Thanks the information from "The Hat", and the encourage from "stratman". Before somebody send me US version of EEPROM dump, I actually spent some time to analysis the dump from my printer, and found something interesting:
1. the EEPROM (M95080WP) is a 1K (1024) byte SPI EEPROM, it has 32 pages, and 32 bytes each page.
2. there are lots of successive "FFFF" meanings these bytes are not used.
3. some data are repeated, which means they are something important, and saving them at two locations will help to avoid the possible data error.
4. the data in EEPROM are "raw data", meaning no encrypt, the characters are stored as ASCII code, and numbers are stored as HEX data.
For example, if we look into the data from 0x60 to 0x68, they are 0x464C, 0x464E, 0x3133, 0x3834, 0x0034, each byte falls in ASCII code range, so let's change them to characters based on ASCII code, they will be like "FL", "FN", "13","84"," 4", and if we swap high byte and low byte of each word, they are "LF", "NF", "31", "48", "4 ", this is exactly the serial number (SN) on the first line of EEPROM print. So we know that SN is stored from 0x60 to 0x68, and 0x90 to 0x98 (repeated) with ASCII code.
Similarly, if you look at some data like P_ON (power on times), it's 844 in DEC, and if we search its HEX value (0x034C), it is stored at 0x224 in EEPROM, with only one location, meaning if you chose to clean EEPROM in service mode, most probably it will be cleaned (set to 0x0000).
Anyway, SN and cleanable data are not what we're looking for here, but by doing this kind of analysis, we will know how data and characters are stored in EEPROM. Now we will need find out where the so-called "Ink cartridge region code" are stored. It should be a important data, so must be stored twice in this EEPROM. I printed multiple EEPROM dumps, and found out that the data between 0x00 and 0xB0 are never changed, which means they must be something unique to this printer, such as SN, software version, and maybe ink region code.
To further narrow down the scope, I have a simple logic analyzer hooked to EEPROM data line, and try to find out what the printer is doing when I'm doing something related with ink change and destination change. One thing interesting enough is that when I change the destination with service tool, the printer is changing the data on 0x50 and 0x54, and the data in 0x54 is 0x16 which is the #6 option in the destination pull down menu, and when I change destination to USA (the #3 option), and 0x54 changed to 0x13 as well, so we know that destination is stored at 0x54 and 0x84 (repeated).
For those who are interested in logic analyzer, picture below is the one I'm using, it's simple and cheap, but works.
The data captured are as below, the software tool on PC will convert the waveform to data automatically. Here 0x02 means write command, and 0x0054 means the write address, and 0x21E8 is the data writing to EEPROM, it's LSB data, so you will have to reverse it to MSB data to make it meaningful.
Could you please make an EEPROM print and mark the important data and how they were changed?
