Thursday, March 12, 2009

How to program your permanent reset chip

It's almost a year that I own this beautiful printer and it's some time right now that I know a couple of very interesting tricks to enjoy it even more.

First of all Samsung just released clp-310 (and it's black version: the clp-315): for all the owners of the clp-300 unfortunately it means that they are planning to dismiss this printer, since the new toner cartridges for clp-315 and clp-310 are very different from the older ones for clp-300.

Now I will present herein a technique that permits to turn the vast majority of aftermarkets (non OEM chips) into permanent reset chips; this means that you can turn a single chip into one that will last forever, since it will never expire. Common reset chips are cheap (4-7 dollars each), but they should be replaced as soon as the toner inside the cartridge finishes.

The total refill cost is quite expensive, because you have to add to the toner powder ($6 per recharge) the reset chip ($7). Let's see how to cut the costs related to the chips with a permanent reset chip.

To accomplish this task, you will need:
  1. I2C eeprom programmer; I will not describe how to build one on your own. Please refer to the very detailed schemes here: Chiprecharge Serial Programmer
  2. Ponyprog software or similar one
  3. Two aftermarket chips (aftermarket reset chips based on at34c02)
  4. Basic soldering skills
The Lock Protection

Samsung clp-300 (the printer) track of the total number of the pages printed (referred as PAGES), it remembers other things as well, like the number of the print jobs (referred as JOBS) performed so far and the serial number of the toner cartridge (referred as CRUM number).

Each cartridge has a chip on it, which is basically a serial eeprom. This eeprom is costantly written by the printer during all its lifetime span, and it's permanently locked when it expires. I have used the term expire because locked cartridges are not necessarily empty.

The printer has an internal counter which is associated to the last read CRUM number. The internal counter starts with a number of 0 and ends at 2000 for the black cartridge, or at 1000 for the other colors. The counter is increased by 1 for every printed page; when the counter reaches i.e. "2000", the chip on the toner is marked as empty and permanently locked.

When a new toner is inserted in the printer, the printer performs the following operations:
  1. For the very first 1000 pages the chip is not required (toner sold with the printer have no chip)
  2. The printer checks if the new CRUM on the chip is different from the previous one stored internally (date is NOT checked, just the CRUM)
  3. If the new CRUM number is valid for color and region, the printer writes 2 bytes (value A5) at 0x004A and 0x004B, to check if the eeprom has not been locked
  4. If 0x004A and 0x004B are both "A5", the printer sets its internal counter for PAGES and JOBS reading these data from the chip at 0x00C2-0x00C4 (PAGES), 0x00D4 (JOBS). Note: PAGES seem to be crumbled and xored with some data like the CRUM number.
  5. Finally the printer stores internally the new CRUM number
Note: Point n. 4 is controversal, because some people say that the printer resets its internal counter when the the installed toner is swapped with one that has been used but not finished. I can say that this behaviour maybe depends from the software inside the printer, since from the tests performed with my printer, exchanging toner never increased the number of pages for that particular cartridge.

The following image shows the bytes that are changed over time:

When the toner finishes the process is the following one:
  1. Array 0x0080 - 0x00F0 is moved to 0x0000 - 0x0070
  2. 0x004A is turned into AA
  3. Permanent (software) write protection is turned on

As it's possible to see, this lock protection has several flaws:
  1. No encryption is used
  2. Validation is performed by writing the same values at always the same locations
  3. Printer does't check if the writing operations on the chip were succesfully accomplished
Now the steps that we should perform to have a fully permant chips are quite clear:
  1. Our chip should have the value A5, A5 at ox004A ox004B
  2. The crum number, the color and the other information should be set correctly
  3. PAGES and JOBS should have the minimum value recognized as valid (i.e. 01, 01)
  4. The whole array should be write protected, so the printer is not able to change PAGES, JOBS and to lock the cartridge with "AA" at 0x004A.
Let's build our Permanent Chip

The following image represent the dump I used on my "Black" permanent reset chip for EUR region. Of course for different colours, the byte at 0x009B and 0x009E should change.


Now that we have the correct dump, we can transfer it on the chip using our home made I2C serial programmer. If you have any doubt on how to perform this operation, please read "FixYourOwnPrinter" thread before going any further.

You can use a very simple serial programmer like the one I made by myself:

Once the image is transferred correctly, we should enable the write protection. As specified on the Atmel documentation for 34c02 here, in addition to the Software Write Protection, we have the Hardware Write protection: "The WP pin can be connected to VCC, GND, or left floating. Connecting the WP pin to V will write protect the entire array, regardless of whether or not the software write protection has been enabled". Hardware protection prevents the printer from modify a single byte inside our chip, and of course it's reversible and leaves the write protect register untouched.

