Lexmark toner chip Ti046b1  - Page 1
Forum section: electronics / projects

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 24, 2016, 05:11:48 am
content: I have a Lexmark CS310dn color Laser printer which has 4 cartridges which I bought about 150$.Each of them has a chip Ti046b1 which probably counts the number of copies ( I guess but may be wrong)When the count is over in one cartridge, the printer stops.A replacement black cartridge is 100$.What is the real mechanism for this chip protection ?Where can I find the datasheet or the pinout of the Ti046b1 ? I was not able to find it on the web. It seems that it is a FRAM memory, but I am not sure.How to reset this printer chip ?There are some chip available on the web, with the lexmark PCB, but rather expensive (about 25 $) while the chip can be available for only 1$ on aliexpress. Should a simple replacement of the chip on the board work ?It is a TSSOP 8 chip, and there nothing else on the board except some decoupling caps.Thanks for any information on these Ti046b1 chips and chip protection mechanism.

author: SeanB
author_rank: Super Contributor
timestamp: April 24, 2016, 07:09:05 am
content: It is a simple EEProm, used to store the count of pages printed and toner fill state. Also has a key that is used to authenticate the cartridge to the printer, and a cartridge serial number.Try looking in printer refill suppliers for the compatible chips, which are either a programmed chip or a small micro that always reports the cartridge is full.

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 24, 2016, 09:44:26 am
content: Thanks, but is it possible to read and change the values in this eeprom ?And what is the pinout ?This is the chipAnd from what I have looked I got the following schematics, with the 4 pads JP1-4 connecting to the printer

author: Howardlong
author_rank: Super Contributor
timestamp: April 24, 2016, 10:18:29 am
content: Looks like an I2C eeprom from the chip pinout, so...J1 groundJ2 SDAJ3 VddJ4 SCL

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 24, 2016, 11:00:13 am
content: Quote from: Howardlong on April 24, 2016, 10:18:29 amThanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in factJ1 groundJ2 SCLJ3 VddJ4 SDAThen I got the I2C Address : 0x78What should now be the way to go ?

author: SeanB
author_rank: Super Contributor
timestamp: April 24, 2016, 11:51:59 am
content: Grab a non empty cartridge and write it's contents back to the empty one, and see the differences in the data as well. Print a few pages and see how the data changes, which might give enough data to simply reset the count, or make it look full again when refilled. Does the printer work without the chip in, some HP cartridges will give an error code but still print, assuming the chip is misaligned with the reader or it has failed, and then relying instead on the low toner optical path for change messages.

author: Howardlong
author_rank: Super Contributor
timestamp: April 24, 2016, 11:52:40 am
content: Quote from: JacquesBBB on April 24, 2016, 11:00:13 amWhile I can't discount your pinout findings of course, just be aware that there is an unofficial standard pinout for I2C eeproms, so I'd find it unusual to deviate from that, so you might want to just recheck your wiring.https://proprojects.files.wordpress.com/2014/11/2014-11_i2c_24fc1025_im01.pngFor example, Google the images returned from "i2c eeprom pinout".Anyway, back to the problem in hand!Can you probe the device in situ with a bus decoder? This can often reveal a lot.

author: android
author_rank: Regular Contributor
timestamp: April 24, 2016, 12:08:41 pm
content: Quote from: SeanB on April 24, 2016, 11:51:59 am...It might also be worth permanently enabling the Write Protect pin too, so that ithe EEPROM would always report "1 page printed" and not bother you in future. I've never tried it...just a thought.I suspect that the stored data is encrypted - making it difficult to guess how the printer firmware would respond to various kinds of tinkering. The manufacturers really want you to buy more consumables for some reason.

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 24, 2016, 03:16:22 pm
content: @Howardlong : I confirm the pinout that I gave. I have been able to communicate with it with both my arduino based I2C scanner and Bus pirate 3.6 with it.Now I am trying to dump the eeprom with bus pirate, but I have never used it beforeI can get some reading but I am not really sure of what I am doing.What is the best way to dump the content of the eeprom ?Thanks

author: Howardlong
author_rank: Super Contributor
timestamp: April 24, 2016, 05:34:26 pm
content: There are some additional confusions here.The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57 is the common addres range for eeproms. The schematic you gave even shows the address definition bits and WP pin all tied to how I would expect for an eeprom.I don't know if Bus Pirate supports 10 bit addressing.I would take a look at how the printer talks to the device before trying to copy it and match that up with known eeprom protocols. Like pinouts, these are reasonably well standardised so that manufacturers can offer plug in replacements.

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 24, 2016, 06:02:25 pm
content: Quote from: Howardlong on April 24, 2016, 05:34:26 pmI had this value with my arduino reader, and this is what I get with the bus PirateI2C>(1)Searching I2C address space. Found devices at:0xF0(0x78 W) 0xF1(0x78 R)

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 24, 2016, 09:25:32 pm
content: In order to verify what I get with the Bus Pirate,I tried with a more conventional 24FC1026.Then the pinout is standard and I getI2C>(1)Searching I2C address space. Found devices at:0xA0(0x50 W) 0xA1(0x50 R) 0xA2(0x51 W) 0xA3(0x51 R)Thus the usual address as mentioned by HowardlongI can then read and write on the chipI2C>[ 0xa0 0 0 1 3 2 ]I2C START BITWRITE: 0xA0 ACKWRITE: 0x00 ACKWRITE: 0x00 ACKWRITE: 0x01 ACKWRITE: 0x03 ACKWRITE: 0x02 ACKI2C STOP BITI2C>[ 0xa0 0 0 ] [ 0xa1 r:3 ]I2C START BITWRITE: 0xA0 ACKWRITE: 0x00 ACKWRITE: 0x00 ACKI2C STOP BITI2C START BITWRITE: 0xA1 ACKREAD: 0x01 ACK 0x03 ACK 0x02NACKI2C STOP BITI2C>But it does not seem that the sequence is the same for the Ti046b1As If I try the same sequence on the Ti046b1 , I getI2C>(1)Searching I2C address space. Found devices at:0xF0(0x78 W) 0xF1(0x78 R)I2C>[ 0xF0 0 0 1 3 2 ]I2C START BITWRITE: 0xF0 ACKWRITE: 0x00 ACKWRITE: 0x00 NACKWRITE: 0x01 NACKWRITE: 0x03 NACKWRITE: 0x02 NACKI2C STOP BIT[ 0xF0 0 0 ] [ 0xF1 r:3 ]I2C>[ 0xF0 0 0 ] [ 0xF1 r:3 ]I2C START BITWRITE: 0xF0 ACKWRITE: 0x00 ACKWRITE: 0x00 NACKI2C STOP BITI2C START BITWRITE: 0xF1 ACKREAD: 0xFF ACK 0xFF ACK 0xFFNACKI2C STOP BITSo the behaviour of this chip is not the same as a standard eeprom.If anybody has the proper writing/reading sequence, it would be helpful.

author: Howardlong
author_rank: Super Contributor
timestamp: April 24, 2016, 09:51:46 pm
content: 10 bit addressing works a little differently to 7 bit addressing, if that is indeed what it's doing. Whatever you're using to talk to the device needs to be 10-bit aware.Definitely I would sniff out what the printer does to get an idea of what's going on, and look at the I2C specs UM10204 which explain the differences.

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 25, 2016, 09:44:35 am
content: Thanks for your comments. I have started to look to 10 bit addressing...But it is difficult to find reasonable information of Bus Pirate and I2C 10 bit addressing.I made an experiment by searching all possible addresses on the black cartridgesearching with Bus Pirate for all 256 in bunches like :[0xF0 0x00]&[0xF0 0x01]&[0xF0 0x02]&[0xF0 0x03]&[0xF0 0x04]&[0xF0 0x05]&[0xF0 0x06]&[0xF0 0x07]I got only positive answers for 0 and 1DELAY 1usI2C START BITWRITE: 0xF0 ACKWRITE: 0x00 ACKI2C STOP BITDELAY 1usI2C START BITWRITE: 0xF0 ACKWRITE: 0x01 ACKI2C STOP BITDELAY 1usI2C START BITWRITE: 0xF0 ACKWRITE: 0x02 NACKI2C STOP BITThen I searched only for the first 8 addresses for the other cartridges and found for the possiblesecond ByteBlack : 0x00 and 0x01Cyan : 0x00 and 0x02Magenta : 0x00 and 0x03Yellow : 0x00 and 0x04So this is some progress, as I understand now how the different cartridges are recognised,but I am not able to go further. I may need to sniff the I2C port as you recommend, but this will need a settingthat I cannot do immediately, as I will have to dismount the printer to access the wires.

author: igrok_by
author_rank: Contributor
timestamp: May 20, 2016, 07:19:08 am
content: you have successI'm trying to get information from the chip , but it does not come out . To search using Bascom code :Code:$regfile = "m328pdef.dat"$crystal = 8000000Dim Q As Byte , T As Byte , A As Byte , E As Byte , R As ByteConfig Lcd = 16 * 2Config Lcdpin = Pin , Rs = Portd.6 , E = Portd.3 , Db4 = Portc.0 , Db5 = Portc.1 , Db6 = Portc.2 , Db7 = Portc.3Cursor OffClsLocate 1 , 1Lcd "Start"Config Sda = Portd.5 'I2C DataConfig Scl = Portd.4 'I2C ClockWait 2DoClsFor R = 0 To 127For T = 0 To 128I2cstartQ = R * 2I2cwbyte QI2cwbyte TE = Q + 1I2cstartI2cwbyte EI2crbyte A , NackI2cstopLocate 1 , 1Lcd Q ; " " ; T ; " Read " ; A ; " "If A < 255 ThenLocate 2 , 1Lcd Q ; " " ; T ; " " ; AEnd IfWait 2Next TNext RLoopEndThe answer to all addresses 255. Is there a solution

author: Zero999
author_rank: Super Contributor
timestamp: May 20, 2016, 07:44:48 am
content: There's no way I'd buy a printer like this.A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?

author: igrok_by
author_rank: Contributor
timestamp: May 20, 2016, 07:51:26 am
content: Quote from: Hero999 on May 20, 2016, 07:44:48 amXerox, samsung.

author: Gyro
author_rank: Super Contributor
timestamp: May 20, 2016, 08:48:13 am
content: Some laser printers have a s/w setting for non-original cartridges, eg Dell.

author: SeanB
author_rank: Super Contributor
timestamp: May 22, 2016, 07:14:23 pm
content: HP as well, they are refillable, that is why I use them at work. Canon is a brand as well that also has refillable cartridges. The refilled cartridge coasts around 30% of the wholesale price, or around 20% of the retail price. There is a big mark up on cartridges all along the supply chain.I just ask my refiller first if the cartridges on the printers I am considering are refillable, and this does winnow the list down to a dozen or so to choose from, and then often I look to see if the cartridge is one already in use. Just be aware that often HP and Canon cartridges are exactly the same unit, in a different box with a different part number, and a different price. Lot of Canon printers with me use HP cartridges. Same print quality, same operation and no "non genuine cartridge" message either on the new ones.

author: igrok_by
author_rank: Contributor
timestamp: May 25, 2016, 06:31:36 am
content: There are still some who have ideas on the independent decision of zeroing chips.

author: cciollolo
author_rank: Newbie
timestamp: May 30, 2016, 08:53:10 pm
content: hi , i have buy a cs310dn printer. i try to sniff with bus pirate but i have store more number with no result. The value changes every start of the printer and is different in all re-check in ready mode . i buy 10 new empty ti046b1 but i haven't idea to proceed . help please

author: cciollolo
author_rank: Newbie
timestamp: May 31, 2016, 05:25:24 pm
content: i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available !

author: igrok_by
author_rank: Contributor
timestamp: June 01, 2016, 06:42:58 pm
content: Quote from: cciollolo on May 31, 2016, 05:25:24 pmDid I understand you correctly??? An attempt to read the memory via a separate deviceQuote from: Fungus on May 31, 2016, 08:15:31 pmThe fact that the chip is written in the page counter. As far as I understand it in these chips is:1. The number of printing on many targeted chip (I found 10K, 20K)2. The number of printable pages3. Region kprintera.4 for color, he must still be responsible for the color.My reading of the sample controller chips Samsung alas, not what happened. But I realized that chip crypto protection.

author: cciollolo
author_rank: Newbie
timestamp: June 03, 2016, 12:36:18 pm
content: no , i turn on the printer and i sniff the initial trasmission that check all chips, and after turn off the printer and repeat for 24 times. the second file is the same procedure with the black cartridge chip removed . i did another test and i attach new file :senza filo is the 3 initial check without cable off all chipsstamp pagina is the initial check with all chip connected and 2 separate page printedcartucce mancanti is the recheck without one chip at once.i made an attempt only with black chip to read the content inside of the chip, but after select the chip address with 0xf0 0x00 , i test to write the address of memory location , but when i read the chip answers always ff when the address is ack

author: nanofrog
author_rank: Super Contributor
timestamp: June 03, 2016, 01:11:30 pm
content: Quote from: Hero999 on May 20, 2016, 07:44:48 amBrother would be another.Resetting a cartridge is nothing more than moving a gear back to it's start position. And you can refill a genuine cartridge 2- 3x w/ a reset between each refill*.Makes them the lowest per page cost I'm aware of.* Depending on the amount of toner the refill kit contains. Also, replace the fill cap rather than reuse or there's a serious chance it will leak, as they tend to get mangled when removing them (inexpensive & available on eBay and Amazon; new gears too, should you need them).

author: MPOWER
author_rank: Newbie
timestamp: July 20, 2016, 01:46:51 pm
content: Hi, I am new to your forum and found it googling for chip TI046B1.I am also interested in re-writing my lexmark smart chip with a virgin file.My MX410de uses this chip in the toner and in the imaging drum. The important thing is that I have an original 602HE 10.000 pages new and boxed cartridge.So I was thinking that if you help me read its virgin file I could re-write it when the time comes. Of course I would also share the file.Any suggestion would be highly appreciatedThanks in advanceMichael

author: igrok_by
author_rank: Contributor
timestamp: July 20, 2016, 06:48:10 pm
content: Hello everybody. Recently I ordered a couple of chips to try to fill. They came, until set.

author: cciollolo
author_rank: Newbie
timestamp: August 02, 2016, 09:28:44 am
content: i tried to read this chip , and i founded for black cartridge chip that there is just one address that contains data ; all the others contains FF or 00 . I found this with bus pirate scanning step by step all address : first [0xf1 xx , and i found that the only addresses that answer ACK are f1 00 and f1 01 . Second [0xf1 00 xx and [0xf1 01 xx .... at the end the address that answers all ack and return data different from 00 and FF is [0xf1 0 1 0 0.i attach the content of this address . After i bought another chip ti046b1 and i tried to read the same address ; the content doesn't match . So i tried to write the content of the original chip to the new , but when i try to write the chip answers NACK .the procedure to read is [0xf1 0 1 0 0 [ r r r r r r r r r r ri try to write with [0xf0 0 1 0 0 [ data data

author: igrok_by
author_rank: Contributor
timestamp: October 11, 2017, 09:38:54 am
content: Hello friends. I hasten to please, this chip succumbed to erasure and everything works as it should.

author: bigakis
author_rank: Newbie
timestamp: October 16, 2017, 01:49:02 pm
content: I captured the traffic between the printer and the catridge subsystem using a MiniLogic analyzer. Bus Pirate gives erroneous results.My first notes:The catridges have 10 bit addresses. First byte 0xF0 (W)/0xF1(R), second by 0x01-0x04There is another FRAM attached to the bus having address 0x05The printer communicates to the bus in cycles. When opening and closing the lid, it starts 5 cyclesOn Each cycle it polls each catridge by sending 0xF0, 0x0x (x=1-5). If it receives an ACK on the second byte that means the catridge is installed, and sends more bytes. If not it tries one more time before moving to the next address.An ACK on the first byte (0xF0) is always sent by the installed 5th FRAMFirst 4 cycles looks like identification. 5th one is the actual communicationAttached are the SAELAE Logic Capture, the Decoded CSV output, a simple python script to beautify the results and the beutified results.The data are from a cs310dn printer, no catridges attached, so the communication takes place only between the printer and the internal FRAM.More to come soon#update: The 5th FRAM report a S/N CAHxxxxxxxx and part number 38CB0001. It points to a company named sirtec in HK manufacturing toners for Lexmark. But there is no toner installed!

author: igrok_by
author_rank: Contributor
timestamp: October 17, 2017, 05:25:33 am
content: I can say one thing. chip read and until I got to read and write 1024 bytes open for writing and 1024 closed. In a closed file, there is a number, a model, and many that are not understandable.While well go into the discharge with a small amount of toner.I have models 511 and 410. 511 even some with 0 pages went into rewriting.Under No. 1, there is a toner. Under No. 5 there is a photo drum.While there are works with the search of the recovery from 0 pages.Open to HxD.

author: organizatie
author_rank: Newbie
timestamp: October 23, 2017, 07:09:16 pm
content: Hello ,igrok_by in your picture R5L16B is a memory chip equivalent is FM25L16 (RAMTRON).i have dump for this (my printer is mx310dn).i'm trying to identify a programmer for ti046b1 but can not find any documentation for this chip.

author: igrok_by
author_rank: Contributor
timestamp: October 24, 2017, 12:10:09 pm
content: Quote from: organizatie on October 23, 2017, 07:09:16 pmthere is no documentation for the chip. I asked many who sell them. But it seems to me that this is not just a memory, but a controller programmed to impersonate itself for memory. Because my attempts to return the blocked chips are unsuccessful. I'm waiting for the listener with China to test my theory.I can recover a chip that is not blocked.

author: organizatie
author_rank: Newbie
timestamp: October 24, 2017, 05:19:50 pm
content: in romania some devices can be reset, but they must still contain information.of the scheme seems to be a memory but I think it was labeled with a special series.thanks

author: igrok_by
author_rank: Contributor
timestamp: October 25, 2017, 05:29:42 am
content: Quote from: organizatie on October 24, 2017, 05:19:50 pmOpportunity.But I had a chip on the verge of blocking. I thought that he allowed the lock and counted again. Global changes nebylo. Recorded contents before blocking. But it did not work. I know that one thing is that he is not confused, but a controller. He has 2 addresses for an answer.The first one is 0.The second one depends on where it stands. 1 - if this is the bottom with the drum unit and 5 - if there is toner.

author: organizatie
author_rank: Newbie
timestamp: October 27, 2017, 04:53:49 am
content: Hello,igrok, where you ordered the chip??for what printer is it??I found that ic's "2850" is a TI controller in the series MSP430FR57XX.

author: igrok_by
author_rank: Contributor
timestamp: October 30, 2017, 08:03:25 am
content: Quote from: organizatie on October 27, 2017, 04:53:49 amHello. These chips were bought by our marketer.The listener came from China. So far as I thought, it's not a memory controller. You need to get a lot of data to write your controller with reset counter. If you do not care to reset the lock of chips.

author: igrok_by
author_rank: Contributor
timestamp: November 03, 2017, 02:01:15 pm
content: Hello, friends.I did not write for a long time, I was busy trying to understand what kind of animal it was.I recently offered to share with you.1 is not just a memory, but a controller or memory that can generate encryption.2 Yes, yes. Encryption. The algorithm is similar to "AES". This leads to his long attempts at deciphering without knowing the algorithm. Can anyone work with AES, help me understand how this works.I took off my hat near the development of this chip. This works well.

author: stj
author_rank: Super Contributor
timestamp: November 03, 2017, 11:36:30 pm
content: wouldnt it be simpler to hack the printer formware to fake the check result?

