Pantum P2502W Toner Reset Chip help

[Fixik2020]

Re: Pantum P2502W Toner Reset Chip help

do you think it is possible to change the serial number through the program?

[05:25:07.582] ACLParserTask - recv msg job detail
[05:25:07.599] ParseACL - ACL: Received CMD=FF05
[05:25:07.606] ParseACL - ACL PARSER:acl cmd matched 0xff05
[05:25:07.613] ParseACL - ACL PARSER:acl cmd data 00 01 00 00 00 00 00 00 00 00 00 00
[05:25:07.624] AclGetSerialNumber - serial number:CK4S045166
[05:25:07.632] ParseACL - ACL:got a uel flag to exit acl parser

[Fixik2020]

Re: Pantum P2502W Toner Reset Chip help

Under Linux I open the device file (in my case /dev/usb/lp0) and write to it/read from it.
Specifically I'm using freepascal, so I use a TFileStream, i.e.

FPrinter:=TFileStream.Create('/dev/usb/lp0',fmOpenReadWrite);

ok, do you have a program?

[pippolippi]

Re: Pantum P2502W Toner Reset Chip help

hello, how did you send the command to the printer?

Under Linux I open the device file (in my case /dev/usb/lp0) and write to it/read from it.
Specifically I'm using freepascal, so I use a TFileStream, i.e.

FPrinter:=TFileStream.Create('/dev/usb/lp0',fmOpenReadWrite);

[Fixik2020]

Re: Pantum P2502W Toner Reset Chip help

@timschuerewegen I got the printer, under Linux I found that I can write some commands to /dev/usb/lp0 and get back an answer (I tried the same on tcp port 9100, jetdirect, with no answer).

The commands have the format

(ESC)%-12345X@PJL ENTER LANGUAGE=ACL(CR)(LF)(16 bytes)(ESC)%-12345X

and the 16 bytes I found that give me back an answer are:

00 ac 00 01 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back the firmware version (string)

00 ac ff 85 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back the ram size in MB in one of the reply bytes

00 ac ff 05 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back the serial number (string)

00 ac 00 08 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back a long string with some gibberish and part of the model

00 ac 00 06 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back a longer string with some gibberish and another part of the model

Could you tell me if I'm on the right track and what are the commands to read/write the memory?

hello, how did you send the command to the printer?

[markgg]

Re: Pantum P2502W Toner Reset Chip help

How do I get the firmware version?
I have 2 pantum P2500W and now 5 cartridges all but one reading expired. Tried a new chip and get "toner cartridge mismatch".

[mistaker]

Re: Pantum P2502W Toner Reset Chip help

I found a simple way to reset the toner chip page counter via the USB cable. No need to open the printer or buy a chip programmer.

The only drawback is that you still need to be able to print a page for the firmware to write the new page counter to the toner chip.

If anyone wants to try this, send me a PM because this hack is firmware version specific and at the moment it will only work on printers that have the same firmware as mine.

Is ti resolution still valid, in that case can you share it?
My firmware version is: 3.2.4.1

[pippolippi]

Re: Pantum P2502W Toner Reset Chip help

If you send me your dumps in private, then I can decrypt your firmware, locate the page counter variables and tell you how to reset them.

Thanks to your invaluable help I managed to reset the toner of my brand new printer.

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

I'm stubborn but lazy :what are the address(es) of the page counter(s)? (at least in your version of the firmware).

It is not that easy. Page counters are stored on both SPI flash and toner chip. Highest value "wins". IIRC, to reset the page counters you first have to patch a function in RAM to prevent the firmware from overwriting one of the page counter variables with the page counter value stored in SPI flash. If you send me your dumps in private, then I can decrypt your firmware, locate the page counter variables and tell you how to reset them.

[pippolippi]

Re: Pantum P2502W Toner Reset Chip help

I'm stubborn but lazy :what are the address(es) of the page counter(s)? (at least in your version of the firmware).

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

Right, what are suitable addresses and the maximum you can read at once (I doubt it's 0xffffffff)?
Maybe the address of the page counter hasn't changed (even if mine is firmware 3.2.4.2).

