-
Lexmark toner chip Ti046b1
Posted by
JacquesBBB
on 24 Apr, 2016 05:11
-
I have a Lexmark CS310dn color Laser printer which has 4 cartridges which I bought about 150$.
Each of them has a chip Ti046b1 which probably counts the number of copies ( I guess but may be wrong)
When the count is over in one cartridge, the printer stops.
A replacement black cartridge is 100$.
What is the real mechanism for this chip protection ?
Where can I find the datasheet or the pinout of the Ti046b1 ? I was not able to find it on the web. It seems that it is a FRAM memory, but I am not sure.
How to reset this printer chip ?
There are some chip available on the web, with the lexmark PCB, but rather expensive (about 25 $) while the chip can be available for only 1$ on aliexpress. Should a simple replacement of the chip on the board work ?
It is a TSSOP 8 chip, and there nothing else on the board except some decoupling caps.
Thanks for any information on these Ti046b1 chips and chip protection mechanism.
-
#1 Reply
Posted by
SeanB
on 24 Apr, 2016 07:09
-
It is a simple EEProm, used to store the count of pages printed and toner fill state. Also has a key that is used to authenticate the cartridge to the printer, and a cartridge serial number.
Try looking in printer refill suppliers for the compatible chips, which are either a programmed chip or a small micro that always reports the cartridge is full.
-
#2 Reply
Posted by
JacquesBBB
on 24 Apr, 2016 09:44
-
Thanks, but is it possible to read and change the values in this eeprom ?
And what is the pinout ?
This is the chip
And from what I have looked I got the following schematics, with the 4 pads JP1-4 connecting to the printer
-
#3 Reply
Posted by
Howardlong
on 24 Apr, 2016 10:18
-
Looks like an I2C eeprom from the chip pinout, so...
J1 ground
J2 SDA
J3 Vdd
J4 SCL
-
#4 Reply
Posted by
JacquesBBB
on 24 Apr, 2016 11:00
-
Looks like an I2C eeprom from the chip pinout, so...
J1 ground
J2 SDA
J3 Vdd
J4 SCL
Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact
J1 ground
J2 SCL
J3 Vdd
J4 SDA
Then I got the I2C Address : 0x78
What should now be the way to go ?
-
#5 Reply
Posted by
SeanB
on 24 Apr, 2016 11:51
-
Grab a non empty cartridge and write it's contents back to the empty one, and see the differences in the data as well. Print a few pages and see how the data changes, which might give enough data to simply reset the count, or make it look full again when refilled. Does the printer work without the chip in, some HP cartridges will give an error code but still print, assuming the chip is misaligned with the reader or it has failed, and then relying instead on the low toner optical path for change messages.
-
#6 Reply
Posted by
Howardlong
on 24 Apr, 2016 11:52
-
Looks like an I2C eeprom from the chip pinout, so...
J1 ground
J2 SDA
J3 Vdd
J4 SCL
Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact
J1 ground
J2 SCL
J3 Vdd
J4 SDA
Then I got the I2C Address : 0x78
What should now be the way to go ?
While I can't discount your pinout findings of course, just be aware that there is an unofficial standard pinout for I2C eeproms, so I'd find it unusual to deviate from that, so you might want to just recheck your wiring.
https://proprojects.files.wordpress.com/2014/11/2014-11_i2c_24fc1025_im01.pngFor example, Google the images returned from "i2c eeprom pinout".
Anyway, back to the problem in hand!
Can you probe the device in situ with a bus decoder? This can often reveal a lot.
-
#7 Reply
Posted by
android
on 24 Apr, 2016 12:08
-
Grab a non empty cartridge and write it's contents back to the empty one
...It might also be worth permanently enabling the Write Protect pin too, so that ithe EEPROM would always report "1 page printed" and not bother you in future. I've never tried it...just a thought.
I suspect that the stored data is encrypted - making it difficult to guess how the printer firmware would respond to various kinds of tinkering. The manufacturers really want you to buy more consumables for some reason.
-
#8 Reply
Posted by
JacquesBBB
on 24 Apr, 2016 15:16
-
@Howardlong : I confirm the pinout that I gave. I have been able to communicate with it with both my arduino based I2C scanner and Bus pirate 3.6 with it.
Now I am trying to dump the eeprom with bus pirate, but I have never used it before
I can get some reading but I am not really sure of what I am doing.
What is the best way to dump the content of the eeprom ?
Thanks
-
#9 Reply
Posted by
Howardlong
on 24 Apr, 2016 17:34
-
There are some additional confusions here.
