Canon PRO-10S suddenly stuck in alternating orange/white blink after maintenance

[Spetzbob]

Here's just that part:

---

Update:

After analyzing several EEPROM dumps from related Canon models (MG2410, MG2440, e402) I can now confirm a consistent structure across the entire Canon inkjet lineup.

The K value from the device ID string appears as literal ASCII at offset 0x0216 in every dump. The waste ink counter block sits nearby as 32 bytes with a 2-byte checksum where black + colour = total (mathematically verified). Everything is mirrored, main copy plus backup, and both must be updated or the printer throws an EEPROM error.

Using a brand new MG2440 dump as reference I now have a known-good clean counter block to patch in. The service mode block byte (0x44) also appears encoded inside the 0x85 USB command payloads, confirming the printer is actively reading EEPROM state before responding to service tool commands, when sniffing the USB I saw this block byte in the log. This confirms my service mode being locked.

Not for so long anymore!

Tonight I will attempt the direct EEPROM read/write via Raspberry Pi and SOIC8 clip. Will report back with results.

Thanks!

 

[Spetzbob]

Update: EEPROM analysis and patching attempt


Hooked up the RPi 3B+ to IC402 (S-25A320A SPI EEPROM, 4KB) using a SOIC8 test clip and got a clean read. Two consecutive reads matched SHA256, dump verified.


Initial analysis was confusing, I couldn't find the serial number, couldn't find any familiar Canon EEPROM patterns, no K21000700 string, layout completely different from consumer Pixma dumps I'd compared against.


Then I tried bit-reversing every byte and everything fell into place. The PRO-10S stores all string data bit-reversed in the EEPROM. With that decoding:

• Serial number was found at offset 0x00AA (mirrored at 0x011A)
• Internal model code Canon PRO-10S series at 0x0E86
• WiFi SSID and password stored in bit-reversed plaintext
• And critically: the "SD" service mode lockout marker at offset 0x29-0x2A, also bit-reversed (0xCA 0x22)

So when 'S' is stored as 0xCA and 'D' as 0x22, that's the lockout flag the old service tool versions write. Patched it by changing those two bytes to 0x00 and writing back via SPI.


Result after patching:

• Boot blink count changed from 26 (error 6700) to 9 (error 2001)
• Service tool now connects properly, no more stalled commands
• Set Time command reports OK
• EEPROM save export works (see table below)
  PRO-10S SN= JPN V1.030 ST=1970/01/01-00:00 LPT=1970/01/01-00:00D=000.0DL=01000W=000.0ER(ER0=0000 ER1=0000 ER2=0000 ER3=0000 ER4=0000)PC(M=000 R=000 T=000 D=000 C=000 I=000)TPAGE(TTL=00000)CH=00000CT(LC=000 Y=000 M=000 R=000 LM=000 GY=000 PK=000 C=000 O=000 MBK=000)IL(LC=00 Y=00 M=00 R=00 LM=00 GY=00 PK=00 C=00 O=00 MBK=00)P_ON(S=00000)A_REG=0 M_REG=0ASF PAGE(All=00000 PP=00000 Photo1=00000 Photo2=00000 Photo3=00000 Matto=00000 PC=00000 FA=00000)MF PAGE(All=00000)SIZE(A3=00000 A4=00000 2L=00000 L=00000 4x6=00000 PC=00000 B4=00000 B5=00000 4C=00000 HAN=00000)CDR=00000 CDRP=(00000, 00000) CDRS=(0000)LF(000 0 0 000) EJ(000 0 0 000)INK_OFF(LC=0 Y=0 M=0 R=0 LM=0 GY=0 PK=0 C=0 O=0 MBK=0)EROM CLR=00

Unexpected side effects:

• Serial number now shows N/A in service tool
• WiFi no longer connects (credentials still visible in EEPROM though)
• Set Time saves OK but EEPROM save still shows ST=1970/01/01
• Write Serial returns error 009
• Print EEPROM returns error 002

My current theory is the firmware does a checksum or validity check across a region that includes the bytes I patched. Removing the SD lockout invalidated the checksum, so the firmware treats the whole config block as "invalid" hence empty serial, no WiFi, default time, even though the actual data is still there.


Anyone know if there's a checksum byte somewhere near 0x20-0x40 that needs recalculating? Or does someone have a known-good PRO-10S EEPROM dump I could compare against to find the checksum location?

Or maybe something related to the error codes i got?


I have my original dump backed up so I can revert to the locked state if needed. Considering writing the original back as a clean baseline before attempting another patch with a recalculated checksum.

Thanks!

Edit:
it was a bad solder joint on the EEPROM. I fixed it, it then allowed me to set time in service tool.

Guys it’s working!

What an emotional rollercoaster it has been!