi dati ?
can you check that every time you switch on (first communication) the data exchanged are always the same? and at each subsequent check, at a distance of about 1 minute, always the same data?
thanks
« Last Edit: April 20, 2018, 04:54:50 am by cciollolo »
 

Offline LPI-DANE

  • Newbie
  • Posts: 2
  • Country: us
Re: Lexmark toner chip Ti046b1
« Reply #70 on: April 21, 2018, 04:09:19 am »
Hello, I'm new to this site. I have been looking for the data sheet just like everyone else. I have a friend in Shenzhen that told me that most aftermarket sellers just silk screen on the TI046B1 on to this chip. http://www.ti.com/lit/ds/symlink/pca9515a.pdf. I use a Xeltek 6100 for ghosting IC's. This is not in my data base. I do not have the chip knowledge of most on this site. Could some tell me if this IC could be the same.
 

Offline LPI-DANE

  • Newbie
  • Posts: 2
  • Country: us
Re: Lexmark toner chip Ti046b1
« Reply #71 on: April 21, 2018, 04:23:23 am »
Sorry the link breaks, here is a partial of the PDF. It would not let me load the hole PDF.
 

Offline dimprime

  • Newbie
  • Posts: 1
  • Country: es
Re: Lexmark toner chip Ti046b1
« Reply #72 on: April 22, 2018, 08:31:25 pm »

Thanks for your excellent work.
Thanks to your program I can write on the chip.
02_40_04 [448]
02_00_06 [256]
02_20_00 [56]
02_90_00 [208]
I change [208] to [200] and [56] to [200] and I can write and change the bits as I want and when I read them it changes them but the lines 02_40_04 and 02_00_06 do not change them. why?
 

Offline JoeO

  • Frequent Contributor
  • **
  • Posts: 495
  • Country: us
  • I admit to being deplorable
Re: Lexmark toner chip Ti046b1
« Reply #73 on: April 22, 2018, 10:19:38 pm »
Hello, I'm new to this site. I have been looking for the data sheet just like everyone else. I have a friend in Shenzhen that told me that most aftermarket sellers just silk screen on the TI046B1 on to this chip. http://www.ti.com/lit/ds/symlink/pca9515a.pdf. I use a Xeltek 6100 for ghosting IC's. This is not in my data base. I do not have the chip knowledge of most on this site. Could some tell me if this IC could be the same.

Here is the link to the larger document:

http://www.ti.com/lit/ds/symlink/pca9515a.pdf
The day Al Gore was born there were 7,000 polar bears on Earth.
Today, only 26,000 remain.
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 5770
Re: Lexmark toner chip Ti046b1
« Reply #74 on: April 23, 2018, 02:28:36 am »
That's definitely not it; it doesn't even have memory.

This is the closest to a description (the full report is $$$):

https://www.chipworks.com/TOC/Texas_Instruments_TI046B1_Serial_FRAM_CAR-1504-802_TOC.pdf

As for finding a datasheet, since it is a proprietary part you won't find one unless the right person at Lexmark or TI happens to read this thread and decide to be neighbourly (you know who you are... ;))
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #75 on: April 26, 2018, 08:36:49 am »
Hi, sorry for the little time offline, I was a little busy !

cciollolo, here's a little description of my spy's wiring :
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/dsPIC-Wiring.png
  • RB7 (pin 16) is used as UART output from the dsPIC to the computer
  • RB8 is normally used as SCL, for I2C, but since it doesn't worked, I used RB10 (pin 21) for SCL spy input. Still don't know why RB8 wasn't working !
  • RB9 (pin 18) is normally used as SDA, and I used it as SDA spy input
  • PicKit connection for when I'm writing/debugging the program is RB2 (PGEC1, pin 6) and RB3 (PGED1, pin 7) for PGC and PGD. I'm only using the 5 first pins of the PicKit
  • I used 100nF capacitors (green ones) and for VCap (tantalum 10µF minimum, which I had not) I used the association of a 100µF electrolytic and a 100nF non-electrolytic capacitor in order to have the association of storage capacity and the immediate response time that is probably required to work at full speed.

I'm then using a USB<->Serial converter using TTL / 3.3v signals : when the dsPIC program is writing UART, the computer receives the data, with putty.exe for example.
Into the code it's buffering all the communications and then, it's sending what have been recorded (after 2 seconds of i2c inactivity).
As it's a looooong series of Ones and Zeros, a second program (C++/Qt written, Qt-I2C-Read.zip), it reads bits 9 by 9 between every Start and Stop and do some interpretation to give a readable CSV with address, read/write and acknowledge interpretation. Then I manually add some colors and spaces in order to see patterns and general shape of the communication.


To answer your question about the first communication at each restart, the big first part of the communication is entirely predictable :
  • 02_40_04 [448]
  • 02_00_06 [256]
  • 02_20_00 [56]
  • 02_90_00 [208]

But then, every exchange on 0x80, 0x81 and 0x82 are pretty unpredictable (14 bytes writes and 16 bytes read are every time different, apart from the 2 middle bytes of the 16 bytes read that are the same every time, it just depends of the cartridge).
I would not be surprised if it's just authenticity check without information read/write, just because it would explain why some people already succeeded in the past to "blank" the toner chip usage counter.


dimprime, it's very very cool !
I think that the first part is describing a kind of "model" for the cartridge and I wouldn't be surprised if the second part contain the "status" of the cartridge. So it would be a great idea to try to "restore" the cartridge status after having used a little page amount, just to see if the toner level is retrieving it's previous amount !

I will have some time tomorrow in order to try some things and tickle those chips a little bit, with the arduino as master  :)
« Last Edit: April 26, 2018, 09:02:02 am by pixconfig »
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #76 on: April 26, 2018, 09:32:43 pm »
I've made a pretty cool discovery :

Reading 2048 bytes of 01>00>00, then reading the following ones :
  • 01>20>00  is 01>00>00 with a 32 bytes offset
  • 01>40>00  is 01>00>00 with a 64 bytes offset
  • 01>90>00  is 01>00>00 with a 144 bytes offset
  • 01>00>06 is 01>00>00 with a 6 x 256 bytes offset
  • 01>40>04 is 01>00>00 with a (4 x 256) + 64 bytes offset

Pretty logic, after all : The first byte after 01> indicates a [0 to 255 for 0x00 to 0xFF] byte offset so the following one indicates a multiple of 256 bytes offset !
 
The following users thanked this post: maxic81

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #77 on: April 26, 2018, 10:33:03 pm »
EDIT : I made an error while reading back data, the reality is that I only succeeded to fill the first 1024 bytes with zeroes.

I (too much but successfully) zeroed an entire chips's eeprom by writing 2048 bytes of 0x00 to 02>00>00
It only remains "0xFB, 0x5F, 0x94, 0x54" for the last 4 bytes of the 2048 bytes buffer read


Now I should understand why some writes are successful, and why some others are not.
And I'm also able to restore back the 1024 first bytes to their initial value, but most of them were already set to 0x00
« Last Edit: April 27, 2018, 02:15:16 am by pixconfig »
 
The following users thanked this post: maxic81

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #78 on: April 27, 2018, 12:13:09 am »
I confirm that toner cartridge that are emptied with the chip giving "0 pages left" are not fully locked

I have been able to set the 1024 first bytes to 0x00 and to read it back, then to restore the initial content.

But :
  • When I restore the original, there is some differences at the beginning (32 first bytes) but I already had the problem this morning without writing anything : those 32 bytes were a series of 0x77 and 0x00 and it became just 0x00. Same here, it was a series of 0xB8 and 0x17, now it's just series of 0x00 and 0x00
  • Also, when I try to write with incremental values the first 1024 bytes, there is only 336 bytes that are written : 0 to 32 is not written, 336 bytes are written and all that follow is kept to 0x00

Anyway it's still interesting to see all this
Sorry for multiple Editing, I realized that my interpretation was wrong because of some mistakes in my code !
« Last Edit: April 27, 2018, 02:23:22 am by pixconfig »
 
The following users thanked this post: maxic81

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #79 on: April 27, 2018, 05:54:41 am »
So we are approaching the end, I'm on the verge of attempting something :

This is the 01>20>00 "register" of a brand new magenta cartridge (small capacity)
Code: [Select]
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x75};
After some little magenta prints :
Code: [Select]
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x46, 0xBA};
Nothing else changed into the chip.
The visual indicator doesn't really show any missing bit of toner level but anyway... I would like to try applying this value to a Cyan cartridge that is pretty low, with the exclamation sign at side of it's toner level representation, just in order to see if it's the toner level... or not ! And I hope that the value I will put will not lock anything with the cartridge once into the printer.

Some more details I noticed by analyzing all the content :

The first 1024 bytes of information are completely organised that way :
  • 32 bytes of strange volatile read only value repeating itself 2 by 2, that sometimes changes to 0x00 after some writes
  • 56 bytes of what I believe is the toner level
  • 56 bytes of what I believe is the toner level, a second time, same values - printer doesn't seems to read this field but it's into the chip
  • 208 bytes of information that doesn't have changed since the cartridge is into the printer
  • 6 first bytes of 01>00>04 (the 1024 bytes read only area) followed by zeros. But 16 bytes can be written and here
  • After the 368 first bytes, the 656 following bytes are covered by 0x00 and seems to be read only

After the 32nd and up to the 368th byte, everything can be written by the data of your choice, and I'm not really sure of why sometimes it fails. But if you write the complete set of 1024 bytes it seems to work everytime.
When I try to observe the printer communicating with it's cartridge I only see some Writes into 0x05 EEPROM area and some exchange on 0x80/0x81/0x82 with all cartridge but impossible to guess what it does (apart from entering some kind of 0x08 or 0x09 modes, and writing random 14 bytes to get 16 random bytes in answer).

Also, I tried to read 3072 first bytes, but it does a cycle : the 1024 last bytes are the 1024 first ones.

Keep you informed !

