Lexmark toner chip Ti046b1

[JacquesBBB]

I have a Lexmark CS310dn color Laser printer which has 4 cartridges which I bought about 150$.
Each of them has a chip  Ti046b1 which probably counts the number of copies ( I guess but may be wrong)
When the count is over in one cartridge, the printer stops.
A replacement black cartridge is 100$.

What is the real mechanism for this chip protection ?

Where can I find the datasheet or the pinout of the  Ti046b1 ?  I was not able to find it on the web. It seems that it is a FRAM memory, but I am not sure.

How to reset this printer chip ?

There are some chip available on the web, with the lexmark PCB, but rather expensive (about 25 $) while the chip can be available for only 1$ on  aliexpress. Should a simple replacement of the chip on the board work ?
It is a TSSOP 8 chip, and there nothing else on the board except some decoupling caps.

Thanks for any information on these Ti046b1 chips and chip protection mechanism.

[SeanB]

It is a simple EEProm, used to store the count of pages printed and toner fill state. Also has a key that is used to authenticate the cartridge to the printer, and a cartridge serial number.

Try looking in printer refill suppliers for the compatible chips, which are either a programmed chip or a small micro that always reports the cartridge is full.

[JacquesBBB]

Thanks, but is it possible to  read and change the values in this eeprom ?

And what is the pinout ?

This is the chip



And from what I have looked I got the following schematics, with the 4 pads  JP1-4 connecting to the printer

[Howardlong]

Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

[JacquesBBB]

Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact

J1 ground
J2 SCL
J3 Vdd
J4 SDA

Then I got the I2C Address : 0x78

What should now be the way to go ?

[SeanB]

Grab a non empty cartridge and write it's contents back to the empty one, and see the differences in the data as well. Print a few pages and see how the data changes, which might give enough data to simply reset the count, or make it look full again when refilled. Does the printer work without the chip in, some HP cartridges will give an error code but still print, assuming the chip is misaligned with the reader or it has failed, and then relying instead on the low toner optical path for change messages.

[Howardlong]

Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact

J1 ground
J2 SCL
J3 Vdd
J4 SDA

Then I got the I2C Address : 0x78

What should now be the way to go ?

While I can't discount your pinout findings of course, just be aware that there is an unofficial standard pinout for I2C eeproms, so I'd find it unusual to deviate from that, so you might want to just recheck your wiring.

https://proprojects.files.wordpress.com/2014/11/2014-11_i2c_24fc1025_im01.png

For example, Google the images returned from "i2c eeprom pinout".

Anyway, back to the problem in hand!

Can you probe the device in situ with a bus decoder? This can often reveal a lot.

[android]

Grab a non empty cartridge and write it's contents back to the empty one

...It might also be worth permanently enabling the Write Protect pin too, so that ithe EEPROM would always report "1 page printed" and not bother you in future. I've never tried it...just a thought.

I suspect that the stored data is encrypted - making it difficult to guess how the printer firmware would respond to various kinds of tinkering. The manufacturers really want you to buy more  consumables for some reason.

[JacquesBBB]

@Howardlong : I confirm the pinout that I gave. I have been able to communicate with it with both my arduino based I2C scanner and Bus pirate 3.6 with it.

Now I am trying to dump the eeprom with bus pirate, but I  have never used it before

I can get some reading but I am not really sure of what I am doing.

What is the best way to dump the content of the eeprom ?

Thanks

[Howardlong]

There are some additional confusions here.

The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57 is the common addres range for eeproms. The schematic you gave even shows the address definition bits and WP pin all tied to how I would expect for an eeprom.

I don't know if Bus Pirate supports 10 bit addressing.

I would take a look at how the printer talks to the device before trying to copy it and match that up with known eeprom protocols. Like pinouts, these are reasonably well standardised so that manufacturers can offer plug in replacements.

[JacquesBBB]

The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57

I had this value with my arduino reader, and this is what I get with the bus Pirate

I2C>(1)
Searching I2C address space. Found devices at:
0xF0(0x78 W) 0xF1(0x78 R)

[JacquesBBB]

In order to verify  what I get with the Bus Pirate,
I tried with a more conventional 24FC1026.

Then the pinout is standard  and I get
I2C>(1)
Searching I2C address space. Found devices at:
0xA0(0x50 W) 0xA1(0x50 R) 0xA2(0x51 W) 0xA3(0x51 R)

Thus the usual address as mentioned by Howardlong

I can then read and write on the chip


I2C>[ 0xa0 0 0 1 3 2 ]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 ACK
WRITE: 0x01 ACK
WRITE: 0x03 ACK
WRITE: 0x02 ACK
I2C STOP BIT
I2C>[ 0xa0 0 0 ] [ 0xa1 r:3 ]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 ACK
I2C STOP BIT
I2C START BIT
WRITE: 0xA1 ACK
READ: 0x01  ACK 0x03  ACK 0x02
NACK
I2C STOP BIT
I2C>

But it does not seem that the sequence is the same for the Ti046b1
As If I try the same sequence on  the Ti046b1 , I get

I2C>(1)
Searching I2C address space. Found devices at:
0xF0(0x78 W) 0xF1(0x78 R)


I2C>[ 0xF0 0 0 1 3 2 ]
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 NACK
WRITE: 0x01 NACK
WRITE: 0x03 NACK
WRITE: 0x02 NACK
I2C STOP BIT

[ 0xF0 0 0 ] [ 0xF1 r:3 ]

I2C>[ 0xF0 0 0 ] [ 0xF1 r:3 ]
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 NACK
I2C STOP BIT
I2C START BIT
WRITE: 0xF1 ACK
READ: 0xFF  ACK 0xFF  ACK 0xFF
NACK
I2C STOP BIT

So the behaviour of this chip is not the same as a standard  eeprom.

If anybody has the proper writing/reading sequence, it would be helpful.

[Howardlong]

10 bit addressing works a little differently to 7 bit addressing, if that is indeed what it's doing. Whatever you're using to talk to the device needs to be 10-bit aware.

Definitely I would sniff out what the printer does to get an idea of what's going on, and look at the I2C specs UM10204 which explain the differences.

[JacquesBBB]

Thanks for your comments. I have started to look to 10 bit addressing...

But it is difficult to find reasonable information of  Bus Pirate and I2C 10 bit addressing.

I made an experiment by searching all possible addresses on the black cartridge
searching with Bus Pirate for all 256 in bunches like :
[0xF0 0x00]&[0xF0 0x01]&[0xF0 0x02]&[0xF0 0x03]&[0xF0 0x04]&[0xF0 0x05]&[0xF0 0x06]&[0xF0 0x07]

I got only positive answers for  0 and 1



DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
I2C STOP BIT
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x01 ACK
I2C STOP BIT
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x02 NACK
I2C STOP BIT


Then I searched  only for the first 8 addresses  for the other cartridges and found for the possible
second Byte

Black      : 0x00  and 0x01
Cyan      : 0x00  and 0x02
Magenta : 0x00  and 0x03
Yellow     : 0x00  and 0x04

So  this is some progress,  as I understand now how the different cartridges are recognised,
but I am not able to go further. I may need to sniff the I2C port as you recommend, but this will need a setting
that I  cannot do immediately, as I will have to dismount the printer to access the wires.

[igrok_by]

you have success
I'm trying to get information from the chip , but it does not come out . To search using Bascom code :

Code: [Select]

$regfile = "m328pdef.dat"
$crystal = 8000000

Dim Q As Byte , T As Byte , A As Byte , E As Byte , R As Byte
Config Lcd = 16 * 2
Config Lcdpin = Pin , Rs = Portd.6 , E = Portd.3 , Db4 = Portc.0 , Db5 = Portc.1 , Db6 = Portc.2 , Db7 = Portc.3
Cursor Off
Cls
Locate 1 , 1
Lcd "Start"

Config Sda = Portd.5                                        'I2C Data
Config Scl = Portd.4                                        'I2C Clock
Wait 2

Do
Cls
For R = 0 To 127
 For T = 0 To 128                     
  I2cstart                                           
  Q = R * 2
  I2cwbyte Q                                     
  I2cwbyte T                                     
  E = Q + 1
  I2cstart
  I2cwbyte E                                               
  I2crbyte A , Nack                                     
  I2cstop                                                   
  Locate 1 , 1
  Lcd Q ; " " ; T ; " Read " ; A ; "    "
  If A < 255 Then
  Locate 2 , 1
  Lcd Q ; " " ; T ; " " ; A
  End If
  Wait 2
 Next T
Next R
Loop
End
The answer to all addresses 255. Is there a solution

[Zero999]

There's no way I'd buy a printer like this.

A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?

[igrok_by]

A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?

Xerox, samsung.

[Gyro]

Some laser printers have a s/w setting for non-original cartridges, eg Dell.

[SeanB]

HP as well, they are refillable, that is why I use them at work. Canon is a brand as well that also has refillable cartridges. The refilled cartridge coasts around 30% of the wholesale price, or around 20% of the retail price. There is a big mark up on cartridges all along the supply chain.

I just ask my refiller first if the cartridges on the printers I am considering are refillable, and this does winnow the list down to a dozen or so to choose from, and then often I look to see if the cartridge is one already in use. Just be aware that often HP and Canon cartridges are exactly the same unit, in a different box with a different part number, and a different price. Lot of Canon printers with me use HP cartridges. Same print quality, same operation and no "non genuine cartridge" message either on the new ones.

[igrok_by]

There are still some who have ideas on the independent decision of zeroing chips. 

[cciollolo]

hi , i have buy a cs310dn printer. i try to sniff with bus pirate but i have store more number with no result. The value changes every start of the printer and is different in all re-check in ready mode . i buy 10 new empty ti046b1 but i haven't idea to proceed . help please

[cciollolo]

i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available ! 

[igrok_by]

i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available ! 

Did I understand you correctly??? An attempt to read the memory via a separate device

If they've got any sense they'll be verifying the writes.

It's weird that they'd use an FRAM and not some write-once memory. 

The fact that the chip is written in the page counter. As far as I understand it in these chips is:
1. The number of printing on many targeted chip (I found 10K, 20K)
2. The number of printable pages
3. Region kprintera.
4 for color, he must still be responsible for the color.

My reading of the sample controller chips Samsung alas, not what happened. But I realized that chip crypto protection.

[cciollolo]

no , i turn on the printer and i sniff the initial trasmission that check all chips, and after turn off the printer and repeat for 24 times. the second file is the same procedure with the black cartridge chip removed . i did another test and i attach new file :
senza filo is the 3 initial check without cable off all chips
stamp pagina is the initial check with all chip connected and 2 separate page printed
cartucce mancanti is the recheck without one chip at once.

i made an attempt only with black chip to read the content inside of the chip, but after select the chip address with 0xf0 0x00 , i test to write the address of memory location , but when i read the chip answers always ff when the address is ack

[nanofrog]

A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?

Brother would be another. 

Resetting a cartridge is nothing more than moving a gear back to it's start position. And you can refill a genuine cartridge 2- 3x w/ a reset between each refill*.  Makes them the lowest per page cost I'm aware of. 

* Depending on the amount of toner the refill kit contains. Also, replace the fill cap rather than reuse or there's a serious chance it will leak, as they tend to get mangled when removing them (inexpensive & available on eBay and Amazon; new gears too, should you need them).

[MPOWER]

Hi, I am new to your forum and found it googling for chip TI046B1.
I am also interested in re-writing my lexmark smart chip with a virgin file.
My MX410de uses this chip in the toner and in the imaging drum. The important thing is that I have an original 602HE 10.000 pages new and boxed cartridge.
So I was thinking that if you help me read its virgin file I could re-write it when the time comes. Of course I would also share the file.

Any suggestion would be highly appreciated

Thanks in advance
Michael

[igrok_by]

Hello everybody. Recently I ordered a couple of chips to try to fill. They came, until set.

[cciollolo]

i tried to read this chip , and i founded for black cartridge chip that there is just one address that contains data ; all the others contains FF or 00 . I found this with bus pirate scanning step by step all address :  first [0xf1 xx , and i found that the only addresses that answer ACK are f1 00 and f1 01 . Second [0xf1 00 xx and [0xf1 01 xx .... at the end the address that answers all ack and return data different from 00 and FF is [0xf1 0 1 0 0.
i attach the content of this address . After i bought another chip ti046b1 and i tried to read the same address ; the content doesn't match . So i tried to write the content of the original chip to the new , but when i try to write the chip answers NACK .
the procedure to read is [0xf1 0 1 0 0 [ r r r r r r r r r r r
i try to write with [0xf0 0 1 0 0 [ data data

[igrok_by]

Hello friends. I hasten to please, this chip succumbed to erasure and everything works as it should.

[bigakis]

I captured the traffic between the printer and the catridge subsystem using a MiniLogic analyzer. Bus Pirate gives erroneous results.
My first notes:

• The catridges have 10 bit addresses. First byte 0xF0 (W)/0xF1(R), second by 0x01-0x04
• There is another FRAM attached to the bus having address 0x05
• The printer communicates to the bus in cycles. When opening and closing the lid, it starts 5 cycles
• On Each cycle it polls each catridge by sending 0xF0, 0x0x (x=1-5). If it receives an ACK on the second byte that means the catridge is installed, and sends more bytes. If not it tries one more time before moving to the next address.
• An ACK on the first byte (0xF0) is always sent by the installed 5th FRAM
• First 4 cycles looks like identification. 5th one is the actual communication

Attached are the SAELAE Logic Capture, the Decoded CSV output, a simple python script to beautify the results and the beutified results.
The data are from a cs310dn printer, no catridges attached, so the communication takes place only between the printer and the internal FRAM.
More to come soon

#update: The 5th FRAM report a S/N CAHxxxxxxxx and part number 38CB0001. It points to a company named sirtec in HK manufacturing toners for Lexmark. But there is no toner installed!

[igrok_by]

I can say one thing. chip read and until I got to read and write 1024 bytes open for writing and 1024 closed. In a closed file, there is a number, a model, and many that are not understandable.
While well go into the discharge with a small amount of toner.
I have models 511 and 410. 511 even some with 0 pages went into rewriting.
Under No. 1, there is a toner. Under No. 5 there is a photo drum.
While there are works with the search of the recovery from 0 pages.
Open to HxD.

[organizatie]

Hello ,
igrok_by in your picture R5L16B is a memory chip equivalent is FM25L16 (RAMTRON).i have dump for this (my printer is mx310dn).i'm trying to identify a programmer for ti046b1 but can not find any documentation for this chip.

[igrok_by]

there is no documentation for the chip. I asked many who sell them. But it seems to me that this is not just a memory, but a controller programmed to impersonate itself for memory. Because my attempts to return the blocked chips are unsuccessful. I'm waiting for the listener with China to test my theory.

I can recover a chip that is not blocked.

[organizatie]

in romania some devices can be reset, but they must still contain information.of the scheme seems to be a memory but I think it was labeled with a special series.thanks

[igrok_by]

in romania some devices can be reset, but they must still contain information.of the scheme seems to be a memory but I think it was labeled with a special series.thanks

Opportunity.
But I had a chip on the verge of blocking. I thought that he allowed the lock and counted again. Global changes nebylo. Recorded contents before blocking. But it did not work. I know that one thing is that he is not confused, but a controller. He has 2 addresses for an answer.
The first one is 0.
The second one depends on where it stands. 1 - if this is the bottom with the drum unit and 5 - if there is toner.

[organizatie]

Hello,
igrok, where you ordered the chip??for what printer is it??I found that ic's "2850" is a TI controller in the series MSP430FR57XX.

[igrok_by]

Hello,
igrok, where you ordered the chip??for what printer is it??I found that ic's "2850" is a TI controller in the series MSP430FR57XX.

Hello. These chips were bought by our marketer.
The listener came from China. So far as I thought, it's not a memory controller. You need to get a lot of data to write your controller with reset counter. If you do not care to reset the lock of chips.

[igrok_by]

Hello, friends.
 I did not write for a long time, I was busy trying to understand what kind of animal it was. 
I recently offered to share with you.
1 is not just a memory, but a controller or memory that can generate encryption.
2 Yes, yes. Encryption. The algorithm is similar to "AES". This leads to his long attempts at deciphering without knowing the algorithm. Can anyone work with AES, help me understand how this works.
I took off my hat near the development of this chip. This works well.

[stj]

wouldnt it be simpler to hack the printer formware to fake the check result?

[igrok_by]

wouldnt it be simpler to hack the printer formware to fake the check result?

as far as I know, I was told, I did not check that the printer is updating the encryption algorithm from the chip. Unfortunately, I do not have a printer firmware .

[bigakis]

I'm also pretty sure this memory has embedded security. It is probably the case of this lawsuit https://www.eff.org/document/sixth-circuit-opinion

[igrok_by]

Hello. I see that the information does not appear.  . I want to boast that the "beast" has been trained. The chip fits perfectly into the reset  . All informatics can be given for a reward.

[igrok_by]

How?

After a long training =)
There is no documentation for the chip. I found how it works. And now there is a solution that allows me to restart the mx/ms 410/511 chips.
I think that the others work on the same algorithm.

[igrok_by]

How?

After a long training =)
There is no documentation for the chip. I found how it works. And now there is a solution that allows me to restart the mx/ms 410/511 chips.
I think that the others work on the same algorithm.

Dear igrok_by, I'm very glad that you have succeeded, But, could you chance, forget how it's done, or break your computer, accidentally format the hard drive. Hope for understanding.
With respect!
   

Only after Lexmark agrees that the money spent on protection in vain.
And will cut 10 times the prices of consumables

[igrok_by]

this sounds like a paypal solution to me... I think I am saddled with this pox as well.

Chinese friends offer good chips at good prices. True, these chips are clones of the original . I was surprised when I got five chips with the same number.

