Looking for Canon MP280 EEPROM print

[Tony_SD]

Hi everyone, I'm looking for a MP280 printer EEPROM print or dump, a picture of printed paper is also fine. It's better that the printer is sold in US and supports PG-210 ink cartridge. Thanks in advance!

 

[PeterBJ]

Are you trying to change the printers region by re-flashing the EEPROM? Please more details. Re-flashing the EEPROM in some Canon printers is a very interesting subject as it might be the key to unlock locked service mode.

 

[Tony_SD]

Yes, I moved to US with my printer from Asia, and found out that my printer doesn't support the ink cartridge sold here, but it can print normally in service mode with incompatible ink cartridge, so obviously the printer just doesn't want to work with the ink sold here. After some research on internet, looks like there is a ink cartridge regional code stored in the EEPROM on control board. Screenshot below from Canon MP280 service reference menu indicates that the code won't be erased when EEPROM is cleaned.

So looks like I have two options to resolve this problem, one is to find a EEPROM dump or print from a MP280 sold in US and re-flash it to the EEPROM to make it compatible with the ink sold here (PG-210/PG-211). The other is to find out where the ink cartridge regional code is stored in EEPROM and change it, this will need more time and effort, but should be doable.

I have opened the printer and removed the EEPROM and mounted it on an adapter card, I also found a programmer kit to re-flash this SPI EEPROM, the kit has been reworked to support 3.3V power supply and I/O voltage.

 

[The Hat]

Yes, I moved to US with my printer from Asia, and found out that my printer doesn't support the ink cartridge sold here

The easiest way to overcome the regional chip problem is to reuse the Asian chips and put them on the US cartridges and re set the chips with a resetter and refill the existing carts or purchase aftermarket carts and transfer the chip onto them..

Not as bold or as daring as your method but it works…

 

[stratman]

So looks like I have two options to resolve this problem

Similar was done with optical drives - CD/DVD burners - to extend and often improve upon their usage. Firmware would be altered from the OEM original, sometimes from an EEPROM dump, and then flashed to the drive's EEPROM oftentimes using a custom flash app.

I hope you can get the ball rolling on similar functions with printers. It really would open up a new world for the more adventurous citizen printers.

 

[Tony_SD]

Thanks the information from "The Hat", and the encourage from "stratman". Before somebody send me US version of EEPROM dump, I actually spent some time to analysis the dump from my printer, and found something interesting:

1. the EEPROM (M95080WP) is a 1K (1024) byte SPI EEPROM, it has 32 pages, and 32 bytes each page.
2. there are lots of successive "FFFF" meanings these bytes are not used.
3. some data are repeated, which means they are something important, and saving them at two locations will help to avoid the possible data error.
4. the data in EEPROM are "raw data", meaning no encrypt, the characters are stored as ASCII code, and numbers are stored as HEX data.

For example, if we look into the data from 0x60 to 0x68, they are 0x464C, 0x464E, 0x3133, 0x3834, 0x0034, each byte falls in ASCII code range, so let's change them to characters based on ASCII code, they will be like "FL", "FN", "13","84"," 4", and if we swap high byte and low byte of each word, they are "LF", "NF", "31", "48", "4 ", this is exactly the serial number (SN) on the first line of EEPROM print. So we know that SN is stored from 0x60 to 0x68, and 0x90 to 0x98 (repeated) with ASCII code.

​

Similarly, if you look at some data like P_ON (power on times), it's 844 in DEC, and if we search its HEX value (0x034C), it is stored at 0x224 in EEPROM, with only one location, meaning if you chose to clean EEPROM in service mode, most probably it will be cleaned (set to 0x0000).

Anyway, SN and cleanable data are not what we're looking for here, but by doing this kind of analysis, we will know how data and characters are stored in EEPROM. Now we will need find out where the so-called "Ink cartridge region code" are stored. It should be a important data, so must be stored twice in this EEPROM. I printed multiple EEPROM dumps, and found out that the data between 0x00 and 0xB0 are never changed, which means they must be something unique to this printer, such as SN, software version, and maybe ink region code.

To further narrow down the scope, I have a simple logic analyzer hooked to EEPROM data line, and try to find out what the printer is doing when I'm doing something related with ink change and destination change. One thing interesting enough is that when I change the destination with service tool, the printer is changing the data on 0x50 and 0x54, and the data in 0x54 is 0x16 which is the #6 option in the destination pull down menu, and when I change destination to USA (the #3 option), and 0x54 changed to 0x13 as well, so we know that destination is stored at 0x54 and 0x84 (repeated).

For those who are interested in logic analyzer, picture below is the one I'm using, it's simple and cheap, but works.

The data captured are as below, the software tool on PC will convert the waveform to data automatically. Here 0x02 means write command, and 0x0054 means the write address, and 0x21E8 is the data writing to EEPROM, it's LSB data, so you will have to reverse it to MSB data to make it meaningful.

 

[The Hat]

I actually spent some time to analysis the dump from my printer, and found something interesting:

This is great information @Tony_SD, and very interesting but leaves me a by stander from now on, but will remain in the audience because I find it all fascinating and it comes twenty years too late because my programming days are over…

 

[stratman]

Great post, Tony. You made the unknown easy to understand, a skill many do not have. I look forward to reading more of your posts and learning what you find out about with the EEPROM.

 

[Tony_SD]

After many experiments, I finally find out where the ink cartridge regional code is stored, and when I change it to the right code for the ink sold in US, the E14 error message (incompatible ink cartridge) on my printer is gone, problem resolved!

 

[PeterBJ]

That's impressive work Could you please make an EEPROM print and mark the important data and how they were changed?