author: igrok_by
author_rank: Contributor
timestamp: November 04, 2017, 06:07:30 am
content: Quote from: stj on November 03, 2017, 11:36:30 pmas far as I know, I was told, I did not check that the printer is updating the encryption algorithm from the chip. Unfortunately, I do not have a printer firmware.

author: bigakis
author_rank: Newbie
timestamp: November 06, 2017, 04:26:10 pm
content: I'm also pretty sure this memory has embedded security. It is probably the case of this lawsuithttps://www.eff.org/document/sixth-circuit-opinion

author: igrok_by
author_rank: Contributor
timestamp: December 04, 2017, 09:53:37 am
content: Hello. I see that the information does not appear.. I want to boast that the "beast" has been trained. The chip fits perfectly into the reset. All informatics can be given for a reward.

author: igrok_by
author_rank: Contributor
timestamp: December 07, 2017, 05:26:33 am
content: Quote from: mojalan on December 06, 2017, 11:55:40 amAfter a long training =)There is no documentation for the chip. I found how it works. And now there is a solution that allows me to restart the mx/ms 410/511 chips.I think that the others work on the same algorithm.

author: igrok_by
author_rank: Contributor
timestamp: December 07, 2017, 01:01:10 pm
content: Quote from: maxic81 on December 07, 2017, 06:33:16 amOnly after Lexmark agrees that the money spent on protection in vain.And will cut 10 times the prices of consumables

author: igrok_by
author_rank: Contributor
timestamp: December 08, 2017, 05:19:38 am
content: Quote from: metrologist on December 07, 2017, 08:23:36 pmChinese friends offer good chips at good prices. True, these chips are clones of the original. I was surprised when I got five chips with the same number.

author: organizatie
author_rank: Newbie
timestamp: December 14, 2017, 11:39:17 am
content: Hi igrok_bywhat amount you are talking about igrok_by??regardsi'm waiting for the message in pm

author: igrok_by
author_rank: Contributor
timestamp: December 15, 2017, 06:24:11 am
content: Hello, organized.I did not understand what you want to hear from me?I do not understand English well

author: kees
author_rank: Newbie
timestamp: January 01, 2018, 11:10:43 am
content: Hello. After studying the Lexmark cs410 printer, one can find extended firmware logs:Code:http://<IPaddressOfPrinter>/seAdditionally one can finger the printer in a standard linux shell viaCode:nc <IPaddressOfPrinter> 79and issue commands like setup, firewalld, info, history, dnstable, backend, alerts, t30logEdit: Attached log might be of any value. Search for keywords like osikey, osi debug, bios debug. And find the inner working register values

author: Siryu
author_rank: Newbie
timestamp: January 09, 2018, 12:53:19 pm
content: Good to all, I am new to this, I have a laser printer and the toner that uses also carries the Ti046B1 chip but I can not do anything with it, I have arduino and I have logic analyzer but I can not do anything or I can not interpret the data, I would appreciate some help to see if I could read and record the chip or if on the contrary the shots do not go around, thanks in advance, regards.

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: January 09, 2018, 03:03:21 pm
content: Hello All,I am glad to see this thread active again. I have no time at present to resume my searches to decipher this chip,but will be very attentive to any progress that could help to shunt this protection.

author: igrok_by
author_rank: Contributor
timestamp: January 11, 2018, 10:43:53 am
content: Hello all.Sorry if I offended someone. It turns out the goods on the Chinese site can cost 3 times more than they actually are. I complete the instruc- tion about the chip until the end of the week. I suggest that you talk again about receiving instructions.I'm not a magician while I'm studying. The chip must not be blocked. How to do this I will describe.

author: AlexandruG
author_rank: Newbie
timestamp: January 23, 2018, 12:33:37 pm
content: Hello all,What about that instructions igrok? Can you help us with a tutorial "how is made"?Thank you.

author: driver_x
author_rank: Contributor
timestamp: February 13, 2018, 09:43:20 pm
content: Hello, any news about the instructions?

author: dokimos33
author_rank: Newbie
timestamp: March 05, 2018, 06:05:51 am
content: Quote from: igrok_by on January 11, 2018, 10:43:53 amWrite to me in PM please, I am ready to reward

author: Ronyy
author_rank: Newbie
timestamp: April 02, 2018, 02:24:35 pm
content: Is there any solution to the problem? I have an MS810dn lexmark and would like to know if it is possible to re-record the TI046B1 chip. I'm spending roughly $ 454, 32 per month only with the purchase of chips.

author: pixconfig
author_rank: Contributor
timestamp: April 06, 2018, 05:31:23 pm
content: Hi everybody,With a 70 MIPS DSPIC 33EP512 MC 502, and few days of hard labor, we succeeded in having all the communication between the printer and its cartridges intercepted without any bit of error !The Buspirate was just a Joke as it was unable to spy on a normal 100kHz I²C bus, and for those who tried, it had no chance to give anything meaningful. New versions are maybe approaching 100kHz but micro controller is 16 MIPS.With an Arduino Mega 2560 (16MIPS), we were too slow, too (even with a lot of optimizations). Indeed, it's impossible to use the internal I²C functionalities of any micro controller since theses functionalities necessarily interact with the bus (too bad, since they are 400KHz compatible !).How does it works :First time is recording into enormous buffers, second time (after few time with no data on SDA/SCL) is the sending of the results to the computer (with a simple serial port).Finally, with a Qt written program, we formatted all the series of S (Starts/Restarts), E (Stops/Ends), and 0/1 (with 7 or 10 bits addresses supported, ACK, Read/Writes etc) in order to have CSV files. We sorted a little bit those files in order to recognize I²C Writes, I²C Questions, and I²C Responses. And splitted the 4 cartridges into different colors.And yes, Howardlong was right, cartridges are 10 bits addressed.Enjoy !https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete-1sur2.xlsxhttps://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete-2sur2.xlsxAnd raw data from micro controller :https://www.pixconfig.fr/Lexmark-I2C-TI046B1/capture-complete-raw.txtIf some of you are interested in having more details and created programs for the occasions, we are going to clean it a little bit and put it on our website (https://www.pixconfig.fr/)Now we have to ask ourself one question : what do all those registers contains and says ? Because there is a lot, lot of data exchange between the master (printer) and its slaves (cartridges). For information, the magenta cartridge is empty into the recorded I²C frames.Also, we have a fifth cartridge and we don't really know what is this cartridge but the way it communicates is the same that for the 4 other cartridges.Thank you in advance !

author: pixconfig
author_rank: Contributor
timestamp: April 07, 2018, 10:57:20 am
content: I successfully understood some information about the used protocol, by printing the full series of Questions/Answers/Writes into 1 page (for magenta, firstly) and looking about what it asks, what it answers, and marking everything meaningful with my pen.I compared the results between cartridges and it is the same protocol, registers and bytes number used at each time. ACK and NACK are just where they should be, Starts Stops and restart too. But content of the 14 bytes questions and the 16 bytes answers change every time... !Addresses :0x001 is the black0x002 is the cyan0x003 is the magenta0x004 is the yellow0x005 is the imaging drumRegisters that are being read :0x01>0x20>0x04 is the Color Register. It gives a series of 0x0N and 0x00 that repeats itself, N being 1, 2, 3, 4, or 5 (same as the address)0x01>0x40>0x04 is an big register that is read on 448 bytes (but for each cartridge, only the 297 first ones contains something, the following bytes are 0x00. First bytes looks like ASCII with only slight differences between cartridges)0x01>0x00>0x06 is an big register that is read on 256 bytes (all of them contains something)0x01>0x20>0x00 is an average sized register that is read on 56 bytes (most of the contains 0x00 or 0xFF but not all of them)0x01>0x90>0x00 is an big register that is read on 208 bytes (First bytes looks like ASCII with only slight differences between cartridges)0x82 is a kind of Status Register that the printers reads before asking anything else.status 0x38 is "nothing more to say, please enter something into 0x81"status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x090x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second timeRegisters that are being write :0x04 is the first register that is called on each cartridge, with a Stop occuring during ACK (there is no ACK or NACK bit), followed by a useless start stop, observed by oscilloscope too. Let's guess this is useless. But it's common to the 5 cartridges (well, 4 cartridge and 1 imaging drum).0x81 is the only one register that is written after closing the lid. It's a command register that influences the status register (0x82) and define what will be read into 0x80. We can see single byte writes on it (0x08 or 0x09) for selecting what looks like a mode, then a 14 bytes question write (with something that looks like it's totally unpredictable) before being able to read 16 bytes into 0x80 (16 bytes that also looks like they are totally unpredictable).That's the complete summary of the exchanges between the master and it's slaves. We have only one missing thing : what is written when we print a page ? Since our Magenta cartridge is empty, we can't print anything.Now I think I need some experts attention :Does anybody recognize this kind of dialog ?I'm going to look for possible intepretation of those values (4 bytes sized floats, 8 bytes sized double, integer, unsigned integer, ascii...) but may be somebody already recognize what I'm looking for.Do not hesitate to consult the Excel files we gave on the previous message, it's really clear to read !I'm really happy with what we got from the 70 MIPS DSPic (fast enough to immediately mark the values SDA/SCL when there is a SCL/SDA change notification interrupt, then interpret it quickly enough to see the next SDA/SCL change in time) and the way we formatted the data into the Excel. At the beginning, we were looking after 1 and 0 on the oscilloscope so you see, it's lightyear better that wayIt's also a chance that it's 48 kB RAM memory sized because there is a lot, lot of bytes, starts and stops position to record before being able to slowly send this into the serial port.

author: pixconfig
author_rank: Contributor
timestamp: April 07, 2018, 03:23:27 pm
content: We saw that after the 2 streams of recorded communication with the printer, we had 3 series of Write + Read into 0x005.I made a pretty cool discovery while looking at it : part of the chip is an EEPROM and the printer auto-control what have been written :It writes a 1st time 96 bytes into 0x02>0x20>0x00, and read it back into 0x01>0x20>0x00 (with no single bit change)It writes a 2nd time 96 bytes into 0x02>0x80>0x00 and read it back into 0x01>0x80>0x00 (with no single bit change)In the two writes (and the two reads back) there is no change : same thing written into 0x02>0x20>0x00 and 0x02>0x80>0x00.Finally, it writes 128 bytes of data into 0x02>0xE0>0x00 and read it back into 0x01>0xE0>0x00Here is a picture of the analysis, it's a little bit loaded butI've placed an updated version of the Excel files as ODS file at this address :https://www.pixconfig.fr/Lexmark-I2C-TI046B1/output-complete.odsThe 1st, 2nd and 0x005 Write are into 3 different sheets on the bottom of the document.Formatting of the 2 communication are the same so now it's easier to place the same view on each side, and switch between them to see what is changing.

author: pixconfig
author_rank: Contributor
timestamp: April 07, 2018, 05:05:50 pm
content: AAAnnnd the winner is....(not so fast, my understanding of the situation still should be verified experimentally)I have just noticed that for the first headers (big registers read before exchanges on 0x80 / 0x81 / 0x82) that I documented this morning, they are something more to know about the following ones :0x01>0x20>0x00 is an average sized register that is read on 56 bytes (most of the contains 0x00 or 0xFF but not all of them)0x01>0x90>0x00 is an big register that is read on 208 bytes (First bytes looks like ASCII with only slight differences between cartridges)Those headers are for 0x001, 0x002, 0x03, 0x004, but not for 0x005.For 0x05, those first registers reading are replaced by0x01>0x20>0x00 : read during 96 bytes0x01>0xE0>0x00 : read during 128 bytesYes, the same register that we saw the printer write in my previous message, so we know what the printer reads at the beginning : it reads things that can be writtenThis is probably those registers that the master is writing in order to update the status, and the one that the master reads in order to know the current status of the imaging drum.I guess that the way the master writes the toner level on 0x001, 0x002, 0x003 and 0x004 is the same (replacing the 0x01 by 0x02) but it should be verified while watching the printer writing into those registers.And may be everything addressed by 0x01>0xNN>0x00 can be addressed and written, who knows. I wonder what it contains when the cartridge is brand new ! I'll try to watch that in the following week.According to some folks, there is another thing that is set/locked somewhere else when the cartridge become completely empty. Probably something that could be found by watching the printer doing it's final emptying ? Who knows, it's a shame that we are there, looking again and again to repeat and find what some people already found and kept, those people who find solutions against venal obscurantism in order to finally put moral to the garbage, and ask for dollars too.But I digress, let's keep on studying this I²C component- as you can see, I'm not trying to do anything else but studying a component we all bought, just for me and the others to know how does it works.

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 08, 2018, 09:42:46 am
content: Congratulation for this nice work, pixconfig. I hope that will end up with a solution for resetting these chips.

author: Siryu
author_rank: Newbie
timestamp: April 08, 2018, 01:19:36 pm
content: If wonderful work now I know because I could not read or interpret the data with arduino, hopefully we can do something at last, thanks pixconfig

author: pixconfig
author_rank: Contributor
timestamp: April 08, 2018, 03:16:25 pm
content: Hi !In fact I have good news for everyone who wants to communicates (Read/Write) with those chips and an Arduino as master (or any other kind of I2C master, like RPi or VGA card) : I think it is completely possible ! (Just take care about 3.3v). But I didn't tried.I Guess you should also tells you Arduino that the address you want to write is 0x78 (0b111 1000) + W and then the first data byte you send should be 0x01, 0x02, 0x03, 0x04 or 0x05.Before any read, you will also need to write 0x78 + W, 0x0N (1 2 3 or 5), your desired register(s), and Restart, then just 0x78 + R (on a read, you're only able to write 1 byte of address before receiving, so you can't put the full 10 bit address. But the slave chip will recognize himself since just before the restart, you were talking to it).What we don't succeeded in, with the Arduino, was to watch as input only into the operating bus between printer and cartridges and being able to catch everything sent/received between everybody without any interaction and without any bit of error : coding a software read-everything using software poll and/or interrupt on PD0 / PD1 changes was to slow to :- copy of the SDA/SCL value (PORTD) immediately on any change- interpret the copy by looking at the 2 values with some if/else and masks (0x02, 0x01, 0x03)- putting the results into a dedicated buffer- and to be ready for the next change at timeOf course, sending the values by Serial Port should be done in a second time because it's very long too (talking about too many µs of course, not minutes).We were loosing a lot of bits, starts and stops. Copying the SDA/SCL values on another output port and seeing the time offset with a 2-way oscilloscope revealed that we had no chance to be fast enough to do everything in time because SDA was changing too fast after an SCL change and vice-versa (we were often reading the PORT D too late).May be some Assembly's kings would have done better than us, but anyway, that's why we said it was pretty impossible without a faster controller (and I discovered 70MIPS dsPIC, it solved the problem, but it's a little bit complicated to code with : lot of registers to set everywhere to do any simple thing).I've tried to interpret the data on the big headers as ASCII. That's a little bit poor because it's mainly binary, but there is some ASCII information anyway. It seems that those are serial number, and the model of the compatible printer.There is also a check on the Imaging Drum reference : CAH171303CD6 is written into the Imaging drum's chip but also in the cartridge's chips.Pretty interesting, after all ! May be it's for a compatibility check with what's installed into the printer.Black :CAH171331C8638C42376MBF4CAH171303CD675272394Lexmark CX417deBlue :CAH1713218DA38C42346MBF46MBF4CAH171303CD675272394Lexmark CX417deMagenta :CAH171350F7B38C42356MBF46MBF46MBF4CAH171303CD675272394Lexmark CX417deYellow :CAH1713208AA38C42366MBF4CAH171303CD675272394Lexmark CX417deImaging Drum :CAH171303CD638CB0001

author: pixconfig
author_rank: Contributor
timestamp: April 09, 2018, 01:08:27 pm
content: Hi !I can now confirm that the Arduino (Mega 2560 at least) is able to be master and communicate, and read into the 10 bits TI046B1 (using 10k + 5.2k + 2k between ground and SDA and same between ground and SCL, in order to have 3.3v and no 5v)Here is a sample code in order to address (by write) the 0x01 > 0x20 > 0x00 register, and read it during 56 bytes after a restart EDIT : it's also able to write, nowI used arduino's twi.h and twi.c in order to understand what I was doing on the bus, because Wire.h and Wire.cpp overlay was a little bit strange to understand; anyway it should work toohttps://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/twi-all-included.hhttps://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Read.inoEDIT : the goal is to read those registers and send it trough serial port, in order to copy it into C declaration, and write it back, for example.We will first try to read the chips on the same values that the printer does, and see if we are able to see the same things, before trying to write anything.

author: Siryu
author_rank: Newbie
timestamp: April 09, 2018, 06:06:48 pm
content: Thank you Pixconfig for your excellent work.Indeed with the Mega ADK I have managed to read a chip of the Monochrome printer with a single cartridge of toner and another drum. Now the interesting thing would be to be able to write on the chip.

author: cciollolo
author_rank: Newbie
timestamp: April 11, 2018, 09:45:12 pm
content: Thank you Pixconfig for your excellent work.I started doing tests of reading the chips with buspirate posting various files, then failing to find anything I bought MSP430F5529 launchpad and I tried to read the chip, but appears "the debug interface to the devices has been secured".I'm not very practical in data communication and I abandoned everything for a hardware change: disconnect the power supply to all 4 chips after the first verification phase at the printer and sending the document to be printed. In the printing phase the processor must be so busy that it checks the cartridges (almost always) at the end of the print (even if many pages, even if on the back side) to subtract pages from the toner counter, so finished printing I turn off the whole printer and re-lighting it after a few seconds with the reactivated pultant. Change that I do not know why it does not work so much, because the toner level keeps going down; perhaps for a cross check that does between printed pages from the machine and toner residue, I do not know. I saw that instead you have come a long way in the part of communication and I wanted to understand how to help you with the means I have, if possible.

author: pixconfig
author_rank: Contributor
timestamp: April 14, 2018, 04:57:09 pm
content: Hi !After reading the following registers on a new out of the box cartridge's chip that haven't be connected to the printer for the moment :01_40_0401_00_0601_20_0001_90_00And after trying to write the good one, out of the box content into another chip (not the good cartridge, I mean of course it's the good cartridge, but the chip says "no, go buy another one") :02_40_0402_00_0602_20_0002_90_00I've tried to read the content again but no byte changed...it's still the old content.What should I try ?I'm going to place the cartridge and his new chip inside the printer, and to observe, but if anybody is inspired, feel free to share your ideas

author: pixconfig
author_rank: Contributor
timestamp: April 15, 2018, 01:34:28 am
content: I cleaned a little bit the code of our dsPIC I2C observerhttps://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/main.hhttps://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/main.cIt's for a dsPIC 33 EP512 MC502, there is two buffers in order to keep recording while sending the previous results trough UART, and a buffer overflow protection nowComments are in english too.Also, there is a Qt code in order to change the series of letters into a viewable CSV, but it does not interpret anything else than I2C (in fact, apart from the Arduino 10bits master reader/writer I gave the other day, there is nothing linked to the Lexmark products into any of these codes, they can be used for any other thing).https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/Qt-I2C-Read.zipDoes anybody know if there is a patent describing the communication process between the cartridge and the printer ? Such patents could be really important for Lexmark to ensure no concurrent can sell anything that is patented by their own technology, but such patent are also helpful into understanding the product as customers and developers as we are, for interoperability, modification, but without spending too much time into retro-engineering if everything is already described somewhereI guess I'm ready to put the new cartridge into the printer and to watch what it gives !

author: pixconfig
author_rank: Contributor
timestamp: April 18, 2018, 12:06:50 pm
content: Hi,Thanks to a very interesting discussion and idea exchange about patent, here is some information :I searched a little bit onhttp://www.suppliespatents.info/(official Lexmark list of patents for their cartridges), and Google Patent, as patents are publicly available on Google, I succeeded in having a lot how them about our cartridge and communication, by seeing the website indicated on the cartridge, and by some research. But not all of them seems to be what we are looking for.https://patents.google.com/patent/US7258558https://patentimages.storage.googleapis.com/d9/d2/7c/787cbf35f9fdf2/US7258558.pdfhttps://patents.google.com/patent/US7272336https://patentimages.storage.googleapis.com/2c/9b/24/3466ec9fd84210/US7272336.pdfhttps://patents.google.com/patent/US7321739https://patentimages.storage.googleapis.com/9d/81/1d/74aa37e5d35ee4/US7321739.pdfhttps://patents.google.com/patent/US7606520https://patentimages.storage.googleapis.com/25/cf/fc/f6b00f8489ff68/US7606520.pdfhttps://patents.google.com/patent/US7672624https://patentimages.storage.googleapis.com/1c/c4/95/0dcc721952358c/US7672624.pdfhttps://patents.google.com/patent/US8401437https://patentimages.storage.googleapis.com/b6/09/25/9092a07fda3453/US8401437.pdfhttps://patents.google.com/patent/US8948660https://patentimages.storage.googleapis.com/79/ff/2c/62c12f00eb9e0d/US8948660.pdfDoing some manual research :https://patents.google.com/patent/US8966193https://patentimages.storage.googleapis.com/9c/38/4d/f75c5b3c04f954/US8966193.pdfhttps://patents.google.com/patent/US9400764https://patentimages.storage.googleapis.com/ec/90/37/616b217d32e47a/US9400764.pdfhttps://patents.google.com/patent/EP2226809B1https://patentimages.storage.googleapis.com/b2/9c/c8/1ef00d503cdace/EP2226809B1.pdfhttps://patents.google.com/patent/US9245591https://patentimages.storage.googleapis.com/71/b8/db/58443002ccc33f/US9245591.pdfhttps://patents.google.com/patent/US20170163641https://patentimages.storage.googleapis.com/7a/7d/01/b2b076d57ecd92/US20170163641A1.pdfhttps://patents.google.com/patent/US7426613https://patentimages.storage.googleapis.com/01/03/f5/87cfecdb866b32/US7426613.pdfhttps://patents.google.com/patent/US8099791On the National Institute of Standards and Technology (NISThttps://www.nist.gov/) into the Computer Security Resource Center, some part of the Lexmark cryptographic module validation program documentation has also been made available for public too :https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2444.pdfBut it doesn't talk about the i2c toner chip at allI don't have a lot of time this week, so if anybody feel ready to eat all these documents, feel free !I watched the result of 1 print with the new cartridge but there is nothing special to see, it just written 0x005 and did a lot of communication with 0x80, 0x81 and 0x82 on every cartridge... May be a I should print more copies before seeing a cartridge write ?I will come back as soon as a have new time and information

author: cciollolo
author_rank: Newbie
timestamp: April 19, 2018, 06:49:12 pm
content: hi pixconfig, can you explain me how I can save the communication between printer and cartridges? with any arduino with library that you posted? with a pic? if I can understand how you did, I can equip and post printer data different from yoursin the meantime, I ask you some questions:puoi verificare che ad ogni accensione (prima comunicazione ) i dati scambiati sono sempre gli stessi ? e ad ogni controllo successivo , a distanza di circa 1 minuto, sempre gli stessi dati ?can you check that every time you switch on (first communication) the data exchanged are always the same? and at each subsequent check, at a distance of about 1 minute, always the same data?thanks

author: LPI-DANE
author_rank: Newbie
timestamp: April 20, 2018, 06:09:19 pm
content: Hello, I'm new to this site. I have been looking for the data sheet just like everyone else. I have a friend in Shenzhen that told me that most aftermarket sellers just silk screen on the TI046B1 on to this chip.http://www.ti.com/lit/ds/symlink/pca9515a.pdf.I use a Xeltek 6100 for ghosting IC's. This is not in my data base. I do not have the chip knowledge of most on this site. Could some tell me if this IC could be the same.

author: LPI-DANE
author_rank: Newbie
timestamp: April 20, 2018, 06:23:23 pm
content: Sorry the link breaks, here is a partial of the PDF. It would not let me load the hole PDF.

author: dimprime
author_rank: Newbie
timestamp: April 22, 2018, 10:31:25 am
content: Thanks for your excellent work.Thanks to your program I can write on the chip.02_40_04 02_00_06 02_20_00 02_90_00 I change  to  and  to  and I can write and change the bits as I want and when I read them it changes them but the lines 02_40_04 and 02_00_06 do not change them. why?

author: JoeO
author_rank: Frequent Contributor
timestamp: April 22, 2018, 12:19:38 pm
content: Quote from: LPI-DANE on April 20, 2018, 06:09:19 pmHere is the link to the larger document:http://www.ti.com/lit/ds/symlink/pca9515a.pdf

author: amyk
author_rank: Super Contributor
timestamp: April 22, 2018, 04:28:36 pm
content: That's definitely not it; it doesn't even have memory.This is the closest to a description (the full report is $$$):https://www.chipworks.com/TOC/Texas_Instruments_TI046B1_Serial_FRAM_CAR-1504-802_TOC.pdfAs for finding a datasheet, since it is a proprietary part you won't find one unless the right person at Lexmark or TI happens to read this thread and decide to be neighbourly (you know who you are...)

author: pixconfig
author_rank: Contributor
timestamp: April 25, 2018, 10:36:49 pm
content: Hi, sorry for the little time offline, I was a little busy !cciollolo, here's a little description of my spy's wiring :https://www.pixconfig.fr/Lexmark-I2C-TI046B1/dsPIC/dsPIC-Wiring.pngRB7 (pin 16) is used as UART output from the dsPIC to the computerRB8 is normally used as SCL, for I2C, but since it doesn't worked, I used RB10 (pin 21) for SCL spy input. Still don't know why RB8 wasn't working !RB9 (pin 18) is normally used as SDA, and I used it as SDA spy inputPicKit connection for when I'm writing/debugging the program is RB2 (PGEC1, pin 6) and RB3 (PGED1, pin 7) for PGC and PGD. I'm only using the 5 first pins of the PicKitI used 100nF capacitors (green ones) and for VCap (tantalum 10µF minimum, which I had not) I used the association of a 100µF electrolytic and a 100nF non-electrolytic capacitor in order to have the association of storage capacity and the immediate response time that is probably required to work at full speed.I'm then using a USB<->Serial converter using TTL / 3.3v signals : when the dsPIC program is writing UART, the computer receives the data, with putty.exe for example.Into the code it's buffering all the communications and then, it's sending what have been recorded (after 2 seconds of i2c inactivity).As it's a looooong series of Ones and Zeros, a second program (C++/Qt written, Qt-I2C-Read.zip), it reads bits 9 by 9 between every Start and Stop and do some interpretation to give a readable CSV with address, read/write and acknowledge interpretation. Then I manually add some colors and spaces in order to see patterns and general shape of the communication.To answer your question about the first communication at each restart, the big first part of the communication is entirely predictable :02_40_04 02_00_06 02_20_00 02_90_00 But then, every exchange on 0x80, 0x81 and 0x82 are pretty unpredictable (14 bytes writes and 16 bytes read are every time different, apart from the 2 middle bytes of the 16 bytes read that are the same every time, it just depends of the cartridge).I would not be surprised if it's just authenticity check without information read/write, just because it would explain why some people already succeeded in the past to "blank" the toner chip usage counter.dimprime, it's very very cool !I think that the first part is describing a kind of "model" for the cartridge and I wouldn't be surprised if the second part contain the "status" of the cartridge. So it would be a great idea to try to "restore" the cartridge status after having used a little page amount, just to see if the toner level is retrieving it's previous amount !I will have some time tomorrow in order to try some things and tickle those chips a little bit, with the arduino as master

author: pixconfig
author_rank: Contributor
timestamp: April 26, 2018, 11:32:43 am
content: I've made a pretty cool discovery :Reading 2048 bytes of 01>00>00, then reading the following ones :01>20>00 is 01>00>00 with a 32 bytes offset01>40>00 is 01>00>00 with a 64 bytes offset01>90>00 is 01>00>00 with a 144 bytes offset01>00>06 is 01>00>00 with a 6 x 256 bytes offset01>40>04 is 01>00>00 with a (4 x 256) + 64 bytes offsetPretty logic, after all : The first byte after 01> indicates a [0 to 255 for 0x00 to 0xFF] byte offset so the following one indicates a multiple of 256 bytes offset !

author: pixconfig
author_rank: Contributor
timestamp: April 26, 2018, 12:33:03 pm
content: EDIT : I made an error while reading back data, the reality is that I only succeeded to fill the first 1024 bytes with zeroes.I (too much but successfully) zeroed an entire chips's eeprom by writing 2048 bytes of 0x00 to 02>00>00It only remains "0xFB, 0x5F, 0x94, 0x54" for the last 4 bytes of the 2048 bytes buffer readNow I should understand why some writes are successful, and why some others are not.And I'm also able to restore back the 1024 first bytes to their initial value, but most of them were already set to 0x00

author: pixconfig
author_rank: Contributor
timestamp: April 26, 2018, 02:13:09 pm
content: I confirm that toner cartridge that are emptied with the chip giving "0 pages left" are not fully lockedI have been able to set the 1024 first bytes to 0x00 and to read it back, then to restore the initial content.But :When I restore the original, there is some differences at the beginning (32 first bytes) but I already had the problem this morning without writing anything : those 32 bytes were a series of 0x77 and 0x00 and it became just 0x00. Same here, it was a series of 0xB8 and 0x17, now it's just series of 0x00 and 0x00Also, when I try to write with incremental values the first 1024 bytes, there is only 336 bytes that are written : 0 to 32 is not written, 336 bytes are written and all that follow is kept to 0x00Anyway it's still interesting to see all thisSorry for multiple Editing, I realized that my interpretation was wrong because of some mistakes in my code !

author: pixconfig
author_rank: Contributor
timestamp: April 26, 2018, 07:54:41 pm
content: So we are approaching the end, I'm on the verge of attempting something :This is the 01>20>00 "register" of a brand new magenta cartridge (small capacity)Code:uint8_t RegisterRead_01_20_00 = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x75};After some little magenta prints :Code:uint8_t RegisterRead_01_20_00 = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x46, 0xBA};Nothing else changed into the chip.The visual indicator doesn't really show any missing bit of toner level but anyway... I would like to try applying this value to a Cyan cartridge that is pretty low, with the exclamation sign at side of it's toner level representation, just in order to see if it's the toner level... or not ! And I hope that the value I will put will not lock anything with the cartridge once into the printer.Some more details I noticed by analyzing all the content :The first 1024 bytes of information are completely organised that way :32 bytes of strange volatile read only value repeating itself 2 by 2, that sometimes changes to 0x00 after some writes56 bytes of what I believe is the toner level56 bytes of what I believe is the toner level, a second time, same values - printer doesn't seems to read this field but it's into the chip208 bytes of information that doesn't have changed since the cartridge is into the printer6 first bytes of 01>00>04 (the 1024 bytes read only area) followed by zeros. But 16 bytes can be written and hereAfter the 368 first bytes, the 656 following bytes are covered by 0x00 and seems to be read onlyAfter the 32nd and up to the 368th byte, everything can be written by the data of your choice, and I'm not really sure of why sometimes it fails. But if you write the complete set of 1024 bytes it seems to work everytime.When I try to observe the printer communicating with it's cartridge I only see some Writes into 0x05 EEPROM area and some exchange on 0x80/0x81/0x82 with all cartridge but impossible to guess what it does (apart from entering some kind of 0x08 or 0x09 modes, and writing random 14 bytes to get 16 random bytes in answer).Also, I tried to read 3072 first bytes, but it does a cycle : the 1024 last bytes are the 1024 first ones.Keep you informed !EDIT 1 : well, it does not workprinter says that the cartridge isn't recognized. The I2C spy shows nothing abnormal. Now I will try to copy the content of another cartridge of the same reference, delivered with the printer

author: pixconfig
author_rank: Contributor
timestamp: April 26, 2018, 09:14:36 pm
content: SuceededI copied the Yellow level (~40%) of the same cartridge reference into the Cyan toner chip (was almost empty) with the following code :Code:uint8_t Register56[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0x01, 0xFF, 0xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0xA0, 0x0D, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x04, 0xC3, 0x00, 0x00, 0x00, 0x2D, 0x87};void playOnce(){write_TI046B1_register(0x002, 0x02, 0x20, 0x00, Register56, 56);write_TI046B1_register(0x002, 0x02, 0x58, 0x00, Register56, 56);//Check :read_TI046B1_register(0x002, 0x01, 0x00, 0x00, Buffer, 512);read_TI046B1_register(0x002, 0x01, 0x00, 0x02, Buffer, 512);read_TI046B1_register(0x002, 0x01, 0x00, 0x04, Buffer, 512);read_TI046B1_register(0x002, 0x01, 0x00, 0x06, Buffer, 512);}Of course it doesn't add real toner inside the cartridge so it's just for technical comprehension of our printer, as it's written on the cartridge's box : "By opening this package you agree to use this cartridge only once" so of course I'm going to put back the real toner remaining amount into the chip, and use it only once, and I encourage you to do the same.I would love to know what is the "full" level for this reference !I'm gonna analyze a little bit what contains this 56 bytes buffer, may be I would be able to fully understand it.There's still many areas of shadows about what the chip contains and does.

author: pixconfig
author_rank: Contributor
timestamp: April 27, 2018, 10:14:40 am
content: Hi,Another good news for people who have "empty" cartridge with 0 pages left : it's possible to reload the chip, it's not locked (at least, not with the "starter cartridge" delivered with the printer). For this example, we successfully put the "40% left" level of the Yellow toner chip into the "0% left" magenta toner chip, and now, there is "40% magenta left" and it works.A good idea would be to share, here, the different values of 01>20>00 for differents kind of cartridges, with differents levels, and to make a summary here.Let's begin :Magenta, 71B20M0, still not used :Code:uint8_t RegisterRead_01_20_00 = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x75};Magenta, 71B20M0, after just little usesCode:uint8_t RegisterRead_01_20_00 = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x46, 0xBA};Magenta, 802HME High Yield (CX410 / 510), not used because not compatible with our printer :Code:uint8_t RegisterRead_01_20_00 = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xCD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA6, 0xFF};CS417, CX417 Starter Return Program : Black ~30%, Blue ~10%, Magenta 0%, Yellow ~40%)Code:uint8_t RegisterRead_01_20_00 = {0xFF, 0x00, 0xFF 11110xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x11, 0x00, 0x01, 0x20, 0x13, 0x00, 0x61, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x05, 0x05, 0x00, 0x00, 0x00, 0x30, 0x3B};uint8_t RegisterRead_01_20_00 = {0xFF, 0x00, 0x7F 01110xFF, 0xFF, 0x8D, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEF, 0x00, 0x00, 0x60, 0x04, 0x00, 0x69, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x01, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x04, 0xC0, 0x00, 0x00, 0x00, 0x9D, 0x9B};uint8_t RegisterRead_01_20_00 = {0xFF, 0x00, 0x3F 00110xFF, 0xFF, 0x8C, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x23, 0x00, 0x00, 0x40, 0x03, 0x00, 0x6D, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x03, 0x00, 0x00, 0x04, 0xC4, 0x00, 0x00, 0x00, 0x67, 0x68};uint8_t RegisterRead_01_20_00 = {0xFF, 0x01, 0xFF 11110xFF, 0xFF, 0x0F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAD, 0x00, 0x00, 0xA0, 0x0D, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x02, 0x00, 0x00, 0x04, 0xC3, 0x00, 0x00, 0x00, 0x2D, 0x87};Please read before doing :Of course it doesn't add real toner inside the cartridge so it's just for technical comprehension of our printer, as it's written on the cartridge's box : "By opening this package you agree to use this cartridge only once" so of course I'm going to put back the real toner remaining amount into the chip, and use it only once, and I encourage you to do the same.

author: driver_x
author_rank: Contributor
timestamp: April 28, 2018, 12:55:27 am
content: Hi, here's my hypothesis: toner level might be stored in the second and third bytes:The levels might be:Code:% dec hex____________________0 % 63 00 3f10% 127 00 7f20% 255 00 ff30% 511 01 ff40% 1023 03 ff50% 2047 07 ff60% 4095 0f ff70% 8191 1f ff80% 16383 3f ff90% 32767 7f ff100% 65535 ff ffNow we go to your cartridges:Magenta, 71B20M0, still not used : bytes 2 and 3 = ff ff = 100%Magenta, 71B20M0, after just little uses: bytes 2 and 3 = 7f ff = 90%Magenta, 802HME High Yield (CX410 / 510), not used: bytes 2 and 3 = ff ff = 100%Black ~30%, bytes 2 and 3 = 00 ff = 20%Blue ~10%, bytes 2 and 3 = 00 7f = 10%Magenta 0%, bytes 2 and 3 =00 3f = 0%Yellow ~40%, bytes 2 and 3 = 01 ff = 30%Bytes 15 and 16 might hold the number of printed pages or some measure of toner consumed, because it seems proportional with the filling percentage, the emptiest has the biggest value, the fullest has the smallest value. Black cartridge always has more toner than the others.Black ~30% = 0x 0111 = 273Blue ~10% = 0x00ef = 239Magenta 0% = 0x 00123 = 291Yellow ~40% = 0x 00AD = 173I printed a report with device statistics. What information might be stored on the cartridge:Install date (?)Supply level (bytes 2 and 3?)Sides on cart (bytes 15 and 16?)Return program Genuine(??)Printer Liftime(??)Try to print more pages and put here the dump and the report, maybe we can map all the bytes

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 28, 2018, 09:56:08 am
content: Quote from: pixconfig on April 27, 2018, 10:14:40 amBonjour pixconfig !I am following your progress with great interest.As I understand, you have developed two way of communicating :- intercepting the signal on the printer with a dsPIC33EP512MC502 and the associated c program- reading and writing to the chip with an arduino program on an atmega 2560Which one are you using for the latest reading and writing you mention ?I assume it is the arduino. Can you confirm ?What is the wiring you used ?Bien amicalement,Jacques

author: driver_x
author_rank: Contributor
timestamp: April 29, 2018, 07:26:13 am
content: Very interesting information:https://caselaw.findlaw.com/us-6th-circuit/1211276.html

author: pixconfig
author_rank: Contributor
timestamp: April 29, 2018, 04:03:15 pm
content: Salut JacquesBBB, and driver_x !JacquesBBB : We are using the pin description you discovered in the first page of this topic : First one (longer) is GND, second one is SCL, 3rd one is 3.3V power supply, last one is SDA.I would like to thank you as we probably wouldn't have done all this without all the information that was already available in this thread. I wasn't even aware about 10 bit addressing existence.As you saw, yes, for manual read/writes we are using an Arduino (Mega2560, equipped with 8192 bytes of RAM) for directly writing/reading were we want into the chip. We used the dsPIC only as read only, with a self made program for in-situ spying of I2C communication inside the printer, with 3 wires (GND/SDA/SCL) connected on the imaging drum electronic card (that is easily removable, its just like a big toner chip with 4 slots and 1 connector).https://image.noelshack.com/fichiers/2018/17/7/1525016623-sans-titre2.pngWe firstly tried to solder some wires on the chip's contact before putting the cartridge in place, but it was a bad idea since the cartridge was unable to fully take it's place into the printer (toner leaks !)I would like to add some detail about the wiring with Arduino 2560 :Atmel AtMega2560 has internal pullup on the RD0 and RD1 port used for I²C, connected to 5v, that cannot be disabled for these pins on this model.We used, both for SDA and SCL, some 18 kOhms resistor mount for reducing the voltage on the toner chip pins. With this, we have ~3.3v when the bus is high and 0v when the bus is lowdriver_x :Your hypothesis is interesting, I won't have the printer this week but I will do some more test as soon as possible. I also see that there is some others bytes changing everywhere; putting all the data into an Excel helped me to see some similar points but also a lot of questions remaining !For the lawsuit, I saw a similar document in this thread (2nd page,https://www.eff.org/document/sixth-circuit-opinion), if I understood, it's a case where some company was duplicating a lexmark obfuscated protocol program chip by simply copying the program inside the chip instead of doing its own, which caused some copyright issue.

