Bypassing Xerox Phaser 8560DN Configuration Card - Page 1
Forum section: electronics / repair

author: Ironsmith
author_rank: Newbie
timestamp: April 01, 2025, 03:48:59 am
content: Hello!First time posting, hope I'm doing this rightI recently purchased a Xerox Phaser 8560DN printer. I tried it out but it gives and error:Configuration Card InvalidService NeededFault 02,011.61:4377www.xerox.com/office/8560PsupportLooking up the code in the service manual and it indicates that the card I have is for a different model of printer:I checked the configuration card and it looks like this:Looked up that number on the card 856-8871-00 and it indicates that this is indeed for a different printer, the 8870, not my 8560.I tried booting the printer without a configuration card and it power cycles 3 times until it shows an error saying 'Configuration Card Missing'.Checking the service manual, I looked up the part ID for the card meant for my printer and searched high and low. I checked ebay, craigslist, kijiji, facebook marketplace, called Xerox, Argecy, and some local shops but I can't find this part anywhere.Has anyone had luck bypassing this configuration card completely such that the printer only uses the NVRAM copied values?Could I try reading the data on this configuration card? I don't have a reader designed for this, but I was thinking of just using some alligator clips and then maybe I can read the data on the configuration card and also read the NVRAM, then try to write some of the NVRAM data onto the configuration card if that's even possible? I know the printer uses the configuration card as a ROM but I don't know if that necessarily means I can't write to it a few times.Any guidance would be appreciated, the printer itself is in very good condition, I don't want to throw it out just because of some configuration card.

author: amyk
author_rank: Super Contributor
timestamp: April 01, 2025, 04:59:41 am
content: That is an ISO 7816 format card, which is a little worrying because it's the same format used for things like SIM cards and payment cards, which definitely have a security layer to them. The fact that it appears to be an Atmel (now Microchip) part, and they had secure microcontrollers in that format (look up Atmel CryptoMemory series) doesn't help either.However, Atmel also made EEPROMs in this format, and the '7816 contact pattern is usually distinctive, so a search online found their EEPROM cards with the same contact pattern as yours:https://www.ebay.com/itm/281964033156https://www.cardomatic.de/en/p/i2c-memory-card-512kbit-atmel-simWhile here are some others with their secure microcontroller, note the different contact pattern:https://www.ebay.com/itm/281975530473https://www.ebay.com/itm/283050477547Here are more (unbranded) '7816 cards with a secure microcontroller:https://upload.wikimedia.org/wikipedia/commons/8/80/Differentsmartcardpadlayouts.jpgIt is likely you may have an EEPROM card. A programmer that supports 24xx series should be able to read it.

author: amyk
author_rank: Super Contributor
timestamp: April 02, 2025, 12:01:39 am
content: A followup amendment - I was mistaken in assuming that your pad pattern is for a regular EEPROM card, as it appears that the secure ones can also be ordered with that pattern or a different one, and vice-versa:https://ww1.microchip.com/downloads/en/DeviceDoc/doc5044.pdf(pages 3, 6)https://ww1.microchip.com/downloads/en/DeviceDoc/doc5045.pdf(2nd-last page)To determine what you have, you'll need either a logic analyser to capture how it's accessed, or a standard ISO 7816 card reader (which will likely not detect an EEPROM correctly.)

author: cunningfellow
author_rank: Regular Contributor
timestamp: April 02, 2025, 10:32:06 pm
content: Does anyone know if the card is locked to the printer serial number?I might have one sitting around in my "dead printer storage" - I know I have about 10 phasers of varying age - I'll look when I get home.

author: Ironsmith
author_rank: Newbie
timestamp: April 06, 2025, 07:10:19 am
content: Thanks amyk and cunningfellow!Quote from: amyk on April 02, 2025, 12:01:39 amgotchya, I have a CH341A Pro (fixed) EEPROM reader, I'll try reading the card with that to determine if it's encrypted or notQuote from: cunningfellow on April 02, 2025, 10:32:06 pmI do know that the card is designed to hot-swap to other printers such that it keeps the same IP and other settings so the user doesn't need to set anything up if a printer gets replaced, so I'm pretty sure it's not locked to a serial number. If you can take a look that would be great! Let me know if you find one for my specific phaser model!

author: Ironsmith
author_rank: Newbie
timestamp: April 10, 2025, 02:15:05 am
content: I think I messed up. Tried reading the card assuming it was 24xx EEPROM. Not sure which chip to select so I went through the whole list.Initially I got some FF and 00 bytes, and as I went through the list it eventually started showing only FF, and going back to the older ones I tried it now only shows FF.Does this mean it is indeed encrypted? Or did I wipe out a perfectly fine 24xx EEPROM?

author: amyk
author_rank: Super Contributor
timestamp: April 10, 2025, 11:57:59 pm
content: Check your pinout, make sure it's correct...https://www.alldatasheet.com/datasheet-pdf/pdf/103856/ATMEL/AT24C16SC-10WI.htmlOnly 4 of the 8 pads need to be connected if it's an EEPROM - hint, look at how many pins on the machine's original socket is connected.Otherwise it could be something like this, which is sort of in-between an EEPROM and a real smartcard, as it uses 5 pins:https://www.alldatasheet.com/datasheet-pdf/pdf/92588/ATMEL/AT88SC153.html...or a real smartcard, also 5 pins:https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5211-CryptoMem-Full-Specification-Datasheet.pdfIf I were you I'd use a logic analyser (even a $5 FX2LP one would be sufficient) to see how the machine communicates with the card. That'll make it obvious what it is.Aservice manualI found for the machine shows that there's ~6KB of data stored on the card, which indicates that it should be at least 48Kbit or more - so it could be an AT24C64SC or an AT88SC6416C.