A Fun Exploit For Canon Printers Brings GDB Gifts

The printer's display with the exploit-loaded animation playing, saying "hacked by blasty" and a bunch more stuff

Modern printers make it all that much more tempting to try and hack them — the hardware generally tends to be decent, but the firmware appears to be designed to squeeze as much money out of you as possible while keeping your annoyance level consistently high. That’s why it’s nice to see this exploit of the Canon imageCLASS MF74XCdw series (MF742Cdw/MF743Cdw) by [blasty], triggerable over a network connection, with a story for our amusement.

In this post, we get a tale of how this hack came out of a Pwn2Own Toronto challenge, notes on the hardware involved, and we’re shown the journey to a successful hack. The Canon printer OS is built without many of the protections, which makes playing with it easier than with more modernized targets, but it’s nevertheless not straightforward. Still, exploiting a couple things like the SOAP XML implementation and the UTF8 encoder nets you an ability to play nice animations on the display, and most certainly, control over the entirety of the hardware if you wanted it.

One of the most fun things about this hack is the GDB stub recently included in the repo. If you wanted to debug Canon printers for fun or profit, [blasty] brings you a GDB stub to do that comfortably, with a respectable README that even has porting notes for other Canon ImageCLASS printer models, should you lay your hands on a different machine of despair. WiFi connectivity appears to be enough for this hack, so you better make sure you don’t have your network-connected printers exposed on the Internet — not that you needed more reasons to avoid that.

12 thoughts on “A Fun Exploit For Canon Printers Brings GDB Gifts

  1. How close are we to being able to re-purpose a printer with an off-the-shelf 3D printer board? Maybe just a custom module for the inkjet driver?

    I had a printer recently refuse to print in black and white until the Magenta cartridge was replaced. Ugh. Double ugh. One reason I was a big fan of “black only” printers.

    Still hoping e-paper finally gets to the point we can use it instead. 2600×1400 resolution on a 9×5 display for $50 that can run for a month would be sweet. (I cannot stand how Kindle downsized the battery and make you charge it every couple weeks, mine are perpetually dead. Killed the whole point of them replacing books :/)

    1. Are none of yall using laser printers? I bought a brother color laser printer a few years back and have had no problem with it anf still on original toner. I will never buy inkjet again.

  2. We’re now at the point where 3D printers are better and more user-friendly than 2D printers despite a massive head-start… where’s my open-source 2D printer, guys?

    1. You bring up a really good point – with as long as 2D printers have existed compared to their 3D counterparts, you’d really expect a lot more from the 2D models by now…

      And to Miles – man, that’s infuriating, isn’t it? Why would they design a printer that refuses to print in b/w because one of the COLOR cartridges is empty?? That makes me frustrated FOR you, lol. I’m with you on that, too – I often miss the old-school, simple black-cartridge-only printers…

      1. While undoubtedly the printer manufacturers are being greedy, there is a difference between a true black or white and composite shades. For painting, for instance, an artist might want a warm or cool black instead of a grey black. I suppose that if a printer, out of colour ink, substituted “close enough” black ink for what is supposed to be a blend, there’d be some angry and frustrated graphic designers.

        I don’t know what the printer receives for data, and it may well be that it just gets an absolute colour per “pixel”. So maybe printer need to smarten up, and software too, in regards to data packets?

        If anyone does an open source 2d printer, that would be something to take into consideration.

    2. Right? And not only does the 3d printer do a more complex job, mine is also built/programmed in large part by me. AND is still more user friendly!
      I don’t want flying cars in the future, I just want a printer that works.

  3. Epson
    easy to change the ink cartridge?
    Menu->Maintenance->down, down –>ink–>down ,down ,down –>change ink cartridge.

    A great example of an easy task must be difficult.

  4. Cheap consumer printers sold at a loss are obviously a bad deal.
    Inkjet printers are also a bad deal unless hey have external ink tanks, or you use them every day.

    Get a used office laser printer.
    $50-$100 upfront.
    $20 for a 20k-30k page toner cartridge, which you can refill with toner if they somehow become hard to find. (Use PPE! Toner should be in the cartridge, not your lungs or eyes)
    Toner doesn’t dry out. And these machines run FOREVER, so there is always toner available. My HP is from 2003 and it is sill trivial to get toner.

    Food for thought:
    How hard would it be to get an open source printer distribution, so we can start gutting the proprietary control boards from these things.
    Surely a modern ARM board + servo/power board could do the job.
    Built-in Ethernet and GPIO should make this a doable thing.

  5. I’ve been thinkig for long about use a DVD laser to do a printer without Ink… Obviosly adjusting to not burning the paper completely nor only yelowing the paper…

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.