Canon PRO-10S suddenly stuck in alternating orange/white blink after maintenance

[Spetzbob]

Here's just that part:

---

Update:

After analyzing several EEPROM dumps from related Canon models (MG2410, MG2440, e402) I can now confirm a consistent structure across the entire Canon inkjet lineup.

The K value from the device ID string appears as literal ASCII at offset 0x0216 in every dump. The waste ink counter block sits nearby as 32 bytes with a 2-byte checksum where black + colour = total (mathematically verified). Everything is mirrored, main copy plus backup, and both must be updated or the printer throws an EEPROM error.

Using a brand new MG2440 dump as reference I now have a known-good clean counter block to patch in. The service mode block byte (0x44) also appears encoded inside the 0x85 USB command payloads, confirming the printer is actively reading EEPROM state before responding to service tool commands, when sniffing the USB I saw this block byte in the log. This confirms my service mode being locked.

Not for so long anymore!

Tonight I will attempt the direct EEPROM read/write via Raspberry Pi and SOIC8 clip. Will report back with results.

Thanks!

 

[Spetzbob]

Update: EEPROM analysis and patching attempt


Hooked up the RPi 3B+ to IC402 (S-25A320A SPI EEPROM, 4KB) using a SOIC8 test clip and got a clean read. Two consecutive reads matched SHA256, dump verified.


Initial analysis was confusing, I couldn't find the serial number, couldn't find any familiar Canon EEPROM patterns, no K21000700 string, layout completely different from consumer Pixma dumps I'd compared against.


Then I tried bit-reversing every byte and everything fell into place. The PRO-10S stores all string data bit-reversed in the EEPROM. With that decoding:

• Serial number was found at offset 0x00AA (mirrored at 0x011A)
• Internal model code Canon PRO-10S series at 0x0E86
• WiFi SSID and password stored in bit-reversed plaintext
• And critically: the "SD" service mode lockout marker at offset 0x29-0x2A, also bit-reversed (0xCA 0x22)

So when 'S' is stored as 0xCA and 'D' as 0x22, that's the lockout flag the old service tool versions write. Patched it by changing those two bytes to 0x00 and writing back via SPI.


Result after patching:

• Boot blink count changed from 26 (error 6700) to 9 (error 2001)
• Service tool now connects properly, no more stalled commands
• Set Time command reports OK
• EEPROM save export works (see table below)
  PRO-10S SN= JPN V1.030 ST=1970/01/01-00:00 LPT=1970/01/01-00:00D=000.0DL=01000W=000.0ER(ER0=0000 ER1=0000 ER2=0000 ER3=0000 ER4=0000)PC(M=000 R=000 T=000 D=000 C=000 I=000)TPAGE(TTL=00000)CH=00000CT(LC=000 Y=000 M=000 R=000 LM=000 GY=000 PK=000 C=000 O=000 MBK=000)IL(LC=00 Y=00 M=00 R=00 LM=00 GY=00 PK=00 C=00 O=00 MBK=00)P_ON(S=00000)A_REG=0 M_REG=0ASF PAGE(All=00000 PP=00000 Photo1=00000 Photo2=00000 Photo3=00000 Matto=00000 PC=00000 FA=00000)MF PAGE(All=00000)SIZE(A3=00000 A4=00000 2L=00000 L=00000 4x6=00000 PC=00000 B4=00000 B5=00000 4C=00000 HAN=00000)CDR=00000 CDRP=(00000, 00000) CDRS=(0000)LF(000 0 0 000) EJ(000 0 0 000)INK_OFF(LC=0 Y=0 M=0 R=0 LM=0 GY=0 PK=0 C=0 O=0 MBK=0)EROM CLR=00

Unexpected side effects:

• Serial number now shows N/A in service tool
• WiFi no longer connects (credentials still visible in EEPROM though)
• Set Time saves OK but EEPROM save still shows ST=1970/01/01
• Write Serial returns error 009
• Print EEPROM returns error 002

My current theory is the firmware does a checksum or validity check across a region that includes the bytes I patched. Removing the SD lockout invalidated the checksum, so the firmware treats the whole config block as "invalid" hence empty serial, no WiFi, default time, even though the actual data is still there.


Anyone know if there's a checksum byte somewhere near 0x20-0x40 that needs recalculating? Or does someone have a known-good PRO-10S EEPROM dump I could compare against to find the checksum location?

Or maybe something related to the error codes i got?


I have my original dump backed up so I can revert to the locked state if needed. Considering writing the original back as a clean baseline before attempting another patch with a recalculated checksum.

Thanks!

Edit:
it was a bad solder joint on the EEPROM. I fixed it, it then allowed me to set time in service tool.

Guys it’s working!

What an emotional rollercoaster it has been!

 

[Spetzbob]

Guess what... error B200

 

[The Hat]

Guess what... error B200

Unfortunately, when the printer brings up that error code, it could be anything, usually it’s a print head problem but in your case, the printer doesn’t know what’s wrong, it’s gotten confused because you beaten the bugger this time at its own game..

The problem now is find what’s confusing this confusion..
P.S. I was about to say well done..

 

[Spetzbob]

Unfortunately, when the printer brings up that error code, it could be anything, usually it’s a print head problem but in your case, the printer doesn’t know what’s wrong, it’s gotten confused because you beaten the bugger this time at its own game..

The problem now is find what’s confusing this confusion..
P.S. I was about to say well done..

Hm, yeah I’m leaning towards the print head. The printer boots up fine if I take it out, and if I put it in when booted it gives me 10 blinks again. I’m gonna go ahead and try to clean the print head with a water soak on the lower side.

If that doesn’t work i guess I’ll have to reward myself for all of this hard work with a new printer… really like the pigment ink prints and quality of this one, so I guess maybe a pro-310 would be a good fit for me

 

[The Hat]

I guess maybe a pro-310 would be a good fit for me

I am surprised your giving up that quick, a new print head would solve your problem and reset the printer back to default, besides it wouldn’t be a waste if the Pro 10 goes west on you, the same new print head will work in a Pro 310 also..

 

[Spetzbob]

I am surprised your giving up that quick, a new print head would solve your problem and reset the printer back to default, besides it wouldn’t be a waste if the Pro 10 goes west on you, the same new print head will work in a Pro 310 also..

Haha, well i was getting into some hesitation around all of this, thinking i put a LOT of time into it already.

That and i could only find the printhead new from the local canon service partner here in europe for like €250 and that would already have paid for 1/3 of the Pro 310

Did not know it’s the same head!

Do you maybe have any idea where I can source a new or used head for a better price?

Thank you.