[organizatie]

Hi igrok_by
what amount you are talking about igrok_by??
regards
i'm waiting for the message in pm

[igrok_by]

Hello, organized.
I did not understand what you want to hear from me?
I do not understand English well 

[kees]

Hello. After studying the Lexmark cs410 printer, one can find extended firmware logs:

Code: [Select]

http://<IPaddressOfPrinter>/seAdditionally one can finger the printer in a standard linux shell via

Code: [Select]

nc <IPaddressOfPrinter> 79and issue commands like setup, firewalld, info, history, dnstable, backend, alerts, t30log
Edit: Attached log might be of any value. Search for keywords like osikey, osi debug, bios debug. And find the inner working register values   

[Siryu]

Good to all, I am new to this, I have a laser printer and the toner that uses also carries the Ti046B1 chip but I can not do anything with it, I have arduino and I have logic analyzer but I can not do anything or I can not interpret the data, I would appreciate some help to see if I could read and record the chip or if on the contrary the shots do not go around, thanks in advance, regards. 

[JacquesBBB]

Hello All,

I am glad to see this thread active again. I have no time at present to resume my searches  to decipher this  chip,
but will be very attentive to any progress that could help to shunt this protection.

[igrok_by]

Hello all.

Sorry if I offended someone  . It turns out the goods on the Chinese site can cost 3 times more than they actually are. I complete the instruc- tion about the chip until the end of the week. I suggest that you talk again about receiving instructions.
I'm not a magician while I'm studying. The chip must not be blocked. How to do this I will describe.

[AlexandruG]

Hello all,

What about that instructions igrok? Can you help us with a tutorial "how is made"?

Thank you. 

[driver_x]

Hello, any news about the instructions?

[dokimos33]

Hello all.

Sorry if I offended someone  . It turns out the goods on the Chinese site can cost 3 times more than they actually are. I complete the instruc- tion about the chip until the end of the week. I suggest that you talk again about receiving instructions.
I'm not a magician while I'm studying. The chip must not be blocked. How to do this I will describe.

Write to me in PM please, I am ready to reward 

[Ronyy]

Is there any solution to the problem? I have an MS810dn lexmark and would like to know if it is possible to re-record the TI046B1 chip. I'm spending roughly $ 454, 32 per month only with the purchase of chips.

[pixconfig]

Hi everybody,

With a 70 MIPS DSPIC 33EP512 MC 502, and few days of hard labor, we succeeded in having all the communication between the printer and its cartridges intercepted without any bit of error !

The Buspirate was just a Joke as it was unable to spy on a normal 100kHz I²C bus, and for those who tried, it had no chance to give anything meaningful. New versions are maybe approaching 100kHz but micro controller is 16 MIPS.

With an Arduino Mega 2560 (16MIPS), we were too slow, too (even with a lot of optimizations). Indeed, it's impossible to use the internal I²C functionalities of any micro controller since theses functionalities necessarily interact with the bus (too bad, since they are 400KHz compatible !).

How does it works :
First time is recording into enormous buffers, second time (after few time with no data on SDA/SCL) is the sending of the results to the computer (with a simple serial port).
Finally, with a Qt written program, we formatted all the series of S (Starts/Restarts), E (Stops/Ends), and 0/1 (with 7 or 10 bits addresses supported, ACK, Read/Writes etc) in order to have CSV files. We sorted a little bit those files in order to recognize I²C Writes, I²C Questions, and I²C Responses. And splitted the 4 cartridges into different colors.

And yes, Howardlong was right, cartridges are 10 bits addressed.

Enjoy !
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete-1sur2.xlsx
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete-2sur2.xlsx

And raw data from micro controller : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/capture-complete-raw.txt

If some of you are interested in having more details and created programs for the occasions, we are going to clean it a little bit and put it on our website (https://www.pixconfig.fr/)

Now we have to ask ourself one question : what do all those registers contains and says ? Because there is a lot, lot of data exchange between the master (printer) and its slaves (cartridges). For information, the magenta cartridge is empty into the recorded I²C frames.

Also, we have a fifth cartridge and we don't really know what is this cartridge but the way it communicates is the same that for the 4 other cartridges.

Thank you in advance !

[pixconfig]

I successfully understood some information about the used protocol, by printing the full series of Questions/Answers/Writes into 1 page (for magenta, firstly) and looking about what it asks, what it answers, and marking everything meaningful with my pen.


I compared the results between cartridges and it is the same protocol, registers and bytes number used at each time. ACK and NACK are just where they should be, Starts Stops and restart too. But content of the 14 bytes questions and the 16 bytes answers change every time... !

Addresses :

• 0x001 is the black
• 0x002 is the cyan
• 0x003 is the magenta
• 0x004 is the yellow
• 0x005 is the imaging drum

Registers that are being read :

• 0x01>0x20>0x04 is the Color Register. It gives a series of 0x0N and 0x00 that repeats itself, N being 1, 2, 3, 4, or 5 (same as the address)
• 0x01>0x40>0x04 is an big register that is read on 448 bytes (but for each cartridge, only the 297 first ones contains something, the following bytes are 0x00. First bytes looks like ASCII with only slight differences between cartridges)
• 0x01>0x00>0x06 is an big register that is read on 256 bytes (all of them contains something)
• 0x01>0x20>0x00 is an average sized register that is read on 56 bytes (most of the contains 0x00 or 0xFF but not all of them)
• 0x01>0x90>0x00 is an big register that is read on 208 bytes (First bytes looks like ASCII with only slight differences between cartridges)
• 0x82 is a kind of Status Register that the printers reads before asking anything else.
• status 0x38 is "nothing more to say, please enter something into 0x81"
   
• status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
• status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
   
• status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
• status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09


• 0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time

Registers that are being write :

• 0x04 is the first register that is called on each cartridge, with a Stop occuring during ACK (there is no ACK or NACK bit), followed by a useless start stop, observed by oscilloscope too. Let's guess this is useless. But it's common to the 5 cartridges (well, 4 cartridge and 1 imaging drum).
  
  
• 0x81 is the only one register that is written after closing the lid. It's a command register that influences the status register (0x82) and define what will be read into 0x80. We can see single byte writes on it (0x08 or 0x09) for selecting what looks like a mode, then a 14 bytes question write (with something that looks like it's totally unpredictable) before being able to read 16 bytes into 0x80 (16 bytes that also looks like they are totally unpredictable).

That's the complete summary of the exchanges between the master and it's slaves. We have only one missing thing : what is written when we print a page ? Since our Magenta cartridge is empty, we can't print anything.

Now I think I need some experts attention : Does anybody recognize this kind of dialog ?
I'm going to look for possible intepretation of those values (4 bytes sized floats, 8 bytes sized double, integer, unsigned integer, ascii...) but may be somebody already recognize what I'm looking for.

Do not hesitate to consult the Excel files we gave on the previous message, it's really clear to read !

I'm really happy with what we got from the 70 MIPS DSPic (fast enough to immediately mark the values SDA/SCL when there is a SCL/SDA change notification interrupt, then interpret it quickly enough to see the next SDA/SCL change in time) and the way we formatted the data into the Excel. At the beginning, we were looking after 1 and 0 on the oscilloscope so you see, it's lightyear better that way
It's also a chance that it's 48 kB RAM memory sized because there is a lot, lot of bytes, starts and stops position to record before being able to slowly send this into the serial port.

[pixconfig]

We saw that after the 2 streams of recorded communication with the printer, we had 3 series of Write + Read into 0x005.
I made a pretty cool discovery while looking at it : part of the chip is an EEPROM and the printer auto-control what have been written :

It writes a 1st time 96 bytes into 0x02>0x20>0x00, and read it back into 0x01>0x20>0x00 (with no single bit change)

It writes a 2nd time 96 bytes into 0x02>0x80>0x00 and read it back into 0x01>0x80>0x00 (with no single bit change)

In the two writes (and the two reads back) there is no change : same thing written into 0x02>0x20>0x00 and 0x02>0x80>0x00.

Finally, it writes 128 bytes of data into 0x02>0xE0>0x00 and read it back into 0x01>0xE0>0x00

Here is a picture of the analysis, it's a little bit loaded but


I've placed an updated version of the Excel files as ODS file at this address : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete.ods
The 1st, 2nd and 0x005 Write are into 3 different sheets on the bottom of the document.
Formatting of the 2 communication are the same so now it's easier to place the same view on each side, and switch between them to see what is changing.

[pixconfig]

AAAnnnd the winner is....  (not so fast, my understanding of the situation still should be verified experimentally)

I have just noticed that for the first headers (big registers read before exchanges on 0x80 / 0x81 / 0x82) that I documented this morning, they are something more to know about the following ones :

• 0x01>0x20>0x00 is an average sized register that is read on 56 bytes (most of the contains 0x00 or 0xFF but not all of them)
• 0x01>0x90>0x00 is an big register that is read on 208 bytes (First bytes looks like ASCII with only slight differences between cartridges)

Those headers are for 0x001, 0x002, 0x03, 0x004, but not for 0x005.

For 0x05, those first registers reading are replaced by
0x01>0x20>0x00 : read during 96 bytes
0x01>0xE0>0x00 : read during 128 bytes

Yes, the same register that we saw the printer write in my previous message, so we know what the printer reads at the beginning : it reads things that can be written 

This is probably those registers that the master is writing in order to update the status, and the one that the master reads in order to know the current status of the imaging drum.

I guess that the way the master writes the toner level on 0x001, 0x002, 0x003 and 0x004 is the same (replacing the 0x01 by 0x02) but it should be verified while watching the printer writing into those registers.
And may be everything addressed by 0x01>0xNN>0x00 can be addressed and written, who knows. I wonder what it contains when the cartridge is brand new ! I'll try to watch that in the following week.

According to some folks, there is another thing that is set/locked somewhere else when the cartridge become completely empty. Probably something that could be found by watching the printer doing it's final emptying ? Who knows, it's a shame that we are there, looking again and again to repeat and find what some people already found and kept, those people who find solutions against venal obscurantism in order to finally put moral to the garbage, and ask for dollars too. 

But I digress, let's keep on studying this I²C component  - as you can see, I'm not trying to do anything else but studying a component we all bought, just for me and the others to know how does it works.

[JacquesBBB]

Congratulation for this nice work, pixconfig. I hope that will end up with a solution for resetting these chips.

[Siryu]

If wonderful work now I know because I could not read or interpret the data with arduino, hopefully we can do something at last, thanks pixconfig

[pixconfig]

Hi !

In fact I have good news for everyone who wants to communicates (Read/Write) with those chips and an Arduino as master (or any other kind of I2C master, like RPi or VGA card) : I think it is completely possible ! (Just take care about 3.3v). But I didn't tried.
I Guess you should also tells you Arduino that the address you want to write is 0x78 (0b111 1000) + W and then the first data byte you send should be 0x01, 0x02, 0x03, 0x04 or 0x05.

Before any read, you will also need to write 0x78 + W, 0x0N (1 2 3 or 5), your desired register(s), and Restart, then just 0x78 + R (on a read, you're only able to write 1 byte of address before receiving, so you can't put the full 10 bit address. But the slave chip will recognize himself since just before the restart, you were talking to it).

What we don't succeeded in, with the Arduino, was to watch as input only into the operating bus between printer and cartridges and being able to catch everything sent/received between everybody without any interaction and without any bit of error : coding a software read-everything using software poll and/or interrupt on PD0 / PD1 changes was to slow to :
 - copy of the SDA/SCL value (PORTD) immediately on any change
 - interpret the copy by looking at the 2 values with some if/else and masks (0x02, 0x01, 0x03)
 - putting the results into a dedicated buffer
 - and to be ready for the next change at time

Of course, sending the values by Serial Port should be done in a second time because it's very long too (talking about too many µs of course, not minutes  ).

We were loosing a lot of bits, starts and stops. Copying the SDA/SCL values on another output port and seeing the time offset with a 2-way oscilloscope revealed that we had no chance to be fast enough to do everything in time because SDA was changing too fast after an SCL change and vice-versa (we were often reading the PORT D too late).

May be some Assembly's kings would have done better than us, but anyway, that's why we said it was pretty impossible without a faster controller (and I discovered 70MIPS dsPIC, it solved the problem, but it's a little bit complicated to code with : lot of registers to set everywhere to do any simple thing).

I've tried to interpret the data on the big headers as ASCII. That's a little bit poor because it's mainly binary, but there is some ASCII information anyway. It seems that those are serial number, and the model of the compatible printer.
There is also a check on the Imaging Drum reference : CAH171303CD6 is written into the Imaging drum's chip but also in the cartridge's chips.

Pretty interesting, after all ! May be it's for a compatibility check with what's installed into the printer.

Black :
   CAH171331C86
   38C4237
   6MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de

Blue :
   CAH1713218DA
   38C4234
   6MBF46MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Magenta :
   CAH171350F7B
   38C4235
   6MBF46MBF46MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Yellow :
   CAH1713208AA
   38C4236
   6MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Imaging Drum :
   CAH171303CD6
   38CB0001

[pixconfig]

Hi !

I can now confirm that the Arduino (Mega 2560 at least) is able to be master and communicate, and read into the 10 bits TI046B1 (using 10k + 5.2k + 2k between ground and SDA and same between ground and SCL, in order to have 3.3v and no 5v)

Here is a sample code in order to address (by write) the 0x01 > 0x20 > 0x00 register, and read it during 56 bytes after a restart EDIT : it's also able to write, now

I used arduino's twi.h and twi.c in order to understand what I was doing on the bus, because Wire.h and Wire.cpp overlay was a little bit strange to understand; anyway it should work too

https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/twi-all-included.h
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Read.ino

EDIT : the goal is to read those registers and send it trough serial port, in order to copy it into C declaration, and write it back, for example.
We will first try to read the chips on the same values that the printer does, and see if we are able to see the same things, before trying to write anything.

[Siryu]

Thank you Pixconfig for your excellent work. 
Indeed with the Mega ADK I have managed to read a chip of the Monochrome printer with a single cartridge of toner and another drum. Now the interesting thing would be to be able to write on the chip. 

[cciollolo]

Thank you Pixconfig for your excellent work. 
I started doing tests of reading the chips with buspirate posting various files, then failing to find anything I bought MSP430F5529 launchpad and I tried to read the chip, but appears "the debug interface to the devices has been secured".
I'm not very practical in data communication and I abandoned everything for a hardware change: disconnect the power supply to all 4 chips after the first verification phase at the printer and sending the document to be printed. In the printing phase the processor must be so busy that it checks the cartridges (almost always) at the end of the print (even if many pages, even if on the back side) to subtract pages from the toner counter, so finished printing I turn off the whole printer and re-lighting it after a few seconds with the reactivated pultant. Change that I do not know why it does not work so much, because the toner level keeps going down; perhaps for a cross check that does between printed pages from the machine and toner residue, I do not know. I saw that instead you have come a long way in the part of communication and I wanted to understand how to help you with the means I have, if possible.

[pixconfig]

Hi !

After reading the following registers on a new out of the box cartridge's chip that haven't be connected to the printer for the moment :

• 01_40_04[448]
• 01_00_06[256]
• 01_20_00[56]
• 01_90_00[208]

And after trying to write the good one, out of the box content into another chip (not the good cartridge, I mean of course it's the good cartridge, but the chip says "no, go buy another one") :

• 02_40_04[448]
• 02_00_06[256]
• 02_20_00[56]
• 02_90_00[208]

I've tried to read the content again but no byte changed...  it's still the old content.

What should I try ?
I'm going to place the cartridge and his new chip inside the printer, and to observe, but if anybody is inspired, feel free to share your ideas 

[pixconfig]

I cleaned a little bit the code of our dsPIC I2C observer

https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/main.h
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/main.c

It's for a dsPIC 33 EP512 MC502, there is two buffers in order to keep recording while sending the previous results trough UART, and a buffer overflow protection now 
Comments are in english too.

Also, there is a Qt code in order to change the series of letters into a viewable CSV, but it does not interpret anything else than I2C (in fact, apart from the Arduino 10bits  master reader/writer I gave the other day, there is nothing linked to the Lexmark products into any of these codes, they can be used for any other thing).
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/Qt-I2C-Read.zip

Does anybody know if there is a patent describing the communication process between the cartridge and the printer ? Such patents could be really important for Lexmark to ensure no concurrent can sell anything that is patented by their own technology, but such patent are also helpful into understanding the product as customers and developers as we are, for interoperability, modification, but without spending too much time into retro-engineering if everything is already described somewhere 

I guess I'm ready to put the new cartridge into the printer and to watch what it gives !

[pixconfig]

Hi,

Thanks to a very interesting discussion and idea exchange about patent, here is some information :

I searched a little bit on http://www.suppliespatents.info/ (official Lexmark list of patents for their cartridges), and Google Patent, as patents are publicly available on Google, I succeeded in having a lot how them about our cartridge and communication, by seeing the website indicated on the cartridge, and by some research. But not all of them seems to be what we are looking for.

https://patents.google.com/patent/US7258558
https://patentimages.storage.googleapis.com/d9/d2/7c/787cbf35f9fdf2/US7258558.pdf

https://patents.google.com/patent/US7272336
https://patentimages.storage.googleapis.com/2c/9b/24/3466ec9fd84210/US7272336.pdf

https://patents.google.com/patent/US7321739
https://patentimages.storage.googleapis.com/9d/81/1d/74aa37e5d35ee4/US7321739.pdf

https://patents.google.com/patent/US7606520
https://patentimages.storage.googleapis.com/25/cf/fc/f6b00f8489ff68/US7606520.pdf

https://patents.google.com/patent/US7672624
https://patentimages.storage.googleapis.com/1c/c4/95/0dcc721952358c/US7672624.pdf

https://patents.google.com/patent/US8401437
https://patentimages.storage.googleapis.com/b6/09/25/9092a07fda3453/US8401437.pdf

https://patents.google.com/patent/US8948660
https://patentimages.storage.googleapis.com/79/ff/2c/62c12f00eb9e0d/US8948660.pdf


Doing some manual research :

https://patents.google.com/patent/US8966193
https://patentimages.storage.googleapis.com/9c/38/4d/f75c5b3c04f954/US8966193.pdf

https://patents.google.com/patent/US9400764
https://patentimages.storage.googleapis.com/ec/90/37/616b217d32e47a/US9400764.pdf

https://patents.google.com/patent/EP2226809B1
https://patentimages.storage.googleapis.com/b2/9c/c8/1ef00d503cdace/EP2226809B1.pdf

https://patents.google.com/patent/US9245591
https://patentimages.storage.googleapis.com/71/b8/db/58443002ccc33f/US9245591.pdf

https://patents.google.com/patent/US20170163641
https://patentimages.storage.googleapis.com/7a/7d/01/b2b076d57ecd92/US20170163641A1.pdf

https://patents.google.com/patent/US7426613
https://patentimages.storage.googleapis.com/01/03/f5/87cfecdb866b32/US7426613.pdf

https://patents.google.com/patent/US8099791

On the National Institute of Standards and Technology (NIST https://www.nist.gov/) into the Computer Security Resource Center, some part of the Lexmark cryptographic module validation program documentation has also been made available for public too :
https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2444.pdf
But it doesn't talk about the i2c toner chip at all

I don't have a lot of time this week, so if anybody feel ready to eat all these documents, feel free !

