- Thread starter
- #11
Spetzbob
Newbie to Printing
- Joined
- Apr 23, 2026
- Messages
- 9
- Reaction score
- 2
- Points
- 8
- Printer Model
- Canon GX4050, Canon Pro-10S
Here's just that part:
Update:
After analyzing several EEPROM dumps from related Canon models (MG2410, MG2440, e402) I can now confirm a consistent structure across the entire Canon inkjet lineup.
The K value from the device ID string appears as literal ASCII at offset 0x0216 in every dump. The waste ink counter block sits nearby as 32 bytes with a 2-byte checksum where black + colour = total (mathematically verified). Everything is mirrored, main copy plus backup, and both must be updated or the printer throws an EEPROM error.
Using a brand new MG2440 dump as reference I now have a known-good clean counter block to patch in. The service mode block byte (0x44) also appears encoded inside the 0x85 USB command payloads, confirming the printer is actively reading EEPROM state before responding to service tool commands, when sniffing the USB I saw this block byte in the log. This confirms my service mode being locked.
Not for so long anymore!
Tonight I will attempt the direct EEPROM read/write via Raspberry Pi and SOIC8 clip. Will report back with results.
Thanks!
Update:
After analyzing several EEPROM dumps from related Canon models (MG2410, MG2440, e402) I can now confirm a consistent structure across the entire Canon inkjet lineup.
The K value from the device ID string appears as literal ASCII at offset 0x0216 in every dump. The waste ink counter block sits nearby as 32 bytes with a 2-byte checksum where black + colour = total (mathematically verified). Everything is mirrored, main copy plus backup, and both must be updated or the printer throws an EEPROM error.
Using a brand new MG2440 dump as reference I now have a known-good clean counter block to patch in. The service mode block byte (0x44) also appears encoded inside the 0x85 USB command payloads, confirming the printer is actively reading EEPROM state before responding to service tool commands, when sniffing the USB I saw this block byte in the log. This confirms my service mode being locked.
Not for so long anymore!
Tonight I will attempt the direct EEPROM read/write via Raspberry Pi and SOIC8 clip. Will report back with results.
Thanks!
Last edited:
