Unbrick Service Mode

[Pyro Phoenix]

Hey folks,

I recently got an faulty MG2950 who was throwing me the 5B00 Service Code - so clearly a sign of planned obsolescence. After searching a while, I found a tutorial how to reset the Ink Waste counter to 0 - altogether with a service tool. But nobody was warning me about the possibility to brick my device while using an outdated version of this service tool ... so the things went mayhem.

Now I can't start the service mode - the printer will freeze with orange light when trying to.

Now im curious:

First:
Is there a (public accessible!) way of restoring the service mode apart from exchanging the EEPROM or the whole mainboard?

Second:
Where to order an replacement EEPROM, if there is no other way of restoring the service mode?

Third:
Is this "softbrick" an intended behavior added by Canon to hinder people to extend the lifespan of their property or a side effect of trying to alter the EEPROM content with an outdated service tool. (i.e. service tool writing to the wrong memory addresses - thus resulting in corrupting the EEPROM)

Thanks!

 

[stratman]

First:

Sadly, no.

Second:

None that anyone here has ever mentioned besides cannibalizing another printer.

Third:

Is the glass half full or half empty? No doubt done in part to prevent people from getting ink leaked onto surfaces outside the printer due to saturated ink absorbers. The firmware of the EEPROM is intellectual property and rightfully protected by Canon.

 

[The Hat]

@Pyro Phoenix, Canon printers are great machines, and you can do what you like with them inside and out mechanically, but interfere with the printers’ software and you’ll end up with a door stop on your hands, it won’t work again till you take to a Canon Service agent.

You own the printer, but Canon owns the software and they guard it very well, O’ and they don’t make a secret of it either...

 

[Pyro Phoenix]

None that anyone here has ever mentioned besides cannibalizing another printer.

So, why don't create a EEPROM binary dump library? Or better - some kind of delta backup which doesn't contain any copyrighted material but is able to reset the present EEPROM contents back to default on the basis of checksums. Kind of ... I'm not a programmer

Is the glass half full or half empty? No doubt done in part to prevent people from getting ink leaked onto surfaces outside the printer due to saturated ink absorbers.

So rather completely disabling the print functionality than warning the user about the ink absorbers have to be replaced and further usage can cause nasty stains?

Yeah, same type of problem like Apple with their way of bullying customers. Have problems with freezing phones due to insufficient amperage? Of course you secretly slow down the CPU instead of displaying a message that the battery is dying and you need to replace it. Hopefully users will buy new phones, because they start lagging ...

Ehh, whatever. Enough ranting about shitty company policies for today.

 

[stratman]

So, why don't create a EEPROM binary dump library? Or better - some kind of delta backup which doesn't contain any copyrighted material but is able to reset the present EEPROM contents back to default on the basis of checksums. Kind of ... I'm not a programmer

Some of this has been done with other hardware devices, such as CD/DVD burners, with great success. Either those with the skills are uninterested or Canon presents a greater difficulty. Let us know if you find a site.

BTW, manufacturing of great CD/DVD burners pooped out and so did the firmware mod groups. Only a handful cared about optimized burning and it wasn't the manufacturers anymore.

 

[Rainbow]

To unblock the service mode, you need a soldering iron and a SPI flash programmer that supports 1.8V chips (a simple LPT port based programmer can be made using a short cable, a couple of resistors and two transistors).

Desolder the flash (it's on the bottom of the printer control PCB) and read. Using a hex editor, check byte at address 0x2a (and a copy at 0x102a). It will be 0x44 ('D') if the service mode is blocked. The byte before is 'S' so if you see 'SD', it's blocked. Change both the 0x44 bytes to 0x00 to unblock.

And now the funny part: service tool V4905 will not block the service mode - but will not reset the ink absorber either! The button is simply missing. To reset ink absorber, replace the 32 bytes at 0xd0 (and the copy at 0x10d0) with this:

000000d0: 63 a5 40 00 00 00 00 00 00 00 00 00 01 00 00 00  c.@.............
000000e0: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................

Then flash the modified dump back.
This will probably work with all MG2900 series printers.

 

[The Hat]

This will probably work with all MG2900 series printers.

Would you like to be the first victim.....? (Candidate)….

 

[Rainbow]

I've just fixed MG2950 with 1700 error. Tried with v4720 service tool, blocking the service mode, then found this thread... Found a non-blocked MG2950 dump somewhere on the web, flashed, turned on/off, read back, blocked using v4720, read back and compared to find the 'D'. Fixed that in my original dump and service mode was unblocked. That was quick.

The "ink absorber" part was harder. The first two bytes of the 32-byte block are some kind of checksum. Tried to crack it as CRC-16 using reveng but was not successful - it's probably not a CRC. Then there's 0x40 costant. Then there are 3 numbers, 1st one + 2nd one equals to 3rd one. Probably black+colour = total wasted ink. You can't change them without recalculating the checksum or it will result in EEPROM error (6800). Luckily, found a clean (new printer) MG2940 dump elsewhere on the web - the 32 bytes above are taken from that.

Some people are directly using complete dumps from other printers. I don't recommend doing that - serial number and all counters will change, probably also some factory calibration data (if there are any).

BTW. The absorbers are really small in these models.

 

[The Hat]

I've just fixed MG2950 with 1700 error.

Way to go @rainbow…

 

[websnail]

To unblock the service mode, you need a soldering iron and a SPI flash programmer that supports 1.8V chips (a simple LPT port based programmer can be made using a short cable, a couple of resistors and two transistors).

Desolder the flash (it's on the bottom of the printer control PCB) and read. Using a hex editor, check byte at address 0x2a (and a copy at 0x102a). It will be 0x44 ('D') if the service mode is blocked. The byte before is 'S' so if you see 'SD', it's blocked. Change both the 0x44 bytes to 0x00 to unblock...

Going to admit my complete n00b status on this side of things. So, wondered if you can recommend any tutorials, references, etc... that would explain the various points, tools, processes you've suggested above.

Sadly I never got into electronics beyond discovering capacitors and nearly learning to fly across rooms so I wasn't allowed much more and since then time has been the crutch/excuse/barrier.