Lexmark toner chip Ti046b1

[AndreiKenig]

What data is stored in the chip from Lexmark CS series with offset 0x045f and 0x0460? In the lexmark MS/MX, if you transfer this data to the DEC, you get the capacity of the cartridge. I tested this on more than 10 different models of the cartridge.

[pixconfig]

Hi,

At offset 0x045f and 0x0460 (by reading 0x01 > 0x5F > 0x04 during 2 bytes) we found 0x60 and 0x12 on starter kits cartridges.

We have been unable to write after offset 0x400 (past 0x02 > 0x00 > 0x04).
We tried by replacing the 0x02 first byte with any value from [0x00 to 0xFF] but it did nothing.

We also tried to write at 0x02 > 0x00 > 0x08 (so at offset 0x800 which is 2048) and 0x02 > 0x00 > 0x0C (so at offset 0xC00 which is 3072) but it did nothing too.

We are out of ideas now 
We also tried to reset to factory setting the printer (by typing 2 + 6 at power on for entering into maintenance menu), with no cartridge in the printer, and we placed the cartridge after, with an almost new magenta cartridge but an empty reset starter kit chip on it, and we were disconnected from network during all this. After few minutes it said again that the magenta cartridge is "end of life" with 0 page left.

Finally, we had some return from some people, that the Reset Program for Arduino corrupted some toner chip information after having fail to read the content before modifying it, but successfully writing it back to the toner chip... with a lot of 0x00 !

So we modified the program in order not to write anything if the reading fails before. The new version is here : https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Reset.zip

Any more idea is welcome !
Bye

[AndreiKenig]

Все изменения в дампе картриджа должны быть подписаны хэшем который храниться в дампе начиная со смещения 0х700. Чтение и изменения хэша происходит через посылку 14 байт в регистр 81. И только после декодирования запросов в 81 регистр и ответов в регистр 80 можно будет полноценно восстанавливать чипы.

[pixconfig]

All changes to the cartridge dump must be signed by a hash that is stored in the dump since the 0x700 offset. Reading and modifying the hash is via sending 14 bytes to register 81. And only after decoding the requests in the 81 register and the responses to register 80 it will be possible to fully restore the chips.

Hi AndreiKenig, Thank your for this answer, actually the printers does a ton of exchanges on 0x81 and associated registers. I believed this was only a "genuine check" when I successfully edited the cartridge level for the first time so I didn't looked after it for a while, but now that we realize there is something else, this make sense to watch again over it!

Here is what I saw when I watched it for the first time with the dsPIC :

0x82 is a kind of Status Register that the printers reads before asking anything to 0x81 or 0x80 :
status 0x38 is "nothing more to say, please enter something into 0x81"
status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
     
status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09

0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time

I also noticed after that in the middle of the 16 bytes answer inside 0x82, there is two bytes that never changes on each cartridge

[AndreiKenig]

Работа с регистрами 81 и 80 идёт циклами сначала с тонер картриджем затем с драм картриджем. Принтер выходит в готовность когда при последнем ответе в регистре 80 драм картриджа 15 байт начиная с 0 передаёт значение 0х88 (истина).

[AndreiKenig]

0x82 - это своего рода регистр состояния, который печатает на принтере, прежде чем спрашивать что-либо 0x81 или 0x80:
статус 0x38 «больше нечего сказать, пожалуйста, введите что-то в 0x81 «
status 0x48 -« 0x81 Регистр получен 0x08 »(позволяет вызывать этот режим 0x08)
status 0x88 является следующим шагом: 14 байтов вопрос записывается в 0x81 после ввода режима 0x08
     
статус 0x49 - «0x81 Регистр принят 0x09» (позволяет вызывать этот режим 0x09).
0x89 - это следующий шаг: вопрос 14 байтов записывается в 0x81
после ввода режима 0x09

0х98  - ошибка, картридж заблокирован
после в ответе регистр 0х80 будет 16 байт 0х00

[Alan.B]

Hello friends!

Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?

Regards!

[AndreiKenig]

Полный дамп снять не получиться. Адреса с 0х00 по 0х1F, c 0x170 по 0x3FF и c 0x700 по 0x7FF считать будет невозможно. Вернее данные в них будут ошибочны либо 00 либо FF. Вышеуказанные области защищены от прямого чтения.

[Alan.B]

Perfect! Thank you!

I will try to use my Saleae Logic Analyzer and see if I get more information about it. At the moment I am building a logic level converter to protect the memory. Unfortunately, my logic analyzer only works with 8-bit i2c readings, but I think the data can be interpreted anyway. If someone has the time, the knowledge and the desire, could modify the *.dll´s starting from the SDK of Saleae and I will gladly use it to make readings in the printer and observe what happens with the addresses that you mention in the previous post.

Regards! 

