Looks like an I2C eeprom from the chip pinout, so...
J1 ground
J2 SDA
J3 Vdd
J4 SCL
Looks like an I2C eeprom from the chip pinout, so...
J1 ground
J2 SDA
J3 Vdd
J4 SCL
Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact
J1 ground
J2 SCL
J3 Vdd
J4 SDA
Then I got the I2C Address : 0x78
What should now be the way to go ?
Grab a non empty cartridge and write it's contents back to the empty one...It might also be worth permanently enabling the Write Protect pin too, so that ithe EEPROM would always report "1 page printed" and not bother you in future. I've never tried it...just a thought.
The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57
$regfile = "m328pdef.dat"
$crystal = 8000000
Dim Q As Byte , T As Byte , A As Byte , E As Byte , R As Byte
Config Lcd = 16 * 2
Config Lcdpin = Pin , Rs = Portd.6 , E = Portd.3 , Db4 = Portc.0 , Db5 = Portc.1 , Db6 = Portc.2 , Db7 = Portc.3
Cursor Off
Cls
Locate 1 , 1
Lcd "Start"
Config Sda = Portd.5 'I2C Data
Config Scl = Portd.4 'I2C Clock
Wait 2
Do
Cls
For R = 0 To 127
For T = 0 To 128
I2cstart
Q = R * 2
I2cwbyte Q
I2cwbyte T
E = Q + 1
I2cstart
I2cwbyte E
I2crbyte A , Nack
I2cstop
Locate 1 , 1
Lcd Q ; " " ; T ; " Read " ; A ; " "
If A < 255 Then
Locate 2 , 1
Lcd Q ; " " ; T ; " " ; A
End If
Wait 2
Next T
Next R
Loop
End
A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?Xerox, samsung.
i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available ! :-+ >:DDid I understand you correctly??? An attempt to read the memory via a separate device ???
If they've got any sense they'll be verifying the writes.The fact that the chip is written in the page counter. As far as I understand it in these chips is:
It's weird that they'd use an FRAM and not some write-once memory. :popcorn:
A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?Brother would be another. :)
in romania some devices can be reset, but they must still contain information.of the scheme seems to be a memory but I think it was labeled with a special series.thanksOpportunity.
Hello,Hello. These chips were bought by our marketer.
igrok, where you ordered the chip??for what printer is it??I found that ic's "2850" is a TI controller in the series MSP430FR57XX.
wouldnt it be simpler to hack the printer formware to fake the check result?as far as I know, I was told, I did not check that the printer is updating the encryption algorithm from the chip. Unfortunately, I do not have a printer firmware :-//.
How?After a long training =)
Only after Lexmark agrees that the money spent on protection in vain.Dear igrok_by, I'm very glad that you have succeeded, But, could you chance, forget how it's done, or break your computer, accidentally format the hard drive. Hope for understanding.How?After a long training =)
There is no documentation for the chip. I found how it works. And now there is a solution that allows me to restart the mx/ms 410/511 chips.
I think that the others work on the same algorithm.
With respect! :)
this sounds like a paypal solution to me... I think I am saddled with this pox as well.Chinese friends offer good chips at good prices. True, these chips are clones of the original :). I was surprised when I got five chips with the same number.
http://<IPaddressOfPrinter>/se
Additionally one can finger the printer in a standard linux shell vianc <IPaddressOfPrinter> 79
and issue commands like setup, firewalld, info, history, dnstable, backend, alerts, t30logHello all. ;)
Sorry if I offended someone :'(. It turns out the goods on the Chinese site can cost 3 times more than they actually are. I complete the instruc- tion about the chip until the end of the week. I suggest that you talk again about receiving instructions.
I'm not a magician while I'm studying. The chip must not be blocked. How to do this I will describe.
Hello, I'm new to this site. I have been looking for the data sheet just like everyone else. I have a friend in Shenzhen that told me that most aftermarket sellers just silk screen on the TI046B1 on to this chip. http://www.ti.com/lit/ds/symlink/pca9515a.pdf. (http://www.ti.com/lit/ds/symlink/pca9515a.pdf.) I use a Xeltek 6100 for ghosting IC's. This is not in my data base. I do not have the chip knowledge of most on this site. Could some tell me if this IC could be the same.
