Pixma 4300 Firmware Dump

[nanosec]

As luck or bad luck has it, I just trashed a printhead on a Pixma 4300.


I also have a chip reader.

If anyone is interested I can try pulling the flash chip off the Pixma 4300 and dumping the firmware for the printer.

The idea being a hacked firmware might be possible that allows printing while ignoring the chips and/or writing to the chip on the cartridges.

If anybody has any interest in this let me know and I'll attempt it. i will stipulate that if the flash chip is extremely
small I will probably have problems, but will have no problems donating the chip to somebody who feels up to the task of dumping the firmware.

I have no coding experience, just thought I'd offer the chance at a dumped bin for the printer.

 

[Tin Ho]

It is not easy to hack the firmware. Within the firmware it probably has a piece of code that checks the checksum of the code and compares it to a pre-calculated checksum data. If you alter any code it will upset this comparison which could lead to printer death. But if you pull the flash chip and install a socket for the chip then you can dump and make copies of the chip. If the hack somehow upsets the printer you can put one chip with an original copy of the firmware back and be happy again.

I believe you will be able to buy cheaply a used ip4300 on eBay with a bad print head in it sooner or later. People will put up a sale of one with a dead print head.

 

[nospam2000]

Hi Tin Ho,

I would be very interested in a Firmware dump. A high resolution picture of the main board would be also very nice to figure out the used CPU type and other chips. Most probably highly integrated ICs are used. I haven't found any internals about the pixma hardware or firmware on the net.

On ebay you may find a cheap new replacement printer without ink tanks. I bought one for 33,- Euro some weeks ago which is cheaper than a new print head which costs around 65,- Euro.

nospam2000

 

[Tin Ho]

If the flash chip is a commercial one (such as those made by AMD, Atmel, etc) then you can pull it off the board and put it on a commercial EEPROM programmer to dump the content of it. The image (the dump) can be programmed to new flash chips as copies. I do not know if the flash chip in Canon printers are commercial ones or custom ones. If they are custom chips then forget it. There is no way to dump its content using tools in the public domain. I doubt Canon will use custom chips. That's a very expensive way to make printers.

There is usually a software route to reprogram the flash chip. But it is unlikely a public domain software exists for Canon printers. If one exists it can be used to reprogram the firmware to reset the printer. This would wipe out the memory the printer had for remembering that you had used refilled ink tanks. This route is highly unlikely in my opinion.

 

[nospam2000]

There is usually a software route to reprogram the flash chip. But it is unlikely a public domain software exists for Canon printers. If one exists it can be used to reprogram the firmware to reset the printer. This would wipe out the memory the printer had for remembering that you had used refilled ink tanks. This route is highly unlikely in my opinion.

There are tools for reading/writung the EEPROM memory (http://ipt.nm.ru/iPTool.rar or http://www.resetters.com/download/RestoreEEPROM.zip). Any non-volatile settings and therefore also the flag for using 3rd party ink should be stored there.

I was looking for firmware updates of any Canon Pixma printers. The only one I found was an update for the Selphy CP710 which can be downloaded from the Canon support pages. The question is, if the hardware design of the Selphy CP710 and the ip4xxx / 5xxx printers has the same base. Maybe the included firmware upgrade tool could also be used with the ip4xxx printers: http://web.canon.jp/Imaging/cp710/frm/cp710-data-e.exe

It seems to be a generic tool which uses an ini-file:
[UPDATER]
DriverName=Canon SELPHY CP710
ProductName=CP710
USB_VID=04A9
USB_PID=3127

The ROM image is 2MB and a lot of it is either empty (0xff / 0x00) or contains graphics or character ROM data. From the firware image I could read, that they use a library from NEC called AP703000-B03 for JPEG processing. This library is for the NEC 32 bit RISC processors V810/V850 which are also used in CD-ROM/DVD drives.

A lot of strings concerning DPOF are readable, but I couldn't find anything about the Canon command strings like BJLSTART, ControlMode, etc.

Some ideas:
- would it be possible to flash an iP5000 ROM to an iP4200/iP4300 or is the hardware too different?
- what about patching the ROM to remove the CHIP check of the printer cartridges?

nospam2000

 

[Marx]

Isn't it simpler to crack printer driver?