[Alan.B]

Hello friends!

Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?

Regards!

Всем, Привет!
Немного исправил рисунок

Hello Friend!
The circuit that I attach in my post is correct! The one that you attached in your post is not correct!

[Alan.B]

Hello again!

I can not get the pixconfig source code to work to read the chips
I already tried 9 chips but nothing yet ...

This is the error that throws "Error occured wile trying to write to the slave: Slave's address not acknowledged (begning only) - is it connected?"

My configuration is Arduino -> Logic Level -> Chip

According to what I read it may be an error in my i2c address, does anyone know how I calculate the address of the Ti046b1?

Regards!

[Technics66]

I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

[Alan.B]

I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

Hello Friend!

Seeing on the internet, the chip of the model that you commented "MX410" is exactly the same as my "MS810" chip ...
The log that you shared, is a chip reset to new?
If so, it would be useful to perform tests on my chip.

Regards!

[Technics66]

is a chip reset to new?

Yes. But when the chip was reset, the programmer gave an error. I can check the chip later.
In the sketch pixconfig when reading 01> 20> 00 reads 56 bytes, and in the logs read 16 bytes. A very big difference in the methods of reading between the sketch and the logs.

[AndreiKenig]

Чтение и запись данных по адресам  диапазона с 0х700 по 0х7FF производится через команды в регистр 0х81

[AndreiKenig]

А кто нибудь может сказать почему чтением в скетче 01> 20> 00 получается 56 байт, а программатором видно что читается 8 байт? Это от чипа зависит или от чего-то другого?

Я читаю своим программатором строки по 16 байт и у меня проблемы не возникают

[Alan.B]

I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

Friend! Analyzing your log "Log_MX410", after consulting the model in the registry 0x01 0x50 0x04, the programmer obtains the 14 bytes to record in the registry 0x81. Has anyone already discovered how this is done?

I also want to tell you that I modified the functions created by pixconfig a bit, when I have it completely ready it will be posted, but for now I need to know how to calculate the 14 bytes for the 0x81 register.

Regards!

[Alan.B]

More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...

Regards!

Code: [Select]

-------------------------------------------------------------------------------------------------------------
BLOCKED CHIP
-------------------------------------------------------------------------------------------------------------
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00

-------------------------------------------------------------------------------------------------------------
NEW CHIP
-------------------------------------------------------------------------------------------------------------
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: C8
Send: 0x80 | Response: 00 00 00 00 00 00 5A06 00 00 00 00 00 00 00 80


[amyk]

Please keep the discussion in English, translate it yourself before posting, this is an interesting topic but hard to read if everyone has to use Google Translate themselves.

[Technics66]

More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...

Please give your sketch.
I have 5 chips locked and 3 chips not locked.
I can check with your sketch sooner.

[Alan.B]

More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...

Please give your sketch.
I have 5 chips locked and 3 chips not locked.
I can check with your sketch sooner.

Of course I share it with you! Sorry for my English helped me with Google translator.
If you get successful results, please share them with the community!

Regards!

Code: [Select]

#include "twi-all-included.h"


void setup()
{
  Serial.begin(9600); //[Start+8bits+STOP] => 960 o/s
  twi_init(); //Standard 100 kHz Atmel's internal I2C device initialisation with Pull-Up on SDA/SCL
}

void read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom)
{
  uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSB
  uint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB
 
  //Put the MSB bits to the Left :
  slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003
 
  //7 bits address equivalent for the begining :
  uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.
 
  //Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.
  uint8_t txBuffer[registerSize + 1];

  for(uint8_t i = 0; i < sizeof(txBuffer); i++)
  {
    if(i==0)
    {
      txBuffer[i] = slave_address_LSB;
    }
    else
    {
      txBuffer[i] = registerBuffer[i-1];
    }
  }

  uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);
  if (nRet == 1)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave : TWI class's buffer is too small");
    Serial.println("W1");
    return;
  }

  else if (nRet == 2)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave : Slave's address not acknowldged (begning only) - is it connected ?");
    Serial.println("W2");
    return;
  }
 
  else if (nRet == 3)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("Error occured wile trying to write to the slave :");
    //Serial.println("Slaves's begining of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?");
    Serial.println("W3");
    return;
  }

  else if (nRet == 4)
  {
    //it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
    //Serial.println("I2C protocol error occured wile trying to write to the slave. Is the wiring correct ? TWI Initialisation ?");
    Serial.println("W4");
    return;
  }
 