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x75};
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x46, 0xBA};
uint8_t Register56[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0x01, 0xFF, 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0xA0, 0x0D, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x04, 0xC3, 0x00, 0x00, 0x00, 0x2D, 0x87};
void playOnce()
{
write_TI046B1_register(0x002, 0x02, 0x20, 0x00, Register56, 56);
write_TI046B1_register(0x002, 0x02, 0x58, 0x00, Register56, 56);
//Check :
read_TI046B1_register(0x002, 0x01, 0x00, 0x00, Buffer, 512);
read_TI046B1_register(0x002, 0x01, 0x00, 0x02, Buffer, 512);
read_TI046B1_register(0x002, 0x01, 0x00, 0x04, Buffer, 512);
read_TI046B1_register(0x002, 0x01, 0x00, 0x06, Buffer, 512);
}
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x75};
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x46, 0xBA};
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xCD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA6, 0xFF};
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0xFF 1111 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x11, 0x00, 0x01, 0x20, 0x13, 0x00, 0x61, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x05, 0x05, 0x00, 0x00, 0x00, 0x30, 0x3B};
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0x7F 0111 0xFF, 0xFF, 0x8D, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEF, 0x00, 0x00, 0x60, 0x04, 0x00, 0x69, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x01, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x04, 0xC0, 0x00, 0x00, 0x00, 0x9D, 0x9B};
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x00, 0x3F 0011 0xFF, 0xFF, 0x8C, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x23, 0x00, 0x00, 0x40, 0x03, 0x00, 0x6D, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x04, 0xC4, 0x00, 0x00, 0x00, 0x67, 0x68};
uint8_t RegisterRead_01_20_00[56] = {0xFF, 0x01, 0xFF 1111 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0xA0, 0x0D, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x04, 0xC3, 0x00, 0x00, 0x00, 0x2D, 0x87};
% dec hex
____________________
0 % 63 00 3f
10% 127 00 7f
20% 255 00 ff
30% 511 01 ff
40% 1023 03 ff
50% 2047 07 ff
60% 4095 0f ff
70% 8191 1f ff
80% 16383 3f ff
90% 32767 7f ff
100% 65535 ff ff
Hi,
Another good news for people who have "empty" cartridge with 0 pages left : it's possible to reload the chip, it's not locked (at least, not with the "starter cartridge" delivered with the printer). For this example, we successfully put the "40% left" level of the Yellow toner chip into the "0% left" magenta toner chip, and now, there is "40% magenta left" and it works.
[...]
The first program at issue is Lexmark's “Toner Loading Program,” which measures the amount of toner remaining in the cartridge based on the amount of torque (rotational force) sensed on the toner cartridge wheel. Maggs Aff. ¶ 24, JA 709. The Toner Loading Program relies upon eight program commands-“add,” “sub” (an abbreviation for subtract), “mul” (multiply), “pct” (take a percent), “jump,” “if,” “load,” and “exit”-to execute one of several mathematical equations that convert the torque reading into an approximation of toner level. Goldberg Aff. ¶ 21, JA 578; Maggs Aff. ¶ 24, JA 709. If the torque is less than a certain threshold value, the program executes one equation to calculate the toner level, and if the torque equals or exceeds that threshold, the program executes a different equation to calculate the toner level. Goldberg Aff. ¶ 19, JA 576-77. The exact code of the Toner Loading Program varies slightly for each printer model, and this case involves two versions of the program-one for Lexmark's T520 and T522 printer models and another for Lexmark's T620 and T622 printer models. The Toner Loading Program for the T520/522 printers comprises 33 program instructions and occupies 37 bytes of memory, while the Toner Loading Program for the T620/622 printers comprises 45 program commands and uses 55 bytes of memory. To illustrate the modest size of this computer program, the phrase “Lexmark International, Inc. vs. Static Control Components, Inc.” in ASCII format would occupy more memory than either version of the Toner Loading Program. Burchette Aff. ¶ 13, JA 106. The Toner Loading Program is located on a microchip contained in Lexmark's toner cartridges.
[...]
To ensure that consumers adhere to the Prebate agreement, Lexmark uses an “authentication sequence” that performs a “secret handshake” between each Lexmark printer and a microchip on each Lexmark toner cartridge. Both the printer and the chip employ a publicly available encryption algorithm known as “Secure Hash Algorigthm-1” or “SHA-1,” which calculates a “Message Authentication Code” based on data in the microchip's memory. If the code calculated by the microchip matches the code calculated by the printer, the printer functions normally. If the two values do not match, the printer returns an error message and will not operate, blocking consumers from using toner cartridges that Lexmark has not authorized
[...]
The parties agree that Lexmark's printers perform a second calculation independent of the authentication sequence. After the authentication sequence concludes, the Printer Engine Program downloads a copy of the Toner Loading Program from the toner cartridge chip onto the printer in order to measure toner levels. Before the printer runs the Toner Loading Program, it performs a “checksum operation,” a “commonly used technique” to ensure the “integrity” of the data downloaded from the toner cartridge microchip. D. Ct. Op. ¶ 77, at 14. Under this operation, the printer compares the result of a calculation performed on the data bytes of the transferred copy of the Toner Loading Program with the “checksum value” located elsewhere on the toner cartridge microchip. If the two values do not match, the printer assumes that the data was corrupted in the program download, displays an error message and ceases functioning. If the two values do match, the printer continues to operate.
[...]
Salut JacquesBBB, and driver_x !
JacquesBBB : We are using the pin description you discovered in the first page of this topic : First one (longer) is GND, second one is SCL, 3rd one is 3.3V power supply, last one is SDA.
I would like to thank you as we probably wouldn't have done all this without all the information that was already available in this thread. I wasn't even aware about 10 bit addressing existence.