author: driver_x
author_rank: Contributor
timestamp: April 29, 2018, 04:25:50 pm
content: Salut pixconfigFrom the lawsuit we find interesting things (I don't know if it still applies to current cartridges, but is interesting to know):Quote

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: April 30, 2018, 04:54:03 pm
content: Quote from: pixconfig on April 29, 2018, 04:03:15 pmThanks, Its good to know that this effort was useful.I am trying to implement your arduino file, but cannot find the following libraries#include <avr/io.h>#include <avr/interrupt.h>#include <compat/twi.h>where are they ?Thanksupdate : OK, I see that if I use an AVR chip, there is no problem and the libraries are automatically loaded.

author: driver_x
author_rank: Contributor
timestamp: May 02, 2018, 07:51:29 pm
content: Hi again,From my cs310dn:Code:Cyan, high yeld few pages printed (the chip is not original, "compatible" cartridge)uint8_t destinationBuffer = {0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0x1F, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xD7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x65, 0xDA};Yellow, 60% (normal yeld)uint8_t destinationBuffer = {0xFF, 0x7, 0xFF, 0xFF, 0xFF, 0xF, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5B, 0x0, 0x0, 0x50, 0x10, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xAF, 0x0, 0x0, 0x0, 0xAD, 0x27};Magenta(starter) (10%)uint8_t destinationBuffer = {0xFF, 0x0, 0x7F, 0xFF, 0xFF, 0x8D, 0xA, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xEE, 0x0, 0x0, 0x20, 0xA, 0x0, 0x6D, 0x7F, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x1, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xFF, 0xFF, 0x0, 0x0, 0xFF, 0xFF, 0x3, 0x0, 0x0, 0x3, 0xB, 0x0, 0x0, 0x0, 0x4C, 0xB5};Cyan, starter, (empty)uint8_t destinationBuffer = {0xFF, 0x0, 0x3F, 0xFF, 0xFF, 0x8C, 0xA, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x19, 0x0, 0x0, 0x20, 0xF, 0x0, 0x69, 0x7F, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xFF, 0xFF, 0x0, 0x0, 0xFF, 0xFF, 0x3, 0x0, 0x0, 0x3, 0xC, 0x0, 0x0, 0x0, 0x9A, 0x5B};

author: pixconfig
author_rank: Contributor
timestamp: May 08, 2018, 10:18:21 am
content: Hi folks, working back on the printer todayFiguring out that a 2 bytes sized checksum is likely to be CRC 16, and based on the work of qub1n intohttps://stackoverflow.com/questions/10564491/function-to-calculate-a-crc16-checksumWe successfully implemented the checksum used for 2 last bytes. Enjoy !https://www.pixconfig.fr/Lexmark-I2C-TI046B1/QtChecksumI2C.zipNow we are gonna modify all that we can, based of driver_x suggestions and discoveries and test what we can.There is some last issue, after few prints, it's like if cartridge is finding back it's previous level (magenta is empty again, cyan is in "warning almost empty status" again, even with a cartridge full of toner so it's not likely to be due to a physical sensor). May be another place to modify ?PS : JacquesBBB, in fact I included and modified (buffer sizes) twi.h without using wire.h so I place the file "twi-all-included.h" at side of the "I2C_TI046B1_Read.ino" file.

author: amyk
author_rank: Super Contributor
timestamp: May 08, 2018, 11:09:49 am
content: Quote from: pixconfig on May 08, 2018, 10:18:21 amIt might not be this exact printer/model but I remember there being mentions of printers storing the data from the last X cartridges in its own EEPROM. You should try changing the serial number since that's what it uses to detect "simple" reset attempts like these.

author: pixconfig
author_rank: Contributor
timestamp: May 08, 2018, 05:09:57 pm
content: It will be a good idea to check this ! Il will try to print and check.Based on some test and analysis, and a big thank you to driver_x, here is the Full toner level for starter kits cartridgeCode:uint8_t Register56Cyan[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x69, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD3, 0xA2};uint8_t Register56Mage[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6D, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC4, 0x90};It based on the following analysis of the different toner chip contents listed on this forum, so you can build your own 56 bytes register depending on which kind of cartridge you are using.Code:Byte 1 : 0xFF everywhereBytes 2 and 3 : 0xFFFF is full, 0x7FFF after 2 or 3 pages, 0x003F : 0%, 0x007F : 10~20%, 0x01FF for 40%, 0x07FF for 60%,Bytes 4 and 5 : 0xFF everywhereByte 6 : 0x1F for Full or almost full, 0x8C for empty, 0x8D for almost empty with warning sign, 0x0F seen for 30% 40% and 60%.Byte 7 : 0x0A for starter kits, 0x00 for othersBytes 8 to 14 : 0xFF then 0x00, 0x00... everywhereByte 15 and 16 : printed pages : 0x0000 for newBytes 17 18 19 20 : 0x00 for the first byte everywhere, then 0x??, 0x??, 0x?? depending on cartridge. Non proportionnal. 0x00000000 when new or almost newBytes 21 22 23 24 : 0x00 then 3 bytes depending on the cartridge modelback starter : 0x00 61 7F FFcyan starter : 0x00 69 7F FFmagenta starter: 0x00 6D 7F FFyellow starter: 0x00 63 7F FFmagenta 71B20M0 : 0x00 C0 00 00magenta 802HME : 0x00 CD 00 00cyan high yield for CS310dn : 0x00 D7 00 00yellow normal yield for CS310dn : 0x00 52 00 00don't forget to double check when you can, and add new ones when you have !Bytes 25 26 27 28 : 0x00 00 00 00 everywhereBytes 29 and 30 : 0x0000 when new or >= 30%, 0x01 90 (=400) or 0x011D (=285) when warning low level. Final count down rising as approaching the end ?Bytes 31 32 33 34 35 36 37 38 39 40 : 0x 00000... everywhereByte 41 and 42 : 0xFFFF for starter kits, 0x0000 if not starter kitByte 43 and 44 : 0x0000 everywhereByte 45 and 46 : 0xFFFF for starter kits, 0x0000 if not starter kitByte 47 : 0x00 if not used, seen at 0x01 on 2 pages printed, seen as 0x02 if >3 pages, seen at 0x03 when almost (or completely empty)Byte 48 and 49 : 0x0000 everywhereByte 50 and 51 : 0x0000 = new, 0x0001 = few usage, 00AF = ~60%, 0x04C3 = ~40%, 0x0505 = ~30%, 030B and 04C0 = low, 0x04C4 and 0x030C : empty... so when level is low, it's imprevisibleByte 52 53 54 : 0x00 00 00 everywhereByte 55 and 56 : CRC16 Checksum of the 54 previous bytesSo if I'm not wrong, the full level of starter black and starter yellow would be :Code:uint8_t Register56Black[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x61, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFD, 0xC6};uint8_t Register56Yellow[56+4] = {0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x1F, 0x0A, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63, 0x7F, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF6, 0x5F};But it should be tested; if it does not work, then we should check the checksum or the cartridge type bytes.Let's check if the level is changing normally when we print some big pictures ! If not, then it's probably because of what amyk describes. I will watch how the reference number of the cartridge can be changed, probably into the 208 bytes field.

author: driver_x
author_rank: Contributor
timestamp: May 08, 2018, 06:14:54 pm
content: Hi againI have made the same analysis with similar result.Now, after I've read some patents (for example this:https://patentimages.storage.googleapis.com/32/30/7a/832cd3e5de56ed/US5995774.pdf), my question is : do we have or not lockout bits (bits that, once written, cannot be modified)? Only 1 write once bit is needed to mark that the cartridge is depleted and all our work is for nothing.

author: driver_x
author_rank: Contributor
timestamp: May 08, 2018, 06:29:35 pm
content: Now, of course the printer it's checking the toner level using it's mechanical parts (wheels, torque sensors etc) so if you write 100% toner on the chip and the printer is sensing something else, probably it will tell you that the cartridge is defective and needs to be replaced. My opinion is that first you must fill the cartridge with toner, write the new information to the chip and after this to try inserting it in the printer.I have two new readings, for the balck cartridges:Code:Black starter - empty:uint8_t destinationBuffer = {0xFF, 0x0, 0x3F, 0xFF, 0xFF, 0xC, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xF5, 0x0, 0x0, 0x60, 0x15, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x88, 0x0, 0x0, 0x0, 0x0, 0x67};Black- High Yeld ~90%:uint8_t destinationBuffer = {0xFF, 0x1F, 0xFF, 0xFF, 0xFF, 0xF, 0x0, 0xFF, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xB0, 0x0, 0x0, 0xD0, 0xB, 0x0, 0xD1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, 0xBC, 0x15};

author: pixconfig
author_rank: Contributor
timestamp: May 09, 2018, 12:34:22 pm
content: Hi,In fact there is good news, even with an almost empty cartridge, the system is working fine when we put the correct 100% values, we successfully consumed some toner and had the cyan toner level slightly reduced (from 100% to 90%) after some big pictures prints.And the 56 bytes register values of full start Black and full starter Yellow are good too :We will probably see some missing colors soon or late into the prints, once the cartridge will be completely emptied, even when the "toner level" will be indicating some remaining amount of toner. I would not be surprised if the printer is unable to see if toner is really here or not : the only things that connects the imaging drums and cartridge to the printer are mechanical gears and I2C bus for toner chips. The laser probably "touch" the imaging drums without having to connect anything else but photons, and if there is missing toner powder, then may be nothing can see it, but our eyes once the document is printed.The fact that, few days ago, the toner chip previous level was restored by the printer, is probably due to the fact that the "Yellow" cartridge type was copied into the others (our first try) and it was probably not a completely good idea, of course, since every cartridge has it own type bytes into the 56 bytes register (then it should probably be respected - it's what we dit yesterday and it seems better).Also, may be the fact that the 56 bytes register is written 2 times is a way to give a second chance to read the data when it's corrupted or abnormal. Then, if it's not enough, then the printer probably keeps a local copy of those register in order to restore it (probably what happened).And a final good thing to know, at least for starter kit : the chip was indicating "empty", "0 pages left", no print possible, and we succeeded in putting "100%" level into it.

author: driver_x
author_rank: Contributor
timestamp: May 09, 2018, 08:14:03 pm
content: So they calculate the remaining toner only by estimating how much powder has been used based on the number of pages printed (or maybe based on how many rotations the mirror has made)I thought that the motor that is turning the cartridge's wheels had some kind of torque sensor, so in case that the number stored in the cartridge becames "corrupt", the printer to be able to estimate again the quantity of remained toner, as stated in their patent:Quotehttps://patents.google.com/patent/US7747180?oq=lexmark+toner+levelAnyway, thank you for all the hard work

author: pixconfig
author_rank: Contributor
timestamp: May 28, 2018, 03:55:32 pm
content: Hi everybody !We still had some issues, sometimes, with the cartridge emptying a little bit too fast (sometimes way too fast, after less than 50 pages), even when full of toner into the cartridge.So we tried to figure out what is into the 208 bytes register at 0x01 > 0x90There is a 30 bytes UUID around the end of this 208 bytes register, that finishes with the famous CRC16 (the one that we are now, of course, able to check/complete). All the rest is completely fulfilled with 0x00 for a brand new cartridge.Here is the analysis :https://www.pixconfig.fr/Lexmark-I2C-TI046B1/208byte-analysis.odsAnd after a lot of uses, we finally see some changes into this register, so it should be reset too.We updated the Arduino code in order to auto-reset the connected cartridges, keeping the information that should be kept, and recalculating the CRC16 automatically at the end for both 56 and 208 bytes registers.It firstly reads the content of every register before changing the values that should be changed, automatically.Enjoy !https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Reset.zipMay be at the end it would be nice to try to modify the 30 bytes UUID, but let's first try to see if it works without changing it.

author: AndreiKenig
author_rank: Contributor
timestamp: May 29, 2018, 12:40:00 pm
content: I know exactly where to store the cartridge capacity for Lexmark MS\MX. I ask to lay out a chain of 448 bytes starting from 02_40_04 for Lexmark CS order in to verify in the same place the capacity of the cartridge is stored in the Lexmark of the CS or not.

author: pixconfig
author_rank: Contributor
timestamp: May 31, 2018, 02:39:00 pm
content: Hi,Thank you much for this information !Do you succeeded to write this area ? I didn't succeeded.01>40>04 is located at (4x256 + 64) bytes and is read during 448 bytes, so from 1024+64 to 1536 bytes (it's like if the printer reads from 1024 to 1024+512 but without the 64 first bytes).Did you guess some interpretation of what's inside this register ? I see there is some ASCII strings but also some binary datas and lot of "0x00".Here is the content of a brand new chip I have :But it's not compatible with my printer... anyway it's still interesting to watch what is inside and compare with others.My persistent problem of today is : the printer says my magenta cartridge reached end of life at each print.So I finally tried to change the 30 bytes UUID inside the 02>90>00 register but after any print, it says "end of life" for the magenta cartridge, again.No problem with the others, that's pretty strange, may be there is a real physical problem with the magenta but it is completely new and full, I just changed the chip to play a little bit and understand how those chips works, and because the original chip of this cartridge says "not compatible with this printer". I also checked if the cartridge is, physically, the same, and yes obviously. I have no more idea for the moment !I guess the 12 first bytes of 01>40>04 (that contains the same barcode stuck on the cartridge sticker) should be changed too; It may have som key procedure to write this area (starting to a precise byte during a precise length for having the chip accepting the written value ?)

author: Arturo2511
author_rank: Newbie
timestamp: June 01, 2018, 02:14:36 am
content: hello,from my research, the problem comes from the fact that the chip retains the number of copies made since the beginning. When the cartridge is reset to 0, that if it is 100% but the copy number remains unchanged. The printer will check if the number of copies is less than or equal to the maximum capacity of the printer. After resetting a chip with 80% remaining but the number of copies unchanged (1538 copies / 1500 max) that if automatically becomes empty after the first impressions while he had 80% of free (it went from 100% - > 0). I did not manage to dump the memory of the chip to compare the data before and after. If you had an arduino program to read the whole of the chip, I'm interested. I communicate with the chip by i2c but 10-bit registers are difficult to read with an arduino.

author: driver_x
author_rank: Contributor
timestamp: June 02, 2018, 02:31:37 pm
content: Hi, you can find the program and instructions for reading/writing the chip with arduino in the previous posts. We managed to find where on the chip is stored the number of printed pages and also where is stored the actual toner level, so the problem is not here.Maybe the printer is also storing into its internal memory(not on the cartridge) the serial number of the cartridge along with a timestamp and probably more information about the cartridge.

author: AndreiKenig
author_rank: Contributor
timestamp: June 09, 2018, 12:47:44 am
content: What data is stored in the chip from Lexmark CS series with offset 0x045f and 0x0460? In the lexmark MS/MX, if you transfer this data to the DEC, you get the capacity of the cartridge. I tested this on more than 10 different models of the cartridge.

author: pixconfig
author_rank: Contributor
timestamp: June 28, 2018, 09:59:05 pm
content: Hi,At offset 0x045f and 0x0460 (by reading 0x01 > 0x5F > 0x04 during 2 bytes) we found 0x60 and 0x12 on starter kits cartridges.We have been unable to write after offset 0x400 (past 0x02 > 0x00 > 0x04).We tried by replacing the 0x02 first byte with any value from [0x00 to 0xFF] but it did nothing.We also tried to write at 0x02 > 0x00 > 0x08 (so at offset 0x800 which is 2048) and 0x02 > 0x00 > 0x0C (so at offset 0xC00 which is 3072) but it did nothing too.We are out of ideas nowWe also tried to reset to factory setting the printer (by typing 2 + 6 at power on for entering into maintenance menu), with no cartridge in the printer, and we placed the cartridge after, with an almost new magenta cartridge but an empty reset starter kit chip on it, and we were disconnected from network during all this. After few minutes it said again that the magenta cartridge is "end of life" with 0 page left.Finally, we had some return from some people, that the Reset Program for Arduino corrupted some toner chip information after having fail to read the content before modifying it, but successfully writing it back to the toner chip... with a lot of 0x00 !So we modified the program in order not to write anything if the reading fails before. The new version is here :https://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Reset.zipAny more idea is welcome !Bye

author: AndreiKenig
author_rank: Contributor
timestamp: June 29, 2018, 09:28:37 pm
content: Все изменения в дампе картриджа должны быть подписаны хэшем который храниться в дампе начиная со смещения 0х700. Чтение и изменения хэша происходит через посылку 14 байт в регистр 81. И только после декодирования запросов в 81 регистр и ответов в регистр 80 можно будет полноценно восстанавливать чипы.

author: pixconfig
author_rank: Contributor
timestamp: July 01, 2018, 05:13:33 pm
content: QuoteHi AndreiKenig, Thank your for this answer, actually the printers does a ton of exchanges on 0x81 and associated registers. I believed this was only a "genuine check" when I successfully edited the cartridge level for the first time so I didn't looked after it for a while, but now that we realize there is something else, this make sense to watch again over it!Here is what I saw when I watched it for the first time with the dsPIC :0x82 is a kind of Status Register that the printers reads before asking anything to 0x81 or 0x80 :status 0x38 is "nothing more to say, please enter something into 0x81"status 0x48 is "0x81 Register received 0x08" (lets call this mode 0x08)status 0x88 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x08status 0x49 is "0x81 Register received 0x09" (lets call this mode 0x09)status 0x89 is the following step : 14 bytes question has been write into 0x81 after having entered mode 0x090x80 is an information register where 16 bytes are read after having write the 0x81 register as described before, by 0x08 or 0x09 in a first time and then 14 bytes in a second timeI also noticed after that in the middle of the 16 bytes answer inside 0x82, there is two bytes that never changes on each cartridge

author: AndreiKenig
author_rank: Contributor
timestamp: July 02, 2018, 11:53:34 pm
content: Работа с регистрами 81 и 80 идёт циклами сначала с тонер картриджем затем с драм картриджем. Принтер выходит в готовность когда при последнем ответе в регистре 80 драм картриджа 15 байт начиная с 0 передаёт значение 0х88 (истина).

author: AndreiKenig
author_rank: Contributor
timestamp: July 02, 2018, 11:58:19 pm
content: 0x82 - это своего рода регистр состояния, который печатает на принтере, прежде чем спрашивать что-либо 0x81 или 0x80:статус 0x38 «больше нечего сказать, пожалуйста, введите что-то в 0x81 «status 0x48 -« 0x81 Регистр получен 0x08 »(позволяет вызывать этот режим 0x08)status 0x88 является следующим шагом: 14 байтов вопрос записывается в 0x81 после ввода режима 0x08статус 0x49 - «0x81 Регистр принят 0x09» (позволяет вызывать этот режим 0x09).0x89 - это следующий шаг: вопрос 14 байтов записывается в 0x81после ввода режима 0x090х98 - ошибка, картридж заблокированпосле в ответе регистр 0х80 будет 16 байт 0х00

author: Alan.B
author_rank: Contributor
timestamp: July 08, 2018, 11:16:47 pm
content: Hello friends!Excellent work. I tell you that I have similar chips, attached photo and circuit of it; These days I get a new chip and I would like to be able to test the chips that are already used. How is the address of the Ti046B1? My circuit varies a bit from the circuit found in the first posts. Is it possible to do a full dump to the new chip that is about to arrive in a few days, with the program for arduino shared by the pixconfig friend?Regards!

author: AndreiKenig
author_rank: Contributor
timestamp: July 09, 2018, 05:57:07 pm
content: Полный дамп снять не получиться. Адреса с 0х00 по 0х1F, c 0x170 по 0x3FF и c 0x700 по 0x7FF считать будет невозможно. Вернее данные в них будут ошибочны либо 00 либо FF. Вышеуказанные области защищены от прямого чтения.

author: Alan.B
author_rank: Contributor
timestamp: July 10, 2018, 09:29:12 pm
content: Perfect! Thank you!I will try to use my Saleae Logic Analyzer and see if I get more information about it. At the moment I am building a logic level converter to protect the memory. Unfortunately, my logic analyzer only works with 8-bit i2c readings, but I think the data can be interpreted anyway. If someone has the time, the knowledge and the desire, could modify the *.dll´s starting from the SDK of Saleae and I will gladly use it to make readings in the printer and observe what happens with the addresses that you mention in the previous post.Regards!

author: Alan.B
author_rank: Contributor
timestamp: July 12, 2018, 08:47:30 pm
content: Quote from: maxic81 on July 12, 2018, 06:37:15 amHello Friend!The circuit that I attach in my post is correct! The one that you attached in your post is not correct!

author: Alan.B
author_rank: Contributor
timestamp: July 13, 2018, 01:30:48 am
content: Hello again!I can not get the pixconfig source code to work to read the chipsI already tried 9 chips but nothing yet ...This is the error that throws "Error occured wile trying to write to the slave: Slave's address not acknowledged (begning only) - is it connected?"My configuration is Arduino -> Logic Level -> ChipAccording to what I read it may be an error in my i2c address, does anyone know how I calculate the address of the Ti046b1?Regards!

author: Technics66
author_rank: Contributor
timestamp: July 13, 2018, 07:31:05 pm
content: I do not speak english. I use Google translate.The chip from the printer MX410 capacity of 5000 pages. The starter cartridge printed 5200+ pages. It is not blocked. Log of reset of the chip by the programmer DelCopi. I do not yet have a mega 2560 r3 to read and write a chip, but there is a programmer to reset the chip, but it's paid. In the future, I want to convert a sketch to Arduino to reset free and change serial number.

author: Alan.B
author_rank: Contributor
timestamp: July 13, 2018, 10:17:29 pm
content: Quote from: Technics66 on July 13, 2018, 07:31:05 pmHello Friend!Seeing on the internet, the chip of the model that you commented "MX410" is exactly the same as my "MS810" chip ...The log that you shared, is a chip reset to new?If so, it would be useful to perform tests on my chip.Regards!

author: Technics66
author_rank: Contributor
timestamp: July 14, 2018, 04:01:27 am
content: Quote from: Alan.B on July 13, 2018, 10:17:29 pmYes. But when the chip was reset, the programmer gave an error. I can check the chip later.In the sketch pixconfig when reading 01> 20> 00 reads 56 bytes, and in the logs read 16 bytes. A very big difference in the methods of reading between the sketch and the logs.

author: AndreiKenig
author_rank: Contributor
timestamp: July 14, 2018, 08:27:43 am
content: Чтение и запись данных по адресам диапазона с 0х700 по 0х7FF производится через команды в регистр 0х81

author: AndreiKenig
author_rank: Contributor
timestamp: July 14, 2018, 12:29:41 pm
content: Quote from: Technics66 on July 14, 2018, 10:33:33 amЯ читаю своим программатором строки по 16 байт и у меня проблемы не возникают

author: Alan.B
author_rank: Contributor
timestamp: July 15, 2018, 10:40:48 pm
content: Quote from: Technics66 on July 13, 2018, 07:31:05 pmFriend! Analyzing your log "Log_MX410", after consulting the model in the registry 0x01 0x50 0x04, the programmer obtains the 14 bytes to record in the registry 0x81. Has anyone already discovered how this is done?I also want to tell you that I modified the functions created by pixconfig a bit, when I have it completely ready it will be posted, but for now I need to know how to calculate the 14 bytes for the 0x81 register.Regards!

author: Alan.B
author_rank: Contributor
timestamp: July 17, 2018, 01:23:53 am
content: More info friends, look what happens with a blocked chip (0x98) and a new chip (0xC8), send anything in the register 0x81, but at least tell us what are the fixed bytes and which change...Regards!Code:-------------------------------------------------------------------------------------------------------------BLOCKED CHIP-------------------------------------------------------------------------------------------------------------Send: 0x03 | Response: 00Send: 0x83 | Response: F0Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)Send: 0x82 | Response: 38Send: 0x81, 0x08 | Response: FFSend: 0x82 | Response: 48Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FFSend: 0x82 | Response: 98Send: 0x80 | Response: 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00-------------------------------------------------------------------------------------------------------------NEW CHIP-------------------------------------------------------------------------------------------------------------Send: 0x03 | Response: 00Send: 0x83 | Response: F0Send: 0x01,0x50,0x04 | Response: 078F0040353244344830300000000D61 (52D4H00)Send: 0x82 | Response: 38Send: 0x81, 0x08 | Response: FFSend: 0x82 | Response: 48Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FFSend: 0x82 | Response: C8Send: 0x80 | Response: 00 00 00 00 00 00 5A06 00 00 00 00 00 00 00 80

author: amyk
author_rank: Super Contributor
timestamp: July 17, 2018, 01:29:51 am
content: Please keep the discussion in English, translate it yourself before posting, this is an interesting topic but hard to read if everyone has to use Google Translate themselves.

author: Technics66
author_rank: Contributor
timestamp: July 17, 2018, 07:24:06 am
content: Quote from: Alan.B on July 17, 2018, 01:23:53 amPlease give your sketch.I have 5 chips locked and 3 chips not locked.I can check with your sketch sooner.

author: Alan.B
author_rank: Contributor
timestamp: July 17, 2018, 10:01:38 pm
content: Quote from: Technics66 on July 17, 2018, 07:24:06 amOf course I share it with you! Sorry for my English helped me with Google translator.If you get successful results, please share them with the community!Regards!Code:#include "twi-all-included.h"void setup(){Serial.begin(9600); //[Start+8bits+STOP] => 960 o/stwi_init(); //Standard 100 kHz Atmel's internal I2C device initialisation with Pull-Up on SDA/SCL}void read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom){uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSBuint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB//Put the MSB bits to the Left :slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003//7 bits address equivalent for the begining :uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.//Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.uint8_t txBuffer[registerSize + 1];for(uint8_t i = 0; i < sizeof(txBuffer); i++){if(i==0){txBuffer = slave_address_LSB;}else{txBuffer = registerBuffer[i-1];}}uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);if (nRet == 1){//it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().//Serial.println("Error occured wile trying to write to the slave : TWI class's buffer is too small");Serial.println("W1");return;}else if (nRet == 2){//it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().//Serial.println("Error occured wile trying to write to the slave : Slave's address not acknowldged (begning only) - is it connected ?");Serial.println("W2");return;}else if (nRet == 3){//it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().//Serial.println("Error occured wile trying to write to the slave :");//Serial.println("Slaves's begining of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?");Serial.println("W3");return;}else if (nRet == 4){//it seems, reading TWI code, that the stop is sent anyway when there is a NACK. No need to call twi_stop().//Serial.println("I2C protocol error occured wile trying to write to the slave. Is the wiring correct ? TWI Initialisation ?");Serial.println("W4");return;}//else :nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end.if (nRet == 0x00){//Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.//Serial.println("Error occured wile trying to read from the slave.");Serial.println("R1");return;}if (nRet != readSize){//Incomplete reading : twi_stop() already done anyway when there is a NACK on Addr + read.Serial.print("Unable to read all the bytes from the slave : ");Serial.print(nRet, DEC);Serial.println(" bytes read");return;}//else :for (uint16_t i=0; i<readSize; i++){//Serial.print("0x");if (destinationBuffer < 0x10){Serial.print(0, HEX);Serial.print(destinationBuffer, HEX);}else{Serial.print(destinationBuffer, HEX);}}Serial.println("");}//Delcopi sequence obtained from "Log_MX410" by Technics66uint8_t a = {0x03};uint8_t a_;uint8_t b = {0x83};uint8_t b_;uint8_t c = {0x01,0x50,0x04};uint8_t c_;uint8_t d = {0x82};uint8_t d_;uint8_t e = {0x81, 0x08};uint8_t e_;uint8_t f = {0x82};uint8_t f_;uint8_t g = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};uint8_t g_;uint8_t h = {0x82};uint8_t h_;uint8_t i = {0x80};uint8_t i_;void loop(){char command = getCommand();switch (command){case 'a':Serial.print("Send: 0x03 | Response: ");//read_TI046B1_register(ADDR, CMD, sizeof(CMD), BUFFER_RESPONSE, sizeof(BUFFER_RESPONSE), STOPCOM 1|0);read_TI046B1_register(0x000, a, sizeof(a), a_, sizeof(a_), 0);break;case 'b':Serial.print("Send: 0x83 | Response: ");read_TI046B1_register(0x000, b, sizeof(b), b_, sizeof(b_), 0);break;case 'c':Serial.print("Send: 0x01,0x50,0x04 | Response: ");read_TI046B1_register(0x000, c, sizeof(c), c_, sizeof(c_), 0);break;case 'd':Serial.print("Send: 0x82 | Response: ");read_TI046B1_register(0x000, d, sizeof(d), d_, sizeof(d_), 0);break;case 'e':Serial.print("Send: 0x81, 0x08 | Response: ");read_TI046B1_register(0x000, e, sizeof(e), e_, sizeof(e_), 1);break;case 'f':Serial.print("Send: 0x82 | Response: ");read_TI046B1_register(0x000, f, sizeof(f), f_, sizeof(f_), 0);break;case 'g':Serial.print("Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: ");read_TI046B1_register(0x000, g, sizeof(g), g_, sizeof(g_), 1);break;case 'h':Serial.print("Send: 0x82 | Response: ");read_TI046B1_register(0x000, h, sizeof(h), h_, sizeof(h_), 0);break;case 'i':Serial.print("Send: 0x80 | Response: ");read_TI046B1_register(0x000, i, sizeof(i), i_, sizeof(i_), 0);break;}}char getCommand(){char c = '\0';if (Serial.available()){c = Serial.read();}return c;}

author: Technics66
author_rank: Contributor
timestamp: July 18, 2018, 01:54:59 pm
content: Alan.BYour sketch does not work. There is no information in the terminal.I'm using Arducopter on ATMEGA 2560.I found out that the page counter is located at 0xE1 2 byte.I have several dumps from different chips. Are they needed?

author: Alan.B
author_rank: Contributor
timestamp: July 18, 2018, 10:08:50 pm
content: Friends!maxic81:Reading errors I solved by removing the resistors in the SDA and SCL lines.Technics66:I'm using the sketch I uploaded in the previous post, are you adding the library "#include" twi-all-included.h ""?I would like you to upload your dumps, all information is valuable.To add information...Reading one of the printer's manufacturer's patents, they indicate that the authentication KEY is stored in memory, it only changes when new changes are made to it.Regards!PS: I continue to investigate

author: Technics66
author_rank: Contributor
timestamp: July 19, 2018, 09:26:36 am
content: Alan.BSorry. I did not understand that I should enter a, b, c, d ... The sketch works.Code:------ UnBlock-----Send: 0x03 | Response: 00Send: 0x83 | Response: F0Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909Send: 0x82 | Response: 38Send: 0x81, 0x08 | Response: FFSend: 0x82 | Response: 48Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FFSend: 0x82 | Response: 88Send: 0x80 | Response: BD98F565CCE0D40116CBB70880CDB38A---Send: 0x03 | Response: 00Send: 0x83 | Response: F0Send: 0x01,0x50,0x04 | Response: 01F80050323446303030320000000909Send: 0x82 | Response: 38Send: 0x81, 0x08 | Response: FFSend: 0x82 | Response: 48Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FFSend: 0x82 | Response: 88Send: 0x80 | Response: BD98F565CCE0C7017B0EE30DF199F38B---Send: 0x03 | Response: 00Send: 0x83 | Response: F0Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913Send: 0x82 | Response: 38Send: 0x81, 0x08 | Response: FFSend: 0x82 | Response: 48Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FFSend: 0x82 | Response: 88Send: 0x80 | Response: BD98F565CCE0F0015709189211715C84-----Block-----Send: 0x03 | Response: 00Send: 0x83 | Response: F0Send: 0x01,0x50,0x04 | Response: 03AD0050323446303030330000000913Send: 0x82 | Response: 38Send: 0x81, 0x08 | Response: FFSend: 0x82 | Response: 48Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FFSend: 0x82 | Response: 98Send: 0x80 | Response: 00000000000000000000000000000000---Send: 0x03 | Response: 00Send: 0x83 | Response: F0Send: 0x01,0x50,0x04 | Response: 01940050323446313338320000000905Send: 0x82 | Response: 38Send: 0x81, 0x08 | Response: FFSend: 0x82 | Response: 48Send: 0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35 | Response: FFSend: 0x82 | Response: 98Send: 0x80 | Response: 00000000000000000000000000000000The programmer DelCopi badly flushes the chip. He writes that 500 pages are printed.Мemory addresses where the information:0x00E1-0x00E2 Number of pages printed //0x16, 0x32 (5682 pages)0x0440-0x044B Serial number //0x43, 0x41, 0x44, 0x31, 0x37, 0x33, 0x31, 0x38, 0x31, 0x35, 0x34, 0x33 (CAD173181543)0x0453-0x045A Model //0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x33 (P24F0003)0x045F-0x0460 Volume of the cartridge //0x13, 0x88 (5000)Attaching dump chips. In the name "reset" this chip was dropped and after that printed.

author: Technics66
author_rank: Contributor
timestamp: July 19, 2018, 06:21:57 pm
content: Log reset of the chip P24F1382 (Starter MX317) by the programmer DelCopi without error after completion.

author: Alan.B
author_rank: Contributor
timestamp: July 19, 2018, 10:16:19 pm
content: Friend, thank you for your logs, they are very helpful!Could you add these lines to the sketch? They are to make a full dump of the chip! And I would need you to upload those dumps, especially the reset chip and if you can also do a full dump of a chip before the reset with delcopi and after the reset, better!Code://In variablesuint8_t k = {0x01, 0x00, 0x00};uint8_t k_;uint8_t l = {0x01, 0x00, 0x04};uint8_t l_;//In "switch" functioncase 'k':Serial.print("Send: 0x01, 0x00, 0x00 | Dump1: ");read_TI046B1_register(0x000, k, sizeof(k), k_, sizeof(k_), 0);break;case 'l':Serial.print("Send: 0x01, 0x00, 0x04 | Dump2: ");read_TI046B1_register(0x000, l, sizeof(l), l_, sizeof(l_), 0);break;

author: AndreiKenig
author_rank: Contributor
timestamp: July 22, 2018, 06:40:16 pm
content: Quote from: Technics66 on July 19, 2018, 09:26:36 amNumber of pages printed 0x131, 0x132

author: Technics66
author_rank: Contributor
timestamp: July 23, 2018, 03:47:28 pm
content: Quote from: AndreiKenig on July 22, 2018, 06:40:16 pmI noticed that 0x0C0-0FF = 0x110-0x14F.There are new cartridges P50F5H00. I took the dumps from the new one installed in the printer 317, installed in the MFP410 and printed pages.

author: Alan.B
author_rank: Contributor
timestamp: July 24, 2018, 01:51:29 am
content: Technics66! You would have some chip of these 24D0002, 52D4000, 52D4H00, 52D4X00. They are the ones that I have, but I can not authenticate in the registry 0x81; and I think if you try to read with Delcopi any of these in the log you could get an authentication key and it would be very useful ...I leave you a new sketch, which optimizes a bit the use of memory in global variables.With "t", perform a test chip (chip information)with "d", perform a full dump of the chip.Regards!Code:#include "twi-all-included.h"void setup(){Serial.begin(9600);twi_init();}bool read_TI046B1_register(uint16_t TenBits_slave_address, uint8_t * registerBuffer, int registerSize, uint8_t * destinationBuffer, uint16_t readSize, bool stopCom){uint16_t slave_address_LSB = TenBits_slave_address & 0x0FF; //0076543210 //8 LSBuint16_t slave_address_MSB = TenBits_slave_address & 0x300; //9800000000 //2 MSB//Put the MSB bits to the Left :slave_address_MSB = slave_address_MSB >> 8; //For example, 0x300 becomes 0x003//7 bits address equivalent for the begining :uint8_t SevenBits_compat_address = 0x78 | slave_address_MSB; //TWI library will put send those 7 bits followed by read/write bit.//Preparation of the write buffer : 8LSB of the slave's address, then 3 bytes writes to call a register read.uint8_t txBuffer[registerSize + 1];for(uint8_t i = 0; i < sizeof(txBuffer); i++){if(i==0){txBuffer = slave_address_LSB;}else{txBuffer = registerBuffer[i-1];}}uint16_t nRet = twi_writeTo(SevenBits_compat_address, txBuffer, sizeof(txBuffer), 1, stopCom);if (nRet == 1){Serial.println("W1");return;}else if (nRet == 2){Serial.println("W2");return;}else if (nRet == 3){Serial.println("W3");return;}else if (nRet == 4){Serial.println("W4");return;}nRet = twi_readFrom(SevenBits_compat_address, destinationBuffer, readSize, true); //xxx bytes read with a Stop at the end.if (nRet == 0x00){Serial.println("R1");return;}if (nRet != readSize){Serial.println("R2");return;}if (nRet == readSize){for (uint16_t i=0; i<readSize; i++){//Serial.print("0x");if (destinationBuffer < 0x10){Serial.print(0, HEX);Serial.print(destinationBuffer, HEX);}else{Serial.print(destinationBuffer, HEX);}if(i != readSize) Serial.print(" ");}Serial.println("");return true;}}//DelCopi Secuenceuint16_t a_ = 1, b_ = 1, c_ = 16, d_ = 1, e_ = 1, f_ = 1, g_ = 1, h_ = 1, i_ = 16, k_ = 1024, l_ = 1024;uint8_t a = {0x03};uint8_t b = {0x83};uint8_t c = {0x01,0x50,0x04};uint8_t d = {0x82};uint8_t e = {0x81, 0x08};uint8_t f = {0x82};uint8_t g = {0x81, 0x4E, 0x86, 0x61, 0xAE, 0x96, 0x54, 0xC2, 0x31, 0xFA, 0xC6, 0x2D, 0x53, 0x74, 0x35};uint8_t h = {0x82};uint8_t i = {0x80};//Full Dump!uint8_t k = {0x01, 0x00, 0x00};uint8_t l = {0x01, 0x00, 0x04};//One Buffer for all!uint8_t rxBuffer;void loop(){char command = getCommand();switch (command){case 't': //Test ChipSerial.print("Send: 03 \t\t\t\t\t\t| Response: ");read_TI046B1_register(0x000, a, sizeof(a), rxBuffer, a_, 0);Serial.print("Send: 83 \t\t\t\t\t\t| Response: ");read_TI046B1_register(0x000, b, sizeof(b), rxBuffer, b_, 0);Serial.print("Send: 01 50 04 \t\t\t\t\t\t| Response: ");read_TI046B1_register(0x000, c, sizeof(c), rxBuffer, c_, 0);Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");read_TI046B1_register(0x000, d, sizeof(d), rxBuffer, d_, 0);Serial.print("Send: 81 08 \t\t\t\t\t\t| Response: ");read_TI046B1_register(0x000, e, sizeof(e), rxBuffer, e_, 1);Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");read_TI046B1_register(0x000, f, sizeof(f), rxBuffer, f_, 0);Serial.print("Send: 81 4E 86 61 AE 96 54 C2 31 FA C6 2D 53 74 35 \t| Response: ");//81 4E 86 61 AE 96 54 C2 31 FA C6 2D 53 74 35read_TI046B1_register(0x000, g, sizeof(g), rxBuffer, g_, 1);Serial.print("Send: 82 \t\t\t\t\t\t| Response: ");read_TI046B1_register(0x000, h, sizeof(h), rxBuffer, h_, 0);Serial.print("Send: 80 \t\t\t\t\t\t| Response: ");read_TI046B1_register(0x000, i, sizeof(i), rxBuffer, i_, 0);Serial.println("");break;case 'd': //Dump ChipSerial.print("Full Dump: ");read_TI046B1_register(0x000, k, sizeof(k), rxBuffer, k_, 0);read_TI046B1_register(0x000, l, sizeof(l), rxBuffer, l_, 0);Serial.println("");break;}}char getCommand(){char c = '\0';if (Serial.available()){c = Serial.read();}return c;}

author: Bigkim
author_rank: Contributor
timestamp: July 24, 2018, 06:06:11 am
content: I work for a company that sells generic cartridges that are not refilled, but are manufactured by a different company.Our chips no only give a "Full" reading at all times,but more importantly trick the printer into thinking that a cartridge is original.We actually find that "compatables" cost less than refilling, and since refilling is messy, and a lot of "toner empty" notifications are actually mechanical problems in disguise, so we have found compatables a better route.Printer companies spend a lotta time trying to keep non-original compatable cartridges outta their printers, and often try to "root" us out with frequent "printer upgrades" by email.Luckily our Asian suppliers keep one step ahead of them, as are one of Amazons top suppliers, with 100% customer satisfaction, over 20 years.

