timschuerewegen
Member
Last Activity: 05-16-2023, 12:53 AM
Joined: 07-07-2020
Location: Antwerp
-
Hello mr, I could not create the script required to change the serial number of the Pantum printer. Can you help me with this? -
Re: Pantum P2502W Toner Reset Chip help
What tool? I looked at the disassembled Pantum firmware in Ghidra to see how it calculated that checksum.... -
Re: Pantum P2502W Toner Reset Chip help
I used the firmware checksum calculation function....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
Try this checksum. It should be correct....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
Probably not. You can change the serial number via USB by using the AclSetSerialNumber command. I also checked the code that writes the serial number to the flash chip, and it does calculate a checksum....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
There is a checksum somewhere I think....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
BASE64 decode that string and you get "CA2J000228P2500w"....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
First you need to extract/decompress the firmware using offzip.
offzip.exe -a "pantum toner empty.bin"
You can then disassemble the generated "00020120.bin" ELF file with Ghidra....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
I can edit the firmware and know how to make it work without toner chip, but it is too much work, sorry....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
It is not that easy. Page counters are stored on both SPI flash and toner chip. Highest value "wins". IIRC, to reset the page counters you first have to patch a function in RAM to prevent the firmware from overwriting one of the page counter variables with the page counter value stored in SPI flash. If you send me your dumps in private, then I can decrypt your firmware, locate the page counter variables and tell you how to reset them....Last edited by timschuerewegen; 01-10-2023, 04:15 AM.Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
The maximum you can read at once is ~1.5MB IIRC. I always read in chunks of 1MB (or less).
0x00000000 => RAM (128MB)
0xF6000000 => SPI FLASH (8MB)
0xFD0D0000 => OTP eFuses banks 0 to 3 (256 bytes)...Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
00 AC 00 09 AA AA AA AA SS SS SS SS 00 00 00 00
AA = address (big endian)
SS = size (big endian)
I extracted the ACL command/function information from a debug build of the firmware....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
These are the different functions.
AclReadTable and AclWriteTable are the functions that read/write memory. You can use them to read the OTP memory (to derive the firmware encryption key), dump the SPI flash, and modify firmware variables to reset the toner counters.
0x0001 = AclGetVersion
0x0002 = AclRetStatus
0x0003 = AclReadEEPROM
0x0004 = AclGetASICID
0x0006 = AclGet1284String
0x0008 = AclGetBuildInfo
0x0009 = AclReadTable
0x000A = AclWriteTable
0x000F...Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
How are you sending the commands to the printer?...Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
I used the USB memory read/write commands to modify some of the firmware RAM variables related to page counter(s) so that when I printed a page, the page counter(s) would be set to 0, both in the toner chip and printer flash memory. My printer has the 3.2.4.1 (encrypted) firmware....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
I never made such firmware. The only thing I can do is reset the toner page counter(s) by using the USB memory read/write commands, but it depends on firmware version, so only the version I have is supported....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
The M2070W SPI flash contents looks totally different, there is no decrypted bootloader. Recent Pantum printers use a decrypted bootloader with an encrypted firmware, and the values needed to derive the key are stored in OTP register inside the SoC. The firmware contains USB commands to read/write ANY memory, so you can dump the SPI flash (since it is memory mapped), read the OTP registers to derive the key, and manipulate RAM while the printer is running to e.g. reset the toner chip counters....Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
I found a simple way to reset the toner chip page counter via the USB cable. No need to open the printer or buy a chip programmer.
The only drawback is that you still need to be able to print a page for the firmware to write the new page counter to the toner chip.
If anyone wants to try this, send me a PM because this hack is firmware version specific and at the moment it will only work on printers that have the same firmware as mine.
[url=https://ibb.co/wZn5QRY][/url]Re: Pantum P2502W Toner Reset...Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
I successfully modified the page count on my toner chip, but ...
The newer firmware versions keep track of up to 5 toner chip page counts in the nvram area on the SPI flash chip. When the firmware reads the page count from the toner chip, it will compare it to the page count value in nvram for that toner chip and use the highest value. This means that lowering the page count on the toner chip alone will not work, unless you also edit nvram or use the toner chip in a new printer.
I also figured out how to dump...Leave a comment:
-
Re: Pantum P2502W Toner Reset Chip help
If your printer has an older firmware then it might be possible to reset the toner chip counters by sending a special command to the printer. I can probably help you with that. My P2500W has a "3.2.4.1" firmware (from 2020) and Pantum removed the "clear counters" command and added extra toner chip security, compared to a "1.1.9.7" firmware (from 2017).
If you can solder and have a CH341 USB programmer, then you can interface directly with the chip and try to clear the counters that way....Leave a comment:
No activity results to display
Leave a comment: