As I was writing this, I just realized the irony that this printer I am hacking is called the 2600N. First friday of September is coming up soon, hopefully I’ll be able to stop by the local chapter meeting at Regent’s Pizzeria.
Anyways, I managed to recover the EEPROM image out of the 2600N. It changes every page printed, so I have included three copies of the image here, on successive page prints:
00000000 38 28 90 50 B0 78 3B 28 76 50 B1 78 AC 99 9A 98 8( P x;(vP x 00000010 00 00 00 04 00 94 2C 9B 34 9B 00 00 00 00 00 00 , 4 00000020 00 00 F1 27 5C 1B 5C 62 00 00 84 00 30 0C 00 00 '\ \b 0 00000030 0B 00 BE 00 BD BF BC BE 11 22 CF 40 16 43 F3 25 " @ C % 00000040 72 06 00 00 00 00 0E 00 0F 00 1D 00 2E 01 50 E4 r . P 00000050 60 F1 C6 0F C9 00 52 04 1D 1B E7 02 DD 02 2C 9B ` R , 00000060 34 9B 27 38 56 00 00 00 00 00 00 00 00 00 00 00 4 '8V 00000070 0D 00 00 00 00 00 00 00 00 00 58 04 FF FF FF FF X 00000080 38 28 90 50 B0 78 3B 28 76 50 B1 78 AC 99 9A 98 8( P x;(vP x 00000090 00 00 00 04 00 93 2C 9B 34 9B 00 00 00 00 00 00 , 4 000000A0 00 00 F1 27 5C 1B 5C 62 00 00 84 00 2F 0C 00 00 '\ \b / 000000B0 0B 00 BE 00 BD BF BC BE 11 22 CF 40 16 43 F3 25 " @ C % 000000C0 72 06 00 00 00 00 0E 00 0F 00 1D 00 2E 01 50 E4 r . P 000000D0 60 F1 C6 0F C9 00 52 04 00 00 98 96 C8 7F C5 84 ` R 000000E0 1C 4A C4 CB C2 DC 64 14 CB FE 5F A1 19 65 D5 A1 J d _ e 000000F0 99 4B D4 CE A8 31 1C 34 8F 33 F7 10 FF FF FF FF K 1 4 3
00000000 38 28 90 50 B0 78 3B 28 76 50 B1 78 AC 99 9A 98 8( P x;(vP x 00000010 00 00 00 04 00 01 2C 9B 34 9B 00 00 00 00 00 00 , 4 00000020 00 00 F1 27 5C 1B 5C 62 00 00 83 00 9C 0B 00 00 '\ \b 00000030 0C 00 BE 00 BD BF BC BE 11 22 CF 40 16 43 F3 25 " @ C % 00000040 73 06 00 00 00 00 0F 00 10 00 1F 00 2E 01 50 E4 s . P 00000050 60 F1 C6 0F C9 00 52 04 1D 1B E7 02 DD 02 2C 9B ` R , 00000060 34 9B 27 38 56 00 00 00 00 00 00 00 00 00 00 00 4 '8V 00000070 0D 00 00 00 00 00 00 00 00 00 58 04 FF FF FF FF X 00000080 38 28 90 50 B0 78 3B 28 76 50 B1 78 AC 99 9A 98 8( P x;(vP x 00000090 00 00 00 04 00 00 2C 9B 34 9B 00 00 00 00 00 00 , 4 000000A0 00 00 F1 27 5C 1B 5C 62 00 00 83 00 9B 0B 00 00 '\ \b 000000B0 0C 00 BE 00 BD BF BC BE 11 22 CF 40 16 43 F3 25 " @ C % 000000C0 73 06 00 00 00 00 0F 00 10 00 1F 00 2E 01 50 E4 s . P 000000D0 60 F1 C6 0F C9 00 52 04 00 00 98 96 C8 7F C5 84 ` R 000000E0 1C 4A C4 CB C2 DC 64 14 CB FE 5F A1 19 65 D5 A1 J d _ e 000000F0 99 4B D4 CE A8 31 1C 34 8F 33 F7 10 FF FF FF FF K 1 4 3
