Pantum P2502W Toner Reset Chip help

[s00]

Re: Pantum P2502W Toner Reset Chip help

The M2070W SPI flash contents looks totally different, there is no decrypted bootloader. Recent Pantum printers use a decrypted bootloader with an encrypted firmware, and the values needed to derive the key are stored in OTP register inside the SoC. The firmware contains USB commands to read/write ANY memory, so you can dump the SPI flash (since it is memory mapped), read the OTP registers to derive the key, and manipulate RAM while the printer is running to e.g. reset the toner chip counters.

ok, thanks useful to know.
I had a look and found a debug UART on the printer and can see it is using u-boot as the bootloader and running VxWorks as the RTOS. Unfortunately all the standard u-boot commands don't work so I couldn't dump the memory/flash that way. No sign of JTAG either

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

Tanx what commands U use and firmware version of Urs Plz

I used the USB memory read/write commands to modify some of the firmware RAM variables related to page counter(s) so that when I printed a page, the page counter(s) would be set to 0, both in the toner chip and printer flash memory. My printer has the 3.2.4.1 (encrypted) firmware.

[crdleoffiilth]

Re: Pantum P2502W Toner Reset Chip help

I never made such firmware. The only thing I can do is reset the toner page counter(s) by using the USB memory read/write commands, but it depends on firmware version, so only the version I have is supported.

Tanx what commands U use and firmware version of Urs Plz

[crdleoffiilth]

Re: Pantum P2502W Toner Reset Chip help

[QUOTE=timschuerewegen;1155048]I never made such firmware. The only thing I can do is reset the toner page counter(s) by using the USB memory read/write commands, but it depends on firmware version, so only the version I have is supported.[/QUOT]
Tanx what commands U use and firmware version of Urs Plz

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

welldone ... but will you share the cooked firware with us???

I never made such firmware. The only thing I can do is reset the toner page counter(s) by using the USB memory read/write commands, but it depends on firmware version, so only the version I have is supported.

[crdleoffiilth]

Re: Pantum P2502W Toner Reset Chip help

I successfully modified the page count on my toner chip, but ...

The newer firmware versions keep track of up to 5 toner chip page counts in the nvram area on the SPI flash chip. When the firmware reads the page count from the toner chip, it will compare it to the page count value in nvram for that toner chip and use the highest value. This means that lowering the page count on the toner chip alone will not work, unless you also edit nvram or use the toner chip in a new printer.

I also figured out how to dump and upgrade the firmware via USB. I might try to make a "toner always full" or "no toner chip required" firmware for my P2500W printer

welldone ... but will you share the cooked firware with us???

[crdleoffiilth]

Re: Pantum P2502W Toner Reset Chip help

I found a simple way to reset the toner chip page counter via the USB cable. No need to open the printer or buy a chip programmer.

The only drawback is that you still need to be able to print a page for the firmware to write the new page counter to the toner chip.

If anyone wants to try this, send me a PM because this hack is firmware version specific and at the moment it will only work on printers that have the same firmware as mine.

would U PLZ show us how to do so?

[crdleoffiilth]

Re: Pantum P2502W Toner Reset Chip help

would U PLZ show us how to do so?

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

Looking to do the same on a Samsung M2070W which I believe is very similar internals.

The M2070W SPI flash contents looks totally different, there is no decrypted bootloader. Recent Pantum printers use a decrypted bootloader with an encrypted firmware, and the values needed to derive the key are stored in OTP register inside the SoC. The firmware contains USB commands to read/write ANY memory, so you can dump the SPI flash (since it is memory mapped), read the OTP registers to derive the key, and manipulate RAM while the printer is running to e.g. reset the toner chip counters.

[s00]

Re: Pantum P2502W Toner Reset Chip help

I would be interested in more info as well. Looking to do the same on a Samsung M2070W which I believe is very similar internals.
I dumped the eeprom however it looks encrypted so I guess the next step is to reverse engineer the firmware to find the key/algo.
If you could share details of how you did this for the Pantum it might speed up the process. Thanks

[mgaj2010]

Re: Pantum P2502W Toner Reset Chip help

If anyone wants to try this, send me a PM because this hack is firmware version specific and at the moment it will only work on printers that have the same firmware as mine.

Could you please share the instruction with me?

[DJ_MIX]

Re: Pantum P2502W Toner Reset Chip help

Guys check out this page, they have modified the firmware to require no chip.

I hope we can reverse engineer what they did or just pay the small free to the firmware:

https://zaplaty.com/itm/pantum-printer-fixware/3107505

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

I found a simple way to reset the toner chip page counter via the USB cable. No need to open the printer or buy a chip programmer.

The only drawback is that you still need to be able to print a page for the firmware to write the new page counter to the toner chip.

If anyone wants to try this, send me a PM because this hack is firmware version specific and at the moment it will only work on printers that have the same firmware as mine.

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

I successfully modified the page count on my toner chip, but ...

The newer firmware versions keep track of up to 5 toner chip page counts in the nvram area on the SPI flash chip. When the firmware reads the page count from the toner chip, it will compare it to the page count value in nvram for that toner chip and use the highest value. This means that lowering the page count on the toner chip alone will not work, unless you also edit nvram or use the toner chip in a new printer.

I also figured out how to dump and upgrade the firmware via USB. I might try to make a "toner always full" or "no toner chip required" firmware for my P2500W printer

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

How did you get pass the cartridge life expired please

If your printer has an older firmware then it might be possible to reset the toner chip counters by sending a special command to the printer. I can probably help you with that. My P2500W has a "3.2.4.1" firmware (from 2020) and Pantum removed the "clear counters" command and added extra toner chip security, compared to a "1.1.9.7" firmware (from 2017).

If you can solder and have a CH341 USB programmer, then you can interface directly with the chip and try to clear the counters that way. I can also help you with that.

[Hife55]

Re: Pantum P2502W Toner Reset Chip help

I just ordered a P2500W. The toner chip communication is encrypted, according to the disassembled printer firmware, but I have all the necessary information (I think) to read/write the toner chip data using an arduino. If anyone is interested in a modified firmware that e.g. sees empty toner cartridges as full or wants to reprogram toner chips using an arduino, let me know.

How did you get pass the cartridge life expired please

[Hife55]

Re: Pantum P2502W Toner Reset Chip help

Please I just got a solid orange light on my p2509.. How do I clear this without buying a new printer cartridge?

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

Success

I reverse engineered the printer/chip protocol (including encryption), the meaning of the toner chip data (including encryption and checksums) and can communicate directly with the chip using a cheap CH341 USB programmer for reading out all the information.

I should be able to manipulate/reset the counters but I don't think I will try this any time soon, since I don't know what kind of toner chip anti-tamper protection the printer firmware has and I don't want to destroy my toner chip.

If anyone has a genuine chip that he/she does not need anymore, then please let me know.



(readonly data)
type = PA210E
volume = 700
addlevel = 200
lifecontrol = 0
times = 0
totalvolume = 900
config = 4
machineinfo/countrycode = 0xCC

(read/write data, before toner was used)
printedpage = 12
writecoverage = 281
remain = 100
printedact = 1
toner_paper_a4 = 1
toner_paper_a5 = 0
toner_paper_b5 = 0

(read/write data, after printing the 4 builtin test/info pages)
printedpage = 16
writecoverage = 105
remain = 100
printedact = 5
toner_paper_a4 = 5
toner_paper_a5 = 0
toner_paper_b5 = 0

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

The firmware on my new P2500W printer was encrypted, and the key to decode it was stored in 88PA6110 efuses, so I had to modify the bootloader to dump the efuse values via UART

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

I just ordered a P2500W. The toner chip communication is encrypted, according to the disassembled printer firmware, but I have all the necessary information (I think) to read/write the toner chip data using an arduino. If anyone is interested in a modified firmware that e.g. sees empty toner cartridges as full or wants to reprogram toner chips using an arduino, let me know.