  //else :
  nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end. 
  if (nRet == 0x00)
  {
    //Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.
    //Serial.println("Error occured wile trying to read from the slave.");
    Serial.println("R1");
    return;
  }

  if (nRet != readSize)
  {
    //Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.
    Serial.print("Unable to read all the bytes from the slave : ");
    Serial.print(nRet, DEC);
    Serial.println(" bytes read");
   
    return;
  }

  //else :
  for (uint16_t i=0; i<readSize; i++)
  {
    //Serial.print("0x");
    if (destinationBuffer[i] < 0x10)
    {
      Serial.print(0, HEX);
      Serial.print(destinationBuffer[i], HEX);
    }
    else
    {
      Serial.print(destinationBuffer[i], HEX);
    }
  }
  Serial.println("");
}

//Delcopi sequence obtained from "Log_MX410" by Technics66
uint8_t a[1] = {0x03};
uint8_t a_[1];

uint8_t b[1] = {0x83};
uint8_t b_[1];

uint8_t c[3] = {0x01,0x50,0x04};
uint8_t c_[16];

uint8_t d[1] = {0x82};
uint8_t d_[1];

uint8_t e[2] = {0x81, 0x08};
uint8_t e_[1];

uint8_t f[1] = {0x82};
uint8_t f_[1];

uint8_t g[15] = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};
uint8_t g_[1];

uint8_t h[1] = {0x82};
uint8_t h_[1];

uint8_t i[1] = {0x80};
uint8_t i_[16];


void loop()
{
  char command = getCommand();
  switch (command)
  {
    case 'a':
      Serial.print("Send: 0x03 | Response: ");
      //read_TI046B1_register(ADDR, CMD, sizeof(CMD), BUFFER_RESPONSE, sizeof(BUFFER_RESPONSE), STOPCOM 1|0);
      read_TI046B1_register(0x000, a, sizeof(a), a_, sizeof(a_), 0);
      break;
    case 'b':
      Serial.print("Send: 0x83 | Response: ");
      read_TI046B1_register(0x000, b, sizeof(b), b_, sizeof(b_), 0);
      break;
    case 'c':
      Serial.print("Send: 0x01,0x50,0x04 | Response: ");
      read_TI046B1_register(0x000, c, sizeof(c), c_, sizeof(c_), 0);
      break;
    case 'd':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, d, sizeof(d), d_, sizeof(d_), 0);
      break;
    case 'e':
      Serial.print("Send: 0x81, 0x08 | Response: ");
      read_TI046B1_register(0x000, e, sizeof(e), e_, sizeof(e_), 1);
      break;
    case 'f':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, f, sizeof(f), f_, sizeof(f_), 0);
      break;
    case 'g':
      Serial.print("Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: ");
      read_TI046B1_register(0x000, g, sizeof(g), g_, sizeof(g_), 1);
      break;
    case 'h':
      Serial.print("Send: 0x82 | Response: ");
      read_TI046B1_register(0x000, h, sizeof(h), h_, sizeof(h_), 0);
      break;
    case 'i':
      Serial.print("Send: 0x80 | Response: ");
      read_TI046B1_register(0x000, i, sizeof(i), i_, sizeof(i_), 0);
      break;
  }
}

char getCommand()
{
  char c = '\0';
  if (Serial.available())
  {
    c = Serial.read();
  }
  return c;
}


[Technics66]

Alan.B
Your sketch does not work. There is no information in the terminal. 
I'm using Arducopter on ATMEGA 2560.
I found out that the page counter is located at 0xE1 2 byte.
I have several dumps from different chips. Are they needed?

[Alan.B]

Friends!

maxic81:
Reading errors I solved by removing the resistors in the SDA and SCL lines.

Technics66:
I'm using the sketch I uploaded in the previous post, are you adding the library "#include" twi-all-included.h ""?
I would like you to upload your dumps, all information is valuable.

To add information...
Reading one of the printer's manufacturer's patents, they indicate that the authentication KEY is stored in memory, it only changes when new changes are made to it.

Regards!

PS: I continue to investigate 

[Technics66]

Alan.B
Sorry. I did not understand that I should enter a, b, c, d ... The sketch works.

Code: [Select]

------ UnBlock-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0D40116CBB70880CDB38A
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0C7017B0EE30DF199F38B
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0F0015709189211715C84

-----Block-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01940050323446313338320000000905
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000

The programmer DelCopi badly flushes the chip. He writes that 500 pages are printed. 
Мemory addresses where the information:
0x00E1-0x00E2 Number of pages printed //0x16, 0x32  (5682 pages)
0x0440-0x044B Serial number           //0x43, 0x41, 0x44, 0x31, 0x37, 0x33, 0x31, 0x38, 0x31, 0x35, 0x34, 0x33 (CAD173181543)
0x0453-0x045A Model                   //0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x33 (P24F0003)
0x045F-0x0460 Volume of the cartridge //0x13, 0x88 (5000)
Attaching dump chips. In the name "reset" this chip was dropped and after that printed.

[Technics66]

Log reset of the chip P24F1382 (Starter MX317) by the programmer DelCopi without error after completion.