The most difficult part of this process is that the WP pin could be grounded (e.g. connected to GND -). If we cannot connect directly the WP to VCC, because it will result in a short circuit, we have to lift the WP pin. You can take a little help from a very thin steel wire (Wire Wrap), while you are heating the contacts:

The final stage is to solder the WP pin on top of the VCC pin:

The procedure it's almost finished. Almost, because when the toner finishes, our permanet chip is not erased, but the printer still remembers the CRUM number on it. To refill we should insert the second aftermarket chip once, and soon after swapping it with the permanent one. The easiest way, from my point of view, is to have 2 toner cartridges with 2 different permanent chips on it and alternatively using one and the other one after.

Note: this method of write protecting valid data with hardware protection, could work against other printers as well, including ones with encryption.

60 comments:

  1. Uou It works!!! Simply Amazing!

    M.

    ReplyDelete
  2. I don't understand where is the chip. Can could you pls give me some tips where to find the chips in the photo?

    Tnx

    Franz

    ReplyDelete
  3. I bought that chip from an aftermarket reseller i.e. these are the common reset chips made in China and reselled all over the world.

    ReplyDelete
    Replies
    1. Hi!

      Great post, but can't you simply buy aftermarket toner cartridges, and once installed and a page is printed, just lift & solder pin 7 to pin 8?

      FYI, as of May 2012 three colour toners are $20 with free shipping!

      Delete
    2. Hi,

      4 1/2 years later...
      I think it should be possible. I will check it out soon and report. Maybe someone is still interested after this long time.

      Delete
    3. It works.
      Just install the toner cartridges and close the front cover. The printer checks your new cartridges and print a demo page. You don't have to print more pages! Remove the cartridges, lift and solder pin 7 to pin 8 and that's it.

      Note! I just checked this out for the black cartridge. Maybe you have to print one coloured page for cyan, magenta and yellow.

      Delete
  4. Hello, I think that it's the very best explanation of how the internal counter of the printer works. However, I don't understand how to use the wire to lift the pin.

    Franz

    ReplyDelete
  5. You need to heat the contacts while you gently pull the wire

    RM

    ReplyDelete
  6. This is an awesome blog. My gratitude for contributing so much time to it.
    I think it would be great to provide multiple blogs for the CLP 300 series including cleaning the imaging unit, alternative sources for toner, chips, as well as other maintenance problems and solutions.
    I am not a programmer, but from the first printout I see that the pages address changes from new to used to locked. Is it possible that this register is read and when it hits a "max" value, the printer then locks the chip. If this is so then swapping cartridges would not foil the locking.
    I would be interested in obtaining permanent reset chips.

    ReplyDelete
  7. Thank you GreyWizard. This post actually explain how to get your permanent chip from an aftermarket chip.

    As explained the real page counter is on the printer. To avoid printer locks, just freeze a "good state" via hardware protection as explained.

    ReplyDelete
  8. Hi,

    As i can see you have spent alot of time writing this out and explaining the process, but i was wondering whether it would be cheeky of me to ask if you could make a set of reset chips for the samsung clp315.

    ReplyDelete
  9. you cant get reset chips for the clp315, you need to mod the motherboard to reset the printer counter

    ReplyDelete
  10. With the help of this blog (thanks to the author) i created this "adapter":

    http://img147.imageshack.us/my.php?image=ddci2cadapter.jpg

    The "adapter" is connected via an VGA cable and an DVI-VGA adapter to my 9800GTX. Works like a charm. :) Be careful that you have a fully pinned VGA-Cable, most cables dont have the +5 VDC pin, which is neccessary.

    I wrote a Shell script that runs on my Ubuntu machine with the i2c-tools package to automate the reset process. It resets everything and changes the last digit of the CRUM number. Here it is (sorry, dunno where to upload):

    Filename: reset-clp300-i2c
    #################
    #!/bin/sh

    ########
    #This shell script resets the EEPROM Toner cartidge chip of SAMSUNG CLP-300[N] Printers!
    #Don't do something wrong or you might destroy your system!
    ########

    #Arguments
    bus=$1 #I2CBUS
    chip=$2 #CHIP-ADDRESS

    #i2c_get Function, Reads from i2c bus
    #arg1: Address
    i2c_get()
    {
    printf "%d" `i2cget -y $bus $chip $1 b`
    sleep 0.1
    }

    #i2c_set Function, Writes to i2c bus
    #arg1: Address
    #arg2: Value
    i2c_set()
    {
    i2cset -y $bus $chip $1 $2 b
    sleep 0.1
    }