I watched the result of 1 print with the new cartridge but there is nothing special to see, it just written 0x005 and did a lot of communication with 0x80, 0x81 and 0x82 on every cartridge... May be a I should print more copies before seeing a cartridge write ?

I will come back as soon as a have new time and information

[cciollolo]

hi pixconfig, can you explain me how I can save the communication between printer and cartridges? with any arduino with library that you posted? with a pic? if I can understand how you did, I can equip and post printer data different from yours
in the meantime, I ask you some questions:
puoi verificare che ad ogni accensione (prima comunicazione ) i dati scambiati sono sempre gli stessi ? e ad ogni controllo successivo , a distanza di circa 1 minuto, sempre gli stessi dati ?
can you check that every time you switch on (first communication) the data exchanged are always the same? and at each subsequent check, at a distance of about 1 minute, always the same data?
thanks

[LPI-DANE]

Hello, I'm new to this site. I have been looking for the data sheet just like everyone else. I have a friend in Shenzhen that told me that most aftermarket sellers just silk screen on the TI046B1 on to this chip. http://www.ti.com/lit/ds/symlink/pca9515a.pdf. I use a Xeltek 6100 for ghosting IC's. This is not in my data base. I do not have the chip knowledge of most on this site. Could some tell me if this IC could be the same.

[LPI-DANE]

Sorry the link breaks, here is a partial of the PDF. It would not let me load the hole PDF.

[dimprime]

Thanks for your excellent work.
Thanks to your program I can write on the chip.
02_40_04 [448]
02_00_06 [256]
02_20_00 [56]
02_90_00 [208]
I change [208] to [200] and [56] to [200] and I can write and change the bits as I want and when I read them it changes them but the lines 02_40_04 and 02_00_06 do not change them. why?

[JoeO]

Hello, I'm new to this site. I have been looking for the data sheet just like everyone else. I have a friend in Shenzhen that told me that most aftermarket sellers just silk screen on the TI046B1 on to this chip. http://www.ti.com/lit/ds/symlink/pca9515a.pdf. I use a Xeltek 6100 for ghosting IC's. This is not in my data base. I do not have the chip knowledge of most on this site. Could some tell me if this IC could be the same.

Here is the link to the larger document:

http://www.ti.com/lit/ds/symlink/pca9515a.pdf

[amyk]

That's definitely not it; it doesn't even have memory.

This is the closest to a description (the full report is $$$):

https://www.chipworks.com/TOC/Texas_Instruments_TI046B1_Serial_FRAM_CAR-1504-802_TOC.pdf

As for finding a datasheet, since it is a proprietary part you won't find one unless the right person at Lexmark or TI happens to read this thread and decide to be neighbourly (you know who you are... )

[pixconfig]

Hi, sorry for the little time offline, I was a little busy !

cciollolo, here's a little description of my spy's wiring :
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/dsPIC-Wiring.png

• RB7 (pin 16) is used as UART output from the dsPIC to the computer
• RB8 is normally used as SCL, for I2C, but since it doesn't worked, I used RB10 (pin 21) for SCL spy input. Still don't know why RB8 wasn't working !
• RB9 (pin 18) is normally used as SDA, and I used it as SDA spy input
• PicKit connection for when I'm writing/debugging the program is RB2 (PGEC1, pin 6) and RB3 (PGED1, pin 7) for PGC and PGD. I'm only using the 5 first pins of the PicKit
• I used 100nF capacitors (green ones) and for VCap (tantalum 10µF minimum, which I had not) I used the association of a 100µF electrolytic and a 100nF non-electrolytic capacitor in order to have the association of storage capacity and the immediate response time that is probably required to work at full speed.

I'm then using a USB<->Serial converter using TTL / 3.3v signals : when the dsPIC program is writing UART, the computer receives the data, with putty.exe for example.
Into the code it's buffering all the communications and then, it's sending what have been recorded (after 2 seconds of i2c inactivity).
As it's a looooong series of Ones and Zeros, a second program (C++/Qt written, Qt-I2C-Read.zip), it reads bits 9 by 9 between every Start and Stop and do some interpretation to give a readable CSV with address, read/write and acknowledge interpretation. Then I manually add some colors and spaces in order to see patterns and general shape of the communication.


To answer your question about the first communication at each restart, the big first part of the communication is entirely predictable :

• 02_40_04 [448]
• 02_00_06 [256]
• 02_20_00 [56]
• 02_90_00 [208]

But then, every exchange on 0x80, 0x81 and 0x82 are pretty unpredictable (14 bytes writes and 16 bytes read are every time different, apart from the 2 middle bytes of the 16 bytes read that are the same every time, it just depends of the cartridge).
I would not be surprised if it's just authenticity check without information read/write, just because it would explain why some people already succeeded in the past to "blank" the toner chip usage counter.


dimprime, it's very very cool !
I think that the first part is describing a kind of "model" for the cartridge and I wouldn't be surprised if the second part contain the "status" of the cartridge. So it would be a great idea to try to "restore" the cartridge status after having used a little page amount, just to see if the toner level is retrieving it's previous amount !

I will have some time tomorrow in order to try some things and tickle those chips a little bit, with the arduino as master 

[pixconfig]

I've made a pretty cool discovery :

Reading 2048 bytes of 01>00>00, then reading the following ones :

• 01>20>00  is 01>00>00 with a 32 bytes offset
• 01>40>00  is 01>00>00 with a 64 bytes offset
• 01>90>00  is 01>00>00 with a 144 bytes offset
• 01>00>06 is 01>00>00 with a 6 x 256 bytes offset
• 01>40>04 is 01>00>00 with a (4 x 256) + 64 bytes offset

Pretty logic, after all : The first byte after 01> indicates a [0 to 255 for 0x00 to 0xFF] byte offset so the following one indicates a multiple of 256 bytes offset !

[pixconfig]

EDIT : I made an error while reading back data, the reality is that I only succeeded to fill the first 1024 bytes with zeroes.

I (too much but successfully) zeroed an entire chips's eeprom by writing 2048 bytes of 0x00 to 02>00>00
It only remains "0xFB, 0x5F, 0x94, 0x54" for the last 4 bytes of the 2048 bytes buffer read


Now I should understand why some writes are successful, and why some others are not.
And I'm also able to restore back the 1024 first bytes to their initial value, but most of them were already set to 0x00

[pixconfig]

I confirm that toner cartridge that are emptied with the chip giving "0 pages left" are not fully locked

I have been able to set the 1024 first bytes to 0x00 and to read it back, then to restore the initial content.

But :

• When I restore the original, there is some differences at the beginning (32 first bytes) but I already had the problem this morning without writing anything : those 32 bytes were a series of 0x77 and 0x00 and it became just 0x00. Same here, it was a series of 0xB8 and 0x17, now it's just series of 0x00 and 0x00
• Also, when I try to write with incremental values the first 1024 bytes, there is only 336 bytes that are written : 0 to 32 is not written, 336 bytes are written and all that follow is kept to 0x00

Anyway it's still interesting to see all this
Sorry for multiple Editing, I realized that my interpretation was wrong because of some mistakes in my code !

[pixconfig]

So we are approaching the end, I'm on the verge of attempting something :

This is the 01>20>00 "register" of a brand new magenta cartridge (small capacity)

Code: [Select]

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x75};
After some little magenta prints :

Code: [Select]

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x46, 0xBA};
Nothing else changed into the chip.
The visual indicator doesn't really show any missing bit of toner level but anyway... I would like to try applying this value to a Cyan cartridge that is pretty low, with the exclamation sign at side of it's toner level representation, just in order to see if it's the toner level... or not ! And I hope that the value I will put will not lock anything with the cartridge once into the printer.

Some more details I noticed by analyzing all the content :

The first 1024 bytes of information are completely organised that way :

• 32 bytes of strange volatile read only value repeating itself 2 by 2, that sometimes changes to 0x00 after some writes
• 56 bytes of what I believe is the toner level
• 56 bytes of what I believe is the toner level, a second time, same values - printer doesn't seems to read this field but it's into the chip
• 208 bytes of information that doesn't have changed since the cartridge is into the printer
• 6 first bytes of 01>00>04 (the 1024 bytes read only area) followed by zeros. But 16 bytes can be written and here
• After the 368 first bytes, the 656 following bytes are covered by 0x00 and seems to be read only

After the 32nd and up to the 368th byte, everything can be written by the data of your choice, and I'm not really sure of why sometimes it fails. But if you write the complete set of 1024 bytes it seems to work everytime.
When I try to observe the printer communicating with it's cartridge I only see some Writes into 0x05 EEPROM area and some exchange on 0x80/0x81/0x82 with all cartridge but impossible to guess what it does (apart from entering some kind of 0x08 or 0x09 modes, and writing random 14 bytes to get 16 random bytes in answer).

Also, I tried to read 3072 first bytes, but it does a cycle : the 1024 last bytes are the 1024 first ones.

Keep you informed !

EDIT 1 : well, it does not work  printer says that the cartridge isn't recognized. The I2C spy shows nothing abnormal. Now I will try to copy the content of another cartridge of the same reference, delivered with the printer

[pixconfig]

Suceeded 

I copied the Yellow level (~40%) of the same cartridge reference into the Cyan toner chip (was almost empty) with the following code :

Code: [Select]

uint8_t Register56[56+4] = {0x00, 0x00, 0x00, 0x00,      0xFF, 0x01, 0xFF, 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0xA0, 0x0D, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x04, 0xC3, 0x00, 0x00, 0x00, 0x2D, 0x87};

void playOnce()
{
  write_TI046B1_register(0x002, 0x02, 0x20, 0x00, Register56, 56);
  write_TI046B1_register(0x002, 0x02, 0x58, 0x00, Register56, 56);
 
  //Check :
  read_TI046B1_register(0x002, 0x01, 0x00, 0x00, Buffer, 512);
  read_TI046B1_register(0x002, 0x01, 0x00, 0x02, Buffer, 512);
  read_TI046B1_register(0x002, 0x01, 0x00, 0x04, Buffer, 512);
  read_TI046B1_register(0x002, 0x01, 0x00, 0x06, Buffer, 512);
}
Of course it doesn't add real toner inside the cartridge so it's just for technical comprehension of our printer, as it's written on the cartridge's box : "By opening this package you agree to use this cartridge only once" so of course I'm going to put back the real toner remaining amount into the chip, and use it only once, and I encourage you to do the same.

I would love to know what is the "full" level for this reference !
I'm gonna analyze a little bit what contains this 56 bytes buffer, may be I would be able to fully understand it.

There's still many areas of shadows about what the chip contains and does.

[pixconfig]

Hi,

Another good news for people who have "empty" cartridge with 0 pages left : it's possible to reload the chip, it's not locked (at least, not with the "starter cartridge" delivered with the printer). For this example, we successfully put the "40% left" level of the Yellow toner chip into the "0% left" magenta toner chip, and now, there is "40% magenta left" and it works.

A good idea would be to share, here, the different values of 01>20>00[56] for differents kind of cartridges, with differents levels, and to make a summary here.


Let's begin :

Magenta, 71B20M0, still not used :

Code: [Select]

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x75};
Magenta, 71B20M0, after just little uses

Code: [Select]

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x46, 0xBA};
Magenta, 802HME High Yield (CX410 / 510), not used because not compatible with our printer :

Code: [Select]

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xCD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA6, 0xFF};
CS417, CX417 Starter Return Program : Black ~30%, Blue ~10%, Magenta 0%, Yellow ~40%)

Code: [Select]

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0xFF  1111 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x11, 0x00, 0x01, 0x20, 0x13, 0x00, 0x61, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x05, 0x05, 0x00, 0x00, 0x00, 0x30, 0x3B};

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0x7F 0111 0xFF, 0xFF, 0x8D, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEF, 0x00, 0x00, 0x60, 0x04, 0x00, 0x69, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x01, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x04, 0xC0, 0x00, 0x00, 0x00, 0x9D, 0x9B};

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0x3F  0011 0xFF, 0xFF, 0x8C, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x23, 0x00, 0x00, 0x40, 0x03, 0x00, 0x6D, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x04, 0xC4, 0x00, 0x00, 0x00, 0x67, 0x68};

uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x01, 0xFF  1111 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0xA0, 0x0D, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x04, 0xC3, 0x00, 0x00, 0x00, 0x2D, 0x87};

Please read before doing : Of course it doesn't add real toner inside the cartridge so it's just for technical comprehension of our printer, as it's written on the cartridge's box : "By opening this package you agree to use this cartridge only once" so of course I'm going to put back the real toner remaining amount into the chip, and use it only once, and I encourage you to do the same.

[driver_x]

Hi, here's my hypothesis: toner level might be stored in the second and third bytes:

The levels might be:

Code: [Select]

  %     dec     hex
____________________
0 %     63     00 3f
10%    127     00 7f
20%    255     00 ff
30%    511     01 ff
40%    1023    03 ff
50%    2047    07 ff
60%    4095    0f ff   
70%    8191    1f ff
80%    16383   3f ff
90%    32767   7f ff
100%   65535   ff ff

Now we go to your cartridges:

Magenta, 71B20M0, still not used : bytes 2 and 3 = ff ff = 100%
Magenta, 71B20M0, after just little uses: bytes 2 and 3 = 7f ff = 90%
Magenta, 802HME High Yield (CX410 / 510), not used: bytes 2 and 3 = ff ff = 100%
Black ~30%, bytes 2 and 3 = 00 ff = 20%
Blue ~10%, bytes 2 and 3 = 00 7f = 10%
Magenta 0%, bytes 2 and 3 =00 3f = 0%
Yellow ~40%, bytes 2 and 3 = 01 ff = 30%

Bytes 15 and 16 might hold the number of printed pages or some measure of toner consumed, because it seems proportional with the filling percentage, the emptiest has the biggest value, the fullest has the smallest value. Black cartridge always has more toner than the others.
Black ~30% = 0x 0111 = 273
Blue ~10%  = 0x00ef = 239
Magenta 0% = 0x 00123 = 291
Yellow ~40% = 0x 00AD = 173

I printed a report with device statistics. What information might be stored on the cartridge:
Install date (?)
Supply level (bytes 2 and 3?)
Sides on cart (bytes 15 and 16?)
Return program Genuine(??)
Printer Liftime(??)

Try to print more pages and put here the dump and the report, maybe we can map all the bytes

[JacquesBBB]

Hi,

Another good news for people who have "empty" cartridge with 0 pages left : it's possible to reload the chip, it's not locked (at least, not with the "starter cartridge" delivered with the printer). For this example, we successfully put the "40% left" level of the Yellow toner chip into the "0% left" magenta toner chip, and now, there is "40% magenta left" and it works.

Bonjour pixconfig !

I am following your progress  with great interest.

As I understand, you have developed two way of communicating :

- intercepting the signal on the printer with a dsPIC33EP512MC502 and the associated c program

- reading and writing  to the chip with an arduino program on an atmega 2560

Which one are you using for the latest  reading and writing you mention ?
I assume it is the arduino. Can you confirm ?

What is the wiring  you used ?

Bien amicalement,

Jacques

[driver_x]

Very interesting information: https://caselaw.findlaw.com/us-6th-circuit/1211276.html

[pixconfig]

Salut JacquesBBB, and driver_x !

JacquesBBB : We are using the pin description you discovered in the first page of this topic : First one (longer) is GND, second one is SCL, 3rd one is 3.3V power supply, last one is SDA.

I would like to thank you as we probably wouldn't have done all this without all the information that was already available in this thread. I wasn't even aware about 10 bit addressing existence.


As you saw, yes, for manual read/writes we are using an Arduino (Mega2560, equipped with 8192 bytes of RAM) for directly writing/reading were we want into the chip. We used the dsPIC only as read only, with a self made program for in-situ spying of I2C communication inside the printer, with 3 wires (GND/SDA/SCL) connected on the imaging drum electronic card (that is easily removable, its just like a big toner chip with 4 slots and 1 connector).

https://image.noelshack.com/fichiers/2018/17/7/1525016623-sans-titre2.png
We firstly tried to solder some wires on the chip's contact before putting the cartridge in place, but it was a bad idea since the cartridge was unable to fully take it's place into the printer (toner leaks !)

I would like to add some detail about the wiring with Arduino 2560 :
Atmel AtMega2560 has internal pullup on the RD0 and RD1 port used for I²C, connected to 5v, that cannot be disabled for these pins on this model.

We used, both for SDA and SCL, some 18 kOhms resistor mount for reducing the voltage on the toner chip pins. With this, we have ~3.3v when the bus is high and 0v when the bus is low


driver_x :
Your hypothesis is interesting, I won't have the printer this week but I will do some more test as soon as possible. I also see that there is some others bytes changing everywhere; putting all the data into an Excel helped me to see some similar points but also a lot of questions remaining !

For the lawsuit, I saw a similar document in this thread (2nd page, https://www.eff.org/document/sixth-circuit-opinion), if I understood, it's a case where some company was duplicating a lexmark obfuscated protocol program chip by simply copying the program inside the chip instead of doing its own, which caused some copyright issue.

