1. Dismiss Notice
  2. Picture Of The Week (POW) Information and Submissions
    CLICK HERE!
    (if you are logged in, this notice can be dismissed using the "x" to the top right of the notice)

    Dismiss Notice
  3. Official PK Poll: Is there any future in refilling?
    CLICK HERE!
    (if you are logged in, this notice can be dismissed using the "x" to the top right of the notice)

    Dismiss Notice
  4. PK Featured Thread: Assistance needed - Epson 1430 sudden complete clogging or air in print heads
    CLICK HERE!
    (if you are logged in, this notice can be dismissed using the "x" to the top right of the notice)

    Dismiss Notice

Unbrick Service Mode

Discussion in 'Canon InkJet Printers' started by Pyro Phoenix, Oct 14, 2018.

  1. Oct 14, 2018
    Pyro Phoenix

    Pyro Phoenix Printing Apprentice

    Joined:
    Oct 14, 2018
    Messages:
    3
    Likes Received:
    1
    Trophy Points:
    10
    Location:
    Germany
    Printer Model:
    Canon PIXMA MG2950
    Hey folks,

    I recently got an faulty MG2950 who was throwing me the 5B00 Service Code - so clearly a sign of planned obsolescence. After searching a while, I found a tutorial how to reset the Ink Waste counter to 0 - altogether with a service tool. But nobody was warning me about the possibility to brick my device while using an outdated version of this service tool ... so the things went mayhem.

    Now I can't start the service mode - the printer will freeze with orange light when trying to.

    Now im curious:

    First:
    Is there a (public accessible!) way of restoring the service mode apart from exchanging the EEPROM or the whole mainboard?

    Second:
    Where to order an replacement EEPROM, if there is no other way of restoring the service mode?

    Third:
    Is this "softbrick" an intended behavior added by Canon to hinder people to extend the lifespan of their property or a side effect of trying to alter the EEPROM content with an outdated service tool. (i.e. service tool writing to the wrong memory addresses - thus resulting in corrupting the EEPROM)

    Thanks!
     
  2. Oct 14, 2018
    stratman

    stratman Printer VIP Platinum Printer Member

    Joined:
    Apr 19, 2007
    Messages:
    6,270
    Likes Received:
    4,383
    Trophy Points:
    373
    Location:
    USA
    Printer Model:
    Canon MP830, Pencil
    Sadly, no.

    None that anyone here has ever mentioned besides cannibalizing another printer.

    Is the glass half full or half empty? No doubt done in part to prevent people from getting ink leaked onto surfaces outside the printer due to saturated ink absorbers. The firmware of the EEPROM is intellectual property and rightfully protected by Canon.
     
    Pyro Phoenix and The Hat like this.
  3. Oct 14, 2018
    The Hat

    The Hat Printer VIP Moderator

    Joined:
    Jan 18, 2010
    Messages:
    11,655
    Likes Received:
    5,412
    Trophy Points:
    403
    Location:
    Wicklow Ireland
    Printer Model:
    Canon were, BUT 3D is better..
    @Pyro Phoenix, Canon printers are great machines, and you can do what you like with them inside and out mechanically, but interfere with the printers’ software and you’ll end up with a door stop on your hands, it won’t work again till you take to a Canon Service agent. :barnie

    You own the printer, but Canon owns the software and they guard it very well, O’ and they don’t make a secret of it either...
     
    stratman and Pyro Phoenix like this.
  4. Oct 14, 2018
    Pyro Phoenix

    Pyro Phoenix Printing Apprentice

    Joined:
    Oct 14, 2018
    Messages:
    3
    Likes Received:
    1
    Trophy Points:
    10
    Location:
    Germany
    Printer Model:
    Canon PIXMA MG2950
    So, why don't create a EEPROM binary dump library? Or better - some kind of delta backup which doesn't contain any copyrighted material but is able to reset the present EEPROM contents back to default on the basis of checksums. Kind of ... I'm not a programmer :idunno

    So rather completely disabling the print functionality than warning the user about the ink absorbers have to be replaced and further usage can cause nasty stains?

    Yeah, same type of problem like Apple with their way of bullying customers. Have problems with freezing phones due to insufficient amperage? Of course you secretly slow down the CPU instead of displaying a message that the battery is dying and you need to replace it. Hopefully users will buy new phones, because they start lagging ...

    Ehh, whatever. Enough ranting about shitty company policies for today.
     
  5. Oct 14, 2018
    stratman

    stratman Printer VIP Platinum Printer Member

    Joined:
    Apr 19, 2007
    Messages:
    6,270
    Likes Received:
    4,383
    Trophy Points:
    373
    Location:
    USA
    Printer Model:
    Canon MP830, Pencil
    Some of this has been done with other hardware devices, such as CD/DVD burners, with great success. Either those with the skills are uninterested or Canon presents a greater difficulty. Let us know if you find a site. :hu

    BTW, manufacturing of great CD/DVD burners pooped out and so did the firmware mod groups. Only a handful cared about optimized burning and it wasn't the manufacturers anymore.
     
    The Hat and Pyro Phoenix like this.
  6. Sep 7, 2019
    Rainbow

    Rainbow Newbie to Printing

    Joined:
    Sep 7, 2019
    Messages:
    2
    Likes Received:
    6
    Trophy Points:
    3
    Printer Model:
    HP LaserJet 5L, OfficeJet 4110
    To unblock the service mode, you need a soldering iron and a SPI flash programmer that supports 1.8V chips (a simple LPT port based programmer can be made using a short cable, a couple of resistors and two transistors).

    Desolder the flash (it's on the bottom of the printer control PCB) and read. Using a hex editor, check byte at address 0x2a (and a copy at 0x102a). It will be 0x44 ('D') if the service mode is blocked. The byte before is 'S' so if you see 'SD', it's blocked. Change both the 0x44 bytes to 0x00 to unblock.

    And now the funny part: service tool V4905 will not block the service mode - but will not reset the ink absorber either! The button is simply missing. To reset ink absorber, replace the 32 bytes at 0xd0 (and the copy at 0x10d0) with this:
    Code:
    000000d0: 63 a5 40 00 00 00 00 00 00 00 00 00 01 00 00 00  c.@.............
    000000e0: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
    
    Then flash the modified dump back.
    This will probably work with all MG2900 series printers.
     
    websnail and PeterBJ like this.
  7. Sep 7, 2019
    The Hat

    The Hat Printer VIP Moderator

    Joined:
    Jan 18, 2010
    Messages:
    11,655
    Likes Received:
    5,412
    Trophy Points:
    403
    Location:
    Wicklow Ireland
    Printer Model:
    Canon were, BUT 3D is better..
    Would you like to be the first victim.....? (Candidate)….:D
     
  8. Sep 7, 2019
    Rainbow

    Rainbow Newbie to Printing

    Joined:
    Sep 7, 2019
    Messages:
    2
    Likes Received:
    6
    Trophy Points:
    3
    Printer Model:
    HP LaserJet 5L, OfficeJet 4110
    I've just fixed MG2950 with 1700 error. Tried with v4720 service tool, blocking the service mode, then found this thread... Found a non-blocked MG2950 dump somewhere on the web, flashed, turned on/off, read back, blocked using v4720, read back and compared to find the 'D'. Fixed that in my original dump and service mode was unblocked. That was quick.

    The "ink absorber" part was harder. The first two bytes of the 32-byte block are some kind of checksum. Tried to crack it as CRC-16 using reveng but was not successful - it's probably not a CRC. Then there's 0x40 costant. Then there are 3 numbers, 1st one + 2nd one equals to 3rd one. Probably black+colour = total wasted ink. You can't change them without recalculating the checksum or it will result in EEPROM error (6800). Luckily, found a clean (new printer) MG2940 dump elsewhere on the web - the 32 bytes above are taken from that.

    Some people are directly using complete dumps from other printers. I don't recommend doing that - serial number and all counters will change, probably also some factory calibration data (if there are any).

    BTW. The absorbers are really small in these models.
     
  9. Sep 7, 2019
    The Hat

    The Hat Printer VIP Moderator

    Joined:
    Jan 18, 2010
    Messages:
    11,655
    Likes Received:
    5,412
    Trophy Points:
    403
    Location:
    Wicklow Ireland
    Printer Model:
    Canon were, BUT 3D is better..
    Way to go @rainbow…:thumbsup
     
    stratman likes this.
  10. Sep 10, 2019 at 9:37 PM
    websnail

    websnail Printer VIP Platinum Printer Member

    Joined:
    Oct 27, 2005
    Messages:
    3,319
    Likes Received:
    794
    Trophy Points:
    317
    Location:
    South Yorks, UK
    Printer Model:
    Epson, Canon, HP... A "few"
    Going to admit my complete n00b status on this side of things. So, wondered if you can recommend any tutorials, references, etc... that would explain the various points, tools, processes you've suggested above.

    Sadly I never got into electronics beyond discovering capacitors and nearly learning to fly across rooms so I wasn't allowed much more and since then time has been the crutch/excuse/barrier.
     
    The Hat, PeterBJ and stratman like this.

Share This Page