Cyan, high yeld few pages printed (the chip is not original, "compatible" cartridge)
uint8_t destinationBuffer[56] = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xD7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x65, 0xDA};
Yellow, 60% (normal yeld)
uint8_t destinationBuffer[56] = {0xFF, 0x7, 0xFF, 0xFF, 0xFF, 0xF, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5B, 0x0, 0x0, 0x50, 0x10, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xAF, 0x0, 0x0, 0x0, 0xAD, 0x27};
Magenta(starter) (10%)
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x7F, 0xFF, 0xFF, 0x8D, 0xA, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xEE, 0x0, 0x0, 0x20, 0xA, 0x0, 0x6D, 0x7F, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x1, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xFF, 0xFF, 0x0, 0x0, 0xFF, 0xFF, 0x3, 0x0, 0x0, 0x3, 0xB, 0x0, 0x0, 0x0, 0x4C, 0xB5};
Cyan, starter, (empty)
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x3F, 0xFF, 0xFF, 0x8C, 0xA, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x19, 0x0, 0x0, 0x20, 0xF, 0x0, 0x69, 0x7F, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xFF, 0xFF, 0x0, 0x0, 0xFF, 0xFF, 0x3, 0x0, 0x0, 0x3, 0xC, 0x0, 0x0, 0x0, 0x9A, 0x5B};
There is some last issue, after few prints, it's like if cartridge is finding back it's previous level (magenta is empty again, cyan is in "warning almost empty status" again, even with a cartridge full of toner so it's not likely to be due to a physical sensor). May be another place to modify ?It might not be this exact printer/model but I remember there being mentions of printers storing the data from the last X cartridges in its own EEPROM. You should try changing the serial number since that's what it uses to detect "simple" reset attempts like these.
uint8_t Register56Cyan[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x69, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD3, 0xA2};
uint8_t Register56Mage[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6D, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC4, 0x90};
Byte 1 : 0xFF everywhere
Bytes 2 and 3 : 0xFFFF is full, 0x7FFF after 2 or 3 pages, 0x003F : 0%, 0x007F : 10~20%, 0x01FF for 40%, 0x07FF for 60%,
Bytes 4 and 5 : 0xFF everywhere
Byte 6 : 0x1F for Full or almost full, 0x8C for empty, 0x8D for almost empty with warning sign, 0x0F seen for 30% 40% and 60%.
Byte 7 : 0x0A for starter kits, 0x00 for others
Bytes 8 to 14 : 0xFF then 0x00, 0x00... everywhere
Byte 15 and 16 : printed pages : 0x0000 for new
Bytes 17 18 19 20 : 0x00 for the first byte everywhere, then 0x??, 0x??, 0x?? depending on cartridge. Non proportionnal. 0x00000000 when new or almost new
Bytes 21 22 23 24 : 0x00 then 3 bytes depending on the cartridge model
back starter : 0x00 61 7F FF
cyan starter : 0x00 69 7F FF
magenta starter: 0x00 6D 7F FF
yellow starter: 0x00 63 7F FF
magenta 71B20M0 : 0x00 C0 00 00
magenta 802HME : 0x00 CD 00 00
cyan high yield for CS310dn : 0x00 D7 00 00
yellow normal yield for CS310dn : 0x00 52 00 00
don't forget to double check when you can, and add new ones when you have !
Bytes 25 26 27 28 : 0x00 00 00 00 everywhere
Bytes 29 and 30 : 0x0000 when new or >= 30%, 0x01 90 (=400) or 0x011D (=285) when warning low level. Final count down rising as approaching the end ?
Bytes 31 32 33 34 35 36 37 38 39 40 : 0x 00000... everywhere
Byte 41 and 42 : 0xFFFF for starter kits, 0x0000 if not starter kit
Byte 43 and 44 : 0x0000 everywhere
Byte 45 and 46 : 0xFFFF for starter kits, 0x0000 if not starter kit
Byte 47 : 0x00 if not used, seen at 0x01 on 2 pages printed, seen as 0x02 if >3 pages, seen at 0x03 when almost (or completely empty)
Byte 48 and 49 : 0x0000 everywhere
Byte 50 and 51 : 0x0000 = new, 0x0001 = few usage, 00AF = ~60%, 0x04C3 = ~40%, 0x0505 = ~30%, 030B and 04C0 = low, 0x04C4 and 0x030C : empty... so when level is low, it's imprevisible
Byte 52 53 54 : 0x00 00 00 everywhere
Byte 55 and 56 : CRC16 Checksum of the 54 previous bytes
uint8_t Register56Black[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x61, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFD, 0xC6};
uint8_t Register56Yellow[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF6, 0x5F};
But it should be tested; if it does not work, then we should check the checksum or the cartridge type bytes.Black starter - empty:
uint8_t destinationBuffer[56] = {0xFF, 0x0, 0x3F, 0xFF, 0xFF, 0xC, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xF5, 0x0, 0x0, 0x60, 0x15, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x88, 0x0, 0x0, 0x0, 0x0, 0x67};
Black- High Yeld ~90%:
uint8_t destinationBuffer[56] = {0xFF, 0x1F, 0xFF, 0xFF, 0xFF, 0xF, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xB0, 0x0, 0x0, 0xD0, 0xB, 0x0, 0xD1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, 0xBC, 0x15};
"The sensor S may take the form of a mechanical sensor that detects torque required to turn an auger positioned in the reservoir, an optical sensor that uses light to measure the amount of toner, or any other sensor configuration that provides feedback regarding the amount of toner remaining in the reservoir."https://patents.google.com/patent/US7747180?oq=lexmark+toner+level
All changes to the cartridge dump must be signed by a hash that is stored in the dump since the 0x700 offset. Reading and modifying the hash is via sending 14 bytes to register 81. And only after decoding the requests in the 81 register and the responses to register 80 it will be possible to fully restore the chips.
