Do You Recognize This Chip? - Page 1
Forum section: electronics / general

author: Old Printer
author_rank: Frequent Contributor
timestamp: August 14, 2023, 08:37:48 pm
content: Not sure this is the right place for this, but.. This "chip" is attached to an ink cartridge on a UV flatbed printer. The chip contains some information about the ink, like lot# - color and a serial number unique to this cartridge. The printer then recognizes that particular cartridge and keeps track of the remaining ink by estimating how much has passed through the print-head, using a formula. There is no actual, physical ink level sensor. If the printer has one of several issues, over the months the "estimated level remaining" can be very far off, like by 50%. When the printer thinks it's out of ink it shuts down and that cartridge must be replaced. That particular cartridge number forever marked "empty". If I could find out what the number is and either rewrite it or buy a blank chip and program it with a new number maybe I would not have to throw out so many 1/3 full cartridges. Can anybody help me figure this out? If I could figure out where to get a new chip the programming/reading info might be available. Thanks.

author: Shonky
author_rank: Frequent Contributor
timestamp: August 14, 2023, 09:01:23 pm
content: You can't just "buy a new chip and reprogram it" in many cases these days. These devices are designed to be secure to force you to use genuine ink cartridges. HP is making quite a name for it recently. Presumably similar to a SIM in this case.

author: ataradov
author_rank: Super Contributor
timestamp: August 14, 2023, 09:03:45 pm
content: This is just a generic contact pattern, there may be anything connected to those pads.Generally printers manufacturers are aware of your desire to overwrite those settings, so there is not likely to be documentation or ability to program or substitute the IC.Some printers/cartridge models have vulnerabilities, but you need to search for that info by the model name specifically. And those things get patched, which sometimes bricks printers like in a recent HP debacle.The best approach here is to buy printers from vendors that are not greedy bastards. I hear Brother printers are really good in that respect.

author: Bud
author_rank: Super Contributor
timestamp: August 14, 2023, 09:10:51 pm
content: The chip behind the contacts plate can be one of many varieties. In terms of communication protocol they all conform to APDU standard, see herehttps://en.wikipedia.org/wiki/Smart_card_application_protocol_data_unit#:~:text=A%20command%20APDU%20is%20sent,bytes%20(SW1%2C%20SW2).You cant re-program it, programming is protected by encryption keys shared between the chip manufacturer and card personalization factory (customer like printer manufacturer in this case). Your only option is sniff the traffic and inject the desired response using a physical overlay with contacts, but this is a sizeable undertaking.

author: Shonky
author_rank: Frequent Contributor
timestamp: August 14, 2023, 09:21:57 pm
content: You can't just sniff the output and emulate it since they are designed to provide a secure interface. Otherwise it would be trivial to clone.

author: Old Printer
author_rank: Frequent Contributor
timestamp: August 14, 2023, 09:31:38 pm
content: OK guys, thanks for your responses. So there is no practical way to even read what is on the chip? I suppose unless it was in ASCII it would not matter anyway.

author: Bud
author_rank: Super Contributor
timestamp: August 14, 2023, 09:33:11 pm
content: Quote from: Shonky on August 14, 2023, 09:21:57 pmIn general yes but in fact it depends. Overlays are being found all across the globe in ATM machines sniffing traffic.Edit: full emulation is not needed, just intercept and alter traffic at the right moment. I will let you guess how I know.

author: Bud
author_rank: Super Contributor
timestamp: August 14, 2023, 09:38:23 pm
content: Quote from: Old Printer on August 14, 2023, 09:31:38 pmIf the chip is just a memory chip with a use downcounter like we had back in 199x-early2000's phone calling cards then you can read it but can't alter it. If it is a MCU chip then likely you can't.

author: amyk
author_rank: Super Contributor
timestamp: August 15, 2023, 03:55:37 am
content: Quote from: Shonky on August 14, 2023, 09:21:57 pmIt depends what exactly they used. This looks like ISO7816 "smart card" but as others have mentioned it could be something custom or even just a regular EEPROM (e.g. AT24CxxSC).Your particular one has a pad pattern that others have used:https://upload.wikimedia.org/wikipedia/commons/8/80/Differentsmartcardpadlayouts.jpgIn any case, get a logic analyser if you don't already have one and get some logs of what the communcation looks like. You can also try to carefully delaminate the card to get a die photo of the chip itself, which may reveal more part numbers and information.

author: ataradov
author_rank: Super Contributor
timestamp: August 15, 2023, 04:16:32 am
content: All printer/cartridge combinations are already explored in great detail, there is a good chance that it is already documented, we just need to know the model of the cartridge.Third-party cartridges is a huge business, and they generally know what is possible to fake and what is not.HP is willing to majorly screw their customers and brick their printers to prevent use of third-party cartridges.