The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57 is the common addres range for eeproms. The schematic you gave even shows the address definition bits and WP pin all tied to how I would expect for an eeprom.
I don't know if Bus Pirate supports 10 bit addressing.
I would take a look at how the printer talks to the device before trying to copy it and match that up with known eeprom protocols. Like pinouts, these are reasonably well standardised so that manufacturers can offer plug in replacements.
-
#10 Reply
Posted by
JacquesBBB
on 24 Apr, 2016 18:02
-
The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57
I had this value with my arduino reader, and this is what I get with the bus Pirate
I2C>(1)
Searching I2C address space. Found devices at:
0xF0(0x78 W) 0xF1(0x78 R)
-
#11 Reply
Posted by
JacquesBBB
on 24 Apr, 2016 21:25
-
In order to verify what I get with the Bus Pirate,
I tried with a more conventional 24FC1026.
Then the pinout is standard and I get
I2C>(1)
Searching I2C address space. Found devices at:
0xA0(0x50 W) 0xA1(0x50 R) 0xA2(0x51 W) 0xA3(0x51 R)
Thus the usual address as mentioned by Howardlong
I can then read and write on the chip
I2C>[ 0xa0 0 0 1 3 2 ]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 ACK
WRITE: 0x01 ACK
WRITE: 0x03 ACK
WRITE: 0x02 ACK
I2C STOP BIT
I2C>[ 0xa0 0 0 ] [ 0xa1 r:3 ]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 ACK
I2C STOP BIT
I2C START BIT
WRITE: 0xA1 ACK
READ: 0x01 ACK 0x03 ACK 0x02
NACK
I2C STOP BIT
I2C>
But it does not seem that the sequence is the same for the Ti046b1
As If I try the same sequence on the Ti046b1 , I get
I2C>(1)
Searching I2C address space. Found devices at:
0xF0(0x78 W) 0xF1(0x78 R)
I2C>[ 0xF0 0 0 1 3 2 ]
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 NACK
WRITE: 0x01 NACK
WRITE: 0x03 NACK
WRITE: 0x02 NACK
I2C STOP BIT
[ 0xF0 0 0 ] [ 0xF1 r:3 ]
I2C>[ 0xF0 0 0 ] [ 0xF1 r:3 ]
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 NACK
I2C STOP BIT
I2C START BIT
WRITE: 0xF1 ACK
READ: 0xFF ACK 0xFF ACK 0xFF
NACK
I2C STOP BIT
So the behaviour of this chip is not the same as a standard eeprom.
If anybody has the proper writing/reading sequence, it would be helpful.
-
#12 Reply
Posted by
Howardlong
on 24 Apr, 2016 21:51
-
10 bit addressing works a little differently to 7 bit addressing, if that is indeed what it's doing. Whatever you're using to talk to the device needs to be 10-bit aware.
Definitely I would sniff out what the printer does to get an idea of what's going on, and look at the I2C specs UM10204 which explain the differences.
-
#13 Reply
Posted by
JacquesBBB
on 25 Apr, 2016 09:44
-
Thanks for your comments. I have started to look to 10 bit addressing...
But it is difficult to find reasonable information of Bus Pirate and I2C 10 bit addressing.
I made an experiment by searching all possible addresses on the black cartridge
searching with Bus Pirate for all 256 in bunches like :
[0xF0 0x00]&[0xF0 0x01]&[0xF0 0x02]&[0xF0 0x03]&[0xF0 0x04]&[0xF0 0x05]&[0xF0 0x06]&[0xF0 0x07]
I got only positive answers for 0 and 1
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
I2C STOP BIT
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x01 ACK
I2C STOP BIT
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x02 NACK
I2C STOP BIT
Then I searched only for the first 8 addresses for the other cartridges and found for the possible
second Byte
Black : 0x00 and 0x01
Cyan : 0x00 and 0x02
Magenta : 0x00 and 0x03
Yellow : 0x00 and 0x04
So this is some progress, as I understand now how the different cartridges are recognised,
but I am not able to go further. I may need to sniff the I2C port as you recommend, but this will need a setting
that I cannot do immediately, as I will have to dismount the printer to access the wires.