Hello friends!Всем, Привет!
Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?
Regards!
Немного исправил рисунок
I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.
is a chip reset to new?Yes. But when the chip was reset, the programmer gave an error. I can check the chip later.
А кто нибудь может сказать почему чтением в скетче 01> 20> 00 получается 56 байт, а программатором видно что читается 8 байт? Это от чипа зависит или от чего-то другого?Я читаю своим программатором строки по 16 байт и у меня проблемы не возникают
I do not speak english. I use Google translate.
The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.
-------------------------------------------------------------------------------------------------------------
BLOCKED CHIP
-------------------------------------------------------------------------------------------------------------
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00
-------------------------------------------------------------------------------------------------------------
NEW CHIP
-------------------------------------------------------------------------------------------------------------
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: C8
Send: 0x80 | Response: 00 00 00 00 00 00 5A06 00 00 00 00 00 00 00 80
More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...Please give your sketch.
More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...Please give your sketch.
I have 5 chips locked and 3 chips not locked.
I can check with your sketch sooner.
#include "twi-all-included.h"
void setup()
{
Serial.begin(9600); //[Start+8bits+STOP] => 960 o/s
twi_init(); //Standard 100 kHz Atmel's internal I2C device initialisation with Pull-Up on SDA/SCL
}
void read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom)
{
uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSB
uint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB
//Put the MSB bits to the Left :
slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003
//7 bits address equivalent for the begining :
uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.
//Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.
uint8_t txBuffer[registerSize + 1];
for(uint8_t i = 0; i < sizeof(txBuffer); i++)
{
if(i==0)
{
txBuffer[i] = slave_address_LSB;
}
else
{
txBuffer[i] = registerBuffer[i-1];
}
}
uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);
if (nRet == 1)
{
//it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
//Serial.println("Error occured wile trying to write to the slave : TWI class's buffer is too small");
Serial.println("W1");
return;
}
else if (nRet == 2)
{
//it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
//Serial.println("Error occured wile trying to write to the slave : Slave's address not acknowldged (begning only) - is it connected ?");
Serial.println("W2");
return;
}
else if (nRet == 3)
{
//it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
//Serial.println("Error occured wile trying to write to the slave :");
//Serial.println("Slaves's begining of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?");
Serial.println("W3");
return;
}
else if (nRet == 4)
{
//it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().
//Serial.println("I2C protocol error occured wile trying to write to the slave. Is the wiring correct ? TWI Initialisation ?");
Serial.println("W4");
return;
}
//else :
nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end.
if (nRet == 0x00)
{
//Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.
//Serial.println("Error occured wile trying to read from the slave.");
Serial.println("R1");
return;
}
if (nRet != readSize)
{
//Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.
Serial.print("Unable to read all the bytes from the slave : ");
Serial.print(nRet, DEC);
Serial.println(" bytes read");
return;
}
//else :
for (uint16_t i=0; i<readSize; i++)
{
//Serial.print("0x");
if (destinationBuffer[i] < 0x10)
{
Serial.print(0, HEX);
Serial.print(destinationBuffer[i], HEX);
}
else
{
Serial.print(destinationBuffer[i], HEX);
}
}
Serial.println("");
}
//Delcopi sequence obtained from "Log_MX410" by Technics66
uint8_t a[1] = {0x03};
uint8_t a_[1];
uint8_t b[1] = {0x83};
uint8_t b_[1];
uint8_t c[3] = {0x01,0x50,0x04};
uint8_t c_[16];
uint8_t d[1] = {0x82};
uint8_t d_[1];
uint8_t e[2] = {0x81, 0x08};
uint8_t e_[1];
uint8_t f[1] = {0x82};
uint8_t f_[1];
uint8_t g[15] = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};
uint8_t g_[1];
uint8_t h[1] = {0x82};
uint8_t h_[1];
uint8_t i[1] = {0x80};
uint8_t i_[16];
void loop()
{
char command = getCommand();
switch (command)
{
case 'a':
Serial.print("Send: 0x03 | Response: ");
//read_TI046B1_register(ADDR, CMD, sizeof(CMD), BUFFER_RESPONSE, sizeof(BUFFER_RESPONSE), STOPCOM 1|0);
read_TI046B1_register(0x000, a, sizeof(a), a_, sizeof(a_), 0);
break;
case 'b':
Serial.print("Send: 0x83 | Response: ");
read_TI046B1_register(0x000, b, sizeof(b), b_, sizeof(b_), 0);
break;
case 'c':
Serial.print("Send: 0x01,0x50,0x04 | Response: ");
read_TI046B1_register(0x000, c, sizeof(c), c_, sizeof(c_), 0);
break;
case 'd':
Serial.print("Send: 0x82 | Response: ");
read_TI046B1_register(0x000, d, sizeof(d), d_, sizeof(d_), 0);
break;
case 'e':
Serial.print("Send: 0x81, 0x08 | Response: ");
read_TI046B1_register(0x000, e, sizeof(e), e_, sizeof(e_), 1);
break;
case 'f':
Serial.print("Send: 0x82 | Response: ");
read_TI046B1_register(0x000, f, sizeof(f), f_, sizeof(f_), 0);
break;
case 'g':
Serial.print("Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: ");
read_TI046B1_register(0x000, g, sizeof(g), g_, sizeof(g_), 1);
break;
case 'h':
Serial.print("Send: 0x82 | Response: ");
read_TI046B1_register(0x000, h, sizeof(h), h_, sizeof(h_), 0);
break;
case 'i':
Serial.print("Send: 0x80 | Response: ");
read_TI046B1_register(0x000, i, sizeof(i), i_, sizeof(i_), 0);
break;
}
}
char getCommand()
{
char c = '\0';
if (Serial.available())
{
c = Serial.read();
}
return c;
}
------ UnBlock-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0D40116CBB70880CDB38A
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0C7017B0EE30DF199F38B
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0F0015709189211715C84
-----Block-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01940050323446313338320000000905
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
//In variables
uint8_t k[3] = {0x01, 0x00, 0x00};
uint8_t k_[1024];
uint8_t l[3] = {0x01, 0x00, 0x04};
uint8_t l_[1024];
//In "switch" function
case 'k':
Serial.print("Send: 0x01, 0x00, 0x00 | Dump1: ");
read_TI046B1_register(0x000, k, sizeof(k), k_, sizeof(k_), 0);
break;
case 'l':
Serial.print("Send: 0x01, 0x00, 0x04 | Dump2: ");
read_TI046B1_register(0x000, l, sizeof(l), l_, sizeof(l_), 0);
break;
Alan.B
Sorry. I did not understand that I should enter a, b, c, d ... The sketch works.Code: [Select]------ UnBlock-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0D40116CBB70880CDB38A
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0C7017B0EE30DF199F38B
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 88
Send: 0x80 | Response: BD98F565CCE0F0015709189211715C84
-----Block-----
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
---
Send: 0x03 | Response: 00
Send: 0x83 | Response: F0
Send: 0x01,0x50,0x04 | Response: 01940050323446313338320000000905
Send: 0x82 | Response: 38
Send: 0x81, 0x08 | Response: FF
Send: 0x82 | Response: 48
Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FF
Send: 0x82 | Response: 98
Send: 0x80 | Response: 00000000000000000000000000000000
The programmer DelCopi badly flushes the chip. He writes that 500 pages are printed. >:(
Мemory addresses where the information:
0x00E1-0x00E2 Number of pages printed //0x16, 0x32 (5682 pages)
0x0440-0x044B Serial number //0x43, 0x41, 0x44, 0x31, 0x37, 0x33, 0x31, 0x38, 0x31, 0x35, 0x34, 0x33 (CAD173181543)
0x0453-0x045A Model //0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x33 (P24F0003)
0x045F-0x0460 Volume of the cartridge //0x13, 0x88 (5000)
Attaching dump chips. In the name "reset" this chip was dropped and after that printed.
I noticed that 0x0C0-0FF = 0x110-0x14F.
Number of pages printed 0x131, 0x132
#include "twi-all-included.h"
void setup()
{
Serial.begin(9600);
twi_init();
}
bool read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom)
{
uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSB
uint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB
//Put the MSB bits to the Left :
slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003
//7 bits address equivalent for the begining :
uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.
//Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.
uint8_t txBuffer[registerSize + 1];
for(uint8_t i = 0; i < sizeof(txBuffer); i++)
{
if(i==0)
{
txBuffer[i] = slave_address_LSB;
}
else
{
txBuffer[i] = registerBuffer[i-1];
}
}
uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);
if (nRet == 1)
{
Serial.println("W1");
return;
}
else if (nRet == 2)
{
Serial.println("W2");
return;
}
else if (nRet == 3)
{
Serial.println("W3");
return;
}
else if (nRet == 4)
{
Serial.println("W4");
return;
}
nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end.
if (nRet == 0x00)
{
Serial.println("R1");
return;
}
if (nRet != readSize)
{
Serial.println("R2");
return;
}
if (nRet == readSize)
{
for (uint16_t i=0; i<readSize; i++)
{
//Serial.print("0x");
if (destinationBuffer[i] < 0x10)
{
Serial.print(0, HEX);
Serial.print(destinationBuffer[i], HEX);
}
else
{
Serial.print(destinationBuffer[i], HEX);
}
if(i != readSize) Serial.print(" ");
}
Serial.println("");
return true;
}
}
//DelCopi Secuence
uint16_t a_ = 1, b_ = 1, c_ = 16, d_ = 1, e_ = 1, f_ = 1, g_ = 1, h_ = 1, i_ = 16, k_ = 1024, l_ = 1024;
uint8_t a[1] = {0x03};
uint8_t b[1] = {0x83};
uint8_t c[3] = {0x01,0x50,0x04};
uint8_t d[1] = {0x82};
uint8_t e[2] = {0x81, 0x08};
uint8_t f[1] = {0x82};
uint8_t g[15] = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};
uint8_t h[1] = {0x82};
uint8_t i[1] = {0x80};
//Full Dump!