author: Technics66
author_rank: Contributor
timestamp: July 26, 2018, 01:57:01 pm
content: By studying the reset and use logs, I concluded that there are 5 blocks with data. At the end of each block there seems to be a checksum (CRC16).1. 0x020 - 0x0BD. CRC in 0x0BE-0x0BF (158 byte + 2 byte CRC16)2. 0x0C0 - 0X0E9. CRC in 0x0EA-0x0EB (42 byte + 2 byte CRC16)3. 0x0EC - 0x10D. CRC in 0x10E-0x10F (32 byte + 2 byte CRC 16)4. 0x110 - 0x139. CRC in 0x13A-0x13B = block 2 (42 byte + 2 byte CRC16)5. 0x13C - 0x15D. CRC in 0x15E-0x05F = block 3 (32 byte + 2 byte CRC 16)I'm not sure about the checksums, but when resetting the programmer in these addresses writes data that is not read anywhere. Check and understand what kind of data I could not.

author: Technics66
author_rank: Contributor
timestamp: July 27, 2018, 08:28:31 am
content: Sorry. In the previous message, the .xls file is not incorrect. The data was truncated while saving in the xls. The full xlsx file is in the archive.UPD.Using the code for calculating the checksumCode:uint16_t crc16(const uint8_t* data_p, uint8_t length){uint8_t x;uint16_t crc = 0xFFFF;while (length--){x = crc >> 8 ^ *data_p++;x ^= x >> 4;crc = (crc << 8) ^ ((uint16_t)(x << 12)) ^ ((uint16_t)(x <<5)) ^ ((uint16_t)x);}return crc;}Computed that 3 blocks and not 5.1. 0x020 - 0x0BD. CRC16 in 0x0BE-0x0BF (158 byte + 2 byte CRC16)2. 0x0C0 - 0x10D. CRC16 in 0x10E-0x10F (78 byte + 2 byte CRC 16)3. 0x110 - 0x15D. CRC16 in 0x15E-0x15F (78 byte + 2 byte CRC 16) = block2I will write a sketch for resetting the chip.

author: AndreiKenig
author_rank: Contributor
timestamp: July 27, 2018, 06:04:21 pm
content: 0x450 0x451 Initial Quanta (константа расчёта расхода тонера) постоянная0xE3 0xE4 Изменяемая кванта0x133 0x134 = 0xE3 0xE4 Изменяемая квантаInitial Quanta значение по которому рассчитывается расход тонера на печатьИзменяемая кванта - откорректированное значение Initial Quanta в зависимости от вращения мешалки картриджаТак же "изменяемая кванта" меняется от результата проверки OEM или NotOEM

author: Alan.B
author_rank: Contributor
timestamp: July 27, 2018, 09:05:20 pm
content: Quote from: Technics66 on July 27, 2018, 08:28:31 amTechnics66:Analyzing your dumps, I saw that by inserting the cartridge with the new chip, the printer makes changes to the serial number ... Could you connect the analyzer and take data from all this? I was left without the printer, it was from a client, but I want to continue with the investigation.I attach your dumps, I turned them into bin.Regards!

author: AndreiKenig
author_rank: Contributor
timestamp: July 27, 2018, 09:22:17 pm
content: Quote from: Alan.B on July 27, 2018, 09:05:20 pmThe printer never changes the serial number of the chip, which is in the range 0x440 - 0x44b and consists of 12 bytesAnd attached dumps are not suitable for analysis, because there are a lot of incorrectly read data in them.

author: Technics66
author_rank: Contributor
timestamp: July 28, 2018, 04:00:49 am
content: Alan.BThe serial number does not change. You took the dump from another chip. I spread two dumps from 50F5H00 with different serial numbers (CAP142340A90 & CAS1218556D7).AndreiKenigIs it possible to take a complete dump with TI046B1? Full dump can only be read directly from FRAM. I have not come across chips which could be considered a dump.

author: Kulick
author_rank: Newbie
timestamp: August 08, 2018, 05:25:40 pm
content: Hi, friends.There are devices, there are chips and empty and new. Need help?Can I join the decision?Thanks.

author: driver_x
author_rank: Contributor
timestamp: August 09, 2018, 09:37:01 pm
content: Quote from: pixconfig on April 07, 2018, 10:57:20 amThis looks like the chip authenticating protocol described here:https://patents.google.com/patent/US20060224889A1/en?q=md5&assignee=lexmark

author: driver_x
author_rank: Contributor
timestamp: August 20, 2018, 10:20:38 pm
content: Here's some info i've discovered so far:The size of the FRAM is 2048 bytes. The size is specified here :http://techinsights.com/reports-and-subscriptions/open-market-reports/Report-Profile/?ReportKey=CAR-1504-802. Also you can verify this by trying to read addresses bigger than 2048 bytes, it will start to read from the beginning.The corespondence of the memory offsets and the registers discovered by pixconfig here:https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1472727/#msg1472727is the following:Register 0x01>0x20>0x04 = memory offset 0x0420 = 1056 decimalRegister 0x01>0x40>0x04 = memory offset 0x0440 = 1088 decimal[..]etcSo basically you form the offset's hex number by reversing the order of the register's bytes.If you want to dump the entire chip, you can read the register 0x01>0x00>0x00 size 2048 (it didn't work for me) or read in two chunks of 1024 bytes (first 0x01>0x00>0x00 size 1024 then 0x>0x01>0x00>0x04 size 1024)@pixconfig:the following offsets are not read/written in your dumps, so this needs further investigation:Offset 0x160 (register 0x01>0x60>0x01), size 6 bytes, this one is repeating at offset 0x400 (register 0x01>0x00>0x04)also Offset 0x408 (register 0x01>0x08>0x04) - 4 bytes long - contains data that is not read/written in your dumps.Maybe there registers are written by the chip (the same way the copy of 20 00 register is written without any specific instruction from the printer.The other bytes that are not read/written contains either 00 f7 either 00.

author: driver_x
author_rank: Contributor
timestamp: August 21, 2018, 04:52:55 pm
content: Quote from: maxic81 on August 21, 2018, 07:02:37 amFirst 32 bytes and last 256 are just a series of 00 F7, at least in my dump, here's the map I've made:

author: driver_x
author_rank: Contributor
timestamp: August 21, 2018, 09:55:59 pm
content: Some small research:>>>Only for starter cartridges<<<:Year of installation: 0xAF, size = 2 bytesMonth of installation: 0xB2, size = 1 byteDay of installation : 0xB4, size = 1 byteAnother timestamp:Year: 0xc3, size = 2 bytesMonth: 0xc6, size = 1 byteDay: 0xc8, size = 1 byteProbably the expiration year: 0xD5, size=2 bytesYet Another timestamp:Year: 0xd7, size = 2 bytesMonth: 0xda, size = 1 byteDay: 0xdc, size = 1 byte>>>end only for starter cartridges<<<pageCount : 0x51 - 2 bytesserial : 0x440 - 12 bytesdeviceID : 0x44c - 4 bytespartNumber : 0x455 - 8 bytesmaxCapacity : 0x49A 2 bytes

author: Deathcore
author_rank: Newbie
timestamp: August 22, 2018, 01:21:38 pm
content: Has anyone had any luck with doing the same with the Imaging Unit?I've mirrored the contents over from a brand new Imaging Unit to a Used one and the printer only seems to see the unit as "Defective" after about 20 seconds or so.The data structure seems to be different to the toners, as the 1st and 2nd 56 byte register show different contents.I'll put together some dumps and post them up when I can but would appreciate any help or pointers!

author: driver_x
author_rank: Contributor
timestamp: August 22, 2018, 01:37:43 pm
content: Searched for a Texas Instruments chip that is able to perform authentification using cryptographic functions, found this :http://www.ti.com/lit/an/slua389a/slua389a.pdfhttp://www.ti.com/lit/ds/symlink/bq26100.pdfbut...From what I observe, in the 0x81 register is written the 14 bytes challenge, then from 0x80 is being read the 16 bytes response from the chip, and this is done 8 times for each cartridge. But the response does not look like a SHA-1 hash, first because SHA-1 is 20 byte long, and second because in all the the 8 responses of 16 bytes , bytes 7 and 8 are the same. MD5 is 16 bytes but the repetition of the bytes 7 and 8 in all the responses excludes any hash function(?)And second, the last 1024 bytes memory block might be read only in order to prevent the changing of the serial number, deviceID, maxCapacity , region and all the other cartridge factory parameters.Later:Connect your printer via ethernet, then in your internet browser typehttp://your_printer_ip/se(replace "your_printer_ip" with your real printer ip)Then go to "Dump SysDebugData" and do some search for "cyan", yellow or whatever... you'll find some data about the cartridges.What is strange is that after resetting the 56 and 208 registers of a empty cartridge, of course that the printer is telling me to replace it and it does not take in consideration the information stored in the chip, as it is displaying the same number of printed pages, install date etc as they were before the resetting(.

author: Deathcore
author_rank: Newbie
timestamp: August 24, 2018, 03:05:01 pm
content: Just an update.I rewrote the all first 1024 bytes from a new Drum unit to a Used board and the unit is now giving me an "Imaging unit unsupported" error rather than "Imaging unit defective".Step in the right direction but still no luck, I suspect that the device is checking for a CRC somewhere or the 2nd set of 1024 bytes holds part number information and the used board that was overwritten was a "Black only" imaging unit rather than "Black and Colour".

author: amyk
author_rank: Super Contributor
timestamp: August 25, 2018, 12:22:06 am
content: Quote from: driver_x on August 22, 2018, 01:37:43 pmThe printer probablymemorises the serials of the last X cartridges.

author: driver_x
author_rank: Contributor
timestamp: August 25, 2018, 08:19:17 am
content: Quote from: Deathcore on August 24, 2018, 03:05:01 pmI think we must have a sticky thread with the information we have found so far , because i see we are reinventing the wheel with each post:)Int the 56 bytes register is written the type and the color of the cartridge, so you can't just copy the first 1024 bytes from a type of cartridge to another type.The mapping of the bytes in the 56 bytes register was discovered by pixconfig here:https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1526623/#msg1526623We succedeed to set all the counters to zero, but it seems that the printer is also keeping in its internal memory the last parameters of each cartridge, so I see two solutions:1. Discover a way to change the cartridge serial number from the cartridge's memory2. Discover a way to clear the serials of the cartridges from the printer memory(they are not erased when you restore the printer to factory defaults)

author: Deathcore
author_rank: Newbie
timestamp: August 25, 2018, 10:49:58 am
content: Apologies for the confusion, I have read through the thread a couple of times but I was looking at the Chip on the Imaging/Drum Unit not the toners. (Address 0x005)The imaging unit uses the same TI046B1 chip but the registers and data on the chip are in a different layout to the toners.I had copied the data from a good full chip to a used chip that the printer had not seen before, but it was still rejected, the drum unit may be checking for something other than just the serial number though.A sticky thread would be a very good idea though!

author: driver_x
author_rank: Contributor
timestamp: August 25, 2018, 01:59:26 pm
content: If you post the dump of the new chip and the used chip maybe we can discover what and where the printer is writing on the chip and try to reset the counters rather than to overwrite with data from another chip.For the cartridges we have also some bytes in the first 1024 segment that we don't know what are representing (the bytes surrounded with red line from the map posted by me here:https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1762853/#msg1762853) If you look with attention you will see that the group of 6 bytes from 0x160 repeats at the offset 0x400, with other words, the last bytes with values from the first 1024 segment are repeating in the second 1024 segment. If you overwrite the first segment then the values will not match. Maybe in the imaging drum chip there is a similar protection

author: driver_x
author_rank: Contributor
timestamp: August 28, 2018, 07:51:04 pm
content: Ok, some new update with the last discoveries:It seems that (at least for the starter cartridge i'm experimenting) that cleaning all the first 169 bytes(as in pixconfig's function) from the 208 register is making the printer to show the message: "replace the cartridge". I remember that the first time i saw this was in pixconfig's post after he wrote the function for resetting the 208 register. Then I thought that maybe the printer needs some info saved there (the timestamps for example) and I tried to reset only the first 15 bytes which is obvious that are encoding the toner usage (i was lucky because I saved the full dump before reseting, and I was able to restore the initial 208 register). Surprise! The printer no longer says to replace the cartridge and it says that the cartridge is full.Here's the sysdebugdata log for the cartridge:Code:osikey Magenta Toner, serial CAH163060CDA valid 1, id 1:partNumber 38CSL14M, deviceID 65399522, pageCountValid 1, pageCount 801.pageRemainValid 1, pageRemain 1400.maxCapacity 1400, maxCapacityPages 1400, level 10.maxLevel 10, minLevel 0, increments 10%, SUPPLY_STATUS 0.SUPPLY_OSIGAUGE_TYPE 2, SUPPLY_EMAIL_TYPE 0Levels:SUPPLY_EARLYWARN => LevelOn 1, LevelActive 0, TriggerValue 4, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1273, behid 0x126e, behav 0.SUPPLY_NEARLYLOW => LevelOn 1, LevelActive 0, TriggerValue 3, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1274, behid 0x126f, behav 0.SUPPLY_LOW => LevelOn 1, LevelActive 0, TriggerValue 2, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1579, behid 0x1270, behav 2.SUPPLY_NEARLYEMPTY => LevelOn 1, LevelActive 0, TriggerValue 1, LevelMax 9, LevelMin 1, Behaviors 0xff, levid 0x1275, behid 0x1271, behav 2.SUPPLY_EMPTY => LevelOn 1, LevelActive 0, TriggerValue 0, LevelMax 0, LevelMin 0, Behaviors 0x02, levid 0xffff, behid 0x1272, behav 4.type 2, prebate 2, refilled 2, afterMarket 0, carttype 0, menuPageSupport 0.installed INST, supported 1, ignoreMsgNotSupported 0, serialNumberIsReal 1dataValid 1, firstPercentReported 100, region 0, genuine 1, exposed 2, non-genuine IR 2flags:ignoreLevelWrnOnce 0supplyHasWarning 0, supplyHasIntervention 0, supplyHasNonContinueIntervention 0supplyGetConditionTextId 75577 (OK).Need to investigate why it shows pageCount 801, maybe I have a bug somwhere in the resetting function.Later edit: no bug in the function, the printer is writing back on the chip the pageCount as soon you put the cartridge in the printer.208 register analysis:Start ByteEnd ByteDescription014Toner usage in steps1518Filled with zero1930Serial number of the Imaging Kit3136Date, maybe install date3744Printer serial number4546Filled with zero4748Unknown data4950Filled with zero5156Date, probably date of first warning?5764Printer serial number6566Probably page count at the date stored before6768Filled with zero6970Unknown data7176Date, probably date depleted?7784Printer serial number8586Probably page count at the date stored before8788Zero8990Unknown data9199Unknown data, values from 1 to 6 observed in each byte100110Zero111111A0 for starter kits, 00 for the others112114Zero115116Unknown data, seems to increase with as the cartridge gets depleted117118Zero119120Unknown data, seems to increase with as the cartridge gets depleted121122Zero123124Unknown data, seems to increase with as the cartridge gets depleted125126Zero127128Unknown data, seems to increase with as the cartridge gets depleted12912934 for starters, 00 for the others130144Printer Name145168Zero169198Unknown data, does not modify over time, maybe some kind of ID199205Zero206207CRC

author: Kulick
author_rank: Newbie
timestamp: September 19, 2018, 10:34:35 am
content: maxic81, почисти ящик) Не могу сообщение отправить.

author: driver_x
author_rank: Contributor
timestamp: September 19, 2018, 06:01:38 pm
content: Tried to write first 2 bytes with FF, it filled all the read only area that didn't contained data with zeros. Strange.So from 0 to 31 and from 1792 to 2047 (decimal offsets), all bits were set to zero. Ant I wrote only in the first 2 bytes FF. This means that these bites don't really exist on the chip and are just a mirror of the first 2 bytes?

author: driver_x
author_rank: Contributor
timestamp: September 19, 2018, 08:28:55 pm
content: Why do I get mixed results when I try various baud rates for serial.begin?Look at the responses from the 0x82 registerCode:Baud Rate 2400Read 0x82 Registeruint8_t destinationBuffer = {0x38};Write 0x09 in 0x81 RegisterWrite OKRead 0x82 Registeruint8_t destinationBuffer = {0x49};Write question in 0x81 registerWrite OKRead 0x82 Registeruint8_t destinationBuffer = {0x89};Read 0x80 Registeruint8_t destinationBuffer = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0x80, 0x80, 0x31, 0x54, 0xBF, 0xB6, 0xD9, 0x8E};Code:Baud Rate 19200Read 0x82 Registeruint8_t destinationBuffer = {0x89};!!!!!!!!!!Write 0x09 in 0x81 RegisterWrite OKRead 0x82 Registeruint8_t destinationBuffer = {0x89};!!!!!!!!!!Write question in 0x81 registerWrite OKRead 0x82 Registeruint8_t destinationBuffer = {0x89};!!!!!!!!!!Read 0x80 Registeruint8_t destinationBuffer = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0xD, 0xF1, 0xE3, 0xE9, 0x91, 0x71, 0xA1, 0x83};****reset arduino***Baud Rate 19200Read 0x82 Registeruint8_t destinationBuffer = {0x38};Write 0x09 in 0x81 RegisterWrite OKRead 0x82 Registeruint8_t destinationBuffer = {0x49};Write question in 0x81 registerWrite OKRead 0x82 Registeruint8_t destinationBuffer = {0x59};!!!!!!!!!!Read 0x80 Registeruint8_t destinationBuffer = {0x40, 0x39, 0x39, 0xE2, 0xCF, 0xEB, 0xC, 0x0, 0xCD, 0x1A, 0xA6, 0xE9, 0x3E, 0xCA, 0xD2, 0x8A};If I increase the baud rate more, I get mixed results...