    #Check for root
    if [ `whoami` != "root" ]; then
    echo "You have to be root to access devices!"
    exit
    fi

    #Check for arguments
    if [ $# != 2 ]; then
    echo "Usage: sudo sh reset-clp300-i2c I2CBUS CHIP-ADDRESS"
    echo "Use i2cdetect and i2cdump to determine the right I2CBUS and CHIP-ADDRESS"
    exit
    fi

    #Print welcome text and dump current data
    echo "Using I2C Bus $bus and Chip-Address $chip to reset CLP300 Toner Cartidge Chip..."
    echo "Current EEPROM Memory Dump:"
    i2cdump -y $bus $chip b

    #Begin to write
    echo "Beginning to write data..."

    #Write block 0x00 to 0x7F
    for i in `seq 0x00 0x7F`; do i2c_set $i 0xFF; done

    #Write block 0xC0 to 0xFF
    for i in `seq 0xC0 0xC3`; do i2c_set $i 0x00; done
    for i in `seq 0xC4 0xC7`; do i2c_set $i 0xFF; done
    for i in `seq 0xC8 0xC9`; do i2c_set $i 0x00; done
    for i in `seq 0xCA 0xCB`; do i2c_set $i 0xA5; done
    for i in `seq 0xCC 0xCF`; do i2c_set $i 0xFF; done
    for i in `seq 0xD0 0xE3`; do i2c_set $i 0x00; done
    for i in `seq 0xE4 0xFF`; do i2c_set $i 0xFF; done

    #Increase the last digit of the crum number by one
    last_crum_digit=`i2c_get 0xBF`
    if [ $last_crum_digit -ge 48 -a $last_crum_digit -le 57 ]; then
    #Increase the digit
    if [ $last_crum_digit -eq 57 ]; then
    last_crum_digit=48
    else
    last_crum_digit=`expr $last_crum_digit + 1`
    fi
    #Write back
    echo "Changing last CRUM digit to: $last_crum_digit"
    i2c_set 0xBF $last_crum_digit
    else
    echo "ERROR: Last CRUM digit could not be read!"
    fi

    #Dump new data
    echo "New EEPROM Memory Dump:"
    i2cdump -y $bus $chip b

    #Done
    echo "Resetting Chip done. Have a nice day! :)"
    #################

    Pretty short and simple, but works fine on all 4 types of toner chips.
    After resetting and and doing a first print with the chip (to initialize and write the encoded data onto it, see first link), i hardwired the write-protection pin of the EEPROM from GND to VCC. This prevents the printer from writing new page counts to the chip.

    Now i dont have to care about new toner chips anymore. Let the endless printing begin! Horray!

    ReplyDelete
  11. i am unable to access the blog :

    I2C eeprom programmer; I will not describe how to build one on your own. Please refer to the very detailed schemes here: Chiprecharge Serial Programmer

    even after logging in with gmail account....

    sorry..but could you help out please as my office has 2 of clp-300 and enabling them could help me earn some brownie points from my boss and secure me in these difficult times....

    thanx bro

    ReplyDelete
  12. I knew there had to be a way to bypass the lock-out from printing, especially when the colors were printing fine and nothing was beginning to print faded or with a loss of color. Unfortunately, I am not secure in creating a device to reset the chip(s). Would you be willing to sell one to me? My computer knowledge stops short for creative devices (even with instructions).

    ReplyDelete
  13. Please help me, I am unable to log into the Chiprecharge Serial Programmer. I would appreciate any help anyone can give me. I am not an expert with hardware so any help would be great.

    Thanks!
    ~Jacob

    ReplyDelete
  14. @Anonymous: Chiprecharge Serial programmer can be found easily here http://www.chiprecharge.com/hardeng.html

    @Linda: Using this programmer is not difficult, but requires appropriate skills.

    @asdf AKA Jacob, see the link at http://www.chiprecharge.com or have a look at the beautiful thread in Fix your own printer

    Cheers, ResetMan

    ReplyDelete
  15. I can design awesome graphs and create a beautiful financial statement, but programming and using pins and adapters well not so good. Is there any place where a "kit" you have designed be purchased?

    Karen

    ReplyDelete
  16. I wonder if can you help with this, I am fairly novice and am trying to build the serial cable DB9 (9 pin) as appears in the first image of http://www.chiprecharge.com/hardeng.html (which uses 2 zener diodes and 2 resistors)

    The question I have is that I see multiple ground connections to:

    Pin5 of the DB9
    Zener Diode 1
    Zener Diode 2
    Pins 1, 2, 3, 4 and 7 of the I2C EEPROM Socket

    The question I have is, whether these all are connected?