-
#14 Reply
Posted by
igrok_by
on 20 May, 2016 07:19
-
you have success
I'm trying to get information from the chip , but it does not come out . To search using Bascom code :
$regfile = "m328pdef.dat"
$crystal = 8000000
Dim Q As Byte , T As Byte , A As Byte , E As Byte , R As Byte
Config Lcd = 16 * 2
Config Lcdpin = Pin , Rs = Portd.6 , E = Portd.3 , Db4 = Portc.0 , Db5 = Portc.1 , Db6 = Portc.2 , Db7 = Portc.3
Cursor Off
Cls
Locate 1 , 1
Lcd "Start"
Config Sda = Portd.5 'I2C Data
Config Scl = Portd.4 'I2C Clock
Wait 2
Do
Cls
For R = 0 To 127
For T = 0 To 128
I2cstart
Q = R * 2
I2cwbyte Q
I2cwbyte T
E = Q + 1
I2cstart
I2cwbyte E
I2crbyte A , Nack
I2cstop
Locate 1 , 1
Lcd Q ; " " ; T ; " Read " ; A ; " "
If A < 255 Then
Locate 2 , 1
Lcd Q ; " " ; T ; " " ; A
End If
Wait 2
Next T
Next R
Loop
End
The answer to all addresses 255. Is there a solution
-
#15 Reply
Posted by
Zero999
on 20 May, 2016 07:44
-
There's no way I'd buy a printer like this.
A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?
-
#16 Reply
Posted by
igrok_by
on 20 May, 2016 07:51
-
A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?
Xerox, samsung.
-
#17 Reply
Posted by
Gyro
on 20 May, 2016 08:48
-
Some laser printers have a s/w setting for non-original cartridges, eg Dell.
-
#18 Reply
Posted by
SeanB
on 22 May, 2016 19:14
-
HP as well, they are refillable, that is why I use them at work. Canon is a brand as well that also has refillable cartridges. The refilled cartridge coasts around 30% of the wholesale price, or around 20% of the retail price. There is a big mark up on cartridges all along the supply chain.
I just ask my refiller first if the cartridges on the printers I am considering are refillable, and this does winnow the list down to a dozen or so to choose from, and then often I look to see if the cartridge is one already in use. Just be aware that often HP and Canon cartridges are exactly the same unit, in a different box with a different part number, and a different price. Lot of Canon printers with me use HP cartridges. Same print quality, same operation and no "non genuine cartridge" message either on the new ones.
-
#19 Reply
Posted by
igrok_by
on 25 May, 2016 06:31
-
There are still some who have ideas on the independent decision of zeroing chips.
-
#20 Reply
Posted by
cciollolo
on 30 May, 2016 20:53
-
hi , i have buy a cs310dn printer. i try to sniff with bus pirate but i have store more number with no result. The value changes every start of the printer and is different in all re-check in ready mode . i buy 10 new empty ti046b1 but i haven't idea to proceed . help please
-
#21 Reply
Posted by
cciollolo
on 31 May, 2016 17:25
-
i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available !
-
#22 Reply
Posted by
igrok_by
on 01 Jun, 2016 18:42
-
i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available !
Did I understand you correctly??? An attempt to read the memory via a separate device
If they've got any sense they'll be verifying the writes.
It's weird that they'd use an FRAM and not some write-once memory.
The fact that the chip is written in the page counter. As far as I understand it in these chips is:
1. The number of printing on many targeted chip (I found 10K, 20K)
2. The number of printable pages
3. Region kprintera.
4 for color, he must still be responsible for the color.
My reading of the sample controller chips Samsung alas, not what happened. But I realized that chip crypto protection.
-
#23 Reply
Posted by
cciollolo
on 03 Jun, 2016 12:36
-
no , i turn on the printer and i sniff the initial trasmission that check all chips, and after turn off the printer and repeat for 24 times. the second file is the same procedure with the black cartridge chip removed . i did another test and i attach new file :
senza filo is the 3 initial check without cable off all chips
stamp pagina is the initial check with all chip connected and 2 separate page printed
cartucce mancanti is the recheck without one chip at once.
i made an attempt only with black chip to read the content inside of the chip, but after select the chip address with 0xf0 0x00 , i test to write the address of memory location , but when i read the chip answers always ff when the address is ack
-
#24 Reply
Posted by
nanofrog
on 03 Jun, 2016 13:11
-
A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?
Brother would be another.
Resetting a cartridge is nothing more than moving a gear back to it's start position. And you can refill a genuine cartridge 2- 3x w/ a reset between each refill*.
Makes them the lowest per page cost I'm aware of.
* Depending on the amount of toner the refill kit contains. Also, replace the fill cap rather than reuse or there's a serious chance it will leak, as they tend to get mangled when removing them (inexpensive & available on eBay and Amazon; new gears too, should you need them).