EDIT 1 : well, it does not work  :-\ printer says that the cartridge isn't recognized. The I2C spy shows nothing abnormal. Now I will try to copy the content of another cartridge of the same reference, delivered with the printer
« Last Edit: April 27, 2018, 06:31:39 am by pixconfig »
 
The following users thanked this post: maxic81

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #80 on: April 27, 2018, 07:14:36 am »
Suceeded  :)

I copied the Yellow level (~40%) of the same cartridge reference into the Cyan toner chip (was almost empty) with the following code :

Code: [Select]
uint8_t Register56[56+4] = {0x00, 0x00, 0x00, 0x00,      0xFF, 0x01, 0xFF, 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0xA0, 0x0D, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x04, 0xC3, 0x00, 0x00, 0x00, 0x2D, 0x87};

void playOnce()
{
  write_TI046B1_register(0x002, 0x02, 0x20, 0x00, Register56, 56);
  write_TI046B1_register(0x002, 0x02, 0x58, 0x00, Register56, 56);
 
  //Check :
  read_TI046B1_register(0x002, 0x01, 0x00, 0x00, Buffer, 512);
  read_TI046B1_register(0x002, 0x01, 0x00, 0x02, Buffer, 512);
  read_TI046B1_register(0x002, 0x01, 0x00, 0x04, Buffer, 512);
  read_TI046B1_register(0x002, 0x01, 0x00, 0x06, Buffer, 512);
}

Of course it doesn't add real toner inside the cartridge so it's just for technical comprehension of our printer, as it's written on the cartridge's box : "By opening this package you agree to use this cartridge only once" so of course I'm going to put back the real toner remaining amount into the chip, and use it only once, and I encourage you to do the same.

I would love to know what is the "full" level for this reference !
I'm gonna analyze a little bit what contains this 56 bytes buffer, may be I would be able to fully understand it.

There's still many areas of shadows about what the chip contains and does.
 
The following users thanked this post: maxic81

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #81 on: April 27, 2018, 08:14:40 pm »
Hi,

Another good news for people who have "empty" cartridge with 0 pages left : it's possible to reload the chip, it's not locked (at least, not with the "starter cartridge" delivered with the printer). For this example, we successfully put the "40% left" level of the Yellow toner chip into the "0% left" magenta toner chip, and now, there is "40% magenta left" and it works.

A good idea would be to share, here, the different values of 01>20>00[56] for differents kind of cartridges, with differents levels, and to make a summary here.


Let's begin :

Magenta, 71B20M0, still not used :
Code: [Select]
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x75};
Magenta, 71B20M0, after just little uses
Code: [Select]
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x46, 0xBA};
Magenta, 802HME High Yield (CX410 / 510), not used because not compatible with our printer :
Code: [Select]
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xCD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA6, 0xFF};
CS417, CX417 Starter Return Program : Black ~30%, Blue ~10%, Magenta 0%, Yellow ~40%)
Code: [Select]
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0xFF  1111 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x11, 0x00, 0x01, 0x20, 0x13, 0x00, 0x61, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x05, 0x05, 0x00, 0x00, 0x00, 0x30, 0x3B};

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0x7F 0111 0xFF, 0xFF, 0x8D, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEF, 0x00, 0x00, 0x60, 0x04, 0x00, 0x69, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x01, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x04, 0xC0, 0x00, 0x00, 0x00, 0x9D, 0x9B};

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0x3F  0011 0xFF, 0xFF, 0x8C, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x23, 0x00, 0x00, 0x40, 0x03, 0x00, 0x6D, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x04, 0xC4, 0x00, 0x00, 0x00, 0x67, 0x68};

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x01, 0xFF  1111 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0xA0, 0x0D, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x04, 0xC3, 0x00, 0x00, 0x00, 0x2D, 0x87};

Please read before doing : Of course it doesn't add real toner inside the cartridge so it's just for technical comprehension of our printer, as it's written on the cartridge's box : "By opening this package you agree to use this cartridge only once" so of course I'm going to put back the real toner remaining amount into the chip, and use it only once, and I encourage you to do the same.
 
The following users thanked this post: amyk, maxic81

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #82 on: April 28, 2018, 10:55:27 am »
Hi, here's my hypothesis: toner level might be stored in the second and third bytes:

The levels might be:
Code: [Select]
  %     dec     hex
____________________
0 %     63     00 3f
10%    127     00 7f
20%    255     00 ff
30%    511     01 ff
40%    1023    03 ff
50%    2047    07 ff
60%    4095    0f ff   
70%    8191    1f ff
80%    16383   3f ff
90%    32767   7f ff
100%   65535   ff ff

Now we go to your cartridges:

Magenta, 71B20M0, still not used : bytes 2 and 3 = ff ff = 100%
Magenta, 71B20M0, after just little uses: bytes 2 and 3 = 7f ff = 90%
Magenta, 802HME High Yield (CX410 / 510), not used: bytes 2 and 3 = ff ff = 100%
Black ~30%, bytes 2 and 3 = 00 ff = 20%
Blue ~10%, bytes 2 and 3 = 00 7f = 10%
Magenta 0%, bytes 2 and 3 =00 3f = 0%
Yellow ~40%, bytes 2 and 3 = 01 ff = 30%

Bytes 15 and 16 might hold the number of printed pages or some measure of toner consumed, because it seems proportional with the filling percentage, the emptiest has the biggest value, the fullest has the smallest value. Black cartridge always has more toner than the others.
Black ~30% = 0x 0111 = 273
Blue ~10%  = 0x00ef = 239
Magenta 0% = 0x 00123 = 291
Yellow ~40% = 0x 00AD = 173

I printed a report with device statistics. What information might be stored on the cartridge:
Install date (?)
Supply level (bytes 2 and 3?)
Sides on cart (bytes 15 and 16?)
Return program Genuine(??)
Printer Liftime(??)

Try to print more pages and put here the dump and the report, maybe we can map all the bytes
 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #83 on: April 28, 2018, 07:56:08 pm »
Hi,

Another good news for people who have "empty" cartridge with 0 pages left : it's possible to reload the chip, it's not locked (at least, not with the "starter cartridge" delivered with the printer). For this example, we successfully put the "40% left" level of the Yellow toner chip into the "0% left" magenta toner chip, and now, there is "40% magenta left" and it works.

Bonjour pixconfig !

I am following your progress  with great interest.

As I understand, you have developed two way of communicating :

- intercepting the signal on the printer with a dsPIC33EP512MC502 and the associated c program

- reading and writing  to the chip with an arduino program on an atmega 2560

Which one are you using for the latest  reading and writing you mention ?
I assume it is the arduino. Can you confirm ?

What is the wiring  you used ?

Bien amicalement,

Jacques
 

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #84 on: April 29, 2018, 05:26:13 pm »
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #85 on: April 30, 2018, 02:03:15 am »
Salut JacquesBBB, and driver_x !

JacquesBBB : We are using the pin description you discovered in the first page of this topic : First one (longer) is GND, second one is SCL, 3rd one is 3.3V power supply, last one is SDA.

I would like to thank you as we probably wouldn't have done all this without all the information that was already available in this thread. I wasn't even aware about 10 bit addressing existence.


As you saw, yes, for manual read/writes we are using an Arduino (Mega2560, equipped with 8192 bytes of RAM) for directly writing/reading were we want into the chip. We used the dsPIC only as read only, with a self made program for in-situ spying of I2C communication inside the printer, with 3 wires (GND/SDA/SCL) connected on the imaging drum electronic card (that is easily removable, its just like a big toner chip with 4 slots and 1 connector).

https://image.noelshack.com/fichiers/2018/17/7/1525016623-sans-titre2.png
We firstly tried to solder some wires on the chip's contact before putting the cartridge in place, but it was a bad idea since the cartridge was unable to fully take it's place into the printer (toner leaks !)

I would like to add some detail about the wiring with Arduino 2560 :
Atmel AtMega2560 has internal pullup on the RD0 and RD1 port used for I²C, connected to 5v, that cannot be disabled for these pins on this model.

We used, both for SDA and SCL, some 18 kOhms resistor mount for reducing the voltage on the toner chip pins. With this, we have ~3.3v when the bus is high and 0v when the bus is low


driver_x :
Your hypothesis is interesting, I won't have the printer this week but I will do some more test as soon as possible. I also see that there is some others bytes changing everywhere; putting all the data into an Excel helped me to see some similar points but also a lot of questions remaining !

For the lawsuit, I saw a similar document in this thread (2nd page, https://www.eff.org/document/sixth-circuit-opinion), if I understood, it's a case where some company was duplicating a lexmark obfuscated protocol program chip by simply copying the program inside the chip instead of doing its own, which caused some copyright issue.
« Last Edit: April 30, 2018, 02:05:16 am by pixconfig »
 

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #86 on: April 30, 2018, 02:25:50 am »
Salut pixconfig
From the lawsuit we find interesting things (I don't know if it still applies to current cartridges, but is interesting to know):

Quote
[...]
The first program at issue is Lexmark's “Toner Loading Program,” which measures the amount of toner remaining in the cartridge based on the amount of torque (rotational force) sensed on the toner cartridge wheel.   Maggs Aff. ¶ 24, JA 709.   The Toner Loading Program relies upon eight program commands-“add,” “sub” (an abbreviation for subtract), “mul” (multiply), “pct” (take a percent), “jump,” “if,” “load,” and “exit”-to execute one of several mathematical equations that convert the torque reading into an approximation of toner level.   Goldberg Aff. ¶ 21, JA 578;  Maggs Aff. ¶ 24, JA 709.   If the torque is less than a certain threshold value, the program executes one equation to calculate the toner level, and if the torque equals or exceeds that threshold, the program executes a different equation to calculate the toner level.   Goldberg Aff. ¶ 19, JA 576-77.   The exact code of the Toner Loading Program varies slightly for each printer model, and this case involves two versions of the program-one for Lexmark's T520 and T522 printer models and another for Lexmark's T620 and T622 printer models.   The Toner Loading Program for the T520/522 printers comprises 33 program instructions and occupies 37 bytes of memory, while the Toner Loading Program for the T620/622 printers comprises 45 program commands and uses 55 bytes of memory.   To illustrate the modest size of this computer program, the phrase “Lexmark International, Inc. vs.   Static Control Components, Inc.” in ASCII format would occupy more memory than either version of the Toner Loading Program.   Burchette Aff. ¶ 13, JA 106.   The Toner Loading Program is located on a microchip contained in Lexmark's toner cartridges.
[...]
To ensure that consumers adhere to the Prebate agreement, Lexmark uses an “authentication sequence” that performs a “secret handshake” between each Lexmark printer and a microchip on each Lexmark toner cartridge.   Both the printer and the chip employ a publicly available encryption algorithm known as “Secure Hash Algorigthm-1” or “SHA-1,” which calculates a “Message Authentication Code” based on data in the microchip's memory.   If the code calculated by the microchip matches the code calculated by the printer, the printer functions normally.   If the two values do not match, the printer returns an error message and will not operate, blocking consumers from using toner cartridges that Lexmark has not authorized
[...]
The parties agree that Lexmark's printers perform a second calculation independent of the authentication sequence.   After the authentication sequence concludes, the Printer Engine Program downloads a copy of the Toner Loading Program from the toner cartridge chip onto the printer in order to measure toner levels.   Before the printer runs the Toner Loading Program, it performs a “checksum operation,” a “commonly used technique” to ensure the “integrity” of the data downloaded from the toner cartridge microchip.   D. Ct. Op. ¶ 77, at 14.   Under this operation, the printer compares the result of a calculation performed on the data bytes of the transferred copy of the Toner Loading Program with the “checksum value” located elsewhere on the toner cartridge microchip.   If the two values do not match, the printer assumes that the data was corrupted in the program download, displays an error message and ceases functioning.   If the two values do match, the printer continues to operate.
[...]


 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 784
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #87 on: May 01, 2018, 02:54:03 am »
Salut JacquesBBB, and driver_x !

JacquesBBB : We are using the pin description you discovered in the first page of this topic : First one (longer) is GND, second one is SCL, 3rd one is 3.3V power supply, last one is SDA.

I would like to thank you as we probably wouldn't have done all this without all the information that was already available in this thread. I wasn't even aware about 10 bit addressing existence.

Thanks, Its good to know that this effort was useful.

I am trying to implement your arduino file,  but cannot find the following libraries

#include <avr/io.h>
#include <avr/interrupt.h>
#include <compat/twi.h>

where are they ?

Thanks

update : OK,  I see that if I use an AVR chip, there is no problem and the libraries are automatically loaded.

« Last Edit: May 01, 2018, 06:09:26 am by JacquesBBB »
 

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #88 on: May 03, 2018, 05:51:29 am »
Hi again,

From my cs310dn:

Code: [Select]
Cyan, high yeld few pages printed (the chip is not original, "compatible" cartridge)
uint8_t destinationBuffer[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xD7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x65, 0xDA};

Yellow, 60% (normal yeld)
uint8_t destinationBuffer[56] = {0xFF, 0x7, 0xFF, 0xFF, 0xFF, 0xF, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5B, 0x0, 0x0, 0x50, 0x10, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xAF, 0x0, 0x0, 0x0, 0xAD, 0x27};

Magenta(starter) (10%)
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x7F, 0xFF, 0xFF, 0x8D, 0xA, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xEE, 0x0, 0x0, 0x20, 0xA, 0x0, 0x6D, 0x7F, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x1, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xFF, 0xFF, 0x0, 0x0, 0xFF, 0xFF, 0x3, 0x0, 0x0, 0x3, 0xB, 0x0, 0x0, 0x0, 0x4C, 0xB5};

Cyan, starter, (empty)
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x3F, 0xFF, 0xFF, 0x8C, 0xA, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x19, 0x0, 0x0, 0x20, 0xF, 0x0, 0x69, 0x7F, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xFF, 0xFF, 0x0, 0x0, 0xFF, 0xFF, 0x3, 0x0, 0x0, 0x3, 0xC, 0x0, 0x0, 0x0, 0x9A, 0x5B};






 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #89 on: May 08, 2018, 08:18:21 pm »
Hi folks, working back on the printer today

Figuring out that a 2 bytes sized checksum is likely to be CRC 16, and based on the work of qub1n into https://stackoverflow.com/questions/10564491/function-to-calculate-a-crc16-checksum

We successfully implemented the checksum used for 2 last bytes. Enjoy !
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/QtChecksumI2C.zip

Now we are gonna modify all that we can, based of driver_x suggestions and discoveries and test what we can.

There is some last issue, after few prints, it's like if cartridge is finding back it's previous level (magenta is empty again, cyan is in "warning almost empty status" again, even with a cartridge full of toner so it's not likely to be due to a physical sensor). May be another place to modify ?

PS : JacquesBBB, in fact I included and modified (buffer sizes) twi.h without using wire.h so I place the file "twi-all-included.h" at side of the "I2C_TI046B1_Read.ino" file.
 
The following users thanked this post: maxic81

Offline amyk

  • Super Contributor
  • ***
  • Posts: 5770
Re: Lexmark toner chip Ti046b1
« Reply #90 on: May 08, 2018, 09:09:49 pm »
There is some last issue, after few prints, it's like if cartridge is finding back it's previous level (magenta is empty again, cyan is in "warning almost empty status" again, even with a cartridge full of toner so it's not likely to be due to a physical sensor). May be another place to modify ?
It might not be this exact printer/model but I remember there being mentions of printers storing the data from the last X cartridges in its own EEPROM. You should try changing the serial number since that's what it uses to detect "simple" reset attempts like these.
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #91 on: May 09, 2018, 03:09:57 am »
It will be a good idea to check this ! Il will try to print and check.

Based on some test and analysis, and a big thank you to driver_x, here is the Full toner level for starter kits cartridge

Code: [Select]
uint8_t Register56Cyan[56+4] =  {0x00, 0x00, 0x00, 0x00,    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x69, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD3, 0xA2};
uint8_t Register56Mage[56+4] =  {0x00, 0x00, 0x00, 0x00,    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6D, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC4, 0x90};

It based on the following analysis of the different toner chip contents listed on this forum, so you can build your own 56 bytes register depending on which kind of cartridge you are using.

Code: [Select]
Byte 1 : 0xFF everywhere

Bytes 2 and 3 : 0xFFFF is full, 0x7FFF after 2 or 3 pages, 0x003F : 0%, 0x007F : 10~20%, 0x01FF for 40%, 0x07FF for 60%,

Bytes 4 and 5 : 0xFF everywhere

Byte 6 : 0x1F for Full or almost full, 0x8C for empty, 0x8D for almost empty with warning sign, 0x0F seen for 30% 40% and 60%.

Byte 7 : 0x0A for starter kits, 0x00 for others

Bytes 8 to 14 : 0xFF then 0x00, 0x00... everywhere

Byte 15 and 16 : printed pages : 0x0000 for new

Bytes 17 18 19 20 : 0x00 for the first byte everywhere, then 0x??, 0x??, 0x?? depending on cartridge. Non proportionnal. 0x00000000 when new or almost new

Bytes 21 22 23 24 : 0x00 then 3 bytes depending on the cartridge model
back starter : 0x00 61 7F FF
cyan starter : 0x00 69 7F FF
magenta starter: 0x00 6D 7F FF
yellow starter: 0x00 63 7F FF

magenta 71B20M0 : 0x00 C0 00 00
magenta 802HME : 0x00 CD 00 00
cyan high yield for CS310dn : 0x00 D7 00 00
yellow normal yield for CS310dn : 0x00 52 00 00
don't forget to double check when you can, and add new ones when you have !

Bytes 25 26 27 28 : 0x00 00 00 00 everywhere

Bytes 29 and 30 : 0x0000 when new or >= 30%, 0x01 90 (=400) or 0x011D (=285) when warning low level. Final count down rising as approaching the end ?

Bytes 31 32 33 34 35 36 37 38 39 40 : 0x 00000... everywhere

Byte 41 and 42 : 0xFFFF for starter kits, 0x0000 if not starter kit

Byte 43 and 44 : 0x0000 everywhere

Byte 45 and 46 : 0xFFFF for starter kits, 0x0000 if not starter kit

Byte 47 : 0x00 if not used, seen at 0x01 on 2 pages printed, seen as 0x02 if >3 pages, seen at 0x03 when almost (or completely empty)

Byte 48 and 49 : 0x0000 everywhere

Byte 50 and 51 : 0x0000 = new, 0x0001 = few usage, 00AF = ~60%, 0x04C3 = ~40%, 0x0505 = ~30%, 030B and 04C0 = low,  0x04C4 and 0x030C : empty... so when level is low, it's imprevisible

Byte 52 53 54 : 0x00 00 00 everywhere

Byte 55 and 56 : CRC16 Checksum of the 54 previous bytes

So if I'm not wrong, the full level of starter black and starter yellow would be :
Code: [Select]
uint8_t Register56Black[56+4] =  {0x00, 0x00, 0x00, 0x00,    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x61, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFD, 0xC6};

uint8_t Register56Yellow[56+4] =  {0x00, 0x00, 0x00, 0x00,    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF6, 0x5F};
But it should be tested; if it does not work, then we should check the checksum or the cartridge type bytes.

Let's check if the level is changing normally when we print some big pictures ! If not, then it's probably because of what amyk describes. I will watch how the reference number of the cartridge can be changed, probably into the 208 bytes field.
 

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #92 on: May 09, 2018, 04:14:54 am »
Hi again :)
I have made the same analysis with similar result.
Now, after I've read some patents (for example this: https://patentimages.storage.googleapis.com/32/30/7a/832cd3e5de56ed/US5995774.pdf ), my question is : do we have or not lockout bits (bits that, once written, cannot be modified)? Only 1 write once bit is needed to mark that the cartridge is depleted and all our work is for nothing.
« Last Edit: May 09, 2018, 04:48:48 am by driver_x »
 

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #93 on: May 09, 2018, 04:29:35 am »
Now, of course the printer it's checking the toner level using it's mechanical parts (wheels, torque sensors etc) so if you write 100% toner on the chip and the printer is sensing something else, probably it will tell you that the cartridge is defective and needs to be replaced. My opinion is that first you must fill the cartridge with toner, write the new information to the chip and after this to try inserting it in the printer.

I have two new readings, for the balck cartridges:
Code: [Select]
Black starter - empty:
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x3F, 0xFF, 0xFF, 0xC, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xF5, 0x0, 0x0, 0x60, 0x15, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x88, 0x0, 0x0, 0x0, 0x0, 0x67};

Black- High Yeld ~90%:
uint8_t destinationBuffer[56] = {0xFF, 0x1F, 0xFF, 0xFF, 0xFF, 0xF, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xB0, 0x0, 0x0, 0xD0, 0xB, 0x0, 0xD1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, 0xBC, 0x15};
« Last Edit: May 09, 2018, 04:34:38 am by driver_x »
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #94 on: May 09, 2018, 10:34:22 pm »
Hi,
In fact there is good news, even with an almost empty cartridge, the system is working fine when we put the correct 100% values, we successfully consumed some toner and had the cyan toner level slightly reduced (from 100% to 90%) after some big pictures prints.

And the 56 bytes register values of full start Black and full starter Yellow are good too :


We will probably see some missing colors soon or late into the prints, once the cartridge will be completely emptied, even when the "toner level" will be indicating some remaining amount of toner. I would not be surprised if the printer is unable to see if toner is really here or not : the only things that connects the imaging drums and cartridge to the printer are mechanical gears and I2C bus for toner chips. The laser probably "touch" the imaging drums without having to connect anything else but photons, and if there is missing toner powder, then may be nothing can see it, but our eyes once the document is printed.


The fact that, few days ago, the toner chip previous level was restored by the printer, is probably due to the fact that the "Yellow" cartridge type was copied into the others (our first try) and it was probably not a completely good idea, of course, since every cartridge has it own type bytes into the 56 bytes register (then it should probably be respected - it's what we dit yesterday and it seems better).

Also, may be the fact that the 56 bytes register is written 2 times is a way to give a second chance to read the data when it's corrupted or abnormal. Then, if it's not enough, then the printer probably keeps a local copy of those register in order to restore it (probably what happened).

And a final good thing to know, at least for starter kit : the chip was indicating "empty", "0 pages left", no print possible, and we succeeded in putting "100%" level into it.
 

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #95 on: May 10, 2018, 06:14:03 am »
So they calculate the remaining toner only by estimating how much powder has been used based on the number of pages printed (or maybe based on how many rotations the mirror has made)??? I thought that the motor that is turning the cartridge's wheels had some kind of torque sensor, so in case that the number stored in the cartridge becames "corrupt", the printer to be able to estimate again the quantity of remained toner, as stated in their patent:
Quote
"The sensor S may take the form of a mechanical sensor that detects torque required to turn an auger positioned in the reservoir, an optical sensor that uses light to measure the amount of toner, or any other sensor configuration that provides feedback regarding the amount of toner remaining in the reservoir."
https://patents.google.com/patent/US7747180?oq=lexmark+toner+level

Anyway, thank you for all the hard work  :-+
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #96 on: May 29, 2018, 01:55:32 am »
Hi everybody !

We still had some issues, sometimes, with the cartridge emptying a little bit too fast (sometimes way too fast, after less than 50 pages), even when full of toner into the cartridge.
So we tried to figure out what is into the 208 bytes register at 0x01 > 0x90

There is a 30 bytes UUID around the end of this 208 bytes register, that finishes with the famous CRC16 (the one that we are now, of course, able to check/complete). All the rest is completely fulfilled with 0x00 for a brand new cartridge.
Here is the analysis :
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/208byte-analysis.ods

And after a lot of uses, we finally see some changes into this register, so it should be reset too.

We updated the Arduino code in order to auto-reset the connected cartridges, keeping the information that should be kept, and recalculating the CRC16 automatically at the end for both 56 and 208 bytes registers.

It firstly reads the content of every register before changing the values that should be changed, automatically.

Enjoy ! https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Reset.zip

May be at the end it would be nice to try to modify the 30 bytes UUID, but let's first try to see if it works without changing it.
 
The following users thanked this post: maxic81

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #97 on: May 29, 2018, 10:40:00 pm »
I know exactly where to store the cartridge capacity for Lexmark MS\MX. I ask to lay out a chain of 448 bytes starting from 02_40_04 for Lexmark CS order in  to verify in the same place the capacity of the cartridge is stored in the Lexmark of the CS or not.
 
The following users thanked this post: maxic81

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #98 on: June 01, 2018, 12:39:00 am »
Hi,

Thank you much for this information ! :) Do you succeeded to write this area ? I didn't succeeded.
01>40>04 is located at (4x256 + 64) bytes and is read during 448 bytes, so from 1024+64 to 1536 bytes (it's like if the printer reads from 1024 to 1024+512 but without the 64 first bytes).

Did you guess some interpretation of what's inside this register ? I see there is some ASCII strings but also some binary datas and lot of "0x00".

Here is the content of a brand new chip I have :

But it's not compatible with my printer... anyway it's still interesting to watch what is inside and compare with others.


My persistent problem of today is :  the printer says my magenta cartridge reached end of life at each print.
So I finally tried to change the 30 bytes UUID inside the 02>90>00 register but after any print, it says "end of life" for the magenta cartridge, again.

No problem with the others, that's pretty strange, may be there is a real physical problem with the magenta but it is completely new and full, I just changed the chip to play a little bit and understand how those chips works, and because the original chip of this cartridge says "not compatible with this printer". I also checked if the cartridge is, physically, the same, and yes obviously. I have no more idea for the moment !  :-[

I guess the 12 first bytes of 01>40>04 (that contains the same barcode stuck on the cartridge sticker) should be changed too; It may have som key procedure to write this area (starting to a precise byte during a precise length for having the chip accepting the written value ?)
« Last Edit: June 01, 2018, 12:55:35 am by pixconfig »
 
The following users thanked this post: maxic81

Offline Arturo2511

  • Newbie
  • Posts: 1
  • Country: be
Re: Lexmark toner chip Ti046b1
« Reply #99 on: June 01, 2018, 12:14:36 pm »
hello,
from my research, the problem comes from the fact that the chip retains the number of copies made since the beginning. When the cartridge is reset to 0, that if it is 100% but the copy number remains unchanged. The printer will check if the number of copies is less than or equal to the maximum capacity of the printer. After resetting a chip with 80% remaining but the number of copies unchanged (1538 copies / 1500 max) that if automatically becomes empty after the first impressions while he had 80% of free (it went from 100% - > 0). I did not manage to dump the memory of the chip to compare the data before and after. If you had an arduino program to read the whole of the chip, I'm interested. I communicate with the chip by i2c but 10-bit registers are difficult to read with an arduino.
 

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #100 on: June 03, 2018, 12:31:37 am »
Hi, you can find the program and instructions for reading/writing the chip with arduino in the previous posts. We managed to find where on the chip is stored the number of printed pages and also where is stored the actual toner level, so the problem is not here.
Maybe the printer is also storing into its internal memory(not on the cartridge) the serial number of the cartridge along with a timestamp and probably more information about the cartridge.
 
The following users thanked this post: maxic81

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #101 on: June 09, 2018, 10:47:44 am »
What data is stored in the chip from Lexmark CS series with offset 0x045f and 0x0460? In the lexmark MS/MX, if you transfer this data to the DEC, you get the capacity of the cartridge. I tested this on more than 10 different models of the cartridge.
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #102 on: June 29, 2018, 07:59:05 am »
Hi,

At offset 0x045f and 0x0460 (by reading 0x01 > 0x5F > 0x04 during 2 bytes) we found 0x60 and 0x12 on starter kits cartridges.

We have been unable to write after offset 0x400 (past 0x02 > 0x00 > 0x04).
We tried by replacing the 0x02 first byte with any value from [0x00 to 0xFF] but it did nothing.

We also tried to write at 0x02 > 0x00 > 0x08 (so at offset 0x800 which is 2048) and 0x02 > 0x00 > 0x0C (so at offset 0xC00 which is 3072) but it did nothing too.

We are out of ideas now  :-[
We also tried to reset to factory setting the printer (by typing 2 + 6 at power on for entering into maintenance menu), with no cartridge in the printer, and we placed the cartridge after, with an almost new magenta cartridge but an empty reset starter kit chip on it, and we were disconnected from network during all this. After few minutes it said again that the magenta cartridge is "end of life" with 0 page left.

Finally, we had some return from some people, that the Reset Program for Arduino corrupted some toner chip information after having fail to read the content before modifying it, but successfully writing it back to the toner chip... with a lot of 0x00 !

So we modified the program in order not to write anything if the reading fails before. The new version is here : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Reset.zip

Any more idea is welcome !
Bye
 
The following users thanked this post: maxic81

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #103 on: June 30, 2018, 07:28:37 am »
Все изменения в дампе картриджа должны быть подписаны хэшем который храниться в дампе начиная со смещения 0х700. Чтение и изменения хэша происходит через посылку 14 байт в регистр 81. И только после декодирования запросов в 81 регистр и ответов в регистр 80 можно будет полноценно восстанавливать чипы.
« Last Edit: June 30, 2018, 07:38:33 am by AndreiKenig »
 
The following users thanked this post: maxic81, driver_x, pixconfig

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #104 on: July 02, 2018, 03:13:33 am »
Quote
All changes to the cartridge dump must be signed by a hash that is stored in the dump since the 0x700 offset. Reading and modifying the hash is via sending 14 bytes to register 81. And only after decoding the requests in the 81 register and the responses to register 80 it will be possible to fully restore the chips.

Hi AndreiKenig, Thank your for this answer, actually the printers does a ton of exchanges on 0x81 and associated registers. I believed this was only a "genuine check" when I successfully edited the cartridge level for the first time so I didn't looked after it for a while, but now that we realize there is something else, this make sense to watch again over it!

Here is what I saw when I watched it for the first time with the dsPIC :

0x82 is a kind of Status Register that the printers reads before asking anything to 0x81 or 0x80 :
status 0x38 is "nothing more to say, please enter something into 0x81"
status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
     
status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09

0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time

I also noticed after that in the middle of the 16 bytes answer inside 0x82, there is two bytes that never changes on each cartridge
 
The following users thanked this post: maxic81, driver_x

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #105 on: July 03, 2018, 09:53:34 am »
Работа с регистрами 81 и 80 идёт циклами сначала с тонер картриджем затем с драм картриджем. Принтер выходит в готовность когда при последнем ответе в регистре 80 драм картриджа 15 байт начиная с 0 передаёт значение 0х88 (истина).
 
The following users thanked this post: maxic81

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #106 on: July 03, 2018, 09:58:19 am »
0x82 - это своего рода регистр состояния, который печатает на принтере, прежде чем спрашивать что-либо 0x81 или 0x80:
статус 0x38 «больше нечего сказать, пожалуйста, введите что-то в 0x81 «
status 0x48 -« 0x81 Регистр получен 0x08 »(позволяет вызывать этот режим 0x08)
status 0x88 является следующим шагом: 14 байтов вопрос записывается в 0x81 после ввода режима 0x08
     
статус 0x49 - «0x81 Регистр принят 0x09» (позволяет вызывать этот режим 0x09).
0x89 - это следующий шаг: вопрос 14 байтов записывается в 0x81
после ввода режима 0x09

0х98  - ошибка, картридж заблокирован
после в ответе регистр 0х80 будет 16 байт 0х00
« Last Edit: July 03, 2018, 10:48:47 am by AndreiKenig »
 
The following users thanked this post: maxic81, driver_x

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #107 on: July 09, 2018, 09:16:47 am »
Hello friends!

Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?

Regards!

 

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #108 on: July 10, 2018, 03:57:07 am »
Полный дамп снять не получиться. Адреса с 0х00 по 0х1F, c 0x170 по 0x3FF и c 0x700 по 0x7FF считать будет невозможно. Вернее данные в них будут ошибочны либо 00 либо FF. Вышеуказанные области защищены от прямого чтения.
 
The following users thanked this post: maxic81, Alan.B

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #109 on: July 11, 2018, 07:29:12 am »
Perfect! Thank you!

I will try to use my Saleae Logic Analyzer and see if I get more information about it. At the moment I am building a logic level converter to protect the memory. Unfortunately, my logic analyzer only works with 8-bit i2c readings, but I think the data can be interpreted anyway. If someone has the time, the knowledge and the desire, could modify the *.dll´s starting from the SDK of Saleae and I will gladly use it to make readings in the printer and observe what happens with the addresses that you mention in the previous post.

Regards!  :-+
 

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #110 on: July 13, 2018, 06:47:30 am »
Hello friends!

Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?

Regards!
Всем, Привет!
Немного исправил рисунок

Hello Friend!
The circuit that I attach in my post is correct! The one that you attached in your post is not correct!
 

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #111 on: July 13, 2018, 11:30:48 am »
Hello again!

I can not get the pixconfig source code to work to read the chips :(
I already tried 9 chips but nothing yet ...

This is the error that throws "Error occured wile trying to write to the slave: Slave's address not acknowledged (begning only) - is it connected?"

My configuration is Arduino -> Logic Level -> Chip

According to what I read it may be an error in my i2c address, does anyone know how I calculate the address of the Ti046b1?

Regards!
 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #112 on: July 14, 2018, 05:31:05 am »
I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.
 
The following users thanked this post: Alan.B

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #113 on: July 14, 2018, 08:17:29 am »
I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

Hello Friend!

Seeing on the internet, the chip of the model that you commented "MX410" is exactly the same as my "MS810" chip ...
The log that you shared, is a chip reset to new?
If so, it would be useful to perform tests on my chip.

Regards!
 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #114 on: July 14, 2018, 02:01:27 pm »
is a chip reset to new?
Yes. But when the chip was reset, the programmer gave an error. I can check the chip later.
In the sketch pixconfig when reading 01> 20> 00 reads 56 bytes, and in the logs read 16 bytes. A very big difference in the methods of reading between the sketch and the logs.
« Last Edit: July 17, 2018, 10:34:21 pm by Technics66 »
 

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #115 on: July 14, 2018, 06:27:43 pm »
Чтение и запись данных по адресам  диапазона с 0х700 по 0х7FF производится через команды в регистр 0х81
 

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #116 on: July 14, 2018, 10:29:41 pm »
А кто нибудь может сказать почему чтением в скетче 01> 20> 00 получается 56 байт, а программатором видно что читается 8 байт? Это от чипа зависит или от чего-то другого?
Я читаю своим программатором строки по 16 байт и у меня проблемы не возникают
 

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #117 on: July 16, 2018, 08:40:48 am »
I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

Friend! Analyzing your log "Log_MX410", after consulting the model in the registry 0x01 0x50 0x04, the programmer obtains the 14 bytes to record in the registry 0x81. Has anyone already discovered how this is done?

I also want to tell you that I modified the functions created by pixconfig a bit, when I have it completely ready it will be posted, but for now I need to know how to calculate the 14 bytes for the 0x81 register.

Regards!
 
The following users thanked this post: maxic81

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #118 on: July 17, 2018, 11:23:53 am »
More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...

Regards!

Code: [Select]
-------------------------------------------------------------------------------------------------------------
BLOCKED CHIP
-------------------------------------------------------------------------------------------------------------
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00

-------------------------------------------------------------------------------------------------------------
NEW CHIP
-------------------------------------------------------------------------------------------------------------
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: C8
Send: 0x80 | Response: 00 00 00 00 00 00 5A06 00 00 00 00 00 00 00 80
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 5770
Re: Lexmark toner chip Ti046b1
« Reply #119 on: July 17, 2018, 11:29:51 am »
Please keep the discussion in English, translate it yourself before posting, this is an interesting topic but hard to read if everyone has to use Google Translate themselves.
 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #120 on: July 17, 2018, 05:24:06 pm »
More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...
Please give your sketch.
I have 5 chips locked and 3 chips not locked.
I can check with your sketch sooner.
 

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #121 on: July 18, 2018, 08:01:38 am »
More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...
Please give your sketch.
I have 5 chips locked and 3 chips not locked.
I can check with your sketch sooner.

Of course I share it with you! Sorry for my English helped me with Google translator.
If you get successful results, please share them with the community!

Regards!

Code: [Select]
#include "twi-all-included.h"


void setup()
{
  Serial.begin(9600); //[Start+8bits+STOP] => 960 o/s
  twi_init(); //Standard 100 kHz Atmel's internal I2C device initialisation with Pull-Up on SDA/SCL
}

void read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom)
{
  uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSB
  uint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB
 
  //Put the MSB bits to the Left :
  slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003
 
  //7 bits address equivalent for the begining :
  uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.
 
  //Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.
  uint8_t txBuffer[registerSize + 1];

  for(uint8_t i = 0; i < sizeof(txBuffer); i++)
  {
    if(i==0)
    {
      txBuffer[i] = slave_address_LSB;
    }
    else
    {
      txBuffer[i] = registerBuffer[i-1];
    }
  }

  uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);
  if (nRet == 1)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave : TWI class's buffer is too small");
    Serial.println("W1");
    return;
  }

  else if (nRet == 2)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave : Slave's address not acknowldged (begning only) - is it connected ?");
    Serial.println("W2");
    return;
  }
 
  else if (nRet == 3)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave :");
    //Serial.println("Slaves's begining of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?");
    Serial.println("W3");
    return;
  }

  else if (nRet == 4)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("I2C protocol error occured wile trying to write to the slave. Is the wiring correct ? TWI Initialisation ?");
    Serial.println("W4");
    return;
  }
 
  //else :
  nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end. 
  if (nRet == 0x00)
  {
    //Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.
    //Serial.println("Error occured wile trying to read from the slave.");
    Serial.println("R1");
    return;
  }

  if (nRet != readSize)
  {
    //Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.
    Serial.print("Unable to read all the bytes from the slave : ");
    Serial.print(nRet, DEC);
    Serial.println(" bytes read");
   
    return;
  }

  //else :
  for (uint16_t i=0; i<readSize; i++)
  {
    //Serial.print("0x");
    if (destinationBuffer[i] < 0x10)
    {
      Serial.print(0, HEX);
      Serial.print(destinationBuffer[i], HEX);
    }
    else
    {
      Serial.print(destinationBuffer[i], HEX);
    }
  }
  Serial.println("");
}

//Delcopi sequence obtained from "Log_MX410" by Technics66
uint8_t a[1] = {0x03};
uint8_t a_[1];

uint8_t b[1] = {0x83};
uint8_t b_[1];

uint8_t c[3] = {0x01,0x50,0x04};
uint8_t c_[16];

uint8_t d[1] = {0x82};
uint8_t d_[1];

uint8_t e[2] = {0x81, 0x08};
uint8_t e_[1];

uint8_t f[1] = {0x82};
uint8_t f_[1];

uint8_t g[15] = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};
uint8_t g_[1];

uint8_t h[1] = {0x82};
uint8_t h_[1];

uint8_t i[1] = {0x80};
uint8_t i_[16];


void loop()
{
  char command = getCommand();
  switch (command)
  {
    case 'a':
      Serial.print("Send: 0x03 | Response: ");
      //read_TI046B1_register(ADDR, CMD, sizeof(CMD), BUFFER_RESPONSE, sizeof(BUFFER_RESPONSE), STOPCOM 1|0);
      read_TI046B1_register(0x000, a, sizeof(a), a_, sizeof(a_), 0);
      break;
    case 'b':
      Serial.print("Send: 0x83 | Response: ");
      read_TI046B1_register(0x000, b, sizeof(b), b_, sizeof(b_), 0);
      break;
    case 'c':
      Serial.print("Send: 0x01,0x50,0x04 | Response: ");
      read_TI046B1_register(0x000, c, sizeof(c), c_, sizeof(c_), 0);
      break;
    case 'd':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, d, sizeof(d), d_, sizeof(d_), 0);
      break;
    case 'e':
      Serial.print("Send: 0x81, 0x08 | Response: ");
      read_TI046B1_register(0x000, e, sizeof(e), e_, sizeof(e_), 1);
      break;
    case 'f':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, f, sizeof(f), f_, sizeof(f_), 0);
      break;
    case 'g':
      Serial.print("Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: ");
      read_TI046B1_register(0x000, g, sizeof(g), g_, sizeof(g_), 1);
      break;
    case 'h':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, h, sizeof(h), h_, sizeof(h_), 0);
      break;
    case 'i':
      Serial.print("Send: 0x80 | Response: ");
      read_TI046B1_register(0x000, i, sizeof(i), i_, sizeof(i_), 0);
      break;
  }
}

char getCommand()
{
  char c = '\0';
  if (Serial.available())
  {
    c = Serial.read();
  }
  return c;
}


 
The following users thanked this post: maxic81

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #122 on: July 18, 2018, 11:54:59 pm »
Alan.B
Your sketch does not work. There is no information in the terminal.  :(
I'm using Arducopter on ATMEGA 2560.
I found out that the page counter is located at 0xE1 2 byte.
I have several dumps from different chips. Are they needed?
« Last Edit: July 19, 2018, 12:00:27 am by Technics66 »
 

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #123 on: July 19, 2018, 08:08:50 am »
Friends!

maxic81:
Reading errors I solved by removing the resistors in the SDA and SCL lines.

Technics66:
I'm using the sketch I uploaded in the previous post, are you adding the library "#include" twi-all-included.h ""?
I would like you to upload your dumps, all information is valuable.

To add information...
Reading one of the printer's manufacturer's patents, they indicate that the authentication KEY is stored in memory, it only changes when new changes are made to it.

Regards!