    Thank you very much,

    ReplyDelete
  17. @Anonymous

    Connect PIN 5 to the ground of a USB plug. USB has 4 connections: 5v, Data, Data, Ground

    Connect right side of Z1 to ground
    Connect Right side of Z2 to ground

    Pin 1,2,3 are NOT used. Pin 7 is connected to the resistor and the resistor is connected to the left side of the diode.

    @karen

    Karen, I'm sorry but I'm just trying to help CLP300 users like me: it's not a business driven activity. You can buy resetters from various chinese companies (I do not provide the link since I didn't test it personally)

    ReplyDelete
  18. look at
    http://samclp.over-blog.com/

    ReplyDelete
  19. If I am reading this right, you could put a new reset chip let the printer recognise it and write to it, then solder the wp pin to the vcc pin, and skip the programmer. Providing you use two chips to alternate. Am I missing something, or is the programmer only needed once the chip is locked?

    ReplyDelete
  20. Correct... ResetMan uses the programmer just to reset a used chip or to program a at34c02 chip.

    If you insert a new oem chip once, and you solder the WP pin you are done. You need just another one to alternate, can be any chip that has not expired.

    ReplyDelete
  21. hello, who have dump for clp-300 series imaging unit with erased counts?? my email is : szozda2@poczta.fm , thanks

    ReplyDelete
  22. The better solution is to use the software lock on eeprom. After writing the correct empty buffer just send the appropriate command (0110xxxW) to eeprom and we have locked first half/block. So we can reprogram same eeprom with another crum in the second half/block in future without any hardware modification. But someone must write or modify ponyprog e.g. for do that!

    ReplyDelete
  23. @elparadise.com

    As far I as I can understand, locking the first half does not keep the cartdridge counter from incrementing. You tell the printer that the cartdrige is not expired, but it keeps a copy of the number of printed pages on it, so it could not work... I think that's the reason why the author locked the full block with hardware mod

    ReplyDelete
  24. Hi. I can do that, I know how to programme but I didn't understand one thing: if I have OEM tonner's, how I can reset? Where is the chip? The chip than you talk is on printer's motherboard?

    ReplyDelete
  25. @dario If you have an OEM chip, just buy one "non OEM chip" costs 6 dollars and make it permanent.

    ReplyDelete
  26. It work. If you do a software lock to the cartdridge (first block) with 0xA5 in 0x004A and 0x004B you can reprogram infinite times the second block with new crum number and new page counter... (hint: 00 00 00 etc...). Tested on several cartridges.

    ReplyDelete
  27. You can do it on ORIGINAL CARTDRIDGES, when are new.

    ReplyDelete
  28. I'm sorry I'm dense, but I don't understand and need help. If the original toner cartridges don't have a chip then why can't you just refill the original cartridges? Is it because the CRUm # on the printer doesn't get rest without a fresh cartridge?

    ReplyDelete
  29. For original cartridge i mean a new cartridge from samsung (or a cartdridge from a compatible brand). The initials cartridges does't have chip and is the printer that memorize pages... After filling this memory you can't use again cartdridges without chip.

    ReplyDelete
  30. Is there is a way to reset the imaging unit?

    ReplyDelete
  31. Could be tricky as no obvious 'chip' to connect to

    ReplyDelete
  32. Hi ResetMan

    Thanks to your information, I was able to get my cartridge reset to new. I'll try software locking the first block when it gets a bit lower. I did notice one thing about your image though, "bytes that are changed over time" the hex in the blue boxes is repeated over on the right, second line from bottom. Not sure if this makes any difference, but just thought worth mentioning.
    Thanks again!
    Pete

    ReplyDelete
  33. help !! I have a samsung clp-310 with OS v1.01.11.53 oct-10-2009

    Do we have any solution on the reset chip ??

    jvvmusme at yahoo.com

    ReplyDelete
  34. I understand you can reset with a chipsetter.

    Please advice on the longevity of the Laser drum after resetting

    Example - do anyone has experience How long the imaging unit lasts if I can reset the counter?

    Thanks a lot

    ReplyDelete
  35. Can a chip socket be installed then place a new reset chip let the printer recognize it and write to it, then solder the wp pin to the vcc pin, and place it back into the chip socket . Will this work also and for get programming

    ReplyDelete
  36. People with a CLP310/CLP315 should check this:
    http://fcartegnie.free.fr/lines/?p=25
    (lock counters, chipless mod)

    ReplyDelete
  37. tapper.: reset samsung clp 310. sur youtube vous trouver une reponce pour les iprimantes recement acheter.

    ReplyDelete
  38. samsung clp-315

    anyone knows how reset imaging unit counter?

    With 3 printers, if I try every imaging units on the first printer (that work correctly) they are ricognized right, while if I try the same parts on the others two, they aren't recognized. So I assume that the imaging units are still good, but the page counters about them, reports that their life cicle is ended. How I can reset this information???

    ReplyDelete
  39. This it is work with the Xerox Phaser 6110? are the same?

    ReplyDelete
  40. i need to know where can i get the schematic diagram for the reset chip board because I am planning to build it on PCB. but the value of the Capacitors and the IC used are not known except the main reset chip which is an EEPROM.

    e-mail me if you have the answer to my question at sexy_ali_76@yahoo.ca

    thank you.

    ReplyDelete
  41. Is there any solution for Samsung ML-2580N to reset counter chip like this?

    ReplyDelete
  42. do it works with 24c028 chip?

    ReplyDelete
  43. Visit Ones:-

    http://chipreset.webs.com/

    ReplyDelete
  44. sir
    i studied about 24c04 in this chip they u handshaking method ie it gives acknowledgement singal when writing is done so how can u do it for this

    ReplyDelete
  45. What is the part # on the serial eeprom on the toner cartridge (not the one inside the printer)? Also, what addresses are they?

    ReplyDelete
  46. I appreciate help please
    I have a CLP-315 v1.29.11.53 with original toners and black toner is over and the printer stopped.
    I've read several posts here and I tried to reset the 24C64 chip.
    I've tried multiple dumps but I think that none should be compatible with this firmware.
    Now the clp-315 performs the routine to get ready, but the LED is always red.
    Does anyone have a solution to this problem?

    ReplyDelete
    Replies
    1. I have the same version with no solution at this momment.

      Some help will be apprecite.

      Thanks!

      Delete
  47. Check this out

    http://fcartegnie.free.fr/lines/?p=25

    I did it to my 310, seems to work, ya I still have a red light because one of mine is low, I also covered up the chips on the toners too. But I did have to get a new black toner.

    Good luck
    Jabba

    ReplyDelete
  48. Hi, can this be done for Samsung CLP 320

    ReplyDelete
  49. From last few month i am using compatible Ink and Toner Cartridges it is same as genuine is, you can try it without any hesitation quality is guaranteed.

    ReplyDelete
  50. Hi does anyone know if the CLP300 cartridges are region coded, and if so, can this be changed? I'm getting the invalid toner error after trying 2 genuine samsung cartridges from Canada and I have a European printer

    ReplyDelete
  51. I have the same problem :( but with SCX3205W… I think they are also coded for region...

    ReplyDelete
  52. Hello everyone,

    I would like to tell about my problem and how did I solve it.

    I ordered 4 chips from China. Once the Cyan was out of life, I have changed the chip on Cyan and it worked just fine. Then after some time - Yellow cartridge ran out, so I also changed the chip on it. But after changing the chip, suddenly all the other colours stopped working. Printer panel was saying, that Cyan, Magenta, Black and Imaging Unit were invalid. Only Yellow cartridge was valid.

    I tried to figure out what was wrong. I took an Arduino and wrote some software to dump the contents of eeproms. There seemed to be no problems with them. I tried rewriting them with a lot of different combinations found on the internet. Spent almost full day trying to figure out what was wrong, and next day I tried one last combination. I thought if I rewrite all the chips at once, maybe it would work. And one time, only by coincidence, I reflashed Cyan chip, then took Yellow chip and forgot to change the I2C device address in software - BUT IT STILL DID RESPOND. While it should only respond to address 0x50, it respond to 0x51, 0x52 and all other addresses. Then I figured out, that when the printer starts up, it checks the chips staring from lowest I2C address - which is the Yellow chip. Of course it recognizes the Yellow chip and moves on to the next one - Magenta (0x51). Since the printer still receives the answer from the Yellow chip, the printer thinks that the Magenta is invalid, because it has invalid eeprom content. This continues with Cyan, Black and Imaging unit and at the end - all cartridges and imaging unit becomes invalid - because for the printer it looks like all Yellow cartridges.

    So in conclusion - if you even encounter such problem, then it might be, that the eeprom chip of the specific cartridge might answer to all addresses, when it always should answer to only one unique address. I took another chip laying around, resoldered it and it worked just fine.

    Hope that information would help someone...

    ReplyDelete
  53. If the printer does not require a chip in the cartridge during its first 1000 pages, why couldn't we figure out a way to simply reset the page counter in the printer itself every so often so that it is always below 1000? Any idea how we would go about doing this?


    "For the very first 1000 pages the chip is not required (toner sold with the printer have no chip)"

    ReplyDelete
  54. Interesting blog and