66% or better

Xerox Phaser drum unit hacked, lives to print another day

Faced with a printer that would stop printing for no apparent reason, Finnish pirate and hacker [Janne] decided he had had enough. After doing a bit of research, he disassembled the drum assembly and replaced some components. The end result? Supposedly ‘broken’ printers started working again.

Apparently, Xerox uses a fairly basic scheme to determine when it’s time to replace your printer drum: An I2C eeprom keeps a count of the number of pages printed. After a certain number, the printer decides that it’s broken and won’t print any more. To fix this, a suitable replacement memory chip needed to be sourced. The original chip was a ST22C02WP. However, this was difficult to find, so the replacement part was selected to be a CSI 24C01WI. Amusingly enough, the replacement part has only half the space of the original chip, but this doesn’t appear to have caused a problem. The chips were swapped, and after some precision soldering the printer was completely repaired. The blank replacement chip functioned… due to the fact that there is no security or encryption involved between the printer and the drum (Score!)

Have you ever had to get intimate with a soldering iron just to get your printer to do its job? Let us know in the comments.

Comments

  1. PiP says:

    HP CP1700 — Had to remove a CR2032 button battery to kill the internal clock and trick printer into using “expired” ink cartridges.

  2. David J Robertson says:

    Rather than replace the EEPROM, it could have simply been erased.

  3. cde says:

    You could have just rewritten the chip. Hell, now you’ll have to do it again when it runs out a second time.

  4. cde says:

    Or try putting the chip in read only mode, and see if the printer still works like that. No more writing to the chip means no page count updates.

    As for soldering iron, no, but tape. HP Officejet 4125 and the like tend to remember the last 6 cartridges used, so refilling a cartridge will not reset the software ink level display. By taping certain pins on the cartridge in a certain order, the printer thinks its a new tank.

  5. ibedazzled says:

    “After a certain number, the printer decides that it’s broken and won’t print any more.”

    HP employs a similar “feature” on the print-heads and ink cartridges on a plotter we have at work. We don’t use the plotter too much, but the heads go “bad” and the ink carts go “empty” often (of course they are not empty at all — I’ve ripped them open to find out for myself). The HP stuff has a little 4 pin blob covered IC double stick taped to the carts/heads.

    anyone have any experience with this? I’d love to circumvent this feature….

    i had even heard HP was being sued over this crap.

  6. macw says:

    a lot of the time what people think of as “wasted” ink is actually a necessary buffer to keep the heads from drying out/clogging/destroying themselves. It’s upsetting that the ink is so expensive but the alternative is to have your heads destroyed, so it’s maybe worth it depending on how much your printer costs.

    The latest thing I’ve heard of is that since printers are so cheap, as little as twice the cost of a new cartridge in some places, the cartridges that manufacturers include with the printers only contain 1/3 or 1/2 as much ink as the same cartridge bought in a store. Cheap cheap cheap.

  7. walt says:

    These printer companies are run by criminals.

  8. Max says:

    ROTFLMAO.

    The sponsored ad I see on this page is from HP.
    “HP QuickPage lower costs and get control of your printing”

    I think “Hackaday tips, genuinely lower your costs with no marketing BS”

    It’s amazing how badly wrong these “targeted” ads are quite often. “Hmm a reference to printing, must put printing related ads on it”

    Oh, and back on topic : instead of changing the chip, it looks like it’s on a mini board with presumably a connector on the back somewhere. Why not make a matching connector that goes to an eeprom rewriter? Then you just pull that board out and rewrite it, bingo you’re back in business. Could even be easy to sell as a service.

  9. cde says:

    @ macw some if not most of consumer level printers have ink cartridges with builtin print heads, so that renders it moot.

  10. codeman says:

    That’s a old printer before they started using custom eeprom that self destruct if you read the wrong area :)

  11. David J Robertson says:

    @cde that practice is becoming less and less common, now many printer cartridges are simply ink tanks.

  12. unhappy says:

    Another thing, my “all-in-one” printer/scanner Canon MP 610 don’t want to SCAN when out of ink!

    Next time, no all-in-one for me!

  13. macw says:

    HP was the only company that ever did the cartridge-print-head thing, and they’re changing now anyway. Epsons and Canons both have the heads built into the printer, and I’m not sure about Lexmark or Brother or whoever but if the basic technology is a piezo element or a thermal bubblejet the heads won’t be part of the cartridge.

  14. Taylor Alexander says:

    Printer companies need to die.

  15. qwerty says:

    This calls for a PIC/AVR based eeprom emulator that fools the printer logic into believing there is a real eeprom, then resets itself when the page count reaches the limit.

  16. Slanderer says:

    For people who don’t print a lot, expensive ink isn’t that bad a trade for having the cost of the printer offset. An inkjet printer is probably, by far, the most complicated electromechanical device in your house (hackers notwithstanding). A printer sold at the same profit margin as most consumer devices would be much, much more expensive.

  17. medwardl says:

    I hate ink jet printers before I stopped using them if I didn’t print anything in a week the ink would dry in the print head and I would either have to buy 60 dollars in new ink cartridges or a new printer which was usually cheaper most of the time. I don’t print often but when I do it’s a lot and I expect my printer to print when it has new ink in it. Now that I went to laser It was more expensive to get but way cheaper in the long run. My current cartridge is the original I’ve never had to fill or replace it its going on 5 years now though I should get a color laser printer one of these days but I don’t really need it and color doesn’t recycle it’s own ink.

  18. jordan says:

    At work and at home we have Brother laser printers. they have similar mechanisms that outright stop all functionality once X number of pages have been printed. and it’s toner for crying out loud, theres no ink to dry!

    the solution on brother printers is to simply black out a window on the toner tank and/or reset the whole machine to defaults. My little home laser printer has a starter cartridge rated at 1000 pages that shut off entirely after 1200 and is now still happy printing away at over 1500 pages…

    printer & printer consumables companies are ripoffs. and im not one to worry about the environment but if you think about it, that’s a hell of a lot of wasted toner/ink when artificial limits are imposed.

  19. Lt bob says:

    I SUSPECTED THIS TO BE IN SOME PRINTERS!

    THEY JUST DON’T DIE FOR NO REASON!

    FUUUUU!

  20. Evan S. says:

    How is this not the exact same as this story: http://www.wftv.com/news/26986709/detail.html?cxntlid=cmg_cntnt_rss

    I think if someone took these companies to court they would have a strong case.

  21. graymalkin says:

    This is disgusting, aren’t there laws against this?! Products designed to break after x amount of time must be illegal?!

  22. pelrun says:

    This is a completely different issue to the whole inkjet cartridge scam. The imaging drum has a finite lifespan, but it’s not something that just fails and stops working – instead prints get poorer and poorer once it is used beyond a certain point. So there is a counter that flags the deteriorating drum after a certain number of pages printed.

    The fact that there isn’t any encryption or security on the setup is a reasonable indicator that the manufacturers aren’t doing this as a revenue generator – bypassing the counter is easy but you get shitty prints.

    As for counters that force replacement of ink or toner carts before they are empty – that’s utterly despicable.

  23. graymalkin says:

    In the United Kingdom, planned obsolescence engineered into products is considered a breach of customer rights. The Office of Fair Trading and Trading Standards Institute investigate claims of products constantly failing just outside the warranty period.

  24. yetihehe says:

    @pelrun yeah, those drums typically start to show wear after about 6k pages. So why 1k limit?

  25. ThanatosK says:

    Ok, I’ll say it… WTF is up with the Snooki image test page?

  26. Roger Wolff says:

    FYI,
    my IBM infoprint color-8 printer had a toner-out-warning, but it would still be possible to print for a while. Scam? No!

    The toner runs from the cartridge into a storage space, and when the storage space becomes less-than-full, the toner-change warning light comes on. The toner cartridge is fully empty, and it still has several 100 pages worth of toner in the intermediate storage space…

    You can change it anywhere when the toner low light is on, it won’t cost (or save) you a dime if you postpone.

  27. lurker says:

    HeHeeee… THIS is a long-running scam that is sometimes easy to circumvent and sometimes not…

    Old-school inkjets are easy – I have a couple of epson’s that I keep in store for one reason – They’ll take ANY kind of ink, and are not “smart” in any sense of the word. The heads are separate from the cartridge, but a q-tip soaked in alcohol is quick and easy and they’re still useful as heavy-duty document printers…

    Laser printers pose a different problem – What pisses me off the most is the “introductory” cartridge – the one that, out of the brand-new-printer box, gives you 1500 pages on a cartridge designed for 6000 – The drum is the same, the capacity is the same, it’s just short-filled and chipped for the lower number. A lot of “newer” printers have aftermareket refill kits for 20cents on the dollar – An excellent bargain, and they more than pay for themselves… However, the electrostatic drum is bound to wear out after some time – In my experience (when I use a laser printer, it’s 500+ pages at a time) the drum is good for 2-3 “cartridges” worth of acceptable prints – Hmmm…Do I pay ~20 for a refill kit, or ~80 for a cartridge? 60 vs 240 is a no-brainer, but when the drum dies one must put some thought into whether the current printer is WORTH maintaining…

    …As many of you can probably imagine, the older you go the better – I picked up an HP Laserjet-4 a decade or so ago for $5 – Worked fine, just heavy as shit… A few refills, and I put ~30,000 pages through the original hardware – Would have kept using it, but I found a good deal at officemax on a newer, faster printer – Now the drum is failing on that one (after another 25-30,000 or so pages, I print a lot of books), and the question remains – do I dump the money into it or go a generation back?

  28. cde says:

    @ pelrun Not the case. The number of people who can figure out how the cartridge is limiting itself, and are inclined/willing/capable of doing it must be a minuscule half percentage at most. Everyone else will just bitch and shell out more for ink.

    Security through obscurity + plus unwillingness to spend more on engineering a proper secure system = still a significant profit incentive.

  29. gyula says:

    We have 15 of the Xerox Phaser 3450, the shittiest printers we’ve ever had.
    Some of them are used to print envelopes only. If they reach ~3k envelopes(!) with almost 12 words on it, (the printer count them as a full page) it stops working…
    Fortunately half of the printers are died with some “fuser error” message, or just wont turn on on the morning. All of them are 5-6 years old, half of them died in the last month with the same (built in?) error message… Suspicious!

  30. Ran into this “scam” with the battery a while back.
    Another potential hack is to reprogram the 24C256 e2prom in an HP all-in-one printer to accept different cartridges as the only difference between them is that the printer chip goes “Nyet!” when it compares the stored code with the internal one.

    Kudos to the OP for finding out where they store the page count though, this is a neat trick to do if you find a used printer with a drum error.

  31. codeman says:

    After 10 years or reverse engineering these chips starting with simple eeproms to new ones with heavy encryption i can tell you they are getting worse every year.

  32. Marvin says:

    how about a tiny avr which emulates the eeprom and resets the count on powerup?

  33. Per Jensen says:

    I have a Samsung ML-2580N 1200 DPI laser printer, i bought it because i needed 1200 DPI printing. The original toner was a unit with about 1000 pages worth of toner and a chip that stops the machine when that is empty, and it’s about time for it to stop, and then i need to go to eBay, purchase some powder and a new chip. That damn chip is encrypted and impossible to copy/delete… I could connect my logic analyser and see what is happening when the printer is talking to the eeprom, but when i see what a new chip costs, i really don’t want to use time on that….

  34. Wallace says:

    Some comments:
    - Usually printer companies lose money with every (laser) printer sold. They have to sell several genuine toner cartridges to make profit.
    - There’s no feasible way to measure the amount of toner left in the cartridge, so that amount has to be “guessed” from the number of pages and pixels printed. Because the toner should never be empty before the nominal number of pages was printed, some extra toner is added. That’s why sometimes an “empty” cartridges is not really empty.
    Furthermore toner consumption depends on environmental conditions.
    - Often the same print-engine is used in different products, eg. multifuncion device, printer, fax, etc. Because of legal issues a fax must never be out of toner. (To avoid printing received documents in “white” and deleting them from memory afterwards.)

  35. Haku says:

    Many years ago I once bought a new printer online for £10 including postage (it was a promo, I forget which manufacturer it was) then binned it when the ink ran out because replacement cartridges were magnitudes higher than the printer cost me and refilling the carts wouldn’t have worked because they were chipped.

    Yeah I know, fucked up isn’t it.

  36. Janne Paalijarvi says:

    Hello, I’m the original author of this Finnish post. I have started an English blog and also documented this drum unit fiasco here: http://paalijarvi.fi/tgblog/2013/09/01/xerox-laser-toner-cartridges-programmed-to-fail

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s