The maximum you can read at once is ~1.5MB IIRC. I always read in chunks of 1MB (or less).

0x00000000 => RAM (128MB)
0xF6000000 => SPI FLASH (8MB)
0xFD0D0000 => OTP eFuses banks 0 to 3 (256 bytes)

[pippolippi]

Re: Pantum P2502W Toner Reset Chip help

Right, what are suitable addresses and the maximum you can read at once (I doubt it's 0xffffffff)?
Maybe the address of the page counter hasn't changed (even if mine is firmware 3.2.4.2).

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

Thank you!
I think I randomly tried the AclReadTable (I suppose 00 AC 00 09) and it hanged the printer, probably because it needs good parameters in the remaining bytes. Could you tell me something about the parameters? And where did you find the documentation on the ACL commands?

00 AC 00 09 AA AA AA AA SS SS SS SS 00 00 00 00

AA = address (big endian)
SS = size (big endian)

I extracted the ACL command/function information from a debug build of the firmware.

[pippolippi]

Re: Pantum P2502W Toner Reset Chip help

Thank you!
I think I randomly tried the AclReadTable (I suppose 00 AC 00 09) and it hanged the printer, probably because it needs good parameters in the remaining bytes.
Could you tell me something about the parameters? And where did you find the documentation on the ACL commands?

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

These are the different functions.

AclReadTable and AclWriteTable are the functions that read/write memory. You can use them to read the OTP memory (to derive the firmware encryption key), dump the SPI flash, and modify firmware variables to reset the toner counters.

0x0001 = AclGetVersion
0x0002 = AclRetStatus
0x0003 = AclReadEEPROM
0x0004 = AclGetASICID
0x0006 = AclGet1284String
0x0008 = AclGetBuildInfo
0x0009 = AclReadTable
0x000A = AclWriteTable
0x000F = AclBurnFlash
0x0080 = AclGetInportKey
0x0300 = sc_csc_dl_csc_table
0x0301 = sc_csc_delete_csc_tables
0x1001 = ttcp_process_acl
0xC0DE = AclDoDownload
0xD1EE = AclResetBoard
0xEC0D = AclWriteEEPROM
0xF001 = ACL_test_OUT
0xF002 = ACL_test_IN
0xFF00 = AclClearPageCounter
0xFF01 = AclGetPageCounter
0xFF03 = AclGetTonerInfo
0xFF04 = AclSetSerialNumber
0xFF05 = AclGetSerialNumber
0xFF06 = AclSetMacAddress
0xFF07 = AclGetMacAddress
0xFF08 = AclSetProductionDate
0xFF09 = AclGetProductionDate
0xFF0A = AclSetProductionBatch
0xFF0B = AclGetProductionBatch
0xFF0C = AclSetEngineConfig
0xFF0D = AclGetEngineConfig
0xFF0E = AclSetNetConfig
0xFF0F = AclGetNetConfig
0xFF10 = AclSetMachineType
0xFF11 = AclGetMachineType
0xFF13 = AclReadFile
0xFF14 = AclSetPreburningTest
0xFF15 = AclGetPreburningTest
0xFF16 = AclPortTest
0xFF18 = AclMfpPanelUpdate
0xFF1A = AclSetRestoreFactory
0xFF1D = Acl_Wifi_Get_RSSI
0xFF20 = ? set oid, set zone set flag, set country code, ...
0xFF21 = AclGetPrinterAttributes
0xFF23 = ? toner set serial number
0xFF24 = ? toner get serial number
0xFF27 = ? AclSetPowerOffEnable
0xFF28 = ? AclGetPowerOffEnable
0xFF80 = AclWifiSetup
0xFF81 = AclWifiGetInfo
0xFF82 = AclSetSleepTime
0xFF83 = AclGetSleepTime
0xFF84 = AclPrintInternalPage
0xFF85 = ACLGetDDRmemsize
0xFF86 = AclGetFwUpdateRate
0xFF87 = AclGetPrinterStatus
0xFF88 = ACLConfirmUpdateOlderVersion

[pippolippi]

Re: Pantum P2502W Toner Reset Chip help

No, definitely there's plain ASCII code there mixed with binary data.
The reply to those two commands comes in two frames, the first is a mirror of the command with the 8th byte containing the length of the second frame.

00 AC 00 08 00 01 00 5B 00 00 00 00 00 00 00 00

54 49 4D 45 3D E4 BA 94 20 38 E6 9C 88 20 31 34 20 31 37 3A 30 31 3A 34 39 20 32 30 32 30 20 50 52 4F 44 3D 70 61 6E 74 75 6D 5F 32 30 31 36 5F 62 61 73 61 6C 74 20 64 65 62 75 67 20 20 20 20 20 20 20 5B 4E 4F 20 4D 41 43 20 41 44 44 52 45 53 53 5D 0D 0A 00 6C 01 D4 21 6C :TIME=五.8月.14.17:01:49.2020.PROD=pantum_2016_basalt.debug.......[NO.MAC.ADDRESS]...l.?!l



00 AC 00 06 00 01 00 76 00 00 00 00 00 00 00 00

00 76 4D 46 47 3A 50 61 6E 74 75 6D 3B 4D 44 4C 3A 4D 36 35 30 30 57 20 73 65 72 69 65 73 3B 43 4D 44 3A 41 43 4C 2C 43 4D 44 2C 73 63 61 6E 2C 5A 4A 53 2C 50 4A 4C 3B 43 49 44 3A 50 61 6E 74 75 6D 20 4D 36 35 30 30 57 20 73 65 72 69 65 73 3B 43 4C 53 3A 50 52 49 4E 54 45 52 3B 44 45 53 3A 50 61 6E :.vMFG:Pantum;MDL:M6500W.series;CMD:ACL,CMD,scan,ZJS,PJL;CID:Pantum.M6500W.series;CLS:PRINTER;DES:Pan
18 - 74 75 6D 20 4D 36 35 30 30 57 20 73 65 72 69 65 73 3B :tum.M6500W.series;

[stj]

Re: Pantum P2502W Toner Reset Chip help

long string with some gibberish?
try viewing it as 16bit unicode.
maybe it's asian writing?

[pippolippi]

Re: Pantum P2502W Toner Reset Chip help

@timschuerewegen I got the printer, under Linux I found that I can write some commands to /dev/usb/lp0 and get back an answer (I tried the same on tcp port 9100, jetdirect, with no answer).

The commands have the format

(ESC)%-12345X@PJL ENTER LANGUAGE=ACL(CR)(LF)(16 bytes)(ESC)%-12345X

and the 16 bytes I found that give me back an answer are:

00 ac 00 01 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back the firmware version (string)

00 ac ff 85 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back the ram size in MB in one of the reply bytes

00 ac ff 05 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back the serial number (string)

00 ac 00 08 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back a long string with some gibberish and part of the model

00 ac 00 06 00 00 00 00 00 00 00 00 00 00 00 00 -> gives back a longer string with some gibberish and another part of the model

Could you tell me if I'm on the right track and what are the commands to read/write the memory?

[pippolippi]

Re: Pantum P2502W Toner Reset Chip help

How are you sending the commands to the printer?

I just ordered a pantum printer and waiting for it to arrive.
If you're still around, could you give more details on how to send commands to the printer? (i.e. does it emulate a serial port, uses bulk transfers or something else?).

[timschuerewegen]

Re: Pantum P2502W Toner Reset Chip help

I really dont know what exactly U mean common share the commands and the exact commands that modifies f...cking printer frimware

How are you sending the commands to the printer?

[crdleoffiilth]

Re: Pantum P2502W Toner Reset Chip help

I used the USB memory read/write commands to modify some of the firmware RAM variables related to page counter(s) so that when I printed a page, the page counter(s) would be set to 0, both in the toner chip and printer flash memory. My printer has the 3.2.4.1 (encrypted) firmware.

I really dont know what exactly U mean common share the commands and the exact commands that modifies f...cking printer frimware