[driver_x]

Salut pixconfig
From the lawsuit we find interesting things (I don't know if it still applies to current cartridges, but is interesting to know):

[...]
The first program at issue is Lexmark's “Toner Loading Program,” which measures the amount of toner remaining in the cartridge based on the amount of torque (rotational force) sensed on the toner cartridge wheel.   Maggs Aff. ¶ 24, JA 709.   The Toner Loading Program relies upon eight program commands-“add,” “sub” (an abbreviation for subtract), “mul” (multiply), “pct” (take a percent), “jump,” “if,” “load,” and “exit”-to execute one of several mathematical equations that convert the torque reading into an approximation of toner level.   Goldberg Aff. ¶ 21, JA 578;  Maggs Aff. ¶ 24, JA 709.   If the torque is less than a certain threshold value, the program executes one equation to calculate the toner level, and if the torque equals or exceeds that threshold, the program executes a different equation to calculate the toner level.   Goldberg Aff. ¶ 19, JA 576-77.   The exact code of the Toner Loading Program varies slightly for each printer model, and this case involves two versions of the program-one for Lexmark's T520 and T522 printer models and another for Lexmark's T620 and T622 printer models.   The Toner Loading Program for the T520/522 printers comprises 33 program instructions and occupies 37 bytes of memory, while the Toner Loading Program for the T620/622 printers comprises 45 program commands and uses 55 bytes of memory.   To illustrate the modest size of this computer program, the phrase “Lexmark International, Inc. vs.   Static Control Components, Inc.” in ASCII format would occupy more memory than either version of the Toner Loading Program.   Burchette Aff. ¶ 13, JA 106.   The Toner Loading Program is located on a microchip contained in Lexmark's toner cartridges.
[...]
To ensure that consumers adhere to the Prebate agreement, Lexmark uses an “authentication sequence” that performs a “secret handshake” between each Lexmark printer and a microchip on each Lexmark toner cartridge.   Both the printer and the chip employ a publicly available encryption algorithm known as “Secure Hash Algorigthm-1” or “SHA-1,” which calculates a “Message Authentication Code” based on data in the microchip's memory.   If the code calculated by the microchip matches the code calculated by the printer, the printer functions normally.   If the two values do not match, the printer returns an error message and will not operate, blocking consumers from using toner cartridges that Lexmark has not authorized
[...]
The parties agree that Lexmark's printers perform a second calculation independent of the authentication sequence.   After the authentication sequence concludes, the Printer Engine Program downloads a copy of the Toner Loading Program from the toner cartridge chip onto the printer in order to measure toner levels.   Before the printer runs the Toner Loading Program, it performs a “checksum operation,” a “commonly used technique” to ensure the “integrity” of the data downloaded from the toner cartridge microchip.   D. Ct. Op. ¶ 77, at 14.   Under this operation, the printer compares the result of a calculation performed on the data bytes of the transferred copy of the Toner Loading Program with the “checksum value” located elsewhere on the toner cartridge microchip.   If the two values do not match, the printer assumes that the data was corrupted in the program download, displays an error message and ceases functioning.   If the two values do match, the printer continues to operate.
[...]

[JacquesBBB]

Salut JacquesBBB, and driver_x !

JacquesBBB : We are using the pin description you discovered in the first page of this topic : First one (longer) is GND, second one is SCL, 3rd one is 3.3V power supply, last one is SDA.

I would like to thank you as we probably wouldn't have done all this without all the information that was already available in this thread. I wasn't even aware about 10 bit addressing existence.

Thanks, Its good to know that this effort was useful.

I am trying to implement your arduino file,  but cannot find the following libraries

#include <avr/io.h>
#include <avr/interrupt.h>
#include <compat/twi.h>

where are they ?

Thanks

update : OK,  I see that if I use an AVR chip, there is no problem and the libraries are automatically loaded.

[driver_x]

Hi again,

From my cs310dn:

Code: [Select]

Cyan, high yeld few pages printed (the chip is not original, "compatible" cartridge)
uint8_t destinationBuffer[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xD7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x65, 0xDA};

Yellow, 60% (normal yeld)
uint8_t destinationBuffer[56] = {0xFF, 0x7, 0xFF, 0xFF, 0xFF, 0xF, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5B, 0x0, 0x0, 0x50, 0x10, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xAF, 0x0, 0x0, 0x0, 0xAD, 0x27};

Magenta(starter) (10%)
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x7F, 0xFF, 0xFF, 0x8D, 0xA, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xEE, 0x0, 0x0, 0x20, 0xA, 0x0, 0x6D, 0x7F, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x1, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xFF, 0xFF, 0x0, 0x0, 0xFF, 0xFF, 0x3, 0x0, 0x0, 0x3, 0xB, 0x0, 0x0, 0x0, 0x4C, 0xB5};

Cyan, starter, (empty)
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x3F, 0xFF, 0xFF, 0x8C, 0xA, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x19, 0x0, 0x0, 0x20, 0xF, 0x0, 0x69, 0x7F, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xFF, 0xFF, 0x0, 0x0, 0xFF, 0xFF, 0x3, 0x0, 0x0, 0x3, 0xC, 0x0, 0x0, 0x0, 0x9A, 0x5B};

[pixconfig]

Hi folks, working back on the printer today

Figuring out that a 2 bytes sized checksum is likely to be CRC 16, and based on the work of qub1n into https://stackoverflow.com/questions/10564491/function-to-calculate-a-crc16-checksum

We successfully implemented the checksum used for 2 last bytes. Enjoy !
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/QtChecksumI2C.zip

Now we are gonna modify all that we can, based of driver_x suggestions and discoveries and test what we can.

There is some last issue, after few prints, it's like if cartridge is finding back it's previous level (magenta is empty again, cyan is in "warning almost empty status" again, even with a cartridge full of toner so it's not likely to be due to a physical sensor). May be another place to modify ?

PS : JacquesBBB, in fact I included and modified (buffer sizes) twi.h without using wire.h so I place the file "twi-all-included.h" at side of the "I2C_TI046B1_Read.ino" file.

[amyk]

There is some last issue, after few prints, it's like if cartridge is finding back it's previous level (magenta is empty again, cyan is in "warning almost empty status" again, even with a cartridge full of toner so it's not likely to be due to a physical sensor). May be another place to modify ?

It might not be this exact printer/model but I remember there being mentions of printers storing the data from the last X cartridges in its own EEPROM. You should try changing the serial number since that's what it uses to detect "simple" reset attempts like these.

[pixconfig]

It will be a good idea to check this ! Il will try to print and check.

Based on some test and analysis, and a big thank you to driver_x, here is the Full toner level for starter kits cartridge

Code: [Select]

uint8_t Register56Cyan[56+4] =  {0x00, 0x00, 0x00, 0x00,    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x69, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD3, 0xA2};
uint8_t Register56Mage[56+4] =  {0x00, 0x00, 0x00, 0x00,    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6D, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC4, 0x90};

It based on the following analysis of the different toner chip contents listed on this forum, so you can build your own 56 bytes register depending on which kind of cartridge you are using.

Code: [Select]

Byte 1 : 0xFF everywhere

Bytes 2 and 3 : 0xFFFF is full, 0x7FFF after 2 or 3 pages, 0x003F : 0%, 0x007F : 10~20%, 0x01FF for 40%, 0x07FF for 60%,

Bytes 4 and 5 : 0xFF everywhere

Byte 6 : 0x1F for Full or almost full, 0x8C for empty, 0x8D for almost empty with warning sign, 0x0F seen for 30% 40% and 60%.

Byte 7 : 0x0A for starter kits, 0x00 for others

Bytes 8 to 14 : 0xFF then 0x00, 0x00... everywhere

Byte 15 and 16 : printed pages : 0x0000 for new

Bytes 17 18 19 20 : 0x00 for the first byte everywhere, then 0x??, 0x??, 0x?? depending on cartridge. Non proportionnal. 0x00000000 when new or almost new

Bytes 21 22 23 24 : 0x00 then 3 bytes depending on the cartridge model
back starter : 0x00 61 7F FF
cyan starter : 0x00 69 7F FF
magenta starter: 0x00 6D 7F FF
yellow starter: 0x00 63 7F FF

magenta 71B20M0 : 0x00 C0 00 00
magenta 802HME : 0x00 CD 00 00
cyan high yield for CS310dn : 0x00 D7 00 00
yellow normal yield for CS310dn : 0x00 52 00 00
don't forget to double check when you can, and add new ones when you have !

Bytes 25 26 27 28 : 0x00 00 00 00 everywhere

Bytes 29 and 30 : 0x0000 when new or >= 30%, 0x01 90 (=400) or 0x011D (=285) when warning low level. Final count down rising as approaching the end ?

Bytes 31 32 33 34 35 36 37 38 39 40 : 0x 00000... everywhere

Byte 41 and 42 : 0xFFFF for starter kits, 0x0000 if not starter kit

Byte 43 and 44 : 0x0000 everywhere

Byte 45 and 46 : 0xFFFF for starter kits, 0x0000 if not starter kit

Byte 47 : 0x00 if not used, seen at 0x01 on 2 pages printed, seen as 0x02 if >3 pages, seen at 0x03 when almost (or completely empty)

Byte 48 and 49 : 0x0000 everywhere

Byte 50 and 51 : 0x0000 = new, 0x0001 = few usage, 00AF = ~60%, 0x04C3 = ~40%, 0x0505 = ~30%, 030B and 04C0 = low,  0x04C4 and 0x030C : empty... so when level is low, it's imprevisible

Byte 52 53 54 : 0x00 00 00 everywhere

Byte 55 and 56 : CRC16 Checksum of the 54 previous bytes
So if I'm not wrong, the full level of starter black and starter yellow would be :

Code: [Select]

uint8_t Register56Black[56+4] =  {0x00, 0x00, 0x00, 0x00,    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x61, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFD, 0xC6};

uint8_t Register56Yellow[56+4] =  {0x00, 0x00, 0x00, 0x00,    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF6, 0x5F};
But it should be tested; if it does not work, then we should check the checksum or the cartridge type bytes.

Let's check if the level is changing normally when we print some big pictures ! If not, then it's probably because of what amyk describes. I will watch how the reference number of the cartridge can be changed, probably into the 208 bytes field.

[driver_x]

Hi again
I have made the same analysis with similar result.
Now, after I've read some patents (for example this: https://patentimages.storage.googleapis.com/32/30/7a/832cd3e5de56ed/US5995774.pdf ), my question is : do we have or not lockout bits (bits that, once written, cannot be modified)? Only 1 write once bit is needed to mark that the cartridge is depleted and all our work is for nothing.

[driver_x]

Now, of course the printer it's checking the toner level using it's mechanical parts (wheels, torque sensors etc) so if you write 100% toner on the chip and the printer is sensing something else, probably it will tell you that the cartridge is defective and needs to be replaced. My opinion is that first you must fill the cartridge with toner, write the new information to the chip and after this to try inserting it in the printer.

I have two new readings, for the balck cartridges:

Code: [Select]

Black starter - empty:
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x3F, 0xFF, 0xFF, 0xC, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xF5, 0x0, 0x0, 0x60, 0x15, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x88, 0x0, 0x0, 0x0, 0x0, 0x67};

Black- High Yeld ~90%:
uint8_t destinationBuffer[56] = {0xFF, 0x1F, 0xFF, 0xFF, 0xFF, 0xF, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xB0, 0x0, 0x0, 0xD0, 0xB, 0x0, 0xD1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, 0xBC, 0x15};


[pixconfig]

Hi,
In fact there is good news, even with an almost empty cartridge, the system is working fine when we put the correct 100% values, we successfully consumed some toner and had the cyan toner level slightly reduced (from 100% to 90%) after some big pictures prints.

And the 56 bytes register values of full start Black and full starter Yellow are good too :


We will probably see some missing colors soon or late into the prints, once the cartridge will be completely emptied, even when the "toner level" will be indicating some remaining amount of toner. I would not be surprised if the printer is unable to see if toner is really here or not : the only things that connects the imaging drums and cartridge to the printer are mechanical gears and I2C bus for toner chips. The laser probably "touch" the imaging drums without having to connect anything else but photons, and if there is missing toner powder, then may be nothing can see it, but our eyes once the document is printed.


The fact that, few days ago, the toner chip previous level was restored by the printer, is probably due to the fact that the "Yellow" cartridge type was copied into the others (our first try) and it was probably not a completely good idea, of course, since every cartridge has it own type bytes into the 56 bytes register (then it should probably be respected - it's what we dit yesterday and it seems better).

Also, may be the fact that the 56 bytes register is written 2 times is a way to give a second chance to read the data when it's corrupted or abnormal. Then, if it's not enough, then the printer probably keeps a local copy of those register in order to restore it (probably what happened).

And a final good thing to know, at least for starter kit : the chip was indicating "empty", "0 pages left", no print possible, and we succeeded in putting "100%" level into it.

[driver_x]

So they calculate the remaining toner only by estimating how much powder has been used based on the number of pages printed (or maybe based on how many rotations the mirror has made) I thought that the motor that is turning the cartridge's wheels had some kind of torque sensor, so in case that the number stored in the cartridge becames "corrupt", the printer to be able to estimate again the quantity of remained toner, as stated in their patent:

"The sensor S may take the form of a mechanical sensor that detects torque required to turn an auger positioned in the reservoir, an optical sensor that uses light to measure the amount of toner, or any other sensor configuration that provides feedback regarding the amount of toner remaining in the reservoir."

https://patents.google.com/patent/US7747180?oq=lexmark+toner+level

Anyway, thank you for all the hard work 

[pixconfig]

Hi everybody !

We still had some issues, sometimes, with the cartridge emptying a little bit too fast (sometimes way too fast, after less than 50 pages), even when full of toner into the cartridge.
So we tried to figure out what is into the 208 bytes register at 0x01 > 0x90

There is a 30 bytes UUID around the end of this 208 bytes register, that finishes with the famous CRC16 (the one that we are now, of course, able to check/complete). All the rest is completely fulfilled with 0x00 for a brand new cartridge.
Here is the analysis :
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/208byte-analysis.ods

And after a lot of uses, we finally see some changes into this register, so it should be reset too.

We updated the Arduino code in order to auto-reset the connected cartridges, keeping the information that should be kept, and recalculating the CRC16 automatically at the end for both 56 and 208 bytes registers.

It firstly reads the content of every register before changing the values that should be changed, automatically.

Enjoy ! https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Reset.zip

May be at the end it would be nice to try to modify the 30 bytes UUID, but let's first try to see if it works without changing it.

[AndreiKenig]

I know exactly where to store the cartridge capacity for Lexmark MS\MX. I ask to lay out a chain of 448 bytes starting from 02_40_04 for Lexmark CS order in  to verify in the same place the capacity of the cartridge is stored in the Lexmark of the CS or not.

[pixconfig]

Hi,

Thank you much for this information ! Do you succeeded to write this area ? I didn't succeeded.
01>40>04 is located at (4x256 + 64) bytes and is read during 448 bytes, so from 1024+64 to 1536 bytes (it's like if the printer reads from 1024 to 1024+512 but without the 64 first bytes).

Did you guess some interpretation of what's inside this register ? I see there is some ASCII strings but also some binary datas and lot of "0x00".

Here is the content of a brand new chip I have :

But it's not compatible with my printer... anyway it's still interesting to watch what is inside and compare with others.


My persistent problem of today is :  the printer says my magenta cartridge reached end of life at each print.
So I finally tried to change the 30 bytes UUID inside the 02>90>00 register but after any print, it says "end of life" for the magenta cartridge, again.

No problem with the others, that's pretty strange, may be there is a real physical problem with the magenta but it is completely new and full, I just changed the chip to play a little bit and understand how those chips works, and because the original chip of this cartridge says "not compatible with this printer". I also checked if the cartridge is, physically, the same, and yes obviously. I have no more idea for the moment ! 

I guess the 12 first bytes of 01>40>04 (that contains the same barcode stuck on the cartridge sticker) should be changed too; It may have som key procedure to write this area (starting to a precise byte during a precise length for having the chip accepting the written value ?)

[Arturo2511]

hello,
from my research, the problem comes from the fact that the chip retains the number of copies made since the beginning. When the cartridge is reset to 0, that if it is 100% but the copy number remains unchanged. The printer will check if the number of copies is less than or equal to the maximum capacity of the printer. After resetting a chip with 80% remaining but the number of copies unchanged (1538 copies / 1500 max) that if automatically becomes empty after the first impressions while he had 80% of free (it went from 100% - > 0). I did not manage to dump the memory of the chip to compare the data before and after. If you had an arduino program to read the whole of the chip, I'm interested. I communicate with the chip by i2c but 10-bit registers are difficult to read with an arduino.

[driver_x]

Hi, you can find the program and instructions for reading/writing the chip with arduino in the previous posts. We managed to find where on the chip is stored the number of printed pages and also where is stored the actual toner level, so the problem is not here.
Maybe the printer is also storing into its internal memory(not on the cartridge) the serial number of the cartridge along with a timestamp and probably more information about the cartridge.

[AndreiKenig]

What data is stored in the chip from Lexmark CS series with offset 0x045f and 0x0460? In the lexmark MS/MX, if you transfer this data to the DEC, you get the capacity of the cartridge. I tested this on more than 10 different models of the cartridge.

[pixconfig]

Hi,

At offset 0x045f and 0x0460 (by reading 0x01 > 0x5F > 0x04 during 2 bytes) we found 0x60 and 0x12 on starter kits cartridges.

We have been unable to write after offset 0x400 (past 0x02 > 0x00 > 0x04).
We tried by replacing the 0x02 first byte with any value from [0x00 to 0xFF] but it did nothing.

We also tried to write at 0x02 > 0x00 > 0x08 (so at offset 0x800 which is 2048) and 0x02 > 0x00 > 0x0C (so at offset 0xC00 which is 3072) but it did nothing too.

We are out of ideas now 
We also tried to reset to factory setting the printer (by typing 2 + 6 at power on for entering into maintenance menu), with no cartridge in the printer, and we placed the cartridge after, with an almost new magenta cartridge but an empty reset starter kit chip on it, and we were disconnected from network during all this. After few minutes it said again that the magenta cartridge is "end of life" with 0 page left.

Finally, we had some return from some people, that the Reset Program for Arduino corrupted some toner chip information after having fail to read the content before modifying it, but successfully writing it back to the toner chip... with a lot of 0x00 !

So we modified the program in order not to write anything if the reading fails before. The new version is here : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Reset.zip

Any more idea is welcome !
Bye

[AndreiKenig]

Все изменения в дампе картриджа должны быть подписаны хэшем который храниться в дампе начиная со смещения 0х700. Чтение и изменения хэша происходит через посылку 14 байт в регистр 81. И только после декодирования запросов в 81 регистр и ответов в регистр 80 можно будет полноценно восстанавливать чипы.

[pixconfig]

All changes to the cartridge dump must be signed by a hash that is stored in the dump since the 0x700 offset. Reading and modifying the hash is via sending 14 bytes to register 81. And only after decoding the requests in the 81 register and the responses to register 80 it will be possible to fully restore the chips.

Hi AndreiKenig, Thank your for this answer, actually the printers does a ton of exchanges on 0x81 and associated registers. I believed this was only a "genuine check" when I successfully edited the cartridge level for the first time so I didn't looked after it for a while, but now that we realize there is something else, this make sense to watch again over it!

Here is what I saw when I watched it for the first time with the dsPIC :

0x82 is a kind of Status Register that the printers reads before asking anything to 0x81 or 0x80 :
status 0x38 is "nothing more to say, please enter something into 0x81"
status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
     
status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09

0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time

I also noticed after that in the middle of the 16 bytes answer inside 0x82, there is two bytes that never changes on each cartridge

[AndreiKenig]

Работа с регистрами 81 и 80 идёт циклами сначала с тонер картриджем затем с драм картриджем. Принтер выходит в готовность когда при последнем ответе в регистре 80 драм картриджа 15 байт начиная с 0 передаёт значение 0х88 (истина).

[AndreiKenig]

0x82 - это своего рода регистр состояния, который печатает на принтере, прежде чем спрашивать что-либо 0x81 или 0x80:
статус 0x38 «больше нечего сказать, пожалуйста, введите что-то в 0x81 «
status 0x48 -« 0x81 Регистр получен 0x08 »(позволяет вызывать этот режим 0x08)
status 0x88 является следующим шагом: 14 байтов вопрос записывается в 0x81 после ввода режима 0x08
     
статус 0x49 - «0x81 Регистр принят 0x09» (позволяет вызывать этот режим 0x09).
0x89 - это следующий шаг: вопрос 14 байтов записывается в 0x81
после ввода режима 0x09

0х98  - ошибка, картридж заблокирован
после в ответе регистр 0х80 будет 16 байт 0х00

[Alan.B]

Hello friends!

Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?

Regards!

[AndreiKenig]

Полный дамп снять не получиться. Адреса с 0х00 по 0х1F, c 0x170 по 0x3FF и c 0x700 по 0x7FF считать будет невозможно. Вернее данные в них будут ошибочны либо 00 либо FF. Вышеуказанные области защищены от прямого чтения.

[Alan.B]

Perfect! Thank you!

I will try to use my Saleae Logic Analyzer and see if I get more information about it. At the moment I am building a logic level converter to protect the memory. Unfortunately, my logic analyzer only works with 8-bit i2c readings, but I think the data can be interpreted anyway. If someone has the time, the knowledge and the desire, could modify the *.dll´s starting from the SDK of Saleae and I will gladly use it to make readings in the printer and observe what happens with the addresses that you mention in the previous post.

Regards! 

[Alan.B]

Hello friends!

Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?

Regards!

Всем, Привет!
Немного исправил рисунок

Hello Friend!
The circuit that I attach in my post is correct! The one that you attached in your post is not correct!

[Alan.B]

Hello again!

I can not get the pixconfig source code to work to read the chips
I already tried 9 chips but nothing yet ...

This is the error that throws "Error occured wile trying to write to the slave: Slave's address not acknowledged (begning only) - is it connected?"

My configuration is Arduino -> Logic Level -> Chip

According to what I read it may be an error in my i2c address, does anyone know how I calculate the address of the Ti046b1?

Regards!

[Technics66]

I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

[Alan.B]

I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

Hello Friend!

Seeing on the internet, the chip of the model that you commented "MX410" is exactly the same as my "MS810" chip ...
The log that you shared, is a chip reset to new?
If so, it would be useful to perform tests on my chip.

Regards!

[Technics66]

is a chip reset to new?

Yes. But when the chip was reset, the programmer gave an error. I can check the chip later.
In the sketch pixconfig when reading 01> 20> 00 reads 56 bytes, and in the logs read 16 bytes. A very big difference in the methods of reading between the sketch and the logs.

[AndreiKenig]

Чтение и запись данных по адресам  диапазона с 0х700 по 0х7FF производится через команды в регистр 0х81

[AndreiKenig]

А кто нибудь может сказать почему чтением в скетче 01> 20> 00 получается 56 байт, а программатором видно что читается 8 байт? Это от чипа зависит или от чего-то другого?

Я читаю своим программатором строки по 16 байт и у меня проблемы не возникают

[Alan.B]

I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

Friend! Analyzing your log "Log_MX410", after consulting the model in the registry 0x01 0x50 0x04, the programmer obtains the 14 bytes to record in the registry 0x81. Has anyone already discovered how this is done?

I also want to tell you that I modified the functions created by pixconfig a bit, when I have it completely ready it will be posted, but for now I need to know how to calculate the 14 bytes for the 0x81 register.

Regards!

[Alan.B]

More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...

Regards!

Code: [Select]

-------------------------------------------------------------------------------------------------------------
BLOCKED CHIP
-------------------------------------------------------------------------------------------------------------
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00

-------------------------------------------------------------------------------------------------------------
NEW CHIP
-------------------------------------------------------------------------------------------------------------
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: C8
Send: 0x80 | Response: 00 00 00 00 00 00 5A06 00 00 00 00 00 00 00 80


[amyk]

Please keep the discussion in English, translate it yourself before posting, this is an interesting topic but hard to read if everyone has to use Google Translate themselves.

[Technics66]

More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...

Please give your sketch.
I have 5 chips locked and 3 chips not locked.
I can check with your sketch sooner.

[Alan.B]

More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...

Please give your sketch.
I have 5 chips locked and 3 chips not locked.
I can check with your sketch sooner.

Of course I share it with you! Sorry for my English helped me with Google translator.
If you get successful results, please share them with the community!

Regards!

Code: [Select]

#include "twi-all-included.h"


void setup()
{
  Serial.begin(9600); //[Start+8bits+STOP] => 960 o/s
  twi_init(); //Standard 100 kHz Atmel's internal I2C device initialisation with Pull-Up on SDA/SCL
}

void read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom)
{
  uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSB
  uint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB
 
  //Put the MSB bits to the Left :
  slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003
 
  //7 bits address equivalent for the begining :
  uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.
 
  //Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.
  uint8_t txBuffer[registerSize + 1];

  for(uint8_t i = 0; i < sizeof(txBuffer); i++)
  {
    if(i==0)
    {
      txBuffer[i] = slave_address_LSB;
    }
    else
    {
      txBuffer[i] = registerBuffer[i-1];
    }
  }

  uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);
  if (nRet == 1)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave : TWI class's buffer is too small");
    Serial.println("W1");
    return;
  }

  else if (nRet == 2)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave : Slave's address not acknowldged (begning only) - is it connected ?");
    Serial.println("W2");
    return;
  }
 
  else if (nRet == 3)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave :");
    //Serial.println("Slaves's begining of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?");
    Serial.println("W3");
    return;
  }

  else if (nRet == 4)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("I2C protocol error occured wile trying to write to the slave. Is the wiring correct ? TWI Initialisation ?");
    Serial.println("W4");
    return;
  }
 
  //else :
  nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end. 
  if (nRet == 0x00)
  {
    //Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.
    //Serial.println("Error occured wile trying to read from the slave.");
    Serial.println("R1");
    return;
  }

  if (nRet != readSize)
  {
    //Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.
    Serial.print("Unable to read all the bytes from the slave : ");
    Serial.print(nRet, DEC);
    Serial.println(" bytes read");
   
    return;
  }

  //else :
  for (uint16_t i=0; i<readSize; i++)
  {
    //Serial.print("0x");
    if (destinationBuffer[i] < 0x10)
    {
      Serial.print(0, HEX);
      Serial.print(destinationBuffer[i], HEX);
    }
    else
    {
      Serial.print(destinationBuffer[i], HEX);
    }
  }
  Serial.println("");
}

//Delcopi sequence obtained from "Log_MX410" by Technics66
uint8_t a[1] = {0x03};
uint8_t a_[1];

uint8_t b[1] = {0x83};
uint8_t b_[1];

uint8_t c[3] = {0x01,0x50,0x04};
uint8_t c_[16];

uint8_t d[1] = {0x82};
uint8_t d_[1];

uint8_t e[2] = {0x81, 0x08};
uint8_t e_[1];

uint8_t f[1] = {0x82};
uint8_t f_[1];

uint8_t g[15] = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};
uint8_t g_[1];

uint8_t h[1] = {0x82};
uint8_t h_[1];

uint8_t i[1] = {0x80};
uint8_t i_[16];


void loop()
{
  char command = getCommand();
  switch (command)
  {
    case 'a':
      Serial.print("Send: 0x03 | Response: ");
      //read_TI046B1_register(ADDR, CMD, sizeof(CMD), BUFFER_RESPONSE, sizeof(BUFFER_RESPONSE), STOPCOM 1|0);
      read_TI046B1_register(0x000, a, sizeof(a), a_, sizeof(a_), 0);
      break;
    case 'b':
      Serial.print("Send: 0x83 | Response: ");
      read_TI046B1_register(0x000, b, sizeof(b), b_, sizeof(b_), 0);
      break;
    case 'c':
      Serial.print("Send: 0x01,0x50,0x04 | Response: ");
      read_TI046B1_register(0x000, c, sizeof(c), c_, sizeof(c_), 0);
      break;
    case 'd':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, d, sizeof(d), d_, sizeof(d_), 0);
      break;
    case 'e':
      Serial.print("Send: 0x81, 0x08 | Response: ");
      read_TI046B1_register(0x000, e, sizeof(e), e_, sizeof(e_), 1);
      break;
    case 'f':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, f, sizeof(f), f_, sizeof(f_), 0);
      break;
    case 'g':
      Serial.print("Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: ");
      read_TI046B1_register(0x000, g, sizeof(g), g_, sizeof(g_), 1);
      break;
    case 'h':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, h, sizeof(h), h_, sizeof(h_), 0);
      break;
    case 'i':
      Serial.print("Send: 0x80 | Response: ");
      read_TI046B1_register(0x000, i, sizeof(i), i_, sizeof(i_), 0);
      break;
  }
}

char getCommand()
{
  char c = '\0';
  if (Serial.available())
  {
    c = Serial.read();
  }
  return c;
}


[Technics66]

Alan.B
Your sketch does not work. There is no information in the terminal. 
I'm using Arducopter on ATMEGA 2560.
I found out that the page counter is located at 0xE1 2 byte.
I have several dumps from different chips. Are they needed?

[Alan.B]

Friends!

maxic81:
Reading errors I solved by removing the resistors in the SDA and SCL lines.

Technics66:
I'm using the sketch I uploaded in the previous post, are you adding the library "#include" twi-all-included.h ""?
I would like you to upload your dumps, all information is valuable.

To add information...
Reading one of the printer's manufacturer's patents, they indicate that the authentication KEY is stored in memory, it only changes when new changes are made to it.

Regards!

PS: I continue to investigate 

[Technics66]

Alan.B
Sorry. I did not understand that I should enter a, b, c, d ... The sketch works.

Code: [Select]

------ UnBlock-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0D40116CBB70880CDB38A
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0C7017B0EE30DF199F38B
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0F0015709189211715C84

-----Block-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01940050323446313338320000000905
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000

The programmer DelCopi badly flushes the chip. He writes that 500 pages are printed. 
Мemory addresses where the information:
0x00E1-0x00E2 Number of pages printed //0x16, 0x32  (5682 pages)
0x0440-0x044B Serial number           //0x43, 0x41, 0x44, 0x31, 0x37, 0x33, 0x31, 0x38, 0x31, 0x35, 0x34, 0x33 (CAD173181543)
0x0453-0x045A Model                   //0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x33 (P24F0003)
0x045F-0x0460 Volume of the cartridge //0x13, 0x88 (5000)
Attaching dump chips. In the name "reset" this chip was dropped and after that printed.

[Technics66]

Log reset of the chip P24F1382 (Starter MX317) by the programmer DelCopi without error after completion.

[Alan.B]

Friend, thank you for your logs, they are very helpful!

Could you add these lines to the sketch? They are to make a full dump of the chip! And I would need you to upload those dumps, especially the reset chip and if you can also do a full dump of a chip before the reset with delcopi and after the reset, better!

Code: [Select]

//In variables
uint8_t k[3] = {0x01, 0x00, 0x00};
uint8_t k_[1024];

uint8_t l[3] = {0x01, 0x00, 0x04};
uint8_t l_[1024];

//In "switch" function
case 'k':
  Serial.print("Send: 0x01, 0x00, 0x00 | Dump1: ");
  read_TI046B1_register(0x000, k, sizeof(k), k_, sizeof(k_), 0);
  break;
case 'l':
  Serial.print("Send: 0x01, 0x00, 0x04 | Dump2: ");
  read_TI046B1_register(0x000, l, sizeof(l), l_, sizeof(l_), 0);
  break;


[AndreiKenig]

Alan.B
Sorry. I did not understand that I should enter a, b, c, d ... The sketch works.

Code: [Select]

------ UnBlock-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0D40116CBB70880CDB38A
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0C7017B0EE30DF199F38B
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0F0015709189211715C84

-----Block-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01940050323446313338320000000905
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000

The programmer DelCopi badly flushes the chip. He writes that 500 pages are printed. 
Мemory addresses where the information:
0x00E1-0x00E2 Number of pages printed //0x16, 0x32  (5682 pages)
0x0440-0x044B Serial number           //0x43, 0x41, 0x44, 0x31, 0x37, 0x33, 0x31, 0x38, 0x31, 0x35, 0x34, 0x33 (CAD173181543)
0x0453-0x045A Model                   //0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x33 (P24F0003)
0x045F-0x0460 Volume of the cartridge //0x13, 0x88 (5000)
Attaching dump chips. In the name "reset" this chip was dropped and after that printed.

Number of pages printed  0x131, 0x132

[Technics66]

Number of pages printed  0x131, 0x132

I noticed that 0x0C0-0FF = 0x110-0x14F.
There are new cartridges P50F5H00. I took the dumps from the new one installed in the printer 317, installed in the MFP410 and printed pages.

[Alan.B]

Technics66! You would have some chip of these 24D0002, 52D4000, 52D4H00, 52D4X00. They are the ones that I have, but I can not authenticate in the registry 0x81; and I think if you try to read with Delcopi any of these in the log you could get an authentication key and it would be very useful ...

I leave you a new sketch, which optimizes a bit the use of memory in global variables.

With "t", perform a test chip (chip information)
with "d", perform a full dump of the chip.

Regards!

Code: [Select]

#include "twi-all-included.h"

void setup()
{
  Serial.begin(9600); 
  twi_init();
}

bool read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom)
{
  uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSB
  uint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB
 
  //Put the MSB bits to the Left :
  slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003
 
  //7 bits address equivalent for the begining :
  uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.
 
  //Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.
  uint8_t txBuffer[registerSize + 1];

  for(uint8_t i = 0; i < sizeof(txBuffer); i++)
  {
    if(i==0)
    {
      txBuffer[i] = slave_address_LSB;
    }
    else
    {
      txBuffer[i] = registerBuffer[i-1];
    }
  }

  uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);
  if (nRet == 1)
  {
    Serial.println("W1");
    return;
  }
  else if (nRet == 2)
  {
    Serial.println("W2");
    return;
  }
  else if (nRet == 3)
  {
    Serial.println("W3");
    return;
  }
  else if (nRet == 4)
  {
    Serial.println("W4");
    return;
  }
 
  nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end. 
  if (nRet == 0x00)
  {
    Serial.println("R1");
    return;
  }
 
  if (nRet != readSize)
  {
    Serial.println("R2");
    return;
  }

  if (nRet == readSize)
  {
    for (uint16_t i=0; i<readSize; i++)
    {
      //Serial.print("0x");
      if (destinationBuffer[i] < 0x10)
      {
        Serial.print(0, HEX);
        Serial.print(destinationBuffer[i], HEX);
      }
      else
      {
        Serial.print(destinationBuffer[i], HEX);
      }
      if(i != readSize) Serial.print(" ");
    }
    Serial.println("");
   
    return true;
  }

}

//DelCopi Secuence
uint16_t a_ = 1, b_ = 1, c_ = 16, d_ = 1, e_ = 1, f_ = 1, g_ = 1, h_ = 1, i_ = 16, k_ = 1024, l_ = 1024;
uint8_t a[1] = {0x03};
uint8_t b[1] = {0x83};
uint8_t c[3] = {0x01,0x50,0x04};
uint8_t d[1] = {0x82};
uint8_t e[2] = {0x81, 0x08};
uint8_t f[1] = {0x82};
uint8_t g[15] = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};
uint8_t h[1] = {0x82};
uint8_t i[1] = {0x80};
//Full Dump!
uint8_t k[3] = {0x01, 0x00, 0x00};
uint8_t l[3] = {0x01, 0x00, 0x04};
//One Buffer for all!
uint8_t rxBuffer[1024];

void loop()
{
  char command = getCommand();
  switch (command)
  {
    case 't': //Test Chip
        Serial.print("Send: 03 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, a, sizeof(a), rxBuffer, a_, 0);
        Serial.print("Send: 83 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, b, sizeof(b), rxBuffer, b_, 0);
        Serial.print("Send: 01 50 04 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, c, sizeof(c), rxBuffer, c_, 0);
        Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, d, sizeof(d), rxBuffer, d_, 0);
        Serial.print("Send: 81 08 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, e, sizeof(e), rxBuffer, e_, 1);
        Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, f, sizeof(f), rxBuffer, f_, 0);
        Serial.print("Send: 81 4E 86 61 AE 96 54 C2 31 FA C6 2D 53 74 35 \t| Response: ");//81 4E 86 61 AE 96 54 C2 31 FA C6 2D 53 74 35
        read_TI046B1_register(0x000, g, sizeof(g), rxBuffer, g_, 1);
        Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, h, sizeof(h), rxBuffer, h_, 0);
        Serial.print("Send: 80 \t\t\t\t\t\t| Response: ");
        read_TI046B1_register(0x000, i, sizeof(i), rxBuffer, i_, 0);
        Serial.println("");
      break;
    case 'd': //Dump Chip
        Serial.print("Full Dump: ");
        read_TI046B1_register(0x000, k, sizeof(k), rxBuffer, k_, 0);
        read_TI046B1_register(0x000, l, sizeof(l), rxBuffer, l_, 0);
        Serial.println("");
      break;
  }
}

char getCommand()
{
  char c = '\0';
  if (Serial.available())
  {
    c = Serial.read();
  }
  return c;
}


[Bigkim]

 I work for a company that sells generic cartridges that are not refilled, but are manufactured by a different company.
Our chips no only give a "Full" reading at all times,but more importantly trick the printer into thinking that a cartridge is original.
We actually find that "compatables" cost less than refilling, and since refilling is messy, and a lot of "toner empty" notifications are actually mechanical problems in disguise,  so we have found compatables a better route.
 Printer companies spend a lotta time trying to keep non-original compatable cartridges outta their printers, and often try to "root" us out with frequent "printer upgrades" by email.
Luckily our Asian suppliers keep one step ahead of them, as are one of Amazons top suppliers, with 100% customer satisfaction, over 20 years.

[Technics66]

By studying the reset and use logs, I concluded that there are 5 blocks with data. At the end of each block there seems to be a checksum (CRC16).
1. 0x020 - 0x0BD. CRC in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0X0E9. CRC in 0x0EA-0x0EB (42 byte + 2 byte CRC16)
3. 0x0EC - 0x10D. CRC in 0x10E-0x10F (32 byte + 2 byte CRC 16)
4. 0x110 - 0x139. CRC in 0x13A-0x13B = block 2 (42 byte + 2 byte CRC16)
5. 0x13C - 0x15D. CRC in 0x15E-0x05F = block 3 (32 byte + 2 byte CRC 16)
I'm not sure about the checksums, but when resetting the programmer in these addresses writes data that is not read anywhere. Check and understand what kind of data I could not.

[Technics66]

Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.
UPD.
Using the code for calculating the checksum

Code: [Select]

uint16_t crc16(const uint8_t* data_p, uint8_t length)
{
    uint8_t x;
    uint16_t crc = 0xFFFF;

    while (length--)
    {
        x = crc >> 8 ^ *data_p++;
        x ^= x >> 4;
        crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
    }
    return crc;
}Computed that 3 blocks and not 5.
1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)
3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2
I will write a sketch for resetting the chip.

[AndreiKenig]

0x450 0x451 Initial Quanta (константа расчёта расхода тонера) постоянная
0xE3 0xE4 Изменяемая кванта
0x133 0x134 = 0xE3 0xE4 Изменяемая кванта
Initial Quanta значение по которому рассчитывается расход тонера на печать
Изменяемая кванта - откорректированное значение Initial Quanta в зависимости от вращения мешалки картриджа
Так же "изменяемая кванта" меняется от результата проверки OEM или NotOEM

[Alan.B]

Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.
UPD.
Using the code for calculating the checksum

Code: [Select]

uint16_t crc16(const uint8_t* data_p, uint8_t length)
{
    uint8_t x;
    uint16_t crc = 0xFFFF;

    while (length--)
    {
        x = crc >> 8 ^ *data_p++;
        x ^= x >> 4;
        crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
    }
    return crc;
}Computed that 3 blocks and not 5.
1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)
3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2
I will write a sketch for resetting the chip.

Technics66:
Analyzing your dumps, I saw that by inserting the cartridge with the new chip, the printer makes changes to the serial number ... Could you connect the analyzer and take data from all this? I was left without the printer, it was from a client, but I want to continue with the investigation.

I attach your dumps, I turned them into bin.

Regards!

[AndreiKenig]

Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.
UPD.
Using the code for calculating the checksum

Code: [Select]

uint16_t crc16(const uint8_t* data_p, uint8_t length)
{
    uint8_t x;
    uint16_t crc = 0xFFFF;

    while (length--)
    {
        x = crc >> 8 ^ *data_p++;
        x ^= x >> 4;
        crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
    }
    return crc;
}Computed that 3 blocks and not 5.
1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)
3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2
I will write a sketch for resetting the chip.

Technics66:
Analyzing your dumps, I saw that by inserting the cartridge with the new chip, the printer makes changes to the serial number ... Could you connect the analyzer and take data from all this? I was left without the printer, it was from a client, but I want to continue with the investigation.

I attach your dumps, I turned them into bin.

Regards!

The printer never changes the serial number of the chip, which is in the range 0x440 - 0x44b and consists of 12 bytes

And attached dumps are not suitable for analysis, because there are a lot of incorrectly read data in them.

[Technics66]

Alan.B
The serial number does not change. You took the dump from another chip. I spread two dumps from 50F5H00 with different serial numbers (CAP142340A90 & CAS1218556D7).
AndreiKenig
Is it possible to take a complete dump with TI046B1? Full dump can only be read directly from FRAM. I have not come across chips which could be considered a dump. 

[Kulick]

Hi, friends.
There are devices, there are chips and empty and new. Need help?
Can I join the decision?
Thanks.

[driver_x]

• 0x82 is a kind of Status Register that the printers reads before asking anything else.
• status 0x38 is "nothing more to say, please enter something into 0x81"
   
• status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
• status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
   
• status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
• status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09


• 0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time

Registers that are being write :

• 0x04 is the first register that is called on each cartridge, with a Stop occuring during ACK (there is no ACK or NACK bit), followed by a useless start stop, observed by oscilloscope too. Let's guess this is useless. But it's common to the 5 cartridges (well, 4 cartridge and 1 imaging drum).
  
  
• 0x81 is the only one register that is written after closing the lid. It's a command register that influences the status register (0x82) and define what will be read into 0x80. We can see single byte writes on it (0x08 or 0x09) for selecting what looks like a mode, then a 14 bytes question write (with something that looks like it's totally unpredictable) before being able to read 16 bytes into 0x80 (16 bytes that also looks like they are totally unpredictable).

This looks like the chip authenticating protocol described here: https://patents.google.com/patent/US20060224889A1/en?q=md5&assignee=lexmark

[driver_x]

Here's some info i've discovered so far:
The size of the FRAM is 2048 bytes. The size is specified here : http://techinsights.com/reports-and-subscriptions/open-market-reports/Report-Profile/?ReportKey=CAR-1504-802. Also you can verify this by trying to read addresses bigger than 2048 bytes, it will start to read from the beginning.

The corespondence of the memory offsets and the registers discovered by pixconfig here: https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1472727/#msg1472727 is the following:

Register 0x01>0x20>0x04 = memory offset 0x0420 = 1056 decimal
Register 0x01>0x40>0x04 = memory offset 0x0440 = 1088 decimal
[..]etc
So basically you form the offset's hex number by reversing the order of the register's bytes.

If you want to dump the entire chip, you can read the register 0x01>0x00>0x00 size 2048 (it didn't work for me) or read in two chunks of 1024 bytes (first 0x01>0x00>0x00 size 1024 then 0x>0x01>0x00>0x04 size 1024)

@pixconfig:
the following offsets are not read/written in your dumps, so this needs further investigation:

Offset 0x160 (register 0x01>0x60>0x01), size 6 bytes, this one is repeating at offset 0x400 (register 0x01>0x00>0x04)

also Offset 0x408 (register 0x01>0x08>0x04) - 4 bytes long - contains data that is not read/written in your dumps.

Maybe there registers are written by the chip (the same way the copy of 20 00 register is written without any specific instruction from the printer.

The other bytes that are not read/written contains either 00 f7 either 00.

[driver_x]

Hi!
The first 2 bytes are overwritten and they encrypt the first 32 bytes and the last 256 bytes.
verified personally

First 32 bytes and last 256 are just a series of 00 F7, at least in my dump, here's the map I've made:

[driver_x]

Some small research:


>>>Only for starter cartridges<<<:

Year of installation: 0xAF, size = 2 bytes
Month of installation: 0xB2, size = 1 byte
Day of installation : 0xB4, size = 1 byte

Another timestamp:
Year: 0xc3, size = 2 bytes
Month: 0xc6, size = 1 byte
Day: 0xc8, size = 1 byte

Probably the expiration year: 0xD5, size=2 bytes

Yet Another timestamp:
Year: 0xd7, size = 2 bytes
Month: 0xda, size = 1 byte
Day: 0xdc, size = 1 byte

>>>end only for starter cartridges<<<


pageCount : 0x51 - 2 bytes
serial : 0x440 - 12 bytes
deviceID :  0x44c - 4 bytes
partNumber : 0x455 - 8 bytes
maxCapacity : 0x49A 2 bytes

[Deathcore]

Has anyone had any luck with doing the same with the Imaging Unit?
I've mirrored the contents over from a brand new Imaging Unit to a Used one and the printer only seems to see the unit as "Defective" after about 20 seconds or so.

The data structure seems to be different to the toners, as the 1st and 2nd 56 byte register show different contents.

I'll put together some dumps and post them up when I can but would appreciate any help or pointers!

[driver_x]

Searched for a Texas Instruments chip that is able to perform authentification using cryptographic functions, found this :
http://www.ti.com/lit/an/slua389a/slua389a.pdf
http://www.ti.com/lit/ds/symlink/bq26100.pdf

but...

From what I observe, in the 0x81 register is written the 14 bytes challenge, then from 0x80 is being read the 16 bytes response from the chip, and this is done 8 times for each cartridge. But the response does not look like a SHA-1 hash, first because SHA-1 is 20 byte long, and second because in all the the 8 responses of  16 bytes , bytes 7 and 8 are the same. MD5 is 16 bytes but the repetition of the bytes 7 and 8 in all the responses excludes any hash function(?)
And second, the last 1024 bytes memory block might be read only in order to prevent the changing of the serial number, deviceID, maxCapacity , region and all the other cartridge factory parameters.

Later:

Connect your printer via ethernet, then in your internet browser type http://your_printer_ip/se (replace "your_printer_ip" with your real printer ip)
Then go to "Dump SysDebugData" and do some search for "cyan",  yellow or whatever... you'll find some data about the cartridges.
What is strange is that after resetting the 56 and 208 registers of a empty cartridge, of course that the printer is telling me to replace it and it does not take in consideration the information stored in the chip, as it is displaying the same number of printed pages, install date etc as they were before the resetting (.

[Deathcore]

Just an update.
I rewrote the all first 1024 bytes from a new Drum unit to a Used board and the unit is now giving me an "Imaging unit unsupported" error rather than "Imaging unit defective".

Step in the right direction but still no luck, I suspect that the device is checking for a CRC somewhere or the 2nd set of 1024 bytes holds part number information and the used board that was overwritten was a "Black only" imaging unit rather than "Black and Colour".

[amyk]

What is strange is that after resetting the 56 and 208 registers of a empty cartridge, of course that the printer is telling me to replace it and it does not take in consideration the information stored in the chip, as it is displaying the same number of printed pages, install date etc as they were before the resetting (.

The printer probably memorises the serials of the last X cartridges.

[driver_x]

Just an update.
I rewrote the all first 1024 bytes from a new Drum unit to a Used board and the unit is now giving me an "Imaging unit unsupported" error rather than "Imaging unit defective".

Step in the right direction but still no luck, I suspect that the device is checking for a CRC somewhere or the 2nd set of 1024 bytes holds part number information and the used board that was overwritten was a "Black only" imaging unit rather than "Black and Colour".

I think we must have a sticky thread with the information we have found so far , because i see we are reinventing the wheel with each post:)

Int the 56 bytes register is written the type and the color of the cartridge, so you can't just copy the first 1024 bytes from a type of cartridge to another type.
The mapping of the bytes in the 56 bytes register was discovered by pixconfig here: https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1526623/#msg1526623
We succedeed to set all the counters to zero, but it seems that the printer is also keeping in its internal memory the last parameters of each cartridge, so I see two solutions:

1. Discover a way to change the cartridge serial number from the cartridge's memory
2. Discover a way to clear the serials of the cartridges from the printer memory(they are not erased when you restore the printer to factory defaults)

[Deathcore]

Apologies for the confusion, I have read through the thread a couple of times but I was looking at the Chip on the Imaging/Drum Unit not the toners. (Address 0x005)
The imaging unit uses the same TI046B1 chip but the registers and data on the chip are in a different layout to the toners.

I had copied the data from a good full chip to a used chip that the printer had not seen before, but it was still rejected, the drum unit may be checking for something other than just the serial number though.

A sticky thread would be a very good idea though!

[driver_x]

If you post the dump of the new chip and the used chip maybe we can discover what and where the printer is writing on the chip and try to reset the counters rather than to overwrite with data from another chip.
For the cartridges we have also some bytes in the first 1024 segment that we don't know what are representing (the bytes surrounded with red line from the map posted by me here: https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1762853/#msg1762853 ) If you look with attention you will see that the group of 6 bytes from 0x160 repeats at the offset 0x400, with other words, the last bytes with values from the first 1024 segment are repeating in the second 1024 segment. If you overwrite the first segment then the values will not match. Maybe in the imaging drum chip there is a similar protection

[driver_x]

Ok, some new update with the last discoveries:
It seems that (at least for the starter cartridge i'm experimenting) that cleaning all the first 169 bytes(as in pixconfig's function) from the 208 register is making the printer to show the message: "replace the cartridge". I remember that the first time i saw this was in pixconfig's post after he wrote the function for resetting the 208 register. Then I thought that maybe the printer needs some info saved there (the timestamps for example) and I tried to reset only the first 15 bytes which is obvious that are encoding the toner usage (i was lucky because I saved the full dump before reseting, and I was able to restore the initial 208 register). Surprise! The printer no longer says to replace the cartridge and it says that the cartridge is full.

Here's the sysdebugdata log for the cartridge:

Code: [Select]

osikey Magenta Toner, serial CAH163060CDA valid 1, id 1:
  partNumber 38CSL14M, deviceID 65399522, pageCountValid 1, pageCount 801.
  pageRemainValid 1, pageRemain 1400.
  maxCapacity 1400, maxCapacityPages 1400, level 10.
  maxLevel 10, minLevel 0, increments 10%, SUPPLY_STATUS 0.
  SUPPLY_OSIGAUGE_TYPE 2, SUPPLY_EMAIL_TYPE 0
  Levels:
                  SUPPLY_EARLYWARN => LevelOn 1, LevelActive 0, TriggerValue 4, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1273, behid 0x126e, behav 0.
                  SUPPLY_NEARLYLOW => LevelOn 1, LevelActive 0, TriggerValue 3, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1274, behid 0x126f, behav 0.
                        SUPPLY_LOW => LevelOn 1, LevelActive 0, TriggerValue 2, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1579, behid 0x1270, behav 2.
                SUPPLY_NEARLYEMPTY => LevelOn 1, LevelActive 0, TriggerValue 1, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1275, behid 0x1271, behav 2.
                      SUPPLY_EMPTY => LevelOn 1, LevelActive 0, TriggerValue 0, LevelMax 0, LevelMin 0, Behaviors 0x02, levid 0xffff, behid 0x1272, behav 4.
  type 2, prebate 2, refilled 2, afterMarket 0, carttype 0, menuPageSupport 0.
  installed INST, supported 1, ignoreMsgNotSupported 0, serialNumberIsReal 1
  dataValid 1, firstPercentReported 100, region 0, genuine 1, exposed 2, non-genuine IR 2
  flags:
    ignoreLevelWrnOnce 0
  supplyHasWarning 0, supplyHasIntervention 0, supplyHasNonContinueIntervention 0
  supplyGetConditionTextId 75577 (OK).
Need to investigate why it shows  pageCount 801, maybe I have a bug somwhere in the resetting function.

Later edit: no bug in the function, the printer is writing back on the chip the pageCount as soon you put the cartridge in the printer.

208 register analysis:

Start Byte	End Byte	Description
0	14	Toner usage in steps
15	18	Filled with zero
19	30	Serial number of the Imaging Kit
31	36	Date, maybe install date
37	44	Printer serial number
45	46	Filled with zero
47	48	Unknown data
49	50	Filled with zero
51	56	Date, probably date of first warning?
57	64	Printer serial number
65	66	Probably page count at the date stored before
67	68	Filled with zero
69	70	Unknown data
71	76	Date, probably date depleted?
77	84	Printer serial number
85	86	Probably page count at the date stored before
87	88	Zero
89	90	Unknown data
91	99	Unknown data, values from 1 to 6 observed in each byte
100	110	Zero
111	111	A0 for starter kits, 00 for the others
112	114	Zero
115	116	Unknown data, seems to increase with as the cartridge gets depleted
117	118	Zero
119	120	Unknown data, seems to increase with as the cartridge gets depleted
121	122	Zero
123	124	Unknown data, seems to increase with as the cartridge gets depleted
125	126	Zero
127	128	Unknown data, seems to increase with as the cartridge gets depleted
129	129	34 for starters, 00 for the others
130	144	Printer Name
145	168	Zero
169	198	Unknown data, does not modify over time, maybe some kind of ID
199	205	Zero
206	207	CRC

[Kulick]

maxic81, почисти ящик) Не могу сообщение отправить.

[driver_x]

Tried to write first 2 bytes with FF, it filled all the read only area that didn't contained data with zeros. Strange.

So from 0 to 31 and from 1792 to 2047 (decimal offsets), all bits were set to zero. Ant I wrote only in the first 2 bytes FF. This means that these bites don't really exist on the chip and are just a mirror of the first 2 bytes?