PS: I continue to investigate  ;D
 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #124 on: July 19, 2018, 07:26:36 pm »
Alan.B
Sorry. I did not understand that I should enter a, b, c, d ... The sketch works.
Code: [Select]
------ UnBlock-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0D40116CBB70880CDB38A
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0C7017B0EE30DF199F38B
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0F0015709189211715C84

-----Block-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01940050323446313338320000000905
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000

The programmer DelCopi badly flushes the chip. He writes that 500 pages are printed.  >:(
Мemory addresses where the information:
0x00E1-0x00E2 Number of pages printed //0x16, 0x32  (5682 pages)
0x0440-0x044B Serial number           //0x43, 0x41, 0x44, 0x31, 0x37, 0x33, 0x31, 0x38, 0x31, 0x35, 0x34, 0x33 (CAD173181543)
0x0453-0x045A Model                   //0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x33 (P24F0003)
0x045F-0x0460 Volume of the cartridge //0x13, 0x88 (5000)
Attaching dump chips. In the name "reset" this chip was dropped and after that printed.

 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #125 on: July 20, 2018, 04:21:57 am »
Log reset of the chip P24F1382 (Starter MX317) by the programmer DelCopi without error after completion.
 

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #126 on: July 20, 2018, 08:16:19 am »
Friend, thank you for your logs, they are very helpful!

Could you add these lines to the sketch? They are to make a full dump of the chip! And I would need you to upload those dumps, especially the reset chip and if you can also do a full dump of a chip before the reset with delcopi and after the reset, better!

Code: [Select]
//In variables
uint8_t k[3] = {0x01, 0x00, 0x00};
uint8_t k_[1024];

uint8_t l[3] = {0x01, 0x00, 0x04};
uint8_t l_[1024];

//In "switch" function
case 'k':
  Serial.print("Send: 0x01, 0x00, 0x00 | Dump1: ");
  read_TI046B1_register(0x000, k, sizeof(k), k_, sizeof(k_), 0);
  break;
case 'l':
  Serial.print("Send: 0x01, 0x00, 0x04 | Dump2: ");
  read_TI046B1_register(0x000, l, sizeof(l), l_, sizeof(l_), 0);
  break;
 

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #127 on: July 23, 2018, 04:40:16 am »
Alan.B
Sorry. I did not understand that I should enter a, b, c, d ... The sketch works.
Code: [Select]
------ UnBlock-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0D40116CBB70880CDB38A
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0C7017B0EE30DF199F38B
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0F0015709189211715C84

-----Block-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01940050323446313338320000000905
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000

The programmer DelCopi badly flushes the chip. He writes that 500 pages are printed.  >:(
Мemory addresses where the information:
0x00E1-0x00E2 Number of pages printed //0x16, 0x32  (5682 pages)
0x0440-0x044B Serial number           //0x43, 0x41, 0x44, 0x31, 0x37, 0x33, 0x31, 0x38, 0x31, 0x35, 0x34, 0x33 (CAD173181543)
0x0453-0x045A Model                   //0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x33 (P24F0003)
0x045F-0x0460 Volume of the cartridge //0x13, 0x88 (5000)
Attaching dump chips. In the name "reset" this chip was dropped and after that printed.


Number of pages printed  0x131, 0x132
 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #128 on: July 24, 2018, 01:47:28 am »

Number of pages printed  0x131, 0x132
I noticed that 0x0C0-0FF = 0x110-0x14F.
There are new cartridges P50F5H00. I took the dumps from the new one installed in the printer 317, installed in the MFP410 and printed pages.
« Last Edit: July 24, 2018, 02:23:59 am by Technics66 »
 

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #129 on: July 24, 2018, 11:51:29 am »
Technics66! You would have some chip of these 24D0002, 52D4000, 52D4H00, 52D4X00. They are the ones that I have, but I can not authenticate in the registry 0x81; and I think if you try to read with Delcopi any of these in the log you could get an authentication key and it would be very useful ...

I leave you a new sketch, which optimizes a bit the use of memory in global variables.

With "t", perform a test chip (chip information)
with "d", perform a full dump of the chip.

Regards!

Code: [Select]
#include "twi-all-included.h"

void setup()
{
  Serial.begin(9600); 
  twi_init();
}

bool read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom)
{
  uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSB
  uint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB
 
  //Put the MSB bits to the Left :
  slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003
 
  //7 bits address equivalent for the begining :
  uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.
 
  //Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.
  uint8_t txBuffer[registerSize + 1];

  for(uint8_t i = 0; i < sizeof(txBuffer); i++)
  {
    if(i==0)
    {
      txBuffer[i] = slave_address_LSB;
    }
    else
    {
      txBuffer[i] = registerBuffer[i-1];
    }
  }

  uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);
  if (nRet == 1)
  {
    Serial.println("W1");
    return;
  }
  else if (nRet == 2)
  {
    Serial.println("W2");
    return;
  }
  else if (nRet == 3)
  {
    Serial.println("W3");
    return;
  }
  else if (nRet == 4)
  {
    Serial.println("W4");
    return;
  }
 
  nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end. 
  if (nRet == 0x00)
  {
    Serial.println("R1");
    return;
  }
 
  if (nRet != readSize)
  {
    Serial.println("R2");
    return;
  }

  if (nRet == readSize)
  {
    for (uint16_t i=0; i<readSize; i++)
    {
      //Serial.print("0x");
      if (destinationBuffer[i] < 0x10)
      {
        Serial.print(0, HEX);
        Serial.print(destinationBuffer[i], HEX);
      }
      else
      {
        Serial.print(destinationBuffer[i], HEX);
      }
      if(i != readSize) Serial.print(" ");
    }
    Serial.println("");
   
    return true;
  }

}

//DelCopi Secuence
uint16_t a_ = 1, b_ = 1, c_ = 16, d_ = 1, e_ = 1, f_ = 1, g_ = 1, h_ = 1, i_ = 16, k_ = 1024, l_ = 1024;
uint8_t a[1] = {0x03};
uint8_t b[1] = {0x83};
uint8_t c[3] = {0x01,0x50,0x04};
uint8_t d[1] = {0x82};
uint8_t e[2] = {0x81, 0x08};
uint8_t f[1] = {0x82};
uint8_t g[15] = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};
uint8_t h[1] = {0x82};
uint8_t i[1] = {0x80};
//Full Dump!
uint8_t k[3] = {0x01, 0x00, 0x00};
uint8_t l[3] = {0x01, 0x00, 0x04};
//One Buffer for all!
uint8_t rxBuffer[1024];

void loop()
{
  char command = getCommand();
  switch (command)
  {
    case 't': //Test Chip
        Serial.print("Send: 03 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, a, sizeof(a), rxBuffer, a_, 0);
        Serial.print("Send: 83 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, b, sizeof(b), rxBuffer, b_, 0);
        Serial.print("Send: 01 50 04 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, c, sizeof(c), rxBuffer, c_, 0);
        Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, d, sizeof(d), rxBuffer, d_, 0);
        Serial.print("Send: 81 08 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, e, sizeof(e), rxBuffer, e_, 1);
        Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, f, sizeof(f), rxBuffer, f_, 0);
        Serial.print("Send: 81 4E 86 61 AE 96 54 C2 31 FA C6 2D 53 74 35 \t| Response: ");//81 4E 86 61 AE 96 54 C2 31 FA C6 2D 53 74 35
        read_TI046B1_register(0x000, g, sizeof(g), rxBuffer, g_, 1);
        Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, h, sizeof(h), rxBuffer, h_, 0);
        Serial.print("Send: 80 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, i, sizeof(i), rxBuffer, i_, 0);
        Serial.println("");
      break;
    case 'd': //Dump Chip
        Serial.print("Full Dump: ");
        read_TI046B1_register(0x000, k, sizeof(k), rxBuffer, k_, 0);
        read_TI046B1_register(0x000, l, sizeof(l), rxBuffer, l_, 0);
        Serial.println("");
      break;
  }
}

char getCommand()
{
  char c = '\0';
  if (Serial.available())
  {
    c = Serial.read();
  }
  return c;
}
 

Offline Bigkim

  • Contributor
  • Posts: 5
  • Country: ca
Re: Lexmark toner chip Ti046b1
« Reply #130 on: July 24, 2018, 04:06:11 pm »
 I work for a company that sells generic cartridges that are not refilled, but are manufactured by a different company.
Our chips no only give a "Full" reading at all times,but more importantly trick the printer into thinking that a cartridge is original.
We actually find that "compatables" cost less than refilling, and since refilling is messy, and a lot of "toner empty" notifications are actually mechanical problems in disguise,  so we have found compatables a better route.
 Printer companies spend a lotta time trying to keep non-original compatable cartridges outta their printers, and often try to "root" us out with frequent "printer upgrades" by email.
Luckily our Asian suppliers keep one step ahead of them, as are one of Amazons top suppliers, with 100% customer satisfaction, over 20 years.
 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #131 on: July 26, 2018, 11:57:01 pm »
By studying the reset and use logs, I concluded that there are 5 blocks with data. At the end of each block there seems to be a checksum (CRC16).
1. 0x020 - 0x0BD. CRC in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0X0E9. CRC in 0x0EA-0x0EB (42 byte + 2 byte CRC16)
3. 0x0EC - 0x10D. CRC in 0x10E-0x10F (32 byte + 2 byte CRC 16)
4. 0x110 - 0x139. CRC in 0x13A-0x13B = block 2 (42 byte + 2 byte CRC16)
5. 0x13C - 0x15D. CRC in 0x15E-0x05F = block 3 (32 byte + 2 byte CRC 16)
I'm not sure about the checksums, but when resetting the programmer in these addresses writes data that is not read anywhere. Check and understand what kind of data I could not.
 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #132 on: July 27, 2018, 06:28:31 pm »
Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.
UPD.
Using the code for calculating the checksum
Code: [Select]
uint16_t crc16(const uint8_t* data_p, uint8_t length)
{
    uint8_t x;
    uint16_t crc = 0xFFFF;

    while (length--)
    {
        x = crc >> 8 ^ *data_p++;
        x ^= x >> 4;
        crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
    }
    return crc;
}
Computed that 3 blocks and not 5.
1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)
3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2
I will write a sketch for resetting the chip.
« Last Edit: July 28, 2018, 02:06:32 am by Technics66 »
 

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #133 on: July 28, 2018, 04:04:21 am »
0x450 0x451 Initial Quanta (константа расчёта расхода тонера) постоянная
0xE3 0xE4 Изменяемая кванта
0x133 0x134 = 0xE3 0xE4 Изменяемая кванта
Initial Quanta значение по которому рассчитывается расход тонера на печать
Изменяемая кванта - откорректированное значение Initial Quanta в зависимости от вращения мешалки картриджа
Так же "изменяемая кванта" меняется от результата проверки OEM или NotOEM
 
The following users thanked this post: Alan.B, Technics66

Offline Alan.B

  • Contributor
  • Posts: 12
  • Country: ar
Re: Lexmark toner chip Ti046b1
« Reply #134 on: July 28, 2018, 07:05:20 am »
Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.
UPD.
Using the code for calculating the checksum
Code: [Select]
uint16_t crc16(const uint8_t* data_p, uint8_t length)
{
    uint8_t x;
    uint16_t crc = 0xFFFF;

    while (length--)
    {
        x = crc >> 8 ^ *data_p++;
        x ^= x >> 4;
        crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
    }
    return crc;
}
Computed that 3 blocks and not 5.
1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)
3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2
I will write a sketch for resetting the chip.