author: Diggie
author_rank: Newbie
timestamp: October 09, 2018, 10:33:39 am
content: Hi guys,I've been observing this thread ever since I bought my CS417DN a few months ago.It is very interesting to see the progress that you have made.It certainly goes beyond my expertise.Thats why I have a different proposal on dealing with this: Has anyone tried checking out those reset/replacement chips which you can get?Maybe for those we are able to read them out fully and then copy that to the original chips?Look forward to hearing your thoughts.

author: driver_x
author_rank: Contributor
timestamp: October 09, 2018, 04:55:36 pm
content: Quote from: Diggie on October 09, 2018, 10:33:39 amI'm afraid that this is not possible as the chip has a read-only area where is written the serial number, toner capacity and probably all the initial parameters. Most probably the printer is storing all this info as I have reseted the number of printed pages and after I have inserted the cartridge inside the printer, the number printed pages has reappeared on the chip.

author: igrok_by
author_rank: Contributor
timestamp: November 01, 2018, 05:53:27 am
content: I wonder how soon there will be a cheap toner tankhttp://www.ipwatchdog.com/2017/05/30/supreme-court-lexmark-sales-exhausted-patent-rights/id=83824/

author: Alan.B
author_rank: Contributor
timestamp: November 12, 2018, 12:41:39 am
content: Hello friends!Back to work with this chip, I got an MS810 printer, take readings inserting a new chip in the cartridge, I attach the readings ... The truth is that I have trouble passing it in clean, if someone offers for such a task it would be beneficial for all !Regards!

author: nouvelle_adr
author_rank: Contributor
timestamp: November 30, 2018, 07:46:07 pm
content: Quote from: Alan.B on July 08, 2018, 11:16:47 pmHello, I have the same chip as you (Dell laser printer with almost dead toner cartridge)I only have a raspberry Pi 3 (no arduino), so I connected SDA SCL VDD GND as you shown in your pictures, but when I run the command "i2cdetect -y 1" on my Raspberry it shows no device connected to I2C interface like that:pi@raspberrypi:~ $ i2cdetect -y 10 1 2 3 4 5 6 7 8 9 a b c d e f00: -- -- -- -- -- -- -- -- -- -- -- -- --10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --70: -- -- -- -- -- -- -- --do you have any idea to solve that ?

author: nouvelle_adr
author_rank: Contributor
timestamp: December 08, 2018, 03:38:08 pm
content: Hello, I have the same chip as you ti046b1 chip (Serial I2C F-RAM) (Dell laser printer with almost dead toner cartridge)I tried to read it with my raspberry Pi 3, so I connected SDA SCL VDD GND as shown in pictures, but when I run the command "i2cdetect -y 1" on my Raspberry it shows no device connected to I2C interface (empty) like that:pi@raspberrypi:~ $ i2cdetect -y 10 1 2 3 4 5 6 7 8 9 a b c d e f00: -- -- -- -- -- -- -- -- -- -- -- -- --10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --70: -- -- -- -- -- -- -- --do you have any idea to solve that ?- I tried by inverting SDA SLC connections- I tried by pulling-up to 3.3V SDA and SCL with 10k resistors (as statedhttps://www.raspberrypi.org/forums/viewtopic.php?t=7664)could you please help me to solve that ?And to anticipate your first question : I checked all the connections for this wiring

author: Fang
author_rank: Newbie
timestamp: December 08, 2018, 07:31:41 pm
content: I don't understand why do you need to mess with toner cartridge chips?I think a better way to modify printer firmware. Reset of toner chip is useful if you are in toner refill business. :-)Sent from my SM-G610F using Tapatalk

author: nouvelle_adr
author_rank: Contributor
timestamp: December 08, 2018, 08:09:06 pm
content: Quote from: Fang on December 08, 2018, 07:31:41 pmReally ? If you know how to modify my DELL B2360dn firmware I will be glad and gratful to you !

author: Fang
author_rank: Newbie
timestamp: December 08, 2018, 08:22:54 pm
content: You can download firmware from Dell website ... I can help you with reverse engineering tools :-)Sent from my SM-G610F using Tapatalk

author: nouvelle_adr
author_rank: Contributor
timestamp: December 08, 2018, 08:35:39 pm
content: Quote from: Fang on December 08, 2018, 08:22:54 pmI am really interested by that !, I have downloaded the original firmware from here :https://downloads.dell.com/FOLDER05088145M/1/B2360%20P022%20Firmware.zip, so please help me with your golden skills, I am ready now to follow your instructions

author: driver_x
author_rank: Contributor
timestamp: December 12, 2018, 06:50:10 pm
content: The downloadable firmware is encrypted

author: nargoni
author_rank: Newbie
timestamp: January 31, 2019, 02:38:14 pm
content: hello all!I read every reply of this post, I'm an worried owner off a cheap lexmark 417dn.I think that it is necessary to find a way for the printer to continue printing while having toner, with or without chips.I am looking at how to run code on the printer. Specifically for port 9100, where, in some HP, shell access could be obtained.If you could do this, I think it would be easy to make a bypass on the toner control system. In the end, a printer is a computer, and it may be possible to prevent the executable that controls the toner from doing so.do you see it feasible?

author: nargoni
author_rank: Newbie
timestamp: February 03, 2019, 12:34:33 pm
content: At last I found the solution. I have sold the printer and bought one of very similar with toner compatible economic and easy to find. I get a new printer with the same benefits as 4 toners a lot more economical.I still think that it should not be possible for a manufacturer to decide what consumable should you put on your devices.Lexmark does this for its own benefit, but it is not logical that it costs 4 times more toner than the printer.The other brands are not short either. I have had HP compatible toner do not work or do it badly. However, my first color laser (hp cp1515) has always worked well with the pirate toner. Why the modern ones do not?We have not made much progress ...https://en.wikipedia.org/wiki/Richard_Stallman

author: Doctorandus_P
author_rank: Super Contributor
timestamp: February 03, 2019, 08:39:39 pm
content: Years ago I bought a 2nd hand Samsung ML-1610.This laser is not chipped.Then the toner depleted.Bought 2 tubes of toner from Ali for a total of around EUR 10.Watched a youtube vid on how to open / clean it.Half an hour later it worked as a charm again.I could have done it in 10 minutes if I had more experience, but I just took it slow and extra carefull for my first toner refill.I was a bit afraid of making a mess.Heared some bad things about toner.But if you cover your desk with some sheets of paper and gently tap on it the remains just fall on the desk (into a basket made from an A4 sheet of paper and 4 staples in the corner).Don'd blow on it, nor use a compressor. A vacuum cleaner is good for the last remains.I heared that 2 different kinds of toner don't always mix well and therefore I followed the advise to clean the cardridge before filling it up again. It also has some brushes and spare toner reservoirs you should clean.Have fun.

author: texaspyro
author_rank: Super Contributor
timestamp: February 04, 2019, 04:58:47 am
content: Quote from: Doctorandus_P on February 03, 2019, 08:39:39 pmNO!!!! Most toner particles will pass right through most vacuum cleaner filters so they wind up spewing toner into the air (NOT a good thing). They make "toner vacuums" that are designed for cleaning up toner. They have much better filters in them.

author: Sutan
author_rank: Newbie
timestamp: February 07, 2019, 12:43:17 am
content: Hello pixconfig, I'm really impressed about you've done with Ti046b1 cartridge chip.I really want to read the full content on a Lexmark MS810 fuser chip which is the same TI046b1 chip and i have an arduino mega could you able provide me a sketch that i read the full content on that chipI would really like to reset the chip.Please help me.

author: Sutan
author_rank: Newbie
timestamp: February 12, 2019, 10:40:40 pm
content: Hi Howardlong, Hope you're doing good. Well can you help me to change some coding on the Sketch Picconfig created earlier to read Ti046b1.Well i'm trying to reset a fuser chip which uses TI046b1 chip. i altared the sketch an manged to read the content but i want to write the addresses with right buffer which will make the chip shows full.I'm a learner Arduino please help me if you can.Thank youSutan

author: elpaco
author_rank: Newbie
timestamp: February 17, 2019, 07:28:01 pm
content: Hello All,hope you can help me, this let me crazy...I bought a CX510de laser printer, and the magenta cartridge became declared as empty (the other cartridges are quite full ... around 90% full).I follow your forum and was able to refresh the chip for the magenta cartridge, but after fiew pages printed (in black ...), the printer was crazy again and declared the magenta cartridge again empty.I made 2 copies (from a page), and it was OK.once I want to print a document from an USB stick, only one print, and then red light !Can someone make a full read containt of the magenta chip cartridge in its CX510de ?this will help me a lot.... probably a data somewhere doesn't allow it.Many thanks in advance for your help !

author: elpaco
author_rank: Newbie
timestamp: February 18, 2019, 09:17:50 pm
content: Hello All,here are some details (hope it can help).I wrote in the cartridge chip the following data :area #1 (03022000) and #2 (03025800) :FFFFFFFFFF1F0BFF000000000000000000000000012B7FFF00000000000000000000000000000000FFFF0000FFFF0000000000000000CDFEand in the 3rd area (03029000):00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B2A8E9135CACE4E9F5696A44979EA03EABC7AE1391DF08F5E8E369EB58E50000000000000047B9Then, the cartridge was detected FULL (means OK) only- if I restart 5 times (without the cartridge inside).or- if I reset all the counters (from the configuration menu (I press 2 and 6 at the start)... and if I reset to the factory configuration the printer (it's quite long...).then always after some pages can be printed.... and the crazy things come back... magenta cartridge detected end of lifeit looks like this machine remember the serial number of this cartridge... (it's the only thing that I can not update in the chip).Someone has an idea on how to unlock this ?did I wrote something wrong in the areas ?I'm wondering on the "fake/copy" chip that are provided with toner ... how they can do ?Thanks !

author: nouvelle_adr
author_rank: Contributor
timestamp: March 02, 2019, 11:39:43 am
content: Hello, [It seems to be an issue withtwi-all-included.h]I have bought an Arduino, and I tried I2C_TI046B1_Read.ino to read this Ti046b1. I have nothing on Serial monitor when I upload the code on my ArduinoWavegat:The upload seems to bo OK, but nothing read on the monitor:EDIT---I tried to create a hello world file to do just aSerial.println("--- Hello world ---");" I upload it in my Arduino Wavgat.I noticed that when I include twi-all-included.h, the print ln does not print anymore ! and when I remove the#include "twi-all-included.h"the println works againthe problem seems to be in the "twi-all-included.h"could you please help me to solve that?https://ibb.co/Rz7XCFHI have pull-down on both for SDA and SCL, some 18 kOhms resistors as stated here:https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/msg1505194/#msg1505194https://ibb.co/ZJJK5TwAnd here is a reminder of my wiring:When I remove resistors, and I connect the chip directly to Arduino, it is detected at the address 0x78https://i.ibb.co/dLqkFxB/20190302-182231.jpghttps://i.ibb.co/Snz336X/Detection-I2-C.pngand here the same issue, No read data on Serial monitor

author: Sutan
author_rank: Newbie
timestamp: March 04, 2019, 02:47:00 am
content: Hello nouvelle_adr, Nothing wrong with the sketch and it is created by a genius. Well your pull resistors should by connected to positive +5v not negative -5v. 18K is a right stuff if you're not using you may blow the chip.The sketch is working like a charm and if you can modify the sketch you can read anything related to TI046B1 Chip whether a cartridge or imaging as well as fuser.If you wanna reset a chip it shouldn’t say zero pages left. Not applies to starter cartridges & in this forum it was stated a success but i didn't try. Reset only worked well if you have 5% or even 1% left cartridge. Zero is a total failure.Good luck.

author: nouvelle_adr
author_rank: Contributor
timestamp: March 04, 2019, 08:44:47 pm
content: Quote from: Sutan on March 04, 2019, 02:47:00 amThank you for your feedback.But the TIb46b1 power supply is 3.3V and not 5V !And my Arduino has a 3.3V power supply, so I have used it.When I tried to supply the chip with 5V with 18K resistor linked to GND, Chip address 0x78 is no more detected.And when I bring back the power supply to 3.3 the detection is ok, but not the readingCould you please sketch me a schematic of the full conection between Arduino and TI046b1 ?

author: Sutan
author_rank: Newbie
timestamp: March 05, 2019, 03:35:12 am
content: Hello buddy, according to 18k pull up setup cartridge chip needs 5V. I’ve tried 3.3v it wouldn't work. Anyway, you're using arduino leonardo which doesn’t have enough memory to run the original sketch I believe. What i'm using arduino mega 2560 which has 4kb EEPROMI've attached the diagram & also a simplified sketch of my version. Hopefully you'll win this time but all credits should go to the big boss.Cheers!

author: nouvelle_adr
author_rank: Contributor
timestamp: March 05, 2019, 03:25:33 pm
content: Quote from: Sutan on March 05, 2019, 03:35:12 amHi friend !thank you for the schematics.You are right, My Arduino is an AVGA328 it has only 2kb EEPROM. the issue may comes from here.Regarding your schematics, if I understand well, you supply the chip with 5V ?you sketched a -5V at the left, but Arduino has no -5V !.Do you mean that the schematic is like that ?:again, all credits should go to the big boss

author: Sutan
author_rank: Newbie
timestamp: March 05, 2019, 09:27:44 pm
content: You got it right. At the beginning i had a lot of challenges finally I got it work.FYI: remember error messages according to the sketch should be displayed error messages like below( "Error occured wile trying to write to the slave : Slave's address not acknowledged (beginning only) - is it connected ?")("Error occurred wile trying to write to the slave : TWI class's buffer is too small")("Error occurred wile trying to write to the slave :")("Slaves’ beginning of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?")("I2C protocol error occurred wile trying to write to the slave. Is the wiring correct ? TWI Initialization ?")if you wouldn’t see none of the error messages then you should consider buying Aruduino Mega 2560. The existing board is not suitable for this project.Have you tried the sketch i posted?

author: nouvelle_adr
author_rank: Contributor
timestamp: March 06, 2019, 08:14:59 am
content: Quote from: Sutan on March 05, 2019, 09:27:44 pmthank you for all these important information!I will try the new sketch and inform you

author: nouvelle_adr
author_rank: Contributor
timestamp: March 06, 2019, 02:21:04 pm
content: Quote from: Sutan on March 05, 2019, 09:27:44 pmHi AgainAs I have a Raspberry Pi 3, may be I can run Arduino sketch on it by following this TUTO:https://www.deviceplus.com/how-tos/raspberrypi-guide/how-to-run-arduino-sketches-on-raspberry-pi/Instead of buying a MEGA 2560 Arduino. Raspberry has more memoryDo you think it possible ?

author: Sutan
author_rank: Newbie
timestamp: March 07, 2019, 01:37:51 am
content: Well i don't have any knowledge about raspberry. This site about innovation and myth busting since you have the hardware give it a try. Don't get disappointment easily, reserve some time in day for this projectYou'll definitely achieve & learn something. Goodluck pal and let me know your success.

author: elpaco
author_rank: Newbie
timestamp: March 09, 2019, 11:19:07 am
content: Hello everyone !I'm back on this topic, is there somebody that can read the full content of his magenta chip cartridge compatible for a CX510de ?Then I can write into my cartridge all the same data (expect some protected area) and try quickly.Thanks for your help !

author: nouvelle_adr
author_rank: Contributor
timestamp: March 20, 2019, 05:12:55 pm
content: Quote from: nouvelle_adr on March 06, 2019, 08:14:59 amHi Sutan,I'm back now with my newly received Arduino Mega 2560.You are right about not enough 2Kb memory, and now with 4KB Memory on my new Mega 2560 I can continue my journeyThank you very muchEDIT- I finally succeded to dump my chip (for reminder, it is a Ti046b1 on DELL B2360dn Black and white printer, with a warning message about low tonner level):I attach below a first dump, a second dump after printing 1 page, and again a third dump by printing again one page.Do you think that the write sketch will reset my chip or do I need some modifications on it ?until the next answer, I continue my analysisI noticed 4 blocks:Block 1: 192 bytes (unchanged) :Offset 1 to Offset 192Block 2: 80 bytes (changed) :Offset 193 to Offset 272with 2 bytes CRC-CCITT (0xFFFF) on 78 bytes of this blockBlock 3: 80 bytes (changed and equal to the preveous 80 bytes "repeated bytes") :Offset 273 to Offset 352with 2 bytes CRC-CCITT (0xFFFF) on 78 bytes of this blockBlock 4: 1696 bytes (unchanged) :Offset 353 to Offset 2048So here are the changed noticed in the two 80 bytes blocks:At the affset @226,227 (and @306,307) I guess that it represents the number of printed pages (084C: 2124 then 084D: 2125 then 084E: 2126 pages printed)can someone help me to change the Boss sketch to adapt it to my chip please ?

author: nouvelle_adr
author_rank: Contributor
timestamp: March 24, 2019, 04:46:13 pm
content: Quote from: ionutkok on March 24, 2019, 03:54:22 pmHi, dump again your chip, and check if the 2bytes CRC has been updated (and well calculated) or not, here is a link for Crc calculation:https://www.lammertbies.nl/comm/info/crc-calculation.html

author: uteniyazov
author_rank: Newbie
timestamp: May 02, 2019, 05:35:41 am
content: Hello! How can i read this toner chip? please help me

author: uteniyazov
author_rank: Newbie
timestamp: May 03, 2019, 07:14:06 am
content: Lexmark ms317dn

author: uteniyazov
author_rank: Newbie
timestamp: May 04, 2019, 11:47:53 am
content: Hello!please sorry for my english. my chip is another. it is not TI046B1 , can I read this chineese chip similarly?

author: JerryL
author_rank: Newbie
timestamp: May 06, 2019, 03:59:50 pm
content: I am trying to read this chip. The pic shows its number but I am unable to find it anywhere. It is a 4 pin chip from a Lexmark MX321 and I know the pinouts from the chip as well. I am using an Arduino Mega 2560 but cannot seem to get it to read. I am quite new at this stuff so any help or thoughts are appreciated.

