Hacking the Samsung CLP-315
-
Upload
cosasdeangel -
Category
Documents
-
view
847 -
download
11
Transcript of Hacking the Samsung CLP-315
-
Hacking the Samsung CLP-315 Laser Printer
Posted on March 4, 2012
I am the happy owner of a Samsung CLP-315 laser printer. It is a fantastic printer for the price. Things were
going great until it came time to replace the toner. At the time, the price of a full set of toner cartridges was
around $150. To put things in perspective, the printer itself could be acquired for less on eBay. Not being the
type of person who so easily bends to the will of The Man, I set out on a journey to find a cheaper source of
toner.
A journey? Really? As it turns out, the answer is yes but in the end it was worth it. This is going to be a long
post, so strap yourself in. If youd prefer to cheat, you can skip straight to the good stuff.
How Stuff Works
Since I last purchased a laser printer (my circa 2001 LaserJet 1200 is still kicking) the industry has changed.
Imagine that!? Apparently, it is now common practice for printers and even toner cartridges themselves to count
the number of pages that have been printed in order to track the consumption of toner. The printers then use
these page counts to project how much toner remains in the cartridge. To my knowledge, the cartridges dont
have a way to sense how much toner remains.
Why does this matter, you ask? Essentially, it would be like having a gas gauge in your car that only tracked how
far you had driven, not how much gasoline was left in the tank. Depending on several factors (driving style, load,
tire pressure, etc), the amount of fuel consumed in a mile can vary wildly. The end result; you either waste gas,
or run out. Neither is good. The same can be said for the way modern laser printers track toner.
This causes two problems. First, toner is likely being wasted (which irks me). Second, refilling the cartridges with
toner purchased in bulk does nothing to reset the accumulated page count. It is like putting gasoline in your tank,
but not being able to start the car until the odometer is reset. Knowing all this, the only thing standing between
me and cheap toner refills was finding a way to reset the counters.
Unsurprisingly, I am not the first person to try to address this problem. In fact, there is plenty of published
hackery surrounding this printer. Not wanting to start from scratch, I got to reading. What I discovered is that the
page counts are all stored on an EEPROM chip that is attached to an IC bus (an ST M24C64, in this case). If
Hello World!
Chronicles of an OK programmer
Hacking the Samsung CLP-315 Laser Printer | Hello World! http://rumburg.org/printerhack/
1 de 32 16/07/12 18:50
-
that last sentence meant nothing to you, you might want to skip to the Reset Procedure section It is going to
get technical for a while.
Sniffing
After doing some homework, I decided to try watching the IC traffic with a logic analyzer to see what memory
locations were getting updated on the EEPROM after each print. I was able to catch the first handful of writes,
but there were so many that I decided to take a slightly different approach.
I wrote an Arduino sketch to dump the entire memory of the EEPROM to the serial port. This allowed me to see a
before and after memory snapshot. So, I would dump the EEPROM, print a page, and dump it again. I then
compared the outputs using a diff program. I looked specifically for writes that looked like they incremented a
value. Like I had suspected, there were lots of locations that were incrementing. Great!
The next thing I did was print off the printers Configuration Report. This is done by holding down The Button
until the green light flashes rapidly. This report includes several counts, including the counts for our toner
cartridges and the printer itself. By searching the dump file for these numbers (after converting them to hex), I
was able to track down which memory locations were used to store which counts.
Now I had a list of memory locations that (I assumed) stored the page counts. I could use another Arduino sketch
to write zeros back into those locations. Using our analogy from before, I hoped this would reset the odometer
and register the tank as full.
I was able to successfully write zeros to all of the incrementing memory locations. Unfortunately, after printing the
configuration report again, the Toner Remaining percentage hadnt updated for any of the cartridges. Also, the
low-toner warning lights remained lit for all colors. Apparently that percentage is a stored value, not one that is
calculated on the fly based on the page count. If the numbers were stored as floating points, this could explain
why they were harder to see, as they may not have changed by exactly 1 like the page counts did.
I needed a better way to analyze and flash the entire address space on the EEPROM. I hooked up my Bus Pirate
to the IC bus, and was going to start writing some software to accomplish this. Here is where things got really
interesting
The Discovery
I rebooted the printer with the Bus Pirate connected (I dont remember which mode I had it in), and it took a really
long time to start-up. I ran the configuration report and it had mysteriously zeroed or erased every field. All
values, serial numbers, dates, and counts were blank or zero. I was terrified that I had bricked my printer!
So, I disconnected the Bus Pirate and printed another configuration report. Everything looked as I had left it with
one exception. Now, the black toner cartridge registered zero pages and 100% remaining toner. And the warning
light for the black toner was off Eureka! (I didnt really say that, but I think I did run and show my wife who said
Thats nice, honey. Im such a nerd.)
So what happened, and how could I now make it happen for the color cartridges, too? I hooked up the scope to
Hacking the Samsung CLP-315 Laser Printer | Hello World! http://rumburg.org/printerhack/
2 de 32 16/07/12 18:50
-
Original After Hack After Print After Reboot
the SDA and SCL lines of the bus so I could watch what was happening while booting with the Bus Pirate
connected. After a couple of tries, I noticed that the SDA line was being held low by the Bus Pirate (like I said,
Im not sure what mode I had it in). I could see the clock line getting toggled as it booted, but holding the data line
low seemed to be interrupting the flow of data between the EEPROM and the main processor. I can only assume
that when this happens during a boot up, all of the count variables are left initialized to zero in the main
processors memory.
So, the idea struck me. What if I interrupt the communications during boot (letting the in-memory values initialize
to zero), but then print a page and see if it would run the same incrementing logic and write 1s for the page
counts back to the EEPROM. Is double eureka a thing? It worked. All toner levels, page counts, image counts
and everything had been written back to the EEPROM as if they had started at zero.
Reset Procedure
After printing a few more pages (and giggling like a child to the wife), I was able to refine the reset process a bit.
Here are the steps to perform the reset:
Open the printer and solder a wire to the SDA pin of the EEPROM (see video below)1.
Power up the printer with this line held to ground until it finishes initializing2.
You can use chassis near the USB port is an easy spot to ground to.A.
The printer will take longer than normal to initialize; dont be alarmedB.
Disconnect the SDA line from ground3.
Print the demo page by pushing The Button until you see a slowly blinking green light (about 2 seconds)4.
Print the configuration page by pushing The Button until you see a rapidly blinking green light (about 6
seconds)
5.
Hacking the Samsung CLP-315 Laser Printer | Hello World! http://rumburg.org/printerhack/
3 de 32 16/07/12 18:50
-
76 THOUGHTS ON HACKING THE SAMSUNG CLP-315 LASER PRINTER
Turn off the power6.
Turn on the power, and wait for it to initialize7.
Print the configuration report again8.
All your base are belong to us9.
Notes
One thing worth noting; my printer still has its original toner cartridges which are chipless. Retail replacement
cartridges have a chip with its own EEPROM that has a unique identifier and stores its own count. Since I dont
have toner cartridges with these chips, I dont know (but I suspect) that a different approach or additional steps
may be necessary to reset the counts.
You may be able to tape off the exposed pads on the toner chips before performing this procedure and get the
same effect, but I havent got the chipped cartridges to test with. (nor will I be buying any for $150!) YMMV.
Demo Time!
Conclusion
It took some time to get there, but I think it was worth the effort. This printer is now happily kicking out full-color
pages for 2 versus a whopping 15 (ouch). Life is good. Enjoy!
This entry was posted in Hacks and tagged Arduino, CLP-315, Hack, I2C, Printer by Brian. Bookmark the
permalink [http://rumburg.org/printerhack/] .
Hacking the Samsung CLP-315 Laser Printer | Hello World! http://rumburg.org/printerhack/
4 de 32 16/07/12 18:50
-
Pingback: Resetting the page count on a laser printer - Hack a Day
Mad Professor
on March 5, 2012 at 1:21 pm said:
I have a Samsung CLP-300N, and it uses a PDIP Package: ATMEL
24C64A eeprom, in a socket.
One of my toners was showing as empty, but if you remove the
eeprom chip and power on the printer, it takes longer to boot up, but
like your video shows it resets eveything, and is able to print, but as
soon as you put the chip back it, and power cycle the printer, it then
shows the toner is empty again.
For now I am just going to leave the eeprom chip out.
brian
on March 5, 2012 at 3:14 pm said:
It sounds like pulling the SDA line low might work for your
printer, too. Let me know how it goes if you decide to give it a
try!
Karel
on March 25, 2012 at 2:11 pm said:
I tried doing it (CLP-300), but now it wont do anything
at all anymore. (No LED lights, and the roller only turns
5degrees and makes a click.
This time the wife wasnt to happy with me >_