Author Topic: Lexmark toner chip Ti046b1  (Read 122042 times)

0 Members and 1 Guest are viewing this topic.

Offline igrok_by

  • Contributor
  • Posts: 19
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #50 on: January 11, 2018, 10:43:53 am »
Hello all. ;)

Sorry if I offended someone  :'(. It turns out the goods on the Chinese site can cost 3 times more than they actually are. I complete the instruc- tion about the chip until the end of the week. I suggest that you talk again about receiving instructions.
I'm not a magician while I'm studying. The chip must not be blocked. How to do this I will describe.
« Last Edit: January 11, 2018, 10:51:48 am by igrok_by »
 

Offline AlexandruG

  • Newbie
  • Posts: 1
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #51 on: January 23, 2018, 12:33:37 pm »
Hello all,

What about that instructions igrok? Can you help us with a tutorial "how is made"?

Thank you.  :D
« Last Edit: February 02, 2018, 01:15:29 pm by AlexandruG »
 

Offline driver_x

  • Contributor
  • Posts: 21
  • Country: af
Re: Lexmark toner chip Ti046b1
« Reply #52 on: February 13, 2018, 09:43:20 pm »
Hello, any news about the instructions?
 

Offline dokimos33

  • Newbie
  • Posts: 1
  • Country: ru
Re: Lexmark toner chip Ti046b1
« Reply #53 on: March 05, 2018, 06:05:51 am »
Hello all. ;)

Sorry if I offended someone  :'(. It turns out the goods on the Chinese site can cost 3 times more than they actually are. I complete the instruc- tion about the chip until the end of the week. I suggest that you talk again about receiving instructions.
I'm not a magician while I'm studying. The chip must not be blocked. How to do this I will describe.

Write to me in PM please, I am ready to reward  |O
 

Offline Ronyy

  • Newbie
  • Posts: 1
  • Country: br
Re: Lexmark toner chip Ti046b1
« Reply #54 on: April 02, 2018, 02:24:35 pm »
Is there any solution to the problem? I have an MS810dn lexmark and would like to know if it is possible to re-record the TI046B1 chip. I'm spending roughly $ 454, 32 per month only with the purchase of chips.
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #55 on: April 06, 2018, 05:31:23 pm »
Hi everybody,

With a 70 MIPS DSPIC 33EP512 MC 502, and few days of hard labor, we succeeded in having all the communication between the printer and its cartridges intercepted without any bit of error !

The Buspirate was just a Joke as it was unable to spy on a normal 100kHz I²C bus, and for those who tried, it had no chance to give anything meaningful. New versions are maybe approaching 100kHz but micro controller is 16 MIPS.

With an Arduino Mega 2560 (16MIPS), we were too slow, too (even with a lot of optimizations). Indeed, it's impossible to use the internal I²C functionalities of any micro controller since theses functionalities necessarily interact with the bus (too bad, since they are 400KHz compatible !).

How does it works :
First time is recording into enormous buffers, second time (after few time with no data on SDA/SCL) is the sending of the results to the computer (with a simple serial port).
Finally, with a Qt written program, we formatted all the series of S (Starts/Restarts), E (Stops/Ends), and 0/1 (with 7 or 10 bits addresses supported, ACK, Read/Writes etc) in order to have CSV files. We sorted a little bit those files in order to recognize I²C Writes, I²C Questions, and I²C Responses. And splitted the 4 cartridges into different colors.

And yes, Howardlong was right, cartridges are 10 bits addressed.

Enjoy !
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete-1sur2.xlsx
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete-2sur2.xlsx

And raw data from micro controller : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/capture-complete-raw.txt

If some of you are interested in having more details and created programs for the occasions, we are going to clean it a little bit and put it on our website (https://www.pixconfig.fr/)

Now we have to ask ourself one question : what do all those registers contains and says ? Because there is a lot, lot of data exchange between the master (printer) and its slaves (cartridges). For information, the magenta cartridge is empty into the recorded I²C frames.

Also, we have a fifth cartridge and we don't really know what is this cartridge but the way it communicates is the same that for the 4 other cartridges.

Thank you in advance !
 
The following users thanked this post: Siryu

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #56 on: April 07, 2018, 10:57:20 am »
I successfully understood some information about the used protocol, by printing the full series of Questions/Answers/Writes into 1 page (for magenta, firstly) and looking about what it asks, what it answers, and marking everything meaningful with my pen.


I compared the results between cartridges and it is the same protocol, registers and bytes number used at each time. ACK and NACK are just where they should be, Starts Stops and restart too. But content of the 14 bytes questions and the 16 bytes answers change every time... !

Addresses :
  • 0x001 is the black
  • 0x002 is the cyan
  • 0x003 is the magenta
  • 0x004 is the yellow
  • 0x005 is the imaging drum

Registers that are being read :
  • 0x01>0x20>0x04 is the Color Register. It gives a series of 0x0N and 0x00 that repeats itself, N being 1, 2, 3, 4, or 5 (same as the address)
  • 0x01>0x40>0x04 is an big register that is read on 448 bytes (but for each cartridge, only the 297 first ones contains something, the following bytes are 0x00. First bytes looks like ASCII with only slight differences between cartridges)
  • 0x01>0x00>0x06 is an big register that is read on 256 bytes (all of them contains something)
  • 0x01>0x20>0x00 is an average sized register that is read on 56 bytes (most of the contains 0x00 or 0xFF but not all of them)
  • 0x01>0x90>0x00 is an big register that is read on 208 bytes (First bytes looks like ASCII with only slight differences between cartridges)
  • 0x82 is a kind of Status Register that the printers reads before asking anything else.
    • status 0x38 is "nothing more to say, please enter something into 0x81"
       
    • status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
    • status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
       
    • status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
    • status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09

  • 0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time

Registers that are being write :
  • 0x04 is the first register that is called on each cartridge, with a Stop occuring during ACK (there is no ACK or NACK bit), followed by a useless start stop, observed by oscilloscope too. Let's guess this is useless. But it's common to the 5 cartridges (well, 4 cartridge and 1 imaging drum).

  • 0x81 is the only one register that is written after closing the lid. It's a command register that influences the status register (0x82) and define what will be read into 0x80. We can see single byte writes on it (0x08 or 0x09) for selecting what looks like a mode, then a 14 bytes question write (with something that looks like it's totally unpredictable) before being able to read 16 bytes into 0x80 (16 bytes that also looks like they are totally unpredictable).

That's the complete summary of the exchanges between the master and it's slaves. We have only one missing thing : what is written when we print a page ? Since our Magenta cartridge is empty, we can't print anything.

Now I think I need some experts attention : Does anybody recognize this kind of dialog ?
I'm going to look for possible intepretation of those values (4 bytes sized floats, 8 bytes sized double, integer, unsigned integer, ascii...) but may be somebody already recognize what I'm looking for.

Do not hesitate to consult the Excel files we gave on the previous message, it's really clear to read !

I'm really happy with what we got from the 70 MIPS DSPic (fast enough to immediately mark the values SDA/SCL when there is a SCL/SDA change notification interrupt, then interpret it quickly enough to see the next SDA/SCL change in time) and the way we formatted the data into the Excel. At the beginning, we were looking after 1 and 0 on the oscilloscope so you see, it's lightyear better that way ;D
It's also a chance that it's 48 kB RAM memory sized because there is a lot, lot of bytes, starts and stops position to record before being able to slowly send this into the serial port.

« Last Edit: April 07, 2018, 11:11:49 am by pixconfig »
 
The following users thanked this post: Siryu

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #57 on: April 07, 2018, 03:23:27 pm »
We saw that after the 2 streams of recorded communication with the printer, we had 3 series of Write + Read into 0x005.
I made a pretty cool discovery while looking at it : part of the chip is an EEPROM and the printer auto-control what have been written :

It writes a 1st time 96 bytes into 0x02>0x20>0x00, and read it back into 0x01>0x20>0x00 (with no single bit change)

It writes a 2nd time 96 bytes into 0x02>0x80>0x00 and read it back into 0x01>0x80>0x00 (with no single bit change)

In the two writes (and the two reads back) there is no change : same thing written into 0x02>0x20>0x00 and 0x02>0x80>0x00.

Finally, it writes 128 bytes of data into 0x02>0xE0>0x00 and read it back into 0x01>0xE0>0x00

Here is a picture of the analysis, it's a little bit loaded but


I've placed an updated version of the Excel files as ODS file at this address : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete.ods
The 1st, 2nd and 0x005 Write are into 3 different sheets on the bottom of the document.
Formatting of the 2 communication are the same so now it's easier to place the same view on each side, and switch between them to see what is changing.
 
The following users thanked this post: Siryu, Alan.B

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #58 on: April 07, 2018, 05:05:50 pm »
AAAnnnd the winner is....  ;D (not so fast, my understanding of the situation still should be verified experimentally)

I have just noticed that for the first headers (big registers read before exchanges on 0x80 / 0x81 / 0x82) that I documented this morning, they are something more to know about the following ones :
  • 0x01>0x20>0x00 is an average sized register that is read on 56 bytes (most of the contains 0x00 or 0xFF but not all of them)
  • 0x01>0x90>0x00 is an big register that is read on 208 bytes (First bytes looks like ASCII with only slight differences between cartridges)

Those headers are for 0x001, 0x002, 0x03, 0x004, but not for 0x005.

For 0x05, those first registers reading are replaced by
0x01>0x20>0x00 : read during 96 bytes
0x01>0xE0>0x00 : read during 128 bytes

Yes, the same register that we saw the printer write in my previous message, so we know what the printer reads at the beginning : it reads things that can be written  :-+

This is probably those registers that the master is writing in order to update the status, and the one that the master reads in order to know the current status of the imaging drum.

I guess that the way the master writes the toner level on 0x001, 0x002, 0x003 and 0x004 is the same (replacing the 0x01 by 0x02) but it should be verified while watching the printer writing into those registers.
And may be everything addressed by 0x01>0xNN>0x00 can be addressed and written, who knows. I wonder what it contains when the cartridge is brand new ! I'll try to watch that in the following week.

According to some folks, there is another thing that is set/locked somewhere else when the cartridge become completely empty. Probably something that could be found by watching the printer doing it's final emptying ? Who knows, it's a shame that we are there, looking again and again to repeat and find what some people already found and kept, those people who find solutions against venal obscurantism in order to finally put moral to the garbage, and ask for dollars too.  :clap:

But I digress, let's keep on studying this I²C component  :) - as you can see, I'm not trying to do anything else but studying a component we all bought, just for me and the others to know how does it works.
« Last Edit: April 07, 2018, 05:07:39 pm by pixconfig »
 
The following users thanked this post: aruna1, Siryu, Alan.B

Offline JacquesBBBTopic starter

  • Frequent Contributor
  • **
  • Posts: 829
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #59 on: April 08, 2018, 09:42:46 am »
Congratulation for this nice work, pixconfig. I hope that will end up with a solution for resetting these chips.
 

Offline Siryu

  • Newbie
  • Posts: 3
  • Country: es
Re: Lexmark toner chip Ti046b1
« Reply #60 on: April 08, 2018, 01:19:36 pm »
If wonderful work now I know because I could not read or interpret the data with arduino, hopefully we can do something at last, thanks pixconfig :-+
« Last Edit: April 08, 2018, 01:21:26 pm by Siryu »
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #61 on: April 08, 2018, 03:16:25 pm »
Hi !

In fact I have good news for everyone who wants to communicates (Read/Write) with those chips and an Arduino as master (or any other kind of I2C master, like RPi or VGA card) : I think it is completely possible ! (Just take care about 3.3v). But I didn't tried.
I Guess you should also tells you Arduino that the address you want to write is 0x78 (0b111 1000) + W and then the first data byte you send should be 0x01, 0x02, 0x03, 0x04 or 0x05.

Before any read, you will also need to write 0x78 + W, 0x0N (1 2 3 or 5), your desired register(s), and Restart, then just 0x78 + R (on a read, you're only able to write 1 byte of address before receiving, so you can't put the full 10 bit address. But the slave chip will recognize himself since just before the restart, you were talking to it).

What we don't succeeded in, with the Arduino, was to watch as input only into the operating bus between printer and cartridges and being able to catch everything sent/received between everybody without any interaction and without any bit of error : coding a software read-everything using software poll and/or interrupt on PD0 / PD1 changes was to slow to :
 - copy of the SDA/SCL value (PORTD) immediately on any change
 - interpret the copy by looking at the 2 values with some if/else and masks (0x02, 0x01, 0x03)
 - putting the results into a dedicated buffer
 - and to be ready for the next change at time

Of course, sending the values by Serial Port should be done in a second time because it's very long too (talking about too many µs of course, not minutes  ;)).

We were loosing a lot of bits, starts and stops. Copying the SDA/SCL values on another output port and seeing the time offset with a 2-way oscilloscope revealed that we had no chance to be fast enough to do everything in time because SDA was changing too fast after an SCL change and vice-versa (we were often reading the PORT D too late).

May be some Assembly's kings would have done better than us, but anyway, that's why we said it was pretty impossible without a faster controller (and I discovered 70MIPS dsPIC, it solved the problem, but it's a little bit complicated to code with : lot of registers to set everywhere to do any simple thing).

I've tried to interpret the data on the big headers as ASCII. That's a little bit poor because it's mainly binary, but there is some ASCII information anyway. It seems that those are serial number, and the model of the compatible printer.
There is also a check on the Imaging Drum reference : CAH171303CD6 is written into the Imaging drum's chip but also in the cartridge's chips.

Pretty interesting, after all ! May be it's for a compatibility check with what's installed into the printer.

Black :
   CAH171331C86
   38C4237
   6MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de

Blue :
   CAH1713218DA
   38C4234
   6MBF46MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Magenta :
   CAH171350F7B
   38C4235
   6MBF46MBF46MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Yellow :
   CAH1713208AA
   38C4236
   6MBF4
   CAH171303CD6
   75272394
   Lexmark CX417de
   
Imaging Drum :
   CAH171303CD6
   38CB0001
« Last Edit: April 08, 2018, 03:18:38 pm by pixconfig »
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #62 on: April 09, 2018, 01:08:27 pm »
Hi !

I can now confirm that the Arduino (Mega 2560 at least) is able to be master and communicate, and read into the 10 bits TI046B1 (using 10k + 5.2k + 2k between ground and SDA and same between ground and SCL, in order to have 3.3v and no 5v)

Here is a sample code in order to address (by write) the 0x01 > 0x20 > 0x00 register, and read it during 56 bytes after a restart EDIT : it's also able to write, now

I used arduino's twi.h and twi.c in order to understand what I was doing on the bus, because Wire.h and Wire.cpp overlay was a little bit strange to understand; anyway it should work too

https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/twi-all-included.h
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Read.ino

EDIT : the goal is to read those registers and send it trough serial port, in order to copy it into C declaration, and write it back, for example.
We will first try to read the chips on the same values that the printer does, and see if we are able to see the same things, before trying to write anything.
« Last Edit: April 09, 2018, 04:20:05 pm by pixconfig »
 
The following users thanked this post: Siryu

Offline Siryu

  • Newbie
  • Posts: 3
  • Country: es
Re: Lexmark toner chip Ti046b1
« Reply #63 on: April 09, 2018, 06:06:48 pm »
Thank you Pixconfig for your excellent work.  :clap: :clap: :-+
Indeed with the Mega ADK I have managed to read a chip of the Monochrome printer with a single cartridge of toner and another drum. Now the interesting thing would be to be able to write on the chip.  |O
 