uint8_t k[3] = {0x01, 0x00, 0x00};
uint8_t l[3] = {0x01, 0x00, 0x04};
//One Buffer for all!
uint8_t rxBuffer[1024];
void loop()
{
char command = getCommand();
switch (command)
{
case 't': //Test Chip
Serial.print("Send: 03 \t\t\t\t\t\t| Response: ");
read_TI046B1_register(0x000, a, sizeof(a), rxBuffer, a_, 0);
Serial.print("Send: 83 \t\t\t\t\t\t| Response: ");
read_TI046B1_register(0x000, b, sizeof(b), rxBuffer, b_, 0);
Serial.print("Send: 01 50 04 \t\t\t\t\t\t| Response: ");
read_TI046B1_register(0x000, c, sizeof(c), rxBuffer, c_, 0);
Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
read_TI046B1_register(0x000, d, sizeof(d), rxBuffer, d_, 0);
Serial.print("Send: 81 08 \t\t\t\t\t\t| Response: ");
read_TI046B1_register(0x000, e, sizeof(e), rxBuffer, e_, 1);
Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
read_TI046B1_register(0x000, f, sizeof(f), rxBuffer, f_, 0);
Serial.print("Send: 81 4E 86 61 AE 96 54 C2 31 FA C6 2D 53 74 35 \t| Response: ");//81 4E 86 61 AE 96 54 C2 31 FA C6 2D 53 74 35
read_TI046B1_register(0x000, g, sizeof(g), rxBuffer, g_, 1);
Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");
read_TI046B1_register(0x000, h, sizeof(h), rxBuffer, h_, 0);
Serial.print("Send: 80 \t\t\t\t\t\t| Response: ");
read_TI046B1_register(0x000, i, sizeof(i), rxBuffer, i_, 0);
Serial.println("");
break;
case 'd': //Dump Chip
Serial.print("Full Dump: ");
read_TI046B1_register(0x000, k, sizeof(k), rxBuffer, k_, 0);
read_TI046B1_register(0x000, l, sizeof(l), rxBuffer, l_, 0);
Serial.println("");
break;
}
}
char getCommand()
{
char c = '\0';
if (Serial.available())
{
c = Serial.read();
}
return c;
}
uint16_t crc16(const uint8_t* data_p, uint8_t length)
{
uint8_t x;
uint16_t crc = 0xFFFF;
while (length--)
{
x = crc >> 8 ^ *data_p++;
x ^= x >> 4;
crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
}
return crc;
}
Computed that 3 blocks and not 5.Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.
UPD.
Using the code for calculating the checksumCode: [Select]uint16_t crc16(const uint8_t* data_p, uint8_t length)
Computed that 3 blocks and not 5.
{
uint8_t x;
uint16_t crc = 0xFFFF;
while (length--)
{
x = crc >> 8 ^ *data_p++;
x ^= x >> 4;
crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
}
return crc;
}
1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)
3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2
I will write a sketch for resetting the chip.
Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.
UPD.
Using the code for calculating the checksumCode: [Select]uint16_t crc16(const uint8_t* data_p, uint8_t length)
Computed that 3 blocks and not 5.
{
uint8_t x;
uint16_t crc = 0xFFFF;
while (length--)
{
x = crc >> 8 ^ *data_p++;
x ^= x >> 4;
crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);
}
return crc;
}
1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)
2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)
3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2
I will write a sketch for resetting the chip.
Technics66:
Analyzing your dumps, I saw that by inserting the cartridge with the new chip, the printer makes changes to the serial number ... Could you connect the analyzer and take data from all this? I was left without the printer, it was from a client, but I want to continue with the investigation.
I attach your dumps, I turned them into bin.
Regards!
- 0x82 is a kind of Status Register that the printers reads before asking anything else.
- status 0x38 is "nothing more to say, please enter something into 0x81"
- status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)
- status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08
- status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)
- status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x09
- 0x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second time
Registers that are being write :
- 0x04 is the first register that is called on each cartridge, with a Stop occuring during ACK (there is no ACK or NACK bit), followed by a useless start stop, observed by oscilloscope too. Let's guess this is useless. But it's common to the 5 cartridges (well, 4 cartridge and 1 imaging drum).
- 0x81 is the only one register that is written after closing the lid. It's a command register that influences the status register (0x82) and define what will be read into 0x80. We can see single byte writes on it (0x08 or 0x09) for selecting what looks like a mode, then a 14 bytes question write (with something that looks like it's totally unpredictable) before being able to read 16 bytes into 0x80 (16 bytes that also looks like they are totally unpredictable).