[driver_x]

Why do I get mixed results when I try various baud rates for serial.begin?
Look at the responses from the 0x82 register

Code: [Select]

Baud Rate 2400
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x38};
Write 0x09 in 0x81 Register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x49};
Write question in 0x81 register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x89};
Read 0x80 Register
uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0x80, 0x80, 0x31, 0x54, 0xBF, 0xB6, 0xD9, 0x8E};


Code: [Select]

Baud Rate 19200
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
Write 0x09 in 0x81 Register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
Write question in 0x81 register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
Read 0x80 Register
uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0xD, 0xF1, 0xE3, 0xE9, 0x91, 0x71, 0xA1, 0x83};

****reset arduino***

Baud Rate 19200
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x38};
Write 0x09 in 0x81 Register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x49};
Write question in 0x81 register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x59};!!!!!!!!!!
Read 0x80 Register
uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0xCD, 0x1A, 0xA6, 0xE9, 0x3E, 0xCA, 0xD2, 0x8A};



If I increase the baud rate more, I get mixed results... 

[Diggie]

Hi guys,

I've been observing this thread ever since I bought my CS417DN a few months ago.
It is very interesting to see the progress that you have made.
It certainly goes beyond my expertise. 

Thats why I have a different proposal on dealing with this: Has anyone tried checking out those reset/replacement chips which you can get?
Maybe for those we are able to read them out fully and then copy that to the original chips?

Look forward to hearing your thoughts.

[driver_x]

Hi guys,

I've been observing this thread ever since I bought my CS417DN a few months ago.
It is very interesting to see the progress that you have made.
It certainly goes beyond my expertise. 

Thats why I have a different proposal on dealing with this: Has anyone tried checking out those reset/replacement chips which you can get?
Maybe for those we are able to read them out fully and then copy that to the original chips?

Look forward to hearing your thoughts.

I'm afraid that this is not possible as the chip has a read-only area where is written the serial number, toner capacity and probably all the initial parameters. Most probably the printer is storing all this info as I have reseted the number of printed pages and after I have inserted the cartridge inside the printer, the number printed pages has reappeared on the chip.

[igrok_by]

I wonder how soon there will be a cheap toner tank 
http://www.ipwatchdog.com/2017/05/30/supreme-court-lexmark-sales-exhausted-patent-rights/id=83824/

[Alan.B]

Hello friends!

Back to work with this chip, I got an MS810 printer, take readings inserting a new chip in the cartridge, I attach the readings ... The truth is that I have trouble passing it in clean, if someone offers for such a task it would be beneficial for all !

Regards!

[nouvelle_adr]

Hello friends!

Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?

Regards!

Hello, I have the same chip as you (Dell laser printer with almost dead toner cartridge)

I only have a raspberry Pi 3 (no arduino), so I connected SDA SCL VDD GND as you shown in your pictures, but when I run the command "i2cdetect -y 1" on my Raspberry it shows no device connected to I2C interface like that:

pi@raspberrypi:~ $ i2cdetect -y 1
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --

do you have any idea to solve that ?

[nouvelle_adr]

Hello, I have the same chip as you  ti046b1 chip (Serial I2C F-RAM) (Dell laser printer with almost dead toner cartridge)
I tried to read it with my raspberry Pi 3, so I connected SDA SCL VDD GND as shown in pictures, but when I run the command "i2cdetect -y 1" on my Raspberry it shows no device connected to I2C interface (empty) like that:

    pi@raspberrypi:~ $ i2cdetect -y 1
   
         0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
   
    00:          -- -- -- -- -- -- -- -- -- -- -- -- --   
    10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --   
    20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --   
    30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --   
    40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --   
    50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --   
    60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --   
    70: -- -- -- -- -- -- -- --

do you have any idea to solve that ?
- I tried by inverting SDA SLC connections
- I tried by pulling-up to 3.3V SDA and SCL with 10k resistors (as stated https://www.raspberrypi.org/forums/viewtopic.php?t=7664)

could you please help me to solve that ?

And to anticipate your first question : I checked all the connections for this wiring

[Fang]

I don't understand why do you need to mess with toner cartridge chips?
I think a better way to modify printer firmware. Reset of toner chip is useful if you are in toner refill business. :-)

Sent from my SM-G610F using Tapatalk

[nouvelle_adr]

I don't understand why do you need to mess with toner cartridge chips?
I think a better way to modify printer firmware. Reset of toner chip is useful if you are in toner refill business. :-)

Sent from my SM-G610F using Tapatalk

Really ? If you know how to modify my DELL B2360dn firmware I will be glad and gratful to you !

[Fang]

You can download firmware from Dell website ... I can help you with reverse engineering tools :-)

Sent from my SM-G610F using Tapatalk

[nouvelle_adr]

You can download firmware from Dell website ... I can help you with reverse engineering tools :-)

Sent from my SM-G610F using Tapatalk

I am really interested by that !, I have downloaded the original firmware from here : https://downloads.dell.com/FOLDER05088145M/1/B2360%20P022%20Firmware.zip, so please help me with your golden skills, I am ready now to follow your instructions

[driver_x]

The downloadable firmware is encrypted

[nargoni]

hello all!
I read every reply of this post, I'm an worried owner off a cheap lexmark 417dn.

I think that it is necessary to find a way for the printer to continue printing while having toner, with or without chips.
I am looking at how to run code on the printer. Specifically for port 9100, where, in some HP, shell access could be obtained.
If you could do this, I think it would be easy to make a bypass on the toner control system. In the end, a printer is a computer, and it may be possible to prevent the executable that controls the toner from doing so.


do you see it feasible?

[nargoni]

At last I found the solution. I have sold the printer and bought one of very similar with toner compatible economic and easy to find. I get a new printer with the same benefits as 4 toners a lot more economical.
I still think that it should not be possible for a manufacturer to decide what consumable should you put on your devices.
Lexmark does this for its own benefit, but it is not logical that it costs 4 times more toner than the printer.
The other brands are not short either. I have had HP compatible toner do not work or do it badly. However, my first color laser (hp cp1515) has always worked well with the pirate toner. Why the modern ones do not?
We have not made much progress ...
https://en.wikipedia.org/wiki/Richard_Stallman

[Doctorandus_P]

Years ago I bought a 2nd hand Samsung ML-1610.
This laser is not chipped.
Then the toner depleted.

Bought 2 tubes of toner from Ali for a total of around EUR 10.
Watched a youtube vid on how to open / clean it.
Half an hour later it worked as a charm again.
I could have done it in 10 minutes if I had more experience, but I just took it slow and extra carefull for my first toner refill.

I was a bit afraid of making a mess.
Heared some bad things about toner.
But if you cover your desk with some sheets of paper and gently tap on it the remains just fall on the desk (into a basket made from an A4 sheet of paper and 4 staples in the corner).

Don'd blow on it, nor use a compressor. A vacuum cleaner is good for the last remains.

I heared that 2 different kinds of toner don't always mix well and therefore I followed the advise to clean the cardridge before filling it up again. It also has some brushes and spare toner reservoirs you should clean.

Have fun.

[texaspyro]

A vacuum cleaner is good for the last remains.

NO!!!!  Most toner particles will pass right through most vacuum cleaner filters  so they wind up spewing toner into the air (NOT a good thing).  They make "toner vacuums" that are designed for cleaning up toner.   They have much better filters in them.

[Sutan]

Hello pixconfig, I'm really impressed about you've done with Ti046b1 cartridge chip.

I really want to read the full content on a Lexmark MS810 fuser chip which is the same TI046b1 chip and i have an arduino mega could you able provide me a sketch that i read the full content on that chip

I would really like to reset the chip.

Please help me.

[Sutan]

Hi Howardlong, Hope you're doing good. Well can you help me to change some coding on the Sketch Picconfig created earlier to read Ti046b1.

Well i'm trying to reset a fuser chip which uses TI046b1 chip. i altared the sketch an manged to read the content but i want to write the addresses with right buffer which will make the chip shows full.

I'm a learner Arduino please help me if you can.

Thank you

Sutan

[elpaco]

Hello All,

hope you can help me, this let me crazy...

I bought a CX510de laser printer, and the magenta cartridge became declared as empty (the other cartridges are quite full ... around 90% full).
I follow your forum and was able to refresh the chip for the magenta cartridge, but after fiew pages printed (in black ...), the printer was crazy again and declared the magenta cartridge again empty. 

I made 2 copies (from a page), and it was OK.
once I want to print a document from an USB stick, only one print, and then red light !


Can someone make a full read containt of the magenta chip cartridge in its CX510de ?
this will help me a lot.... probably a data somewhere doesn't allow it.

Many thanks in advance for your help !

[elpaco]

Hello All,

here are some details (hope it can help).
I wrote in the cartridge chip the following data :
area #1 (03022000) and #2 (03025800) :
FFFFFFFFFF1F0BFF000000000000000000000000012B7FFF00000000000000000000000000000000FFFF0000FFFF0000000000000000CDFE

and in the 3rd area (03029000):
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B2A8E9135CACE4E9F5696A44979EA03EABC7AE1391DF08F5E8E369EB58E50000000000000047B9

Then, the cartridge was detected FULL (means OK) only
- if I restart 5 times (without the cartridge inside).
or
- if I reset all the counters (from the configuration menu (I press 2 and 6 at the start)... and if I reset to the factory configuration the printer (it's quite long...).

then always after some pages can be printed.... and the crazy things come back... magenta cartridge detected end of life

it looks like this machine remember the serial number of this cartridge... (it's the only thing that I can not update in the chip).

Someone has an idea on how to unlock this ? 
did I wrote something wrong in the areas ?

I'm wondering on the "fake/copy" chip that are provided with toner ... how they can do ?

Thanks !

[nouvelle_adr]

Hello, [It seems to be an issue with twi-all-included.h]

I have bought an Arduino, and I tried I2C_TI046B1_Read.ino to read this Ti046b1. I have nothing on Serial monitor when I upload the code on my Arduino Wavegat:
The upload seems to bo OK, but nothing read on the monitor:

EDIT---
I tried to create a hello world file to do just a Serial.println("--- Hello world ---"); " I upload it in my Arduino Wavgat.
I noticed that when I include twi-all-included.h, the print ln does not print anymore ! and when I remove the #include "twi-all-included.h" the println works again
the problem seems to be in the "twi-all-included.h"

could you please help me to solve that    ?



https://ibb.co/Rz7XCFH


I have pull-down on both for SDA and SCL, some 18 kOhms resistors as stated here:

https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1505194/#msg1505194

https://ibb.co/ZJJK5Tw


And here is a reminder of my wiring:


When I remove resistors, and I connect the chip directly to Arduino, it is detected at the address 0x78
https://i.ibb.co/dLqkFxB/20190302-182231.jpg


https://i.ibb.co/Snz336X/Detection-I2-C.png



and here the same issue, No read data on Serial monitor

[Sutan]

Hello nouvelle_adr, Nothing wrong with the sketch and it is created by a genius. Well your pull resistors should by connected to positive +5v not negative -5v. 18K is a right stuff if you're not using you may blow the chip.

The sketch is working like a charm and if you can modify the sketch you can read anything related to TI046B1 Chip whether a cartridge or imaging as well as fuser.

If you wanna reset a chip it shouldn’t say zero pages left. Not applies to starter cartridges & in this forum it was stated a success but i didn't try. Reset only worked well if you have 5% or even 1% left cartridge. Zero is a total failure. 

Good luck.

[nouvelle_adr]

Hello nouvelle_adr, Nothing wrong with the sketch and it is created by a genuis. Well your pull resistors should by connected to postive +5v not negative -5v. 18K is a right stuff if you're not using you may blow the chip.

The sketch is working like a charm and if you can modify the sketch you can read anything related to TI046B1 Chip wheater a cartridge or imaging as well as fuser.

If you wanna reset a chip it shouldn't  say zero pages left. Not applies to starter cartridges & in this forum it was stated a suceess but i didn't try. Reset only worked well if you have 5% or even 1% left cartridge. Zero is a total failure. 

Good luck.

Thank you for your feedback.

But the TIb46b1 power supply is 3.3V and not 5V !
And my Arduino has a 3.3V power supply, so I have used it.

When I tried to supply the chip with 5V with 18K resistor linked to GND, Chip address 0x78 is no more detected.

And when I bring back the power supply to 3.3 the detection is ok, but not the reading

Could you please sketch me a schematic of the full conection between Arduino and TI046b1 ?

[Sutan]

Hello buddy, according to 18k pull up setup cartridge chip needs 5V. I’ve tried 3.3v it wouldn't work.  Anyway, you're using arduino leonardo which doesn’t have enough memory to run the original sketch I believe. What i'm using arduino mega 2560 which has 4kb EEPROM

I've attached the diagram & also a simplified sketch of my version. Hopefully you'll win this time but all credits should go to the big boss.

Cheers!

[nouvelle_adr]

Hello buddy, according to 18k pull up setup cartridge chip needs 5V. I’ve tried 3.3v it wouldn't work.  Anyway, you're using arduino leonardo which doesn’t have enough memory to run the original sketch I believe. What i'm using arduino mega 2560 which has 4kb EEPROM

I've attached the diagram & also a simplified sketch of my version. Hopefully you'll win this time but all credits should go to the big boss.

Cheers!

Hi friend !
thank you for the schematics.
You are right, My Arduino is an AVGA328 it has only 2kb EEPROM. the issue may comes from here.

Regarding your schematics, if I understand well, you supply the chip with 5V ?
you sketched a -5V at the left, but Arduino has no -5V !.
Do you mean that the schematic is like that ?:


again, all credits should go to the big boss

[Sutan]

You got it right. At the beginning i had a lot of challenges finally I got it work.

 FYI: remember error messages according to the sketch should be displayed error messages like below

( "Error occured wile trying to write to the slave : Slave's address not acknowledged (beginning only) - is it connected ?")
 
("Error occurred wile trying to write to the slave : TWI class's buffer is too small")

("Error occurred wile trying to write to the slave :")

("Slaves’ beginning of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?")

 ("I2C protocol error occurred wile trying to write to the slave. Is the wiring correct ? TWI Initialization ?")

if you wouldn’t see  none of the error messages then you should consider buying Aruduino Mega 2560. The existing board is not suitable for this project.

Have you tried the sketch i posted?

[nouvelle_adr]

You got it right. At the beginning i had a lot of challenges finally I got it work.

 FYI: remember error messages according to the sketch should be displayed error messages like below

( "Error occured wile trying to write to the slave : Slave's address not acknowledged (beginning only) - is it connected ?")
 
("Error occurred wile trying to write to the slave : TWI class's buffer is too small")

("Error occurred wile trying to write to the slave :")

("Slaves’ beginning of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?")

 ("I2C protocol error occurred wile trying to write to the slave. Is the wiring correct ? TWI Initialization ?")

if you wouldn’t see  none of the error messages then you should consider buying Aruduino Mega 2560. The existing board is not suitable for this project.

Have you tried the sketch i posted?

thank you for all these important information  !
I will try the new sketch and inform you

[nouvelle_adr]

You got it right. At the beginning i had a lot of challenges finally I got it work.

 FYI: remember error messages according to the sketch should be displayed error messages like below

( "Error occured wile trying to write to the slave : Slave's address not acknowledged (beginning only) - is it connected ?")
 
("Error occurred wile trying to write to the slave : TWI class's buffer is too small")

("Error occurred wile trying to write to the slave :")

("Slaves’ beginning of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?")

 ("I2C protocol error occurred wile trying to write to the slave. Is the wiring correct ? TWI Initialization ?")

if you wouldn’t see  none of the error messages then you should consider buying Aruduino Mega 2560. The existing board is not suitable for this project.

Have you tried the sketch i posted?

Hi Again 


As I have a Raspberry Pi 3, may be I can run Arduino sketch on it by following this TUTO:
https://www.deviceplus.com/how-tos/raspberrypi-guide/how-to-run-arduino-sketches-on-raspberry-pi/

Instead of buying a MEGA 2560 Arduino. Raspberry has more memory

Do you think it possible ?

[Sutan]

Well i don't have any knowledge about raspberry. This site about innovation and myth busting since you have the hardware give it a try. Don't get disappointment easily, reserve some time in day for this project

You'll definitely achieve & learn something. Goodluck pal and let me know your success.

[elpaco]

Hello everyone !

I'm back on this topic, is there somebody that can read the full content of his magenta chip cartridge compatible for a CX510de ?

Then I can write into my cartridge all the same data (expect some protected area) and try quickly.

Thanks for your help !

[nouvelle_adr]

You got it right. At the beginning i had a lot of challenges finally I got it work.

 FYI: remember error messages according to the sketch should be displayed error messages like below

( "Error occured wile trying to write to the slave : Slave's address not acknowledged (beginning only) - is it connected ?")
 
("Error occurred wile trying to write to the slave : TWI class's buffer is too small")

("Error occurred wile trying to write to the slave :")

("Slaves’ beginning of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?")

 ("I2C protocol error occurred wile trying to write to the slave. Is the wiring correct ? TWI Initialization ?")

if you wouldn’t see  none of the error messages then you should consider buying Aruduino Mega 2560. The existing board is not suitable for this project.

Have you tried the sketch i posted?

thank you for all these important information  !
I will try the new sketch and inform you

Hi Sutan,

I'm back now with my newly received Arduino Mega 2560.

You are right about not enough 2Kb memory, and now with 4KB Memory  on my new Mega 2560 I can continue my journey

Thank you very much

EDIT- I finally succeded to dump my chip (for reminder, it is a Ti046b1 on DELL B2360dn Black and white printer, with a warning message about low tonner level):
I attach below a first dump, a second dump after printing 1 page, and again a third dump by printing again one page.