author: uteniyazov
author_rank: Newbie
timestamp: May 23, 2019, 01:51:19 pm
content: 18:38:20.280 ->18:38:20.280 -> 5⸮----- I2C Reset of the TI046B1 CHIPS ------18:38:20.477 -> -------------------------------------------18:38:20.477 -> uint8_t destinationBuffer = {0x43, 0x41, 0x53, 0x31, 0x36, 0x32, 0x38, 0x34, 0x33, 0x35, 0x30, 0x45, 0x03, 0x6C, 0x1B, 0xA7, 0x01, 0xF8, 0x00, 0x50, 0x32, 0x34, 0x46, 0x30, 0x30, 0x30, 0x39, 0x00, 0x00, 0x00, 0x09, 0x09, 0xC4, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0x0A, 0x00, 0x3E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:20.890 -> Serial number : CAS16284350E18:38:20.924 -> Fuser, (0x001), 00, F118:38:20.958 -> uint8_t destinationBuffer = {0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D};18:38:21.094 ->18:38:21.094 -> Fuser, (0x001), 10, F118:38:21.128 -> uint8_t destinationBuffer = {0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D, 0x00, 0x6D};18:38:21.264 ->18:38:21.264 -> Fuser, (0x001), 20, F118:38:21.264 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x53, 0x04, 0xD8, 0x5E};18:38:21.400 ->18:38:21.434 -> Fuser, (0x001), 30, F118:38:21.434 -> uint8_t destinationBuffer = {0xBA, 0x25, 0x87, 0x3C, 0xAB, 0x60, 0x59, 0x07, 0x0C, 0x96, 0x79, 0xB4, 0x2B, 0x60, 0xE8, 0xF8};18:38:21.570 ->18:38:21.570 -> Fuser, (0x001), 40, F118:38:21.605 -> uint8_t destinationBuffer = {0x8D, 0x56, 0xE9, 0x2E, 0xDF, 0x62, 0xF9, 0x83, 0x65, 0x93, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:21.740 ->18:38:21.740 -> Fuser, (0x001), 50, F118:38:21.775 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:21.913 ->18:38:21.913 -> Fuser, (0x001), 60, F118:38:21.947 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:22.084 ->18:38:22.084 -> Fuser, (0x001), 70, F118:38:22.084 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:22.219 ->18:38:22.219 -> Fuser, (0x001), 80, F118:38:22.253 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:22.389 ->18:38:22.389 -> Fuser, (0x001), 90, F118:38:22.423 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:22.559 ->18:38:22.559 -> Fuser, (0x001), A0, F118:38:22.593 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:22.732 ->18:38:22.732 -> Fuser, (0x001), B0, F118:38:22.766 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD3, 0xC4};18:38:22.902 ->18:38:22.902 -> Fuser, (0x001), C0, F118:38:22.902 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:23.038 ->18:38:23.038 -> Fuser, (0x001), D0, F118:38:23.072 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF};18:38:23.208 ->18:38:23.208 -> Fuser, (0x001), E0, F118:38:23.243 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x01, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:23.378 ->18:38:23.378 -> Fuser, (0x001), F0, F118:38:23.412 -> uint8_t destinationBuffer = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF8, 0x51, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF8, 0x51, 0x96, 0xC2, 0x06, 0x53, 0x34, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};18:38:24.228 ->18:38:24.228 -> -------------------------------------------This is the new chip for MS317 (emul)

author: Krepton85
author_rank: Newbie
timestamp: June 09, 2019, 05:20:27 pm
content: Could you port "twi-all-icluded" library for Arduino Stm 32:https://github.com/stm32duino/Arduino_Core_STM32?

author: mcu32
author_rank: Newbie
timestamp: July 09, 2019, 07:23:33 pm
content: Hi friends, I do not know will help you this ..I have Chinese chips for Lexmark MX410, on these chips there are 2 microcircuits, one of which is a microcontroller and the other is SPI FRAM of 16 kbps. I soldering out a memory chip and read a dump from it. Now, when the cartridge over, I solder the chip and write the dump to this chip. I share a dump, maybe he will help you for analysis.UPD:I made your reader on arduino, and read my Chinese chip, it seems the first 20 bytes are read from the chip erroneously, the logs of others, too, the first 20 bytes are erasing 2 bytes. I attach my log.

author: constanrine5d
author_rank: Newbie
timestamp: August 01, 2019, 01:50:23 pm
content: Hello Guys!I am a noob at microelectronic stuff,I have arduino mega 2560 r3 and a lexmark cs317dnI read how to connect it to the chip with the two resistors and stuff,how do I run pixconfig's toner reset file to reset?Do I connect the chips in the order they appear in the code?What about the magenta error that they encountered?Thank you! Awesome work!

author: PON
author_rank: Newbie
timestamp: January 19, 2020, 01:51:02 pm
content: Hello,What modification need to made to this filehttps://www.pixconfig.fr/Lexmark-I2C-TI046B1/Arduino/I2C_TI046B1_Read.inofor read the lexmark MX410 chip.I replace in next executionread_TI046B1_register(0x003, 0x01, 0x40, 0x04, RegisterRead_01_40_04, 448);read_TI046B1_register(0x003, 0x01, 0x00, 0x06, RegisterRead_01_00_06, 256);read_TI046B1_register(0x003, 0x01, 0x20, 0x00, RegisterRead_01_20_00, 56);read_TI046B1_register(0x003, 0x01, 0x90, 0x00, RegisterRead_01_90_00, 208);0x003 with 0x001 becouse is black cartridge, but in serial monitor i have:Error occured wile trying to write to the slaveSlaves's begining of address acknowledged but NACK encountered during the following writes - are all of the 10 bits of slave's address correct ? Are the writes value are meaningful to the slave ?

author: atanasssko
author_rank: Newbie
timestamp: January 25, 2020, 11:51:20 am
content: Hello. I have problem with compilation the sketch on arduino.SDA not declared, SCL not declared...Wath can i do? I use arduino on Windows, il try and in arduino droid, same error.

author: atanasssko
author_rank: Newbie
timestamp: January 25, 2020, 05:07:04 pm
content: sorry. I finally made it and uploaded it. now i'm trying to reset the same chip used in Lexmark MX511. is this sketch suitable for this printer model? I get a reply in a terminal:Error occured wile trying to write to the slave : Slave's address not acknowldged (begning only) - is it connected ?i use mega 2560 whit I2C_TI046B1_Reset.ino and I2С Logic Level Converter Module Bi-Directional for Arduino to receive 3,3V on chip./with 18kO resistor is same ansver in a terminal/ Chip connect as GND-SDA-SCL-VCCam I confusing somewhere? do I have a mistake in the direction of work?i will be glad to receive a response and guidance on working with the chip. thankstranslated by google translator

author: PON
author_rank: Newbie
timestamp: February 08, 2020, 10:40:14 am
content: Is someone , or there is some possibility that the chip blocked (98) can be recovered.I will pay for help me this

author: elpaco
author_rank: Newbie
timestamp: March 21, 2020, 01:15:57 pm
content: Hello Every one.I'm back to you some months after with the same status.I 'm able to read and modify the content of the Magenta cartridge for lexmark CX510de.unfortunately the printer doesn't accept it (end of life display).I'm sure the serial number of the cartridge is stored somewhere in the machine. so I can not reuse it.I'm not also able to use the printer in black mode if I don't place a new cartridge... that doesn't make sense, crazy world !so do you have a way to update the full content of the chip (even place a new serial number) ? or the chip is done for ever ?or if you can guide me on some web site to use the printer without color cartridge placed inside, it will be great also.Many thanks to everyone (at home) !

author: GraberKGD
author_rank: Newbie
timestamp: May 21, 2020, 02:40:22 pm
content: Привет.Подскажите скейтч для Arduino 2560 для прошивки чипа Lexmarx ms410. Буду благодарен.

author: hmazzon
author_rank: Newbie
timestamp: May 21, 2020, 07:15:48 pm
content: Quote from: GraberKGD on May 21, 2020, 02:40:22 pmhi i was also experimenting with a ms 410 chip with the sketch "----- I2C Reset of the TI046B1 CHIPS ------" on an arduino 2560 i am not successful: '(The printer pulls a sign that the "cartridge is not compatible lexmark. 33.01N"If someone has a sketch to read the information about the chips, they would also be grateful.Greetings from Argentina!

author: karamouse
author_rank: Newbie
timestamp: August 01, 2020, 09:22:25 pm
content: 0x0C0 - 0X0E9. CRC in 0x0EA-0x0EB (42 byte + 2 byte CRC16)HOW IT WORKS??

author: ScApi
author_rank: Newbie
timestamp: September 23, 2020, 12:45:31 pm
content: Does anyone still have Arduino sketch for dumping/resetting this chip ?Links are dead unfortunately.

author: TUFAN
author_rank: Newbie
timestamp: October 31, 2020, 11:43:44 am
content: hi i was also experimenting with an ms 8 chip with the I2C Reset sketch of TI046B1 CHIPS on an arduino 2560 i am not successful: warning '(Printer, "cartridge is not lexmark compatible. 33.01N"i have the same problemgreetings from Turkey

author: TUFAN
author_rank: Newbie
timestamp: November 02, 2020, 01:22:47 pm
content: hithis link not open

author: ionutkok
author_rank: Newbie
timestamp: December 09, 2020, 07:42:57 pm
content: You wrote a bit wrong ! First you read the chip, save it in a text file, then write only the necessary registers !

author: gkol
author_rank: Newbie
timestamp: February 06, 2021, 01:55:28 pm
content: Hi!Has anyone made a progress with these chips?Can someone share I2C_TI046B1_Reset.zip file because the links above are dead now.

author: Distinctly Average
author_rank: Contributor
timestamp: February 06, 2021, 02:29:32 pm
content: I worked for Lexmark for a few years, or at least the company I worked for was their national service partner. One thing that doesn’t seem to have been mentioned in this thread is that some Lexmark consumables are region coded. When you buy some of the Lexmark laser printers they all come with un-coded consumables. The first time you install a replacement the nvram on the main PCB is set to the region code of where that consumable came from. This is not changeable after that as an internal fuse is blown making that part of memory read only. So for instance, you live in the UK and your new printer runs out of cyan. You order a genuine Lexmark cart from the US as it works out about 45% cheaper even with postage. Once you install that cart, forever more you can only use US coded consumables. Saw a lot of very miffed customers when that bomb hit.Why do I say this here? Well some are suggesting you purchase a chip for the consumable online. You would need to be sure that third party re-programmed chip is of the same region code, or the printer will error. Not sure if they still do that with the latest models as I changed contracts a few years back. It was quite a regular issue for customers at the time.***** Edit. *****Seems it is still the case. And just to be clear, only the original in the box carts are coded as 0, all replacements have a region code -https://infoserve.lexmark.com/ids/ifc/ids_topic.aspx?root=v33091549&gid=&id=33091863&topic=v39295557&productCode=Lexmark_CS720&loc=en_ZA

author: ionutkok
author_rank: Newbie
timestamp: February 18, 2021, 08:26:03 pm
content: It is very simple. First read the chip and save it in a txt file, then write back only the essential bits. At Lexmark printers, you can set the printer to lock before the chip reaches zero .I.M.

author: toni31
author_rank: Contributor
timestamp: March 10, 2021, 06:14:09 pm
content: All links are dead or with money. Is someone who can share the file's?

author: toni31
author_rank: Contributor
timestamp: March 13, 2021, 05:56:27 pm
content: is someone who can help with the ti046b1 chip and lexmark printer

author: constanrine5d
author_rank: Newbie
timestamp: July 03, 2021, 09:11:05 pm
content: This is the last one from pixconfig. It does reset the Black Starter Cartridge for me to 100% but when I try and print it goes back to 0% cause the printer stores the last x amount of cartriges serial numbers in its internal memory.I think the only way we are going to do this is if we modify the printer's firmware. Anybody who knows how to do that?

author: pafinmen10
author_rank: Newbie
timestamp: July 13, 2021, 03:22:14 pm
content: Good day.Please help.I"m need library from arduino twi-all-included.h. from comucation chips Lexmark Ti 046b1 I2C.Very thanks.Best regards Martin

author: epandi
author_rank: Newbie
timestamp: September 15, 2021, 07:44:50 pm
content: Quote from: pafinmen10 on July 13, 2021, 03:22:14 pmYou could try replacing theCode:#include "twi-all-included.h"withCode:#include "Wire.h"extern "C" {#include "utility/twi.h" // from Wire library, so we can do bus scanning}

author: epandi
author_rank: Newbie
timestamp: September 17, 2021, 11:03:05 pm
content: Is it possible to change the slave address of the chip?I messed up connecting the chip to my arduino and now apparently it's set to slave address 0x000 instead of 0x003 Magenta.PS) for those searching for the twi-all-included.h file, see the attachment.

author: Pantelis
author_rank: Newbie
timestamp: October 28, 2021, 11:43:23 am
content: Hi can somebody help me. I read the chip and i get "dump read" fileAfter i run I2C_TI046B1_Reset and i get "dump reset" fileand not all light leds run in sequence without can printi have not understant which register should i change to to show cartigde is full

author: karamouse
author_rank: Newbie
timestamp: January 16, 2022, 08:41:19 pm
content: Good evening dear colleague, I am back, can you help me with the address of %%%%Can someone please explain to us how it works%

author: lupy
author_rank: Newbie
timestamp: November 07, 2022, 12:14:40 pm
content: Can someone send me a working copy of I2C_TI046B1_Reset.zip

author: karamouse
author_rank: Newbie
timestamp: December 03, 2022, 08:44:11 pm
content: I advise you not to load or modify the data of the chip by the one that has not left you risk blocking the chip

author: Hegypt
author_rank: Newbie
timestamp: April 16, 2023, 05:10:53 pm
content: I have full code to reset lexmark and konica toner and drum black only

author: toni31
author_rank: Contributor
timestamp: April 18, 2023, 07:27:13 pm
content: Quote from: Hegypt on April 16, 2023, 05:10:53 pmShare?

author: 5U4GB
author_rank: Super Contributor
timestamp: June 05, 2023, 12:58:08 pm
content: Quote from: SeanB on April 24, 2016, 11:51:59 amThat's one easy approach that I used years ago to reverse-engineer something obscure, with a publicly-readable EEPROM you can get a snapshot of the memory state between each operation and see which way things move. In the case of the device I worked on it was a counter with one bit per count but they had some bug where they shifted in one bits rather than shifting a single bit down (it was years ago and I can't remember all the details any more), but in any case all it took was a few snapshots over time to figure out how their counter (and various other things it did) worked.

author: adolawww
author_rank: Newbie
timestamp: June 15, 2023, 11:57:47 pm
content: Could you please help me set the sketch

author: joud2020
author_rank: Newbie
timestamp: June 20, 2023, 03:58:46 pm
content: I need a sketch who is willing to pay for my help rc_mk@yahoo

author: adolawww
author_rank: Newbie
timestamp: June 25, 2023, 10:28:55 pm
content: Any body needs help i found the solutionFree 100%Just mail me on adeldda.it@gmail.comFor sketch sendingFor some egyptions not free

author: joud2020
author_rank: Newbie
timestamp: July 01, 2023, 05:25:29 am
content: i have not understant which register should i change to to show cartigde is full and

author: Hegypt
author_rank: Newbie
timestamp: July 07, 2023, 09:12:51 am
content: Full Code for Lexmark konica ricoh toner ,drum and fuserHani.3dwy@gmail.com

author: jbtronics
author_rank: Contributor
timestamp: August 11, 2023, 06:57:18 pm
content: So I tried to gather some more insight about this chip from the printers firmware.Using the keys and firmware extraction tools from this repohttps://github.com/blasty/lexmarkI was able to decrypt the latest CS310dn firmware (I guess that this should work for almost all lexmark printers).I was able to extract the linux kernel image and the filesystem of the printer.The kernel image is compiled with some debug infos and decompiling it with Ghidra gives some good results.The linux kernel contains a lot of lexmark specific function extensions, including many functions prefixed with "pnsv" (which stands for pensive). I could not find much about this subsystem but I strongly suspect that it is the subsystem for communicating with the cartridge chips, as it has functions likepnsvCartAuthenticate0to 6, and functions likepnsvIncrementCounterand similar. It also features a lot of functions to authenticate cartridges and verify signatures.The code seem to support different type of cartridges types with different memory sizes. The chips can have different regions: Readonly, Bit fields, Read-Write, Encrypted, Counters, ECC Sigs.For some reason lexmark decided to statically link most of thesere higher lever interface to the pensive subsystem into the kernel image, while the physical communication is handled in its own kernel module, which is loaded during the initramfs.For my legal understanding this should also mean, that all statically linked code is GPL licensed like the linux kernel itself. That should also mean that lexmark has to disclose/provide the source code of these pnsv* functions. I tried to contact the lexmark support, but no luck so far.

author: karamouse
author_rank: Newbie
timestamp: August 23, 2023, 11:24:06 pm
content: good evening I have a simple question: is that after the resetof the chip, the non-renewable page counter becomes 100%??

author: JacquesBBB
author_rank: Frequent Contributor
timestamp: December 10, 2023, 06:53:06 pm
content: Hello to All,After a five-year break, I come back to this topic, still unsolved, but with great progress.I have seen that the market for toner chips has evolved, and while they were around 25$ when I started this thread, I could buy some for just 4€ herehttps://www.aliexpress.com/item/1005006137482651.html?.I tested it, and it works.The chip is not at all as in the site picture, but more like the original Lexmark chip.Lexmark :with pinout :Ljiayin chip :see the attached photo, with the annotated pinout. Of course, the connector is the sameJP1 : GNDJP2 : SCLJP3 : VddJP4 : SDABut what is this chip ? Can anybody guess from the pinout and find a datasheet ?The marking is17024D2229I asked Chat GPT, but although he made some effort, he was not able to say more than stating that it was a I2C eeprom.

author: takha
author_rank: Newbie
timestamp: December 12, 2023, 01:33:25 pm
content: i have lexmark ms410d imprimante but my toner imprimanta is empty, i would to programmer the puce TI046B1 of the toner .if you can i help methanks

author: coromonadalix
author_rank: Super Contributor
timestamp: December 12, 2023, 03:39:41 pm
content: @ takhaplease refrain of doing multiples requests the same day or trying to pull answers you may get banned hereif people can or want to answer they will on their own terms not yours

author: takha
author_rank: Newbie
timestamp: December 13, 2023, 03:33:52 pm
content: @JacquesBBBhello ,I established these connections for reading the TI046b1 chip using a Pickit 2 programmer.

author: Diusha
author_rank: Newbie
timestamp: January 07, 2024, 03:39:22 pm
content: Guys, you can write information in the chip by resetting all the counters, but you will not be able to reuse the chip in the printer, since the printer remembers the serial number of the chip (which is signed)and the number of printed copies, all you can do is exchange information from your chip or if you hacker you can modificate firmware. Original chip can be completely rewritten with new data, but it is microcontroller which listen only command for it programmed (toner, drum or developer if chip present in printer)

author: takha
author_rank: Newbie
timestamp: January 09, 2024, 08:23:05 am
content: hello Guys.hello i can read the eeprom memory, but i can’t write can anyone help me?I can’t attach to you my picture electrical system concerning the cabling with the program PICKIT 2.

author: Diusha
author_rank: Newbie
timestamp: January 09, 2024, 02:18:16 pm
content: If you able to read so you can also write, it is not problem in electric circuit. Commands beginning for read toner: 0xf0 , 0x01 , 0x01 , 0x00 , 0x00 for write toner: 0xf0 , 0x01 , 0x02 , 0x20 , 0x00 for read drum 0xf0 , 0x05 , 0x01 , 0x20 , 0x00 for write drum: 0xf0 , 0x05 , 0x02 , 0x20 , 0x00 (For MS5xx )

author: Hegypt
author_rank: Newbie
timestamp: January 19, 2024, 01:19:55 am
content: Lexmark, konica ,toshiba and ricoh . Full esp8266 code resetterHani.3dwy@gmail.com

author: Sloko2
author_rank: Newbie
timestamp: July 08, 2024, 12:09:22 pm
content: QuoteHi,this doesn't seem to work with the current firmwares, does anyone know how to calculate CRC-CCITTThank you,