00000000 38 28 90 50 B0 78 3B 28 76 50 B1 78 AC 99 9A 98 8( P x;(vP x 00000010 00 00 00 04 00 00 2C 9B 34 9B 00 00 00 00 00 00 , 4 00000020 00 00 F1 27 5C 1B 5C 62 00 00 83 00 9B 0B 00 00 '\ \b 00000030 0D 00 BE 00 BD BF BC BE 11 22 CF 40 16 43 F3 25 " @ C % 00000040 74 06 00 00 00 00 0F 00 10 00 1F 00 2E 01 50 E4 t . P 00000050 60 F1 C6 0F C9 00 52 04 1D 1B E7 02 DD 02 2C 9B ` R , 00000060 34 9B 27 38 56 00 00 00 00 00 00 00 00 00 00 00 4 '8V 00000070 0D 00 00 00 00 00 00 00 00 00 58 04 FF FF FF FF X 00000080 38 28 90 50 B0 78 3B 28 76 50 B1 78 AC 99 9A 98 8( P x;(vP x 00000090 00 00 00 04 00 00 2C 9B 34 9B 00 00 00 00 00 00 , 4 000000A0 00 00 F1 27 5C 1B 5C 62 00 00 83 00 9B 0B 00 00 '\ \b 000000B0 0D 00 BE 00 BD BF BC BE 11 22 CF 40 16 43 F3 25 " @ C % 000000C0 74 06 00 00 00 00 0F 00 10 00 1F 00 2E 01 50 E4 t . P 000000D0 60 F1 C6 0F C9 00 52 04 00 00 98 96 C8 7F C5 84 ` R 000000E0 1C 4A C4 CB C2 DC 64 14 CB FE 5F A1 19 65 D5 A1 J d _ e 000000F0 99 4B D4 CE A8 31 1C 34 8F 33 F7 10 FF FF FF FF K 1 4 3
Ah! Important note to readers: this ROM was read out using the 16-bit read mode of the EEPROM, which assumes a certain word ordering that may or may not be matched to the internal word ordering of the printer.
Getting these EEPROM images took a bit longer than I thought it would, mostly because it took me a while to realize that the SOIC pinouts were rotated relative to the DIP format used by my programmer. No matter, I managed to get everything going within the space of two CDs. Ahh…nothing like a couple Essential Mixes to keep pace while working. I highly recommend the Stanton Warriors 7/25/04 mix. Too good!
I guess the question is–if the watermark is in here, where is it? I’m guessing that a large portion of the data in here corresponds to calibration fields. When I first turned on the 2600N, it spent about five minutes calibrating itself. Presumably there is a page print counter field as well, and perhaps some fields tracking other consumables. Hmmm…what to do next. A lot of possibilities, many of them very labor intensive. Time to sleep on it.
Ugly! That’s an SOIC-to-DIP adapter I soldered in place that I got from Emulation Technologies. The mess of clips is to deal with the pinout rotation from SOIC to DIP that I hadn’t anticipated. I should remember to always read the datasheet, carefully!
Couple of comments on the eeprom images –
1. There seem to be two semi-similar blocks.
Both ‘blocks’ get updated at the same offsets [from the beginning of the block]
The differences between pages are:
Block 1:
0x15: 94 01 00
0x2a: 84 83 83
0x2c: 30 9c 9b
0x2d: 0c 0b 0b
0x30: 0b 0c 0d
0x40: 72 73 74
0x46: 0e 0f 0f
0x48: 0f 10 10
0x4a: 1d 1f 1f
Block 2:
0x95: 93 00 00
0xaa: 84 83 83
0xac: 2f 9b 9b
0xad: 0c 0b 0b
0xb0: 0b 0c 0d
0xc0: 72 73 74
0xc6: 0e 0f 0f
0xc8: 0f 10 10
0xca: 1d 1f 1f
Bunnie, If you think you’ve printed ~1651 pages, 0x40/0xc0 looks like a good candidate for a page counter seeing as it increments every time and is the only one that increments + has a sane value near it to be the high byte [unless you’ve only printed 12 pages].
However, the blocks are nowhere near identical. The lists would take up a significant amount of space, so here’s a little bit of C that’ll do it for you – bincompare.c and blockcompare.c.
Ok, Ignore the previous bits, seems I can’t use angle brackets in this comment field… Bunnie – feel free to clean up the mess :P.
Bits are here: http://www.carne.sys-techs.com/2600N_eeprom/
and better yet, I don’t have to pack it up to fit in a comment ;).
–Me
huh I wonder why the code keeps on getting chopped off. Email the code to me and I can try to make sure it makes it into your post properly.
Also, I think at the time that I had captured these EEPROM traces I had printed between 16 and 18 pages….
Eh, rather than putting it in the comment you can just remove it and leave the link to the sources ;).
Do you know if the printer has an accessible page count? maybe on the status page or something?
–DC
I’ve cleaned up the comment trail to link to your two pieces of code. If you want I can move the code to my server and host it there, no problems.
The printer does keep a page count. When I print a status page it tells me the number of pages printed. So at least, on every page printed, the EEPROM is touched to record page prints. That explains why the system won’t print when I’ve shorted out the EEPROM–I guess its sort of like turning back the odometer.
I think your observation that there are conserved blocks is key. Since the watermark isn’t changing between blocks, I imagine the watermark code is somewhere in one of the conserved blocks. We can figure the watermark is at least 32 bits long–probably more like 64 bits–and by guard banding around the changed regions we can reduce the search space in the EEPROM by over 50% for the watermarks.
This is not directly related to the eeproms, but I figure its better to post on the newest topic rather than make people check the old ones. Bunnie – feel free to move this if you disagree.
I’ve mapped pages 13-14-15.
I did them all separately, and redid from my earlier checks so I had multiple copies to compare to eliminate error.
The results are posted at http://carne.sys-techs.com/2600N_patterns/, but don’t bother downloading them all as the patterns are all the same.
I find this extremely interesting as some of the first images from before this last set do NOT display the same pattern. I’m gonna get the first patterns done hopefully tonight to the same level of accuracy as these 3, but there are definitely differences.
This means [at least to me] that the differences are not page count based. They’ve gotta be time based, with a time step interval larger than however quickly bunnie printed these 3 [which I don’t know]. From his description they were printed immediately one after the other, so lets assume ~ 5-10 seconds difference.
I don’t know about you, but having the time a document was printed be encoded in the printed image creeps the hell outta me.
-DC
Update – Image26 is the same, but Image24 is very different.
[Well, 26 is the same as far as I can tell, but its pretty hashed up, and hard to tell]
Image 24 is pretty ugly, I don’t have a full instance of the pattern anywhere, and I don’t think I can pull out a full transcription, but it still looks very different than 26.
Now I’ve no clue whats going on.
-DC
FTR, 24 and 26 are from different printers; I did not make that clear in my previous postings, sorry about that.
Significantly, anybody can go up to a demo printer in a store and print out one of the configuration pages with serial number, etc. on it…
Could you post the serial number of this printer, please?
Thanks!
serial number CNBC55L0QJ / formatter F9221M9
Something else to try. There’s a procedure at http://www.fixyourownprinter.com/forums/printer/27214#2 for “restoring” your printer serial number. I wonder if it would work for your 2600N.
It would be interesting if you could change the serial number with this procedure, and see what changes in the EEPROM contents.
– Patrick
Dear Friends…
I’m a photographer, with very limited knowledge about “digital electronic” (I’m very good at a “house hold one” but I would like to ask one question.
Why don’t you think that printer driver could embed those watermark patterns? Could you maybe try to print some test print generated by printer or similar?
Maybe something that would not use a computer?
Keep up a good work!!!
PATRICK posted Sept 8th 2005 and may be on to something here – ANYONE TRIED THIS?? Come on guys it’s Nov 2006 now, someone must have some news on this??
Phoenix…
What are Second-hand, Used, Overstock, Surplus, Refurbished Computers…
shgcfksdbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb