Ricoh SP C250DN Laser printer Toner cartridge Hack

Some days ago my printer stopped working with the well known message "toner empty" showing on the display. But wait, the cartridges are heavy. Hmm...Are the toners really empty? No! There is a Chip on each of the toners which collects the printed pages. After reaching a specified value, the printer shows the toner replacement message. This method is done by almost all printer vendors. Some use chips inside the printer also and others try to encrypt the data to the chip. This type of printer does it simple. Just checking the values on the Chip, before printing and writes the chip if a page is getting printed.
First I try to figure out what chip it is. The label says L01A, after some research it was clear that this is a simple I2C EEPROM. Great! It is no down counter PROM or something else, it's realy a simple 1KBit writeable EEPROM.
Now the hacking can start. I tried to get the EEPROM readed with ponyprog via a LPT port adapter. But it didn't work. On of the reasons was that the toner chip does not use the default addresses on the I2C bus. Moreover the chip does not like the clock frequency.
I had some 32F429IDISCOVERY kits laying around. Simply enough I wrote a small programm which initializes one of the I2C peripherals and tried to access the EEPROM on the bus, with success. Now I wrote some functions to access individual addresses of the EEPROM, to write and to read the memory of the toner chip. Next I did a full dump of one chip and wrote it back, with success.
Finally with the dump of the full/newly bought toner cartridges all my old toners show full and I can print color documents until the cartridges are really empty.

Printer version: Firmware-Version : V1.00c
Datasheet of the EEPROM: http://www.directupload.net/file/d/4084/5qpmmnxnpdf.htm
Here you can find a full dump of all toner chips (as header file "data.h" for the source code): http://pastebin.com/Lfy0mA65
Here is the source code of the simple I2C EEPROM toner cartridge chip reader/writer (sorry for the unstructured code, it was done in a couple of minutes): http://pastebin.com/GttUUgNt
Usage: Simply connect the discovery with the EEPROM (PB6=SCL, PB7=SDA, both with pullup 10k resistor connected to 3V) and press the user button, it searches for a known toner chip on the bus and writes it with the data from a full/new toner.
Image of the toner chip PCB with description of the Pins to connect with: http://www.directupload.net/file/d/4084/jfk99mwv
png.htm

Stay charged!

comments powered by Disqus