Hi!First 32 bytes and last 256 are just a series of 00 F7, at least in my dump, here's the map I've made:
The first 2 bytes are overwritten and they encrypt the first 32 bytes and the last 256 bytes.
verified personally ;)
What is strange is that after resetting the 56 and 208 registers of a empty cartridge, of course that the printer is telling me to replace it and it does not take in consideration the information stored in the chip, as it is displaying the same number of printed pages, install date etc as they were before the resetting :((.The printer probably memorises the serials of the last X cartridges (https://haveblue.org/?p=938).
Just an update.I think we must have a sticky thread with the information we have found so far , because i see we are reinventing the wheel with each post:)
I rewrote the all first 1024 bytes from a new Drum unit to a Used board and the unit is now giving me an "Imaging unit unsupported" error rather than "Imaging unit defective".
Step in the right direction but still no luck, I suspect that the device is checking for a CRC somewhere or the 2nd set of 1024 bytes holds part number information and the used board that was overwritten was a "Black only" imaging unit rather than "Black and Colour".
osikey Magenta Toner, serial CAH163060CDA valid 1, id 1:
partNumber 38CSL14M, deviceID 65399522, pageCountValid 1, pageCount 801.
pageRemainValid 1, pageRemain 1400.
maxCapacity 1400, maxCapacityPages 1400, level 10.
maxLevel 10, minLevel 0, increments 10%, SUPPLY_STATUS 0.
SUPPLY_OSIGAUGE_TYPE 2, SUPPLY_EMAIL_TYPE 0
Levels:
SUPPLY_EARLYWARN => LevelOn 1, LevelActive 0, TriggerValue 4, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1273, behid 0x126e, behav 0.
SUPPLY_NEARLYLOW => LevelOn 1, LevelActive 0, TriggerValue 3, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1274, behid 0x126f, behav 0.
SUPPLY_LOW => LevelOn 1, LevelActive 0, TriggerValue 2, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1579, behid 0x1270, behav 2.
SUPPLY_NEARLYEMPTY => LevelOn 1, LevelActive 0, TriggerValue 1, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1275, behid 0x1271, behav 2.
SUPPLY_EMPTY => LevelOn 1, LevelActive 0, TriggerValue 0, LevelMax 0, LevelMin 0, Behaviors 0x02, levid 0xffff, behid 0x1272, behav 4.
type 2, prebate 2, refilled 2, afterMarket 0, carttype 0, menuPageSupport 0.
installed INST, supported 1, ignoreMsgNotSupported 0, serialNumberIsReal 1
dataValid 1, firstPercentReported 100, region 0, genuine 1, exposed 2, non-genuine IR 2
flags:
ignoreLevelWrnOnce 0
supplyHasWarning 0, supplyHasIntervention 0, supplyHasNonContinueIntervention 0
supplyGetConditionTextId 75577 (OK).
Start Byte | End Byte | Description |
0 | 14 | Toner usage in steps |
15 | 18 | Filled with zero |
19 | 30 | Serial number of the Imaging Kit |
31 | 36 | Date, maybe install date |
37 | 44 | Printer serial number |
45 | 46 | Filled with zero |
47 | 48 | Unknown data |
49 | 50 | Filled with zero |
51 | 56 | Date, probably date of first warning? |
57 | 64 | Printer serial number |
65 | 66 | Probably page count at the date stored before |
67 | 68 | Filled with zero |
69 | 70 | Unknown data |
71 | 76 | Date, probably date depleted? |
77 | 84 | Printer serial number |
85 | 86 | Probably page count at the date stored before |
87 | 88 | Zero |
89 | 90 | Unknown data |
91 | 99 | Unknown data, values from 1 to 6 observed in each byte |
100 | 110 | Zero |
111 | 111 | A0 for starter kits, 00 for the others |
112 | 114 | Zero |
115 | 116 | Unknown data, seems to increase with as the cartridge gets depleted |
117 | 118 | Zero |
119 | 120 | Unknown data, seems to increase with as the cartridge gets depleted |
121 | 122 | Zero |
123 | 124 | Unknown data, seems to increase with as the cartridge gets depleted |
125 | 126 | Zero |
127 | 128 | Unknown data, seems to increase with as the cartridge gets depleted |
129 | 129 | 34 for starters, 00 for the others |
130 | 144 | Printer Name |
145 | 168 | Zero |
169 | 198 | Unknown data, does not modify over time, maybe some kind of ID |
199 | 205 | Zero |
206 | 207 | CRC |
Baud Rate 2400
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x38};
Write 0x09 in 0x81 Register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x49};
Write question in 0x81 register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x89};
Read 0x80 Register
uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0x80, 0x80, 0x31, 0x54, 0xBF, 0xB6, 0xD9, 0x8E};
Baud Rate 19200
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
Write 0x09 in 0x81 Register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
Write question in 0x81 register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x89};!!!!!!!!!!
Read 0x80 Register
uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0xD, 0xF1, 0xE3, 0xE9, 0x91, 0x71, 0xA1, 0x83};
****reset arduino***
Baud Rate 19200
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x38};
Write 0x09 in 0x81 Register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x49};
Write question in 0x81 register
Write OK
Read 0x82 Register
uint8_t destinationBuffer[1] = {0x59};!!!!!!!!!!
Read 0x80 Register
uint8_t destinationBuffer[16] = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0xCD, 0x1A, 0xA6, 0xE9, 0x3E, 0xCA, 0xD2, 0x8A};
Hi guys,
I've been observing this thread ever since I bought my CS417DN a few months ago.
It is very interesting to see the progress that you have made.
It certainly goes beyond my expertise. ;)
Thats why I have a different proposal on dealing with this: Has anyone tried checking out those reset/replacement chips which you can get?
Maybe for those we are able to read them out fully and then copy that to the original chips?
Look forward to hearing your thoughts.
Hello friends!
Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?
Regards!
I don't understand why do you need to mess with toner cartridge chips?
I think a better way to modify printer firmware. Reset of toner chip is useful if you are in toner refill business. :-)
Sent from my SM-G610F using Tapatalk
You can download firmware from Dell website ... I can help you with reverse engineering tools :-)I am really interested by that !, I have downloaded the original firmware from here : https://downloads.dell.com/FOLDER05088145M/1/B2360%20P022%20Firmware.zip, so please help me with your golden skills, I am ready now to follow your instructions :)
Sent from my SM-G610F using Tapatalk
A vacuum cleaner is good for the last remains.
Hello nouvelle_adr, Nothing wrong with the sketch and it is created by a genuis. Well your pull resistors should by connected to postive +5v not negative -5v. 18K is a right stuff if you're not using you may blow the chip.
The sketch is working like a charm and if you can modify the sketch you can read anything related to TI046B1 Chip wheater a cartridge or imaging as well as fuser.
If you wanna reset a chip it shouldn't say zero pages left. Not applies to starter cartridges & in this forum it was stated a suceess but i didn't try. Reset only worked well if you have 5% or even 1% left cartridge. Zero is a total failure.
Good luck.
Hello buddy, according to 18k pull up setup cartridge chip needs 5V. I’ve tried 3.3v it wouldn't work. Anyway, you're using arduino leonardo which doesn’t have enough memory to run the original sketch I believe. What i'm using arduino mega 2560 which has 4kb EEPROM
I've attached the diagram & also a simplified sketch of my version. Hopefully you'll win this time but all credits should go to the big boss.
Cheers!
You got it right. At the beginning i had a lot of challenges finally I got it work.
FYI: remember error messages according to the sketch should be displayed error messages like below
( "Error occured wile trying to write to the slave : Slave's address not acknowledged (beginning only) - is it connected ?")
("Error occurred wile trying to write to the slave : TWI class's buffer is too small")
("Error occurred wile trying to write to the slave :")
("Slaves’ beginning of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?")
("I2C protocol error occurred wile trying to write to the slave. Is the wiring correct ? TWI Initialization ?")
if you wouldn’t see none of the error messages then you should consider buying Aruduino Mega 2560. The existing board is not suitable for this project.
Have you tried the sketch i posted?
You got it right. At the beginning i had a lot of challenges finally I got it work.
FYI: remember error messages according to the sketch should be displayed error messages like below
( "Error occured wile trying to write to the slave : Slave's address not acknowledged (beginning only) - is it connected ?")
("Error occurred wile trying to write to the slave : TWI class's buffer is too small")
("Error occurred wile trying to write to the slave :")
("Slaves’ beginning of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?")
("I2C protocol error occurred wile trying to write to the slave. Is the wiring correct ? TWI Initialization ?")
if you wouldn’t see none of the error messages then you should consider buying Aruduino Mega 2560. The existing board is not suitable for this project.
Have you tried the sketch i posted?
You got it right. At the beginning i had a lot of challenges finally I got it work.
FYI: remember error messages according to the sketch should be displayed error messages like below
( "Error occured wile trying to write to the slave : Slave's address not acknowledged (beginning only) - is it connected ?")
("Error occurred wile trying to write to the slave : TWI class's buffer is too small")
("Error occurred wile trying to write to the slave :")
("Slaves’ beginning of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?")
("I2C protocol error occurred wile trying to write to the slave. Is the wiring correct ? TWI Initialization ?")
if you wouldn’t see none of the error messages then you should consider buying Aruduino Mega 2560. The existing board is not suitable for this project.
Have you tried the sketch i posted?
thank you for all these important information :-+ !
I will try the new sketch and inform you
Hello,
I writed a dump, codes from 20 to F0, from 100% new chip on a 2% old chip, and printer say incorect cartridge !
After that, I copied 20 to 30 address back in, and printer say incorect cartridge !
I wrote back the dump from the old chip, and printer say replace cartridge ! Not 2% !!!! :(
What can I do ?
Привет.
Подскажите скейтч для Arduino 2560 для прошивки чипа Lexmarx ms410. Буду благодарен.
I"m need library from arduino twi-all-included.h. from comucation chips Lexmark Ti 046b1 I2C.
#include "twi-all-included.h"
#include "Wire.h"
extern "C" {
#include "utility/twi.h" // from Wire library, so we can do bus scanning
}
I have full code to reset lexmark and konica toner and drum black onlyShare?
Grab a non empty cartridge and write it's contents back to the empty one, and see the differences in the data as well. Print a few pages and see how the data changes, which might give enough data to simply reset the count, or make it look full again when refilled.