Technics66:
Analyzing your dumps, I saw that by inserting the cartridge with the new chip, the printer makes changes to the serial number ... Could you connect the analyzer and take data from all this? I was left without the printer, it was from a client, but I want to continue with the investigation.

I attach your dumps, I turned them into bin.

Regards!
 
The following users thanked this post: AndreiKenig

Offline AndreiKenig

  • Contributor
  • Posts: 11
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #135 on: July 28, 2018, 07:22:17 am »
Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.
UPD.
Using the code for calculating the checksum
Code: [Select]
uint16_t crc16(const uint8_t* data_p, uint8_t length)
{
    uint8_t x;
    uint16_t crc = 0xFFFF;

    while (length--)
    {
        x = crc >> 8 ^ *data_p++;
        x ^= x >> 4;
        crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
    }
    return crc;
}
Computed that 3 blocks and not 5.
1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)
3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2
I will write a sketch for resetting the chip.

Technics66:
Analyzing your dumps, I saw that by inserting the cartridge with the new chip, the printer makes changes to the serial number ... Could you connect the analyzer and take data from all this? I was left without the printer, it was from a client, but I want to continue with the investigation.

I attach your dumps, I turned them into bin.

Regards!

The printer never changes the serial number of the chip, which is in the range 0x440 - 0x44b and consists of 12 bytes

And attached dumps are not suitable for analysis, because there are a lot of incorrectly read data in them.



« Last Edit: July 28, 2018, 07:31:41 am by AndreiKenig »
 

Offline Technics66

  • Contributor
  • Posts: 10
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #136 on: July 28, 2018, 02:00:49 pm »
Alan.B
The serial number does not change. You took the dump from another chip. I spread two dumps from 50F5H00 with different serial numbers (CAP142340A90 & CAS1218556D7).
AndreiKenig
Is it possible to take a complete dump with TI046B1? Full dump can only be read directly from FRAM. I have not come across chips which could be considered a dump.  :(
 

Offline Kulick

  • Newbie
  • Posts: 2
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #137 on: August 09, 2018, 03:25:40 am »
Hi, friends.
There are devices, there are chips and empty and new. Need help?
Can I join the decision? ;)
Thanks.
 

Online driver_x

  • Contributor
  • Posts: 20
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #138 on: August 10, 2018, 07:37:01 am »

    • 0x82 is a kind of Status Register that the printers reads before asking anything else.
      • status 0x38 is "nothing more to say, please enter something into 0x81"
         
      • status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
      • status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
         
      • status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
      • status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09

    • 0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time

    Registers that are being write :
    • 0x04 is the first register that is called on each cartridge, with a Stop occuring during ACK (there is no ACK or NACK bit), followed by a useless start stop, observed by oscilloscope too. Let's guess this is useless. But it's common to the 5 cartridges (well, 4 cartridge and 1 imaging drum).

    • 0x81 is the only one register that is written after closing the lid. It's a command register that influences the status register (0x82) and define what will be read into 0x80. We can see single byte writes on it (0x08 or 0x09) for selecting what looks like a mode, then a 14 bytes question write (with something that looks like it's totally unpredictable) before being able to read 16 bytes into 0x80 (16 bytes that also looks like they are totally unpredictable).


    This looks like the chip authenticating protocol described here: https://patents.google.com/patent/US20060224889A1/en?q=md5&assignee=lexmark



     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #139 on: August 21, 2018, 08:20:38 am »
    Here's some info i've discovered so far:
    The size of the FRAM is 2048 bytes. The size is specified here : http://techinsights.com/reports-and-subscriptions/open-market-reports/Report-Profile/?ReportKey=CAR-1504-802. Also you can verify this by trying to read addresses bigger than 2048 bytes, it will start to read from the beginning.

    The corespondence of the memory offsets and the registers discovered by pixconfig here: http://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1472727/#msg1472727 is the following:

    Register 0x01>0x20>0x04 = memory offset 0x0420 = 1056 decimal
    Register 0x01>0x40>0x04 = memory offset 0x0440 = 1088 decimal
    [..]etc
    So basically you form the offset's hex number by reversing the order of the register's bytes.

    If you want to dump the entire chip, you can read the register 0x01>0x00>0x00 size 2048 (it didn't work for me) or read in two chunks of 1024 bytes (first 0x01>0x00>0x00 size 1024 then 0x>0x01>0x00>0x04 size 1024)

    @pixconfig:
    the following offsets are not read/written in your dumps, so this needs further investigation:

    Offset 0x160 (register 0x01>0x60>0x01), size 6 bytes, this one is repeating at offset 0x400 (register 0x01>0x00>0x04)

    also Offset 0x408 (register 0x01>0x08>0x04) - 4 bytes long - contains data that is not read/written in your dumps.

    Maybe there registers are written by the chip (the same way the copy of 20 00 register is written without any specific instruction from the printer.

    The other bytes that are not read/written contains either 00 f7 either 00.
    « Last Edit: August 21, 2018, 09:00:53 am by driver_x »
     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #140 on: August 22, 2018, 02:52:55 am »
    Hi!
    The first 2 bytes are overwritten and they encrypt the first 32 bytes and the last 256 bytes.
    verified personally ;)
    First 32 bytes and last 256 are just a series of 00 F7, at least in my dump, here's the map I've made:
     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #141 on: August 22, 2018, 07:55:59 am »
    Some small research:


    >>>Only for starter cartridges<<<:

    Year of installation: 0xAF, size = 2 bytes
    Month of installation: 0xB2, size = 1 byte
    Day of installation : 0xB4, size = 1 byte

    Another timestamp:
    Year: 0xc3, size = 2 bytes
    Month: 0xc6, size = 1 byte
    Day: 0xc8, size = 1 byte

    Probably the expiration year: 0xD5, size=2 bytes

    Yet Another timestamp:
    Year: 0xd7, size = 2 bytes
    Month: 0xda, size = 1 byte
    Day: 0xdc, size = 1 byte

    >>>end only for starter cartridges<<<


    pageCount : 0x51 - 2 bytes
    serial : 0x440 - 12 bytes
    deviceID :  0x44c - 4 bytes
    partNumber : 0x455 - 8 bytes
    maxCapacity : 0x49A 2 bytes

    « Last Edit: August 23, 2018, 05:03:55 am by driver_x »
     

    Offline Deathcore

    • Newbie
    • Posts: 3
    • Country: gb
    Re: Lexmark toner chip Ti046b1
    « Reply #142 on: August 22, 2018, 11:21:38 pm »
    Has anyone had any luck with doing the same with the Imaging Unit?
    I've mirrored the contents over from a brand new Imaging Unit to a Used one and the printer only seems to see the unit as "Defective" after about 20 seconds or so.

    The data structure seems to be different to the toners, as the 1st and 2nd 56 byte register show different contents.

    I'll put together some dumps and post them up when I can but would appreciate any help or pointers!
     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #143 on: August 22, 2018, 11:37:43 pm »
    Searched for a Texas Instruments chip that is able to perform authentification using cryptographic functions, found this :
    http://www.ti.com/lit/an/slua389a/slua389a.pdf
    http://www.ti.com/lit/ds/symlink/bq26100.pdf

    but...

    From what I observe, in the 0x81 register is written the 14 bytes challenge, then from 0x80 is being read the 16 bytes response from the chip, and this is done 8 times for each cartridge. But the response does not look like a SHA-1 hash, first because SHA-1 is 20 byte long, and second because in all the the 8 responses of  16 bytes , bytes 7 and 8 are the same. MD5 is 16 bytes but the repetition of the bytes 7 and 8 in all the responses excludes any hash function(?)
    And second, the last 1024 bytes memory block might be read only in order to prevent the changing of the serial number, deviceID, maxCapacity , region and all the other cartridge factory parameters.

    Later:

    Connect your printer via ethernet, then in your internet browser type http://your_printer_ip/se (replace "your_printer_ip" with your real printer ip)
    Then go to "Dump SysDebugData" and do some search for "cyan",  yellow or whatever... you'll find some data about the cartridges.
    What is strange is that after resetting the 56 and 208 registers of a empty cartridge, of course that the printer is telling me to replace it and it does not take in consideration the information stored in the chip, as it is displaying the same number of printed pages, install date etc as they were before the resetting :((.
    « Last Edit: August 23, 2018, 07:33:49 am by driver_x »
     

    Offline Deathcore

    • Newbie
    • Posts: 3
    • Country: gb
    Re: Lexmark toner chip Ti046b1
    « Reply #144 on: August 25, 2018, 01:05:01 am »
    Just an update.
    I rewrote the all first 1024 bytes from a new Drum unit to a Used board and the unit is now giving me an "Imaging unit unsupported" error rather than "Imaging unit defective".

    Step in the right direction but still no luck, I suspect that the device is checking for a CRC somewhere or the 2nd set of 1024 bytes holds part number information and the used board that was overwritten was a "Black only" imaging unit rather than "Black and Colour".
     

    Offline amyk

    • Super Contributor
    • ***
    • Posts: 5770
    Re: Lexmark toner chip Ti046b1
    « Reply #145 on: August 25, 2018, 10:22:06 am »
    What is strange is that after resetting the 56 and 208 registers of a empty cartridge, of course that the printer is telling me to replace it and it does not take in consideration the information stored in the chip, as it is displaying the same number of printed pages, install date etc as they were before the resetting :((.
    The printer probably memorises the serials of the last X cartridges.
     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #146 on: August 25, 2018, 06:19:17 pm »
    Just an update.
    I rewrote the all first 1024 bytes from a new Drum unit to a Used board and the unit is now giving me an "Imaging unit unsupported" error rather than "Imaging unit defective".

    Step in the right direction but still no luck, I suspect that the device is checking for a CRC somewhere or the 2nd set of 1024 bytes holds part number information and the used board that was overwritten was a "Black only" imaging unit rather than "Black and Colour".
    I think we must have a sticky thread with the information we have found so far , because i see we are reinventing the wheel with each post:)

    Int the 56 bytes register is written the type and the color of the cartridge, so you can't just copy the first 1024 bytes from a type of cartridge to another type.
    The mapping of the bytes in the 56 bytes register was discovered by pixconfig here: http://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1526623/#msg1526623
    We succedeed to set all the counters to zero, but it seems that the printer is also keeping in its internal memory the last parameters of each cartridge, so I see two solutions:

    1. Discover a way to change the cartridge serial number from the cartridge's memory
    2. Discover a way to clear the serials of the cartridges from the printer memory(they are not erased when you restore the printer to factory defaults)

     

    Offline Deathcore

    • Newbie
    • Posts: 3
    • Country: gb
    Re: Lexmark toner chip Ti046b1
    « Reply #147 on: August 25, 2018, 08:49:58 pm »
    Apologies for the confusion, I have read through the thread a couple of times but I was looking at the Chip on the Imaging/Drum Unit not the toners. (Address 0x005)
    The imaging unit uses the same TI046B1 chip but the registers and data on the chip are in a different layout to the toners.

    I had copied the data from a good full chip to a used chip that the printer had not seen before, but it was still rejected, the drum unit may be checking for something other than just the serial number though.

    A sticky thread would be a very good idea though! :)
     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #148 on: August 25, 2018, 11:59:26 pm »
    If you post the dump of the new chip and the used chip maybe we can discover what and where the printer is writing on the chip and try to reset the counters rather than to overwrite with data from another chip.
    For the cartridges we have also some bytes in the first 1024 segment that we don't know what are representing (the bytes surrounded with red line from the map posted by me here: http://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1762853/#msg1762853 ) If you look with attention you will see that the group of 6 bytes from 0x160 repeats at the offset 0x400, with other words, the last bytes with values from the first 1024 segment are repeating in the second 1024 segment. If you overwrite the first segment then the values will not match. Maybe in the imaging drum chip there is a similar protection
     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #149 on: August 29, 2018, 05:51:04 am »
    Ok, some new update with the last discoveries:
    It seems that (at least for the starter cartridge i'm experimenting) that cleaning all the first 169 bytes(as in pixconfig's function) from the 208 register is making the printer to show the message: "replace the cartridge". I remember that the first time i saw this was in pixconfig's post after he wrote the function for resetting the 208 register. Then I thought that maybe the printer needs some info saved there (the timestamps for example) and I tried to reset only the first 15 bytes which is obvious that are encoding the toner usage (i was lucky because I saved the full dump before reseting, and I was able to restore the initial 208 register). Surprise! The printer no longer says to replace the cartridge and it says that the cartridge is full. ;)

    Here's the sysdebugdata log for the cartridge:

    Code: [Select]
    osikey Magenta Toner, serial CAH163060CDA valid 1, id 1:
      partNumber 38CSL14M, deviceID 65399522, pageCountValid 1, pageCount 801.
      pageRemainValid 1, pageRemain 1400.
      maxCapacity 1400, maxCapacityPages 1400, level 10.
      maxLevel 10, minLevel 0, increments 10%, SUPPLY_STATUS 0.
      SUPPLY_OSIGAUGE_TYPE 2, SUPPLY_EMAIL_TYPE 0
      Levels:
                      SUPPLY_EARLYWARN => LevelOn 1, LevelActive 0, TriggerValue 4, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1273, behid 0x126e, behav 0.
                      SUPPLY_NEARLYLOW => LevelOn 1, LevelActive 0, TriggerValue 3, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1274, behid 0x126f, behav 0.
                            SUPPLY_LOW => LevelOn 1, LevelActive 0, TriggerValue 2, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1579, behid 0x1270, behav 2.
                    SUPPLY_NEARLYEMPTY => LevelOn 1, LevelActive 0, TriggerValue 1, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1275, behid 0x1271, behav 2.
                          SUPPLY_EMPTY => LevelOn 1, LevelActive 0, TriggerValue 0, LevelMax 0, LevelMin 0, Behaviors 0x02, levid 0xffff, behid 0x1272, behav 4.
      type 2, prebate 2, refilled 2, afterMarket 0, carttype 0, menuPageSupport 0.
      installed INST, supported 1, ignoreMsgNotSupported 0, serialNumberIsReal 1
      dataValid 1, firstPercentReported 100, region 0, genuine 1, exposed 2, non-genuine IR 2
      flags:
        ignoreLevelWrnOnce 0
      supplyHasWarning 0, supplyHasIntervention 0, supplyHasNonContinueIntervention 0
      supplyGetConditionTextId 75577 (OK).

    Need to investigate why it shows  pageCount 801, maybe I have a bug somwhere in the resetting function.

    Later edit: no bug in the function, the printer is writing back on the chip the pageCount as soon you put the cartridge in the printer.

    208 register analysis:

    Start ByteEnd ByteDescription
    014Toner usage in steps
    1518Filled with zero
    1930Serial number of the Imaging Kit
    3136Date, maybe install date
    3744Printer serial number
    4546Filled with zero
    4748Unknown data
    4950Filled with zero
    5156Date, probably date of first warning?
    5764Printer serial number
    6566Probably page count at the date stored before
    6768Filled with zero
    6970Unknown data
    7176Date, probably date depleted?
    7784Printer serial number
    8586Probably page count at the date stored before
    8788Zero
    8990Unknown data
    9199Unknown data, values from 1 to 6 observed in each byte
    100110Zero
    111111A0 for starter kits, 00 for the others
    112114Zero
    115116Unknown data, seems to increase with as the cartridge gets depleted
    117118Zero
    119120Unknown data, seems to increase with as the cartridge gets depleted
    121122Zero
    123124Unknown data, seems to increase with as the cartridge gets depleted
    125126Zero
    127128Unknown data, seems to increase with as the cartridge gets depleted
    12912934 for starters, 00 for the others
    130144Printer Name
    145168Zero
    169198Unknown data, does not modify over time, maybe some kind of ID
    199205Zero
    206207CRC
    « Last Edit: August 29, 2018, 06:01:05 pm by driver_x »
     
    The following users thanked this post: maxic81

    Offline maxic81

    • Newbie
    • Posts: 1
    • Country: ru
    Re: Lexmark toner chip Ti046b1
    « Reply #150 on: September 19, 2018, 06:04:03 pm »
     Hi!
     Tried to wipe the chip on FF, here's what happened
     

    Offline Kulick

    • Newbie
    • Posts: 2
    • Country: ru
    Re: Lexmark toner chip Ti046b1
    « Reply #151 on: September 19, 2018, 08:34:35 pm »
    maxic81, почисти ящик) Не могу сообщение отправить.
     
    The following users thanked this post: maxic81

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #152 on: September 20, 2018, 04:01:38 am »
    Tried to write first 2 bytes with FF, it filled all the read only area that didn't contained data with zeros. Strange.

    So from 0 to 31 and from 1792 to 2047 (decimal offsets), all bits were set to zero. Ant I wrote only in the first 2 bytes FF. This means that these bites don't really exist on the chip and are just a mirror of the first 2 bytes?
    « Last Edit: September 20, 2018, 04:29:23 am by driver_x »
     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #153 on: September 20, 2018, 06:28:55 am »
    Why do I get mixed results when I try various baud rates for serial.begin?
    Look at the responses from the 0x82 register

    Code: [Select]
    Baud Rate 2400
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x38};
    Write 0x09 in 0x81 Register
    Write OK
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x49};
    Write question in 0x81 register
    Write OK
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x89};
    Read 0x80 Register
    uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0x80, 0x80, 0x31, 0x54, 0xBF, 0xB6, 0xD9, 0x8E};


    Code: [Select]
    Baud Rate 19200
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
    Write 0x09 in 0x81 Register
    Write OK
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
    Write question in 0x81 register
    Write OK
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
    Read 0x80 Register
    uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0xD, 0xF1, 0xE3, 0xE9, 0x91, 0x71, 0xA1, 0x83};

    ****reset arduino***

    Baud Rate 19200
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x38};
    Write 0x09 in 0x81 Register
    Write OK
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x49};
    Write question in 0x81 register
    Write OK
    Read 0x82 Register
    uint8_t destinationBuffer[1] = {0x59};!!!!!!!!!!
    Read 0x80 Register
    uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0xCD, 0x1A, 0xA6, 0xE9, 0x3E, 0xCA, 0xD2, 0x8A};



    If I increase the baud rate more, I get mixed results...  :-//
    « Last Edit: September 20, 2018, 06:36:31 am by driver_x »
     

    Offline Diggie

    • Newbie
    • Posts: 1
    • Country: de
    Re: Lexmark toner chip Ti046b1
    « Reply #154 on: October 09, 2018, 09:33:39 pm »
    Hi guys,

    I've been observing this thread ever since I bought my CS417DN a few months ago.
    It is very interesting to see the progress that you have made.
    It certainly goes beyond my expertise.  ;)

    Thats why I have a different proposal on dealing with this: Has anyone tried checking out those reset/replacement chips which you can get?
    Maybe for those we are able to read them out fully and then copy that to the original chips?

    Look forward to hearing your thoughts.
     

    Online driver_x

    • Contributor
    • Posts: 20
    • Country: af
    Re: Lexmark toner chip Ti046b1
    « Reply #155 on: October 10, 2018, 03:55:36 am »
    Hi guys,

    I've been observing this thread ever since I bought my CS417DN a few months ago.
    It is very interesting to see the progress that you have made.
    It certainly goes beyond my expertise.  ;)

    Thats why I have a different proposal on dealing with this: Has anyone tried checking out those reset/replacement chips which you can get?
    Maybe for those we are able to read them out fully and then copy that to the original chips?

    Look forward to hearing your thoughts.


    I'm afraid that this is not possible as the chip has a read-only area where is written the serial number, toner capacity and probably all the initial parameters. Most probably the printer is storing all this info as I have reseted the number of printed pages and after I have inserted the cartridge inside the printer, the number printed pages has reappeared on the chip.
     


    Share me

    Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
    Smf