author: Shonky
author_rank: Frequent Contributor
timestamp: August 15, 2023, 07:23:10 am
content: Good luck with the "it's just a standard smart card or maybe just an EEPROM". Maybe it was 10 or 20 years ago, but it's not any more. As noted companies like HP are actively including secure elements. The reason they are doing this is to protect their business selling consumables. They won't be leaving large holes like you suggest.Devices like these:https://www.microchip.com/en-us/product/atecc608aLet us know how you go hacking one of those. I'll be impressed.Now that said, this seems like some kind of special industrial printer. That may mean it's easier or harder than a $100 bottom of the line printer for the home.

author: Old Printer
author_rank: Frequent Contributor
timestamp: August 15, 2023, 12:32:23 pm
content: The cartridge is from a MUTOH UV flatbed printer. As compared to a consumer product the quantities are infinitesimal, but still a product by a major corporation. We are a sign company, but these machines are in awards shops as well. This is mostly a curiosity on my part, I don't pay for the cartridges. If I were to be able to salvage these by altering or replacing the chips I would get a couple attaboys from my boss and it would be forgotten in a week. I doubt he is aware of even 25% of the wasted ink.Anyway, I have an Analog Discovery as a LA and a Siglent 1104x-e scope and have done some programming of PIC's with a PicKit. That is the extent of my experience, but I am curious. Aren't we allI see some numbers on some of the chips referenced by AMYK so I will see if I can trace any of those down to a part and data sheet that might shed a little light on reading and writing to them. Thanks again.I found a visual match for my card on the Wiki page posted by AMAK, and attached a pix. If anyone can add any clues as to where I should look for further info that would be great.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: August 15, 2023, 12:53:29 pm
content: There is only one good solution for this.That thing is defective by design, so bring it back to the store for a refund, and then buy something that does not have this nonsense.I find it quite weird that selling stuff like that is even legal.

author: Old Printer
author_rank: Frequent Contributor
timestamp: August 15, 2023, 01:00:16 pm
content: Quote from: Doctorandus_P on August 15, 2023, 12:53:29 pmThis is an industrial machine. The ink comes from the manufacture so there is no store. It is not a problem with the ink, but the system for monitoring it in the printer. It works pretty well when the machine is new, but as it ages, air leaks develop and throw it off kilter. The cost to rebuild an otherwise functional machine is prohibitive. This is a $25,000 printer and these are $100 inks.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 15, 2023, 01:04:53 pm
content: As it's a low-volume product, it is possible that it's something hackable, as using more secure chips tends to involve NDAs and more development work - certainly worth some initial investigation.If you have any "dead" chips, stripping with solvent and looking under a microscope may give some clues

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 15, 2023, 01:07:07 pm
content: Also, have you actually talked to the manufacturer about the inaccurate results? Could be this is an issue they may want to fix. Especially if you hint that you are considering buying more machines, and this issue is what's putting you off.Or it could be they say they have to be conservative due to risk of damage if it runs dry

author: Old Printer
author_rank: Frequent Contributor
timestamp: August 15, 2023, 01:46:25 pm
content: Quote from: mikeselectricstuff on August 15, 2023, 01:07:07 pmCertainly, their response is, if the machine is functioning as designed, the system works adequately. It come down to spending a few thousand dollars to fix a $200 problem. This is our third machine of this model, so this is not a major problem, just a curiosity on my part to see if I could use a little of the electronics knowledge I have picked up to "fix" this, and maybe learn something in the process.

author: Old Printer
author_rank: Frequent Contributor
timestamp: August 15, 2023, 03:53:54 pm
content: After some research, I have found an entire cottage industry that supports generating these cards. In the professional wide format printing industry, using "off-brand" inks is taboo. It will kill warranty's and have some techs refuse to work on a machine. All of the machines have some sort of smart-card system to prevent or make it difficult to use third party inks. It is quite possible to buy blank cards, a usb programmer and the software to write clone information to cards so they can be used when cartridges are refilled and the original card expires. Cards are only $7 but the programmer/software is $350-500. I have no interest in refilling, we don't use that much ink, so this is going nowhere. It's clear now that the big guys like Mutoh & Roland & Epson have a lot at stake here and this is not going to be a hobby hack on my part, but it was interesting. Thanks for getting me this far!

author: amyk
author_rank: Super Contributor
timestamp: August 18, 2023, 03:09:40 am
content: Yes, based on the information you've given, almost certainly "real" smartcard ICs are being used. Someone might recognise that distinctive pattern with the clever "SC" letters. It sounds like a very specialised type of printer so there's far less information about them online, and they might be a bit more secure, but nonetheless this sort of DRM is not that hard to bypass with the combined skills of everyone here:https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/https://www.eevblog.com/forum/reviews/dymo-550-thermal-printer-drm-hacking/

author: asmi
author_rank: Super Contributor
timestamp: August 18, 2023, 07:10:13 pm
content: Quote from: Old Printer on August 15, 2023, 03:53:54 pmIt's a well-known fact that printer manufacturers sell printers at cost or sometimes even below, and their main profit center is consumables. Consumer market is not very important for them as it's very cost-sensitive and so most people simply wouldn't buy a printer which requires expensive consumables (or simply keep buying new printers and using stock ink/toner which comes with device), but when it comes to devices targeted at businesses and professional users, they go above an beyond to make sure only first-party supplies are used.