Do You Recognize This Chip?

[Old Printer]

Not sure this is the right place for this, but.. This "chip" is attached to an ink cartridge on a UV flatbed printer. The chip contains some information about the ink, like lot# - color and a serial number unique to this cartridge. The printer then recognizes that particular cartridge and keeps track of the remaining ink by estimating how much has passed through the print-head, using a formula. There is no actual, physical ink level sensor. If the printer has one of several issues, over the months the "estimated level remaining" can be very far off, like by 50%. When the printer thinks it's out of ink it shuts down and that cartridge must be replaced. That particular cartridge number forever marked "empty". If I could find out what the number is and either rewrite it or buy a blank chip and program it with a new number maybe I would not have to throw out so many 1/3 full cartridges. Can anybody help me figure this out? If I could figure out where to get a new chip the programming/reading info might be available. Thanks.

[Shonky]

You can't just "buy a new chip and reprogram it" in many cases these days. These devices are designed to be secure to force you to use genuine ink cartridges. HP is making quite a name for it recently. Presumably similar to a SIM in this case.

[ataradov]

This is just a generic contact pattern, there may be anything connected to those pads.

Generally printers manufacturers are aware of your desire to overwrite those settings, so there is not likely to be documentation or ability to program or substitute the IC.

Some printers/cartridge models have vulnerabilities, but you need to search for that info by the model name specifically. And those things get patched, which sometimes bricks printers like in a recent HP debacle.

The best approach here is to buy printers from vendors that are not greedy bastards. I hear Brother printers are really good in that respect.

[Bud]

The chip behind the contacts plate can be one of many varieties.  In terms of communication protocol they all conform to APDU standard, see here
https://en.wikipedia.org/wiki/Smart_card_application_protocol_data_unit#:~:text=A%20command%20APDU%20is%20sent,bytes%20(SW1%2C%20SW2).

You cant re-program it, programming is protected by encryption keys shared between the chip manufacturer and card personalization factory (customer like printer manufacturer in this case). Your only option is sniff the traffic and inject the desired response using a physical overlay with contacts, but this is a sizeable undertaking.

[Shonky]

You can't just sniff the output and emulate it since they are designed to provide a secure interface. Otherwise it would be trivial to clone.

[Old Printer]

OK guys, thanks for your responses. So there is no practical way to even read what is on the chip? I suppose unless it was in ASCII it would not matter anyway.

[Bud]

You can't just sniff the output and emulate it since they are designed to provide a secure interface. Otherwise it would be trivial to clone.

In general yes but in fact it depends. Overlays are being found all across the globe in ATM machines sniffing traffic.

Edit: full emulation is not needed, just intercept and alter traffic at the right moment. I will let you guess how I know.

[Bud]

OK guys, thanks for your responses. So there is no practical way to even read what is on the chip? I suppose unless it was in ASCII it would not matter anyway.

If the chip is just a memory chip with a use downcounter like we had back in 199x-early2000's phone calling cards then you can read it but can't alter it. If it is a MCU chip then likely you can't.

[amyk]

You can't just sniff the output and emulate it since they are designed to provide a secure interface. Otherwise it would be trivial to clone.

It depends what exactly they used. This looks like ISO7816 "smart card" but as others have mentioned it could be something custom or even just a regular EEPROM (e.g. AT24CxxSC).

Your particular one has a pad pattern that others have used: https://upload.wikimedia.org/wikipedia/commons/8/80/Differentsmartcardpadlayouts.jpg

In any case, get a logic analyser if you don't already have one and get some logs of what the communcation looks like. You can also try to carefully delaminate the card to get a die photo of the chip itself, which may reveal more part numbers and information.

[ataradov]

All printer/cartridge combinations are already explored in great detail, there is a good chance that it is already documented, we just need to know the model of the cartridge.

Third-party cartridges is a huge business, and they generally know what is possible to fake and what is not.

HP is willing to majorly screw their customers and brick their printers to prevent use of third-party cartridges.

[Shonky]

Good luck with the "it's just a standard smart card or maybe just an EEPROM". Maybe it was 10 or 20 years ago, but it's not any more. As noted companies like HP are actively including secure elements. The reason they are doing this is to protect their business selling consumables. They won't be leaving large holes like you suggest.

Devices like these:
https://www.microchip.com/en-us/product/atecc608a

Let us know how you go hacking one of those. I'll be impressed.

Now that said, this seems like some kind of special industrial printer. That may mean it's easier or harder than a $100 bottom of the line printer for the home.

[Old Printer]

The cartridge is from a MUTOH UV flatbed printer. As compared to a consumer product the quantities are infinitesimal, but still a product by a major corporation. We are a sign company, but these machines are in awards shops as well. This is mostly a curiosity on my part, I don't pay for the cartridges. If I were to be able to salvage these by altering or replacing the chips I would get a couple attaboys from my boss and it would be forgotten in a week. I doubt he is aware of even 25% of the wasted ink.
Anyway, I have an Analog Discovery as a LA and a Siglent 1104x-e scope and have done some programming of PIC's with a PicKit. That is the extent of my experience, but I am curious. Aren't we all
I see some numbers on some of the chips referenced by AMYK so I will see if I can trace any of those down to a part and data sheet that might shed a little light on reading and writing to them. Thanks again.

I found a visual match for my card on the Wiki page posted by AMAK, and attached a pix. If anyone can add any clues as to where I should look for further info that would be great.

[Doctorandus_P]

There is only one good solution for this.

That thing is defective by design, so bring it back to the store for a refund, and then buy something that does not have this nonsense.
I find it quite weird that selling stuff like that is even legal.

[Old Printer]

There is only one good solution for this.

That thing is defective by design, so bring it back to the store for a refund, and then buy something that does not have this nonsense.
I find it quite weird that selling stuff like that is even legal.

This is an industrial machine. The ink comes from the manufacture so there is no store. It is not a problem with the ink, but the system for monitoring it in the printer. It works pretty well when the machine is new, but as it ages, air leaks develop and throw it off kilter. The cost to rebuild an otherwise functional machine is prohibitive. This is a $25,000 printer and these are $100 inks.

[mikeselectricstuff]

As it's a low-volume product, it is possible that it's something hackable, as using more secure chips tends to involve NDAs and more development work - certainly worth some initial investigation.
If you have any "dead" chips, stripping with solvent and looking under a microscope may give some clues

[mikeselectricstuff]

Also, have you actually talked to the manufacturer about the inaccurate results? Could be this is an issue they may want to fix. Especially if you hint that you are considering buying more machines, and this issue is what's putting you off.

Or it could be they say they have to be conservative due to risk of damage if it runs dry

[Old Printer]

Also, have you actually talked to the manufacturer about the inaccurate results? Could be this is an issue they may want to fix. Especially if you hint that you are considering buying more machines, and this issue is what's putting you off.

Certainly, their response is, if the machine is functioning as designed, the system works adequately. It come down to spending a few thousand dollars to fix a $200 problem. This is our third machine of this model, so this is not a major problem, just a curiosity on my part to see if I could use a little of the electronics knowledge I have picked up to "fix" this, and maybe learn something in the process.

[Old Printer]

After some research, I have found an entire cottage industry that supports generating these cards. In the professional wide format printing industry, using "off-brand" inks is taboo. It will kill warranty's and have some techs refuse to work on a machine. All of the machines have some sort of smart-card system to prevent or make it difficult to use third party inks. It is quite possible to buy blank cards, a usb programmer and the software to write clone information to cards so they can be used when cartridges are refilled and the original card expires. Cards are only $7 but the programmer/software is $350-500. I have no interest in refilling, we don't use that much ink, so this is going nowhere. It's clear now that the big guys like Mutoh & Roland & Epson have a lot at stake here and this is not going to be a hobby hack on my part, but it was interesting. Thanks for getting me this far!

[amyk]

Yes, based on the information you've given, almost certainly "real" smartcard ICs are being used. Someone might recognise that distinctive pattern with the clever "SC" letters. It sounds like a very specialised type of printer so there's far less information about them online, and they might be a bit more secure, but nonetheless this sort of DRM is not that hard to bypass with the combined skills of everyone here:

https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/

https://www.eevblog.com/forum/reviews/dymo-550-thermal-printer-drm-hacking/

[asmi]

It's clear now that the big guys like Mutoh & Roland & Epson have a lot at stake here and this is not going to be a hobby hack on my part, but it was interesting. Thanks for getting me this far!

It's a well-known fact that printer manufacturers sell printers at cost or sometimes even below, and their main profit center is consumables. Consumer market is not very important for them as it's very cost-sensitive and so most people simply wouldn't buy a printer which requires expensive consumables (or simply keep buying new printers and using stock ink/toner which comes with device), but when it comes to devices targeted at businesses and professional users, they go above an beyond to make sure only first-party supplies are used.