As no electronic item is safe in my house from being taken apart, I decided to look inside the belly of my HP 2600N color laserjet printer. For those of you who play Name that Ware, well, here we are–time to figure out what these boards do in a real-world scenario.
The board pictured above connects to the outside world (USB, Ethernet) and straps over to the board below via a flat-flex cable.
What do these boards do? Well, I can only guess. Here’s my take.
The first board pictured–the one that connects to the outside world–I call the front-end board. Prominent features include an Agilent ASIC that presumably contains the ColdFire V4e 264 MHz processor advertised by HP as the “brains” of the printer, and its companion 128 Mbit EDS1216AATA memory chip (no, the memory is definitely not upgradeable on this printer). The Broadcom part is presumably the Ethernet PHY device. U9, the ST Micro 25P16 part, is a serial code ROM (16 Mbit, 50 MHz). It contains the firmware. Next to it, U10, is a serial EEPROM, a 24C64 which is a 64 kbit (8kbytes x 8) device. If you were to ask me, I’d say that the total cost of this board, fabbed and tested, in volume is well under $35.
An interesting exercise to consider is the datarate generated by this board. At 8ppm and 600×600 dpi printing resolution, assuming 8.5×11 inch coverage and four colors, each of which are printed as binary dots, the board has to output a peak datarate of 17.9 Mbits/s. That’s an astoundingly low datarate. From the looks of the on-board routing, I see four differential pairs routing into the flex connector, so that means it’s running at something on the order of 40 MHz. It would be interesting to drop a scope probe on there to see if my estimates are correct.
Now before we get too excited about pulling the Firmware chip off and reversing the firmware code to try and find the watermarking subroutines, let’s look at the other board. This board sits between the front-end board and the print engine itself. The printer has an array of four scanning lasers–one each for CMYK toner colors–that have to be driven by this board.
Salient features of this board–I call it the engine board–are two motor driver chips (distinguishable by the wide metal sheets near the middle of the chip body, used as heat sinks for the high power handling requirements of a motor driver) near the center. Below these chips is a Fujitsu proprietary-architecture 16-bit microcontroller, the MB90F487. I estimate this contains 192 kbytes of ROM and 10 kbytes of RAM, and it runs at 25 MHz. The chip to the right of the Fujitsu controller…is mysterious. It is labelled RK2-0581-3. From its connectivity, you can guess it talks to the lasers. There’s also a very attractive button on the left labelled “TEST” and some debug headers, very inviting. And finally, there is an 8-pin SOIC labelled “L56” near the lower right corner. This part reeks of a serial EEPROM, although the number L56 isn’t one I recognize off the top of my head. A google search and hunching about leads to a Rohm part number for a 128×16 bit SEEPROM.
Okay, another salient feature of this engine board is that it looks nothing at all like the front-end board. The soldermasks are from different processes; the design and layout styles are vastly different; the assembly solder process shows a different fillet on the resistors. The front-end board reeks of large American company design, and the engine board reeks of large Japanese company design. But wait, isn’t this an HP printer?
On a hunch, I investigate an OEM possibility for HP…and lo! Canon seems to be making HP’s print engines. Canon has beautiful documentation on their printer technology at this link. The schematic printer shown on Canon’s webpage is almost exactly HP’s 2600N. The final piece of evidence is this link to a photo of Canon’s print engine board. Look familiar? Yes, the chips aren’t exactly the same–they have what looks to be a development prototype–but the manufacturing process and board layout style is a match with the engine board in the 2600N.
Now, things are starting to make sense. Laserjet printers are probably crazy hard to develop–there are four scanning lasers in this thing, for heaven’s sake–and it doesn’t make sense in a $400/unit market to invest tons of money into R&D. So it’s quite likely that Canon OEM’s the majority of the entry-level color laserjet engines…and…we now see a single point of weakness. Want to put a watermark into every printed page coming out of color laserjet printers? Just pull the right strings in Japan and viola, the world market is watermarked. Gotta love consolidation and outsourcing. (This also leads to the interesting question of just what value is HP bringing to the market, but get me a beer to talk about that one). And the fact that Tektronix Phaser printers do not have watermarks is consistent with this hypothesis, as the Phaser printer line pre-dates this Canon engine by quite a bit. I’m guessing that Tek probably does their own print engines…
So–assuming we’re looking for a watermarking mechanism–what do we need? We need something to inject the watermark, and something to store the watermark. We have the following injection points for the watermark:
- Front-end processor
- Engine control processor
- Engine rendering ASIC (according to the Canon website it is a Super L/S Rendering ASIC)
We have the following storage points for the watermark:
- Code ROM on fron-end board
- 64kbit Serial EEPROM on front-end board
- Buried within ColdFire processor ASIC on front-end board
- Buried within Fujitsu microcontroller on engine board
- 128 x 16 bit serial EEPROM on engine board
- Within rendering ASIC on engine board
Well, going by the hypothesis that the single point of weakness for a goverment body trying to get watermarks in every printer would be Canon, and not HP (yay outsourcing), we can discard anything on the front-end board. Thus, where would one put a watermark on the engine board?
Well…there’s one excellent spot. The rendering ASIC. If you want to drop in a watermark, how much easier could it be than a set of OR gates on the back-end pixel pipe plus a couple address counters and some registers to hold the watermark data…and some small serial EEPROM to hold that data when the printer is turned off.
It’s compelling to think that perhaps the watermark is just stored in that EEPROM, and just disabling, wiping, or otherwise mangling that device would lead to watermark removal. Then again, that would be just too easy…if someone’s going to go through the trouble of going to Japan to enforce US secret policies across American citizens, surely they would make it more difficult to hack? Something to do on another lazy day…right now, it’s time for bed for this tired soul. Stay tuned! and thanks for reading.
[follow-on note] — shorting the DO pin to ground on the EEPROM (the simplest solution should always be tested first!) yielded a printer engine error. Interestingly, the EEPROM is interacted with both at power-on and before every page printed, but not during a page print (I tried shorting the DO pin at various points in the printing process). Currently getting some spare EEPROMs and adapters to make short work of mucking around with these devices…