Offline cciollolo

  • Newbie
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #64 on: April 11, 2018, 09:45:12 pm »
Thank you Pixconfig for your excellent work.  :clap: :clap:
I started doing tests of reading the chips with buspirate posting various files, then failing to find anything I bought MSP430F5529 launchpad and I tried to read the chip, but appears "the debug interface to the devices has been secured".
I'm not very practical in data communication and I abandoned everything for a hardware change: disconnect the power supply to all 4 chips after the first verification phase at the printer and sending the document to be printed. In the printing phase the processor must be so busy that it checks the cartridges (almost always) at the end of the print (even if many pages, even if on the back side) to subtract pages from the toner counter, so finished printing I turn off the whole printer and re-lighting it after a few seconds with the reactivated pultant. Change that I do not know why it does not work so much, because the toner level keeps going down; perhaps for a cross check that does between printed pages from the machine and toner residue, I do not know. I saw that instead you have come a long way in the part of communication and I wanted to understand how to help you with the means I have, if possible.
 
The following users thanked this post: pixconfig

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #65 on: April 14, 2018, 04:57:09 pm »
Hi !

After reading the following registers on a new out of the box cartridge's chip that haven't be connected to the printer for the moment :
  • 01_40_04[448]
  • 01_00_06[256]
  • 01_20_00[56]
  • 01_90_00[208]

And after trying to write the good one, out of the box content into another chip (not the good cartridge, I mean of course it's the good cartridge, but the chip says "no, go buy another one") :
  • 02_40_04[448]
  • 02_00_06[256]
  • 02_20_00[56]
  • 02_90_00[208]

I've tried to read the content again but no byte changed...  :-\ it's still the old content.

What should I try ?
I'm going to place the cartridge and his new chip inside the printer, and to observe, but if anybody is inspired, feel free to share your ideas  ;)
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #66 on: April 15, 2018, 01:34:28 am »
I cleaned a little bit the code of our dsPIC I2C observer

https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/main.h
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/main.c

It's for a dsPIC 33 EP512 MC502, there is two buffers in order to keep recording while sending the previous results trough UART, and a buffer overflow protection now  :)
Comments are in english too.

Also, there is a Qt code in order to change the series of letters into a viewable CSV, but it does not interpret anything else than I2C (in fact, apart from the Arduino 10bits  master reader/writer I gave the other day, there is nothing linked to the Lexmark products into any of these codes, they can be used for any other thing).
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/Qt-I2C-Read.zip

Does anybody know if there is a patent describing the communication process between the cartridge and the printer ? Such patents could be really important for Lexmark to ensure no concurrent can sell anything that is patented by their own technology, but such patent are also helpful into understanding the product as customers and developers as we are, for interoperability, modification, but without spending too much time into retro-engineering if everything is already described somewhere  ;D

I guess I'm ready to put the new cartridge into the printer and to watch what it gives !
« Last Edit: April 15, 2018, 01:48:50 am by pixconfig »
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #67 on: April 18, 2018, 12:06:50 pm »
Hi,

Thanks to a very interesting discussion and idea exchange about patent, here is some information :

I searched a little bit on http://www.suppliespatents.info/ (official Lexmark list of patents for their cartridges), and Google Patent, as patents are publicly available on Google, I succeeded in having a lot how them about our cartridge and communication, by seeing the website indicated on the cartridge, and by some research. But not all of them seems to be what we are looking for.

https://patents.google.com/patent/US7258558
https://patentimages.storage.googleapis.com/d9/d2/7c/787cbf35f9fdf2/US7258558.pdf

https://patents.google.com/patent/US7272336
https://patentimages.storage.googleapis.com/2c/9b/24/3466ec9fd84210/US7272336.pdf

https://patents.google.com/patent/US7321739
https://patentimages.storage.googleapis.com/9d/81/1d/74aa37e5d35ee4/US7321739.pdf

https://patents.google.com/patent/US7606520
https://patentimages.storage.googleapis.com/25/cf/fc/f6b00f8489ff68/US7606520.pdf

https://patents.google.com/patent/US7672624
https://patentimages.storage.googleapis.com/1c/c4/95/0dcc721952358c/US7672624.pdf

https://patents.google.com/patent/US8401437
https://patentimages.storage.googleapis.com/b6/09/25/9092a07fda3453/US8401437.pdf

https://patents.google.com/patent/US8948660
https://patentimages.storage.googleapis.com/79/ff/2c/62c12f00eb9e0d/US8948660.pdf


Doing some manual research :

https://patents.google.com/patent/US8966193
https://patentimages.storage.googleapis.com/9c/38/4d/f75c5b3c04f954/US8966193.pdf

https://patents.google.com/patent/US9400764
https://patentimages.storage.googleapis.com/ec/90/37/616b217d32e47a/US9400764.pdf

https://patents.google.com/patent/EP2226809B1
https://patentimages.storage.googleapis.com/b2/9c/c8/1ef00d503cdace/EP2226809B1.pdf

https://patents.google.com/patent/US9245591
https://patentimages.storage.googleapis.com/71/b8/db/58443002ccc33f/US9245591.pdf

https://patents.google.com/patent/US20170163641
https://patentimages.storage.googleapis.com/7a/7d/01/b2b076d57ecd92/US20170163641A1.pdf

https://patents.google.com/patent/US7426613
https://patentimages.storage.googleapis.com/01/03/f5/87cfecdb866b32/US7426613.pdf

https://patents.google.com/patent/US8099791

On the National Institute of Standards and Technology (NIST https://www.nist.gov/) into the Computer Security Resource Center, some part of the Lexmark cryptographic module validation program documentation has also been made available for public too :
https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2444.pdf
But it doesn't talk about the i2c toner chip at all

I don't have a lot of time this week, so if anybody feel ready to eat all these documents, feel free !

I watched the result of 1 print with the new cartridge but there is nothing special to see, it just written 0x005 and did a lot of communication with 0x80, 0x81 and 0x82 on every cartridge... May be a I should print more copies before seeing a cartridge write ?

I will come back as soon as a have new time and information
 

Offline cciollolo

  • Newbie
  • Posts: 9
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #68 on: April 19, 2018, 06:49:12 pm »
hi pixconfig, can you explain me how I can save the communication between printer and cartridges? with any arduino with library that you posted? with a pic? if I can understand how you did, I can equip and post printer data different from yours
in the meantime, I ask you some questions:
puoi verificare che ad ogni accensione (prima comunicazione ) i dati scambiati sono sempre gli stessi ? e ad ogni controllo successivo , a distanza di circa 1 minuto, sempre gli stessi dati ?
can you check that every time you switch on (first communication) the data exchanged are always the same? and at each subsequent check, at a distance of about 1 minute, always the same data?
thanks
« Last Edit: April 19, 2018, 06:54:50 pm by cciollolo »
 

Offline LPI-DANE

  • Newbie
  • Posts: 2
  • Country: us
Re: Lexmark toner chip Ti046b1
« Reply #69 on: April 20, 2018, 06:09:19 pm »
Hello, I'm new to this site. I have been looking for the data sheet just like everyone else. I have a friend in Shenzhen that told me that most aftermarket sellers just silk screen on the TI046B1 on to this chip. http://www.ti.com/lit/ds/symlink/pca9515a.pdf. I use a Xeltek 6100 for ghosting IC's. This is not in my data base. I do not have the chip knowledge of most on this site. Could some tell me if this IC could be the same.
 

Offline LPI-DANE

  • Newbie
  • Posts: 2
  • Country: us
Re: Lexmark toner chip Ti046b1
« Reply #70 on: April 20, 2018, 06:23:23 pm »
Sorry the link breaks, here is a partial of the PDF. It would not let me load the hole PDF.
 

Offline dimprime

  • Newbie
  • Posts: 1
  • Country: es
Re: Lexmark toner chip Ti046b1
« Reply #71 on: April 22, 2018, 10:31:25 am »

Thanks for your excellent work.
Thanks to your program I can write on the chip.
02_40_04 [448]
02_00_06 [256]
02_20_00 [56]
02_90_00 [208]
I change [208] to [200] and [56] to [200] and I can write and change the bits as I want and when I read them it changes them but the lines 02_40_04 and 02_00_06 do not change them. why?
 

Offline JoeO

  • Frequent Contributor
  • **
  • Posts: 527
  • Country: us
  • I admit to being deplorable
Re: Lexmark toner chip Ti046b1
« Reply #72 on: April 22, 2018, 12:19:38 pm »
Hello, I'm new to this site. I have been looking for the data sheet just like everyone else. I have a friend in Shenzhen that told me that most aftermarket sellers just silk screen on the TI046B1 on to this chip. http://www.ti.com/lit/ds/symlink/pca9515a.pdf. I use a Xeltek 6100 for ghosting IC's. This is not in my data base. I do not have the chip knowledge of most on this site. Could some tell me if this IC could be the same.

Here is the link to the larger document:

http://www.ti.com/lit/ds/symlink/pca9515a.pdf
The day Al Gore was born there were 7,000 polar bears on Earth.
Today, only 26,000 remain.
 

Online amyk

  • Super Contributor
  • ***
  • Posts: 8240
Re: Lexmark toner chip Ti046b1
« Reply #73 on: April 22, 2018, 04:28:36 pm »
That's definitely not it; it doesn't even have memory.

This is the closest to a description (the full report is $$$):

https://www.chipworks.com/TOC/Texas_Instruments_TI046B1_Serial_FRAM_CAR-1504-802_TOC.pdf

As for finding a datasheet, since it is a proprietary part you won't find one unless the right person at Lexmark or TI happens to read this thread and decide to be neighbourly (you know who you are... ;))
 

Offline pixconfig

  • Contributor
  • Posts: 24
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #74 on: April 25, 2018, 10:36:49 pm »
Hi, sorry for the little time offline, I was a little busy !

cciollolo, here's a little description of my spy's wiring :
https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/dsPIC-Wiring.png
  • RB7 (pin 16) is used as UART output from the dsPIC to the computer
  • RB8 is normally used as SCL, for I2C, but since it doesn't worked, I used RB10 (pin 21) for SCL spy input. Still don't know why RB8 wasn't working !
  • RB9 (pin 18) is normally used as SDA, and I used it as SDA spy input
  • PicKit connection for when I'm writing/debugging the program is RB2 (PGEC1, pin 6) and RB3 (PGED1, pin 7) for PGC and PGD. I'm only using the 5 first pins of the PicKit
  • I used 100nF capacitors (green ones) and for VCap (tantalum 10µF minimum, which I had not) I used the association of a 100µF electrolytic and a 100nF non-electrolytic capacitor in order to have the association of storage capacity and the immediate response time that is probably required to work at full speed.

I'm then using a USB<->Serial converter using TTL / 3.3v signals : when the dsPIC program is writing UART, the computer receives the data, with putty.exe for example.
Into the code it's buffering all the communications and then, it's sending what have been recorded (after 2 seconds of i2c inactivity).
As it's a looooong series of Ones and Zeros, a second program (C++/Qt written, Qt-I2C-Read.zip), it reads bits 9 by 9 between every Start and Stop and do some interpretation to give a readable CSV with address, read/write and acknowledge interpretation. Then I manually add some colors and spaces in order to see patterns and general shape of the communication.


To answer your question about the first communication at each restart, the big first part of the communication is entirely predictable :
  • 02_40_04 [448]
  • 02_00_06 [256]
  • 02_20_00 [56]
  • 02_90_00 [208]

But then, every exchange on 0x80, 0x81 and 0x82 are pretty unpredictable (14 bytes writes and 16 bytes read are every time different, apart from the 2 middle bytes of the 16 bytes read that are the same every time, it just depends of the cartridge).
I would not be surprised if it's just authenticity check without information read/write, just because it would explain why some people already succeeded in the past to "blank" the toner chip usage counter.


dimprime, it's very very cool !
I think that the first part is describing a kind of "model" for the cartridge and I wouldn't be surprised if the second part contain the "status" of the cartridge. So it would be a great idea to try to "restore" the cartridge status after having used a little page amount, just to see if the toner level is retrieving it's previous amount !

I will have some time tomorrow in order to try some things and tickle those chips a little bit, with the arduino as master  :)
« Last Edit: April 25, 2018, 11:02:02 pm by pixconfig »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf