Unbrick Service Mode

Pyro Phoenix

Printing Apprentice
Joined
Oct 14, 2018
Messages
3
Reaction score
1
Points
15
Location
Germany
Printer Model
Canon PIXMA MG2950
Hey folks,

I recently got an faulty MG2950 who was throwing me the 5B00 Service Code - so clearly a sign of planned obsolescence. After searching a while, I found a tutorial how to reset the Ink Waste counter to 0 - altogether with a service tool. But nobody was warning me about the possibility to brick my device while using an outdated version of this service tool ... so the things went mayhem.

Now I can't start the service mode - the printer will freeze with orange light when trying to.

Now im curious:

First:
Is there a (public accessible!) way of restoring the service mode apart from exchanging the EEPROM or the whole mainboard?

Second:
Where to order an replacement EEPROM, if there is no other way of restoring the service mode?

Third:
Is this "softbrick" an intended behavior added by Canon to hinder people to extend the lifespan of their property or a side effect of trying to alter the EEPROM content with an outdated service tool. (i.e. service tool writing to the wrong memory addresses - thus resulting in corrupting the EEPROM)

Thanks!
 

stratman

Printer VIP
Platinum Printer Member
Joined
Apr 19, 2007
Messages
8,712
Reaction score
7,163
Points
393
Location
USA
Printer Model
Canon MB5120, Pencil

The Hat

Printer VIP
Platinum Printer Member
Joined
Jan 18, 2010
Messages
15,618
Reaction score
8,691
Points
453
Location
Residing in Wicklow Ireland
Printer Model
Canon/3D, CR-10, CR-10S, KP-3
@Pyro Phoenix, Canon printers are great machines, and you can do what you like with them inside and out mechanically, but interfere with the printers’ software and you’ll end up with a door stop on your hands, it won’t work again till you take to a Canon Service agent. :barnie

You own the printer, but Canon owns the software and they guard it very well, O’ and they don’t make a secret of it either...
 

Pyro Phoenix

Printing Apprentice
Joined
Oct 14, 2018
Messages
3
Reaction score
1
Points
15
Location
Germany
Printer Model
Canon PIXMA MG2950
None that anyone here has ever mentioned besides cannibalizing another printer.
So, why don't create a EEPROM binary dump library? Or better - some kind of delta backup which doesn't contain any copyrighted material but is able to reset the present EEPROM contents back to default on the basis of checksums. Kind of ... I'm not a programmer :idunno

Is the glass half full or half empty? No doubt done in part to prevent people from getting ink leaked onto surfaces outside the printer due to saturated ink absorbers.

So rather completely disabling the print functionality than warning the user about the ink absorbers have to be replaced and further usage can cause nasty stains?

Yeah, same type of problem like Apple with their way of bullying customers. Have problems with freezing phones due to insufficient amperage? Of course you secretly slow down the CPU instead of displaying a message that the battery is dying and you need to replace it. Hopefully users will buy new phones, because they start lagging ...

Ehh, whatever. Enough ranting about shitty company policies for today.
 

stratman

Printer VIP
Platinum Printer Member
Joined
Apr 19, 2007
Messages
8,712
Reaction score
7,163
Points
393
Location
USA
Printer Model
Canon MB5120, Pencil
So, why don't create a EEPROM binary dump library? Or better - some kind of delta backup which doesn't contain any copyrighted material but is able to reset the present EEPROM contents back to default on the basis of checksums. Kind of ... I'm not a programmer :idunno
Some of this has been done with other hardware devices, such as CD/DVD burners, with great success. Either those with the skills are uninterested or Canon presents a greater difficulty. Let us know if you find a site. :hu

BTW, manufacturing of great CD/DVD burners pooped out and so did the firmware mod groups. Only a handful cared about optimized burning and it wasn't the manufacturers anymore.
 

Rainbow

Newbie to Printing
Joined
Sep 7, 2019
Messages
2
Reaction score
7
Points
3
Printer Model
HP LaserJet 5L, OfficeJet 4110
To unblock the service mode, you need a soldering iron and a SPI flash programmer that supports 1.8V chips (a simple LPT port based programmer can be made using a short cable, a couple of resistors and two transistors).

Desolder the flash (it's on the bottom of the printer control PCB) and read. Using a hex editor, check byte at address 0x2a (and a copy at 0x102a). It will be 0x44 ('D') if the service mode is blocked. The byte before is 'S' so if you see 'SD', it's blocked. Change both the 0x44 bytes to 0x00 to unblock.

And now the funny part: service tool V4905 will not block the service mode - but will not reset the ink absorber either! The button is simply missing. To reset ink absorber, replace the 32 bytes at 0xd0 (and the copy at 0x10d0) with this:
Code:
000000d0: 63 a5 40 00 00 00 00 00 00 00 00 00 01 00 00 00  c.@.............
000000e0: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................

Then flash the modified dump back.
This will probably work with all MG2900 series printers.
 

Rainbow

Newbie to Printing
Joined
Sep 7, 2019
Messages
2
Reaction score
7
Points
3
Printer Model
HP LaserJet 5L, OfficeJet 4110
I've just fixed MG2950 with 1700 error. Tried with v4720 service tool, blocking the service mode, then found this thread... Found a non-blocked MG2950 dump somewhere on the web, flashed, turned on/off, read back, blocked using v4720, read back and compared to find the 'D'. Fixed that in my original dump and service mode was unblocked. That was quick.

The "ink absorber" part was harder. The first two bytes of the 32-byte block are some kind of checksum. Tried to crack it as CRC-16 using reveng but was not successful - it's probably not a CRC. Then there's 0x40 costant. Then there are 3 numbers, 1st one + 2nd one equals to 3rd one. Probably black+colour = total wasted ink. You can't change them without recalculating the checksum or it will result in EEPROM error (6800). Luckily, found a clean (new printer) MG2940 dump elsewhere on the web - the 32 bytes above are taken from that.

Some people are directly using complete dumps from other printers. I don't recommend doing that - serial number and all counters will change, probably also some factory calibration data (if there are any).

BTW. The absorbers are really small in these models.
 

websnail

Printer VIP
Platinum Printer Member
Joined
Oct 27, 2005
Messages
3,661
Reaction score
1,345
Points
337
Location
South Yorks, UK
Printer Model
Epson, Canon, HP... A "few"
To unblock the service mode, you need a soldering iron and a SPI flash programmer that supports 1.8V chips (a simple LPT port based programmer can be made using a short cable, a couple of resistors and two transistors).

Desolder the flash (it's on the bottom of the printer control PCB) and read. Using a hex editor, check byte at address 0x2a (and a copy at 0x102a). It will be 0x44 ('D') if the service mode is blocked. The byte before is 'S' so if you see 'SD', it's blocked. Change both the 0x44 bytes to 0x00 to unblock...
Going to admit my complete n00b status on this side of things. So, wondered if you can recommend any tutorials, references, etc... that would explain the various points, tools, processes you've suggested above.

Sadly I never got into electronics beyond discovering capacitors and nearly learning to fly across rooms so I wasn't allowed much more and since then time has been the crutch/excuse/barrier.
 

Latest posts

Top