Do you think that the write sketch will reset my chip or do I need some modifications on it ?

until the next answer, I continue my analysis

I noticed 4 blocks:
Block 1: 192 bytes (unchanged) : Offset 1 to Offset 192
Block 2: 80 bytes (changed) : Offset 193 to Offset 272 with 2 bytes CRC-CCITT (0xFFFF) on 78 bytes of this block
Block 3: 80 bytes (changed and equal to the preveous 80 bytes "repeated bytes") : Offset 273 to Offset 352 with 2 bytes CRC-CCITT (0xFFFF) on 78 bytes of this block
Block 4: 1696 bytes (unchanged) : Offset 353 to Offset 2048

So here are the changed noticed in the two 80 bytes blocks:


At the affset @226,227 (and @306,307) I guess that it represents the number of printed pages (084C: 2124 then 084D: 2125 then 084E: 2126 pages printed)

can someone help me to change the Boss sketch to adapt it to my chip please ?

[nouvelle_adr]

Hello,

I writed a dump, codes from 20 to F0, from 100% new chip on a 2% old chip, and printer say incorect cartridge !

After that, I copied 20 to 30 address back in, and printer say incorect cartridge !

I wrote back the dump from the old chip, and printer say replace cartridge ! Not 2% !!!!

What can I do ?

Hi, dump again your chip, and check if the 2bytes CRC has been updated (and well calculated) or not, here is a link for Crc calculation:
https://www.lammertbies.nl/comm/info/crc-calculation.html

[uteniyazov]

Hello! How can i read this toner chip? please help me

[uteniyazov]

Lexmark ms317dn

[uteniyazov]

Hello!please sorry for my english. my chip is another. it is not TI046B1 , can I read this chineese chip similarly?

[JerryL]

I am trying to read this chip. The pic shows its number but I am unable to find it anywhere.  It is a 4 pin chip from a Lexmark MX321 and I know the pinouts from the chip as well.  I am using an Arduino Mega 2560 but cannot seem to get it to read.  I am quite new at this stuff so any help or thoughts are appreciated.

[uteniyazov]

18:38:20.280 ->
18:38:20.280 -> 5⸮----- I2C Reset of the TI046B1 CHIPS ------
18:38:20.477 -> -------------------------------------------
18:38:20.477 -> uint8_t destinationBuffer[80] = {0x43, 0x41, 0x53, 0x31, 0x36, 0x32, 0x38, 0x34, 0x33, 0x35, 0x30, 0x45, 0x03, 0x6C, 0x1B, 0xA7, 0x01, 0xF8, 0x00, 0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x39, 0x00, 0x00, 0x00, 0x09, 0x09, 0xC4, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0x0A, 0x00, 0x3E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:20.890 -> Serial number : CAS16284350E
18:38:20.924 -> Fuser, (0x001), 00, F1
18:38:20.958 -> uint8_t destinationBuffer[16] = {0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D};
18:38:21.094 ->
18:38:21.094 -> Fuser, (0x001), 10, F1
18:38:21.128 -> uint8_t destinationBuffer[16] = {0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D};
18:38:21.264 ->
18:38:21.264 -> Fuser, (0x001), 20, F1
18:38:21.264 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x53, 0x04, 0xD8, 0x5E};
18:38:21.400 ->
18:38:21.434 -> Fuser, (0x001), 30, F1
18:38:21.434 -> uint8_t destinationBuffer[16] = {0xBA, 0x25, 0x87, 0x3C, 0xAB, 0x60, 0x59, 0x07, 0x0C, 0x96, 0x79, 0xB4, 0x2B, 0x60, 0xE8, 0xF8};
18:38:21.570 ->
18:38:21.570 -> Fuser, (0x001), 40, F1
18:38:21.605 -> uint8_t destinationBuffer[16] = {0x8D, 0x56, 0xE9, 0x2E, 0xDF, 0x62, 0xF9, 0x83, 0x65, 0x93, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:21.740 ->
18:38:21.740 -> Fuser, (0x001), 50, F1
18:38:21.775 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:21.913 ->
18:38:21.913 -> Fuser, (0x001), 60, F1
18:38:21.947 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:22.084 ->
18:38:22.084 -> Fuser, (0x001), 70, F1
18:38:22.084 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:22.219 ->
18:38:22.219 -> Fuser, (0x001), 80, F1
18:38:22.253 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:22.389 ->
18:38:22.389 -> Fuser, (0x001), 90, F1
18:38:22.423 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:22.559 ->
18:38:22.559 -> Fuser, (0x001), A0, F1
18:38:22.593 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:22.732 ->
18:38:22.732 -> Fuser, (0x001), B0, F1
18:38:22.766 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD3, 0xC4};
18:38:22.902 ->
18:38:22.902 -> Fuser, (0x001), C0, F1
18:38:22.902 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:23.038 ->
18:38:23.038 -> Fuser, (0x001), D0, F1
18:38:23.072 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF};
18:38:23.208 ->
18:38:23.208 -> Fuser, (0x001), E0, F1
18:38:23.243 -> uint8_t destinationBuffer[16] = {0x00, 0x00, 0x00, 0x01, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:23.378 ->
18:38:23.378 -> Fuser, (0x001), F0, F1
18:38:23.412 -> uint8_t destinationBuffer[126] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF8, 0x51, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF8, 0x51, 0x96, 0xC2, 0x06, 0x53, 0x34, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
18:38:24.228 ->
18:38:24.228 -> -------------------------------------------
This is the new chip for MS317 (emul)

[Krepton85]

Could you port "twi-all-icluded" library for Arduino Stm 32: https://github.com/stm32duino/Arduino_Core_STM32?

[mcu32]

Hi friends, I do not know will help you this ..
I have Chinese chips for Lexmark MX410, on these chips there are 2 microcircuits, one of which is a microcontroller and the other is SPI FRAM of 16 kbps. I soldering out a memory chip and read a dump from it. Now, when the cartridge over, I solder the chip and write the dump to this chip. I share a dump, maybe he will help you for analysis.

UPD:
I made your reader on arduino, and read my Chinese chip, it seems the first 20 bytes are read from the chip erroneously, the logs of others, too, the first 20 bytes are erasing 2 bytes. I attach my log.

[constanrine5d]

Hello Guys!

I am a noob at microelectronic stuff,

I have arduino mega 2560 r3 and a lexmark cs317dn

I read how to connect it to the chip with the two resistors and stuff,

how do I run pixconfig's toner reset file to reset?

Do I connect the chips in the order they appear in the code?

What about the magenta error that they encountered?

Thank you! Awesome work!

[PON]

Hello,
What modification need to made to this file
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Read.ino
for read the lexmark MX410 chip.
I replace in next execution
 read_TI046B1_register(0x003, 0x01, 0x40, 0x04, RegisterRead_01_40_04, 448);
  read_TI046B1_register(0x003, 0x01, 0x00, 0x06, RegisterRead_01_00_06, 256);
  read_TI046B1_register(0x003, 0x01, 0x20, 0x00, RegisterRead_01_20_00, 56);
  read_TI046B1_register(0x003, 0x01, 0x90, 0x00, RegisterRead_01_90_00, 208);
0x003 with 0x001 becouse is black cartridge, but in serial monitor i have:
Error occured wile trying to write to the slave
Slaves's begining of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?

[atanasssko]

Hello. I have problem with compilation the sketch on arduino.
SDA not declared, SCL not declared...
Wath can i do? I use arduino on Windows, il try and in arduino droid, same error.

[atanasssko]

sorry. I finally made it and uploaded it. now i'm trying to reset the same chip used in Lexmark MX511. is this sketch suitable for this printer model? I get a reply in a terminal:
Error occured wile trying to write to the slave : Slave's address not acknowldged (begning only) - is it connected ?
i use mega 2560 whit I2C_TI046B1_Reset.ino and I2С Logic Level Converter Module Bi-Directional for Arduino to receive 3,3V on chip.
/with 18kO resistor is same ansver in a terminal/ Chip connect as GND-SDA-SCL-VCC
am I confusing somewhere? do I have a mistake in the direction of work?
i will be glad to receive a response and guidance on working with the chip. thanks
translated by google translator

[PON]

Is someone , or there is some possibility that the chip blocked (98) can be recovered.
I will pay for help me this

[elpaco]

Hello Every one.

I'm back to you some months after with the same status.
I 'm able to read and modify the content of the Magenta cartridge for lexmark CX510de.
unfortunately the printer doesn't accept it (end of life display).
I'm sure the serial number of the cartridge is stored somewhere in the machine. so I can not reuse it.
I'm not also able to use the printer in black mode if I don't place a new cartridge... that doesn't make sense, crazy world !

so do you have a way to update the full content of the chip (even place a new serial number) ? or the chip is done for ever ?
or if you can guide me on some web site to use the printer without color cartridge placed inside, it will be great also.

Many thanks to everyone (at home) !

[GraberKGD]

Привет.

Подскажите скейтч для Arduino 2560 для прошивки чипа Lexmarx ms410. Буду благодарен.

[hmazzon]

Привет.

Подскажите скейтч для Arduino 2560 для прошивки чипа Lexmarx ms410. Буду благодарен.

hi i was also experimenting with a ms 410 chip with the sketch "----- I2C Reset of the TI046B1 CHIPS ------" on an arduino 2560 i am not successful: '(The printer pulls a sign that the "cartridge is not compatible lexmark. 33.01N"

If someone has a sketch to read the information about the chips, they would also be grateful.
 
Greetings from Argentina!

[karamouse]

0x0C0 - 0X0E9. CRC in 0x0EA-0x0EB (42 byte + 2 byte CRC16)         HOW IT WORKS ??

[ScApi]

Does anyone still have Arduino sketch for dumping/resetting this chip ?

Links are dead unfortunately.

[TUFAN]

hi i was also experimenting with an ms 8 chip with the I2C Reset sketch of TI046B1 CHIPS on an arduino 2560 i am not successful: warning '(Printer, "cartridge is not lexmark compatible. 33.01N"

i have the same problem
greetings from Turkey

[TUFAN]

hi
this link not open

[ionutkok]

You wrote a bit wrong ! First you read the chip, save it in a text file, then write only the necessary registers !

[gkol]

Hi!

Has anyone made a progress with these chips?
 
Can someone share I2C_TI046B1_Reset.zip file because the links above are dead now.

[Distinctly Average]

I worked for Lexmark for a few years, or at least the company I worked for was their national service partner. One thing that doesn’t seem to have been mentioned in this thread is that some Lexmark consumables are region coded. When you buy some of the Lexmark laser printers they all come with un-coded consumables. The first time you install a replacement the nvram on the main PCB is set to the region code of where that consumable came from. This is not changeable after that as an internal fuse is blown making that part of memory read only. So for instance, you live in the UK and your new printer runs out of cyan. You order a genuine Lexmark cart from the US as it works out about 45% cheaper even with postage. Once you install that cart, forever more you can only use US coded consumables. Saw a lot of very miffed customers when that bomb hit.

Why do I say this here? Well some are suggesting you purchase a chip for the consumable online. You would need to be sure that third party re-programmed chip is of the same region code, or the printer will error.  Not sure if they still do that with the latest models as I changed contracts a few years back. It was quite a regular issue for customers at the time.

***** Edit. *****

Seems it is still the case. And just to be clear, only the original in the box carts are coded as 0, all replacements have a region code - https://infoserve.lexmark.com/ids/ifc/ids_topic.aspx?root=v33091549&gid=&id=33091863&topic=v39295557&productCode=Lexmark_CS720&loc=en_ZA

[ionutkok]

It is very simple. First read the chip and save it in a txt file, then write back only the essential bits. At Lexmark printers, you can set the printer to lock before the chip reaches zero .

I.M.

[toni31]

All links are dead or with money. Is someone who can share the file's?

[toni31]

is someone who can help with the ti046b1 chip and lexmark printer

[constanrine5d]

This is the last one from pixconfig. It does reset the Black Starter Cartridge for me to 100% but when I try and print it goes back to 0% cause the printer stores the last x amount of cartriges serial numbers in its internal memory.

I think the only way we are going to do this is if we modify the printer's firmware. Anybody who knows how to do that?

[pafinmen10]

Good day.
Please help.
I"m need library from arduino   twi-all-included.h.  from comucation  chips Lexmark Ti 046b1 I2C.
Very thanks.
Best regards Martin

[epandi]

I"m need library from arduino   twi-all-included.h.  from comucation  chips Lexmark Ti 046b1 I2C.

You could try replacing the

Code: [Select]

#include "twi-all-included.h"

with

Code: [Select]

#include "Wire.h"
extern "C" {
#include "utility/twi.h"  // from Wire library, so we can do bus scanning
}


[epandi]

Is it possible to change the slave address of the chip?
I messed up connecting the chip to my arduino and now apparently it's set to slave address 0x000 instead of 0x003 Magenta.

PS) for those searching for the twi-all-included.h file, see the attachment.

[Pantelis]

Hi can somebody help me. I read the chip and i get "dump read" file
After i run I2C_TI046B1_Reset and i get "dump reset" file
and not all light leds run in sequence without can print
i have not understant which register should i change to to show cartigde is full

[karamouse]

Good evening dear colleague, I am back, can you help me with the address of %%%%

Can someone please explain to us how it works%

 

[lupy]

Can someone send me a working copy of I2C_TI046B1_Reset.zip

[karamouse]

I advise you not to load or modify the data of the chip by the one that has not left you risk blocking the chip

[Hegypt]

I have full code to reset lexmark and konica toner and drum  black only

[toni31]

I have full code to reset lexmark and konica toner and drum  black only

Share?

[5U4GB]

Grab a non empty cartridge and write it's contents back to the empty one, and see the differences in the data as well. Print a few pages and see how the data changes, which might give enough data to simply reset the count, or make it look full again when refilled.

That's one easy approach that I used years ago to reverse-engineer something obscure, with a publicly-readable EEPROM you can get a snapshot of the memory state between each operation and see which way things move.  In the case of the device I worked on it was a counter with one bit per count but they had some bug where they shifted in one bits rather than shifting a single bit down (it was years ago and I can't remember all the details any more), but in any case all it took was a few snapshots over time to figure out how their counter (and various other things it did) worked.

[adolawww]

Could you please help me set the sketch

[joud2020]

I need a sketch who is willing to pay for my help  rc_mk@yahoo

[adolawww]

Any body needs help i found the solution
Free 100%
Just mail me on adeldda.it@gmail.com
For sketch sending
For some egyptions not free

[joud2020]

i have not understant which register should i change to to show cartigde is full and

[Hegypt]

Full Code for Lexmark konica ricoh toner ,drum and fuser
Hani.3dwy@gmail.com

[jbtronics]

So I tried to gather some more insight about this chip from the printers firmware.

Using the keys and firmware extraction tools from this repo https://github.com/blasty/lexmark I was able to decrypt the latest CS310dn firmware (I guess that this should work for almost all lexmark printers).
I was able to extract the linux kernel image and the filesystem of the printer.
The kernel image is compiled with some debug infos and decompiling it with Ghidra gives some good results.
The linux kernel contains a lot of lexmark specific function extensions, including many functions prefixed with "pnsv" (which stands for pensive). I could not find much about this subsystem but I strongly suspect that it is the subsystem for communicating with the cartridge chips, as it has functions like pnsvCartAuthenticate0 to 6, and functions like pnsvIncrementCounter and similar. It also features a lot of functions to authenticate cartridges and verify signatures.

The code seem to support different type of cartridges types with different memory sizes. The chips can have different regions: Readonly, Bit fields, Read-Write, Encrypted, Counters, ECC Sigs.

For some reason lexmark decided to statically link most of thesere higher lever interface to the pensive subsystem into the kernel image, while the physical communication is handled in its own kernel module, which is loaded during the initramfs.

For my legal understanding this should also mean, that all statically linked code is GPL licensed like the linux kernel itself. That should also mean that lexmark has to disclose/provide the source code of these pnsv* functions. I tried to contact the lexmark support, but no luck so far.

[karamouse]

good evening I have a simple question: is that after the reset
of the chip, the non-renewable page counter becomes 100%??

[JacquesBBB]

Hello to All,

After a five-year break, I come back to this topic, still unsolved, but with great progress.

I  have seen that the market for  toner chips has evolved, and while they were around 25$ when I started this thread,  I could buy some for just 4€ here
https://www.aliexpress.com/item/1005006137482651.html?.
I tested it, and it works.

The chip is not at all as in the site picture, but more like the original Lexmark chip.

Lexmark :

with pinout :


Ljiayin chip :
see the attached photo, with the annotated pinout. Of course, the connector is the same
JP1 : GND
JP2 : SCL
JP3 : Vdd
JP4 : SDA




But what is this chip ?  Can anybody guess from the pinout  and find a datasheet ?
The marking is
17024D
2229

I asked Chat GPT, but although he  made some effort, he was not able to say more than stating that it was a I2C eeprom.

[takha]

i have lexmark ms410d imprimante but my toner imprimanta is empty, i would to programmer the puce TI046B1 of the toner .
 if you can i help me
 thanks

[coromonadalix]

@ takha

please refrain of doing  multiples requests the same day  or trying to pull answers     you may get  banned here

if people can or want to answer they will on their own terms  not yours

[takha]

@JacquesBBB
hello ,
I established these connections for reading the TI046b1 chip using a Pickit 2 programmer.

[Diusha]

Guys, you can write information in the chip by resetting all the counters, but you will not be able to reuse the chip in the printer, since the printer remembers the serial number of the chip (which is signed)and the number of printed copies, all you can do is exchange information from your chip or if you hacker you can modificate firmware. Original chip can be completely rewritten with new data, but it is microcontroller which listen only command for it programmed (toner, drum or developer if chip present in printer)

[takha]

hello Guys.
hello i can read the eeprom memory, but i can’t write can anyone help me?
I can’t attach to you my picture electrical system concerning the cabling with the program PICKIT 2.

[Diusha]

If you able to read so you can also write, it is not problem in electric circuit. Commands beginning for read toner: 0xf0 , 0x01 , 0x01 , 0x00 , 0x00 for write toner: 0xf0 , 0x01 , 0x02 , 0x20 , 0x00 for read drum 0xf0 , 0x05 , 0x01 , 0x20 , 0x00 for write drum: 0xf0 , 0x05 , 0x02 , 0x20 , 0x00 (For MS5xx )

[Hegypt]

Lexmark, konica ,toshiba and ricoh . Full esp8266 code  resetter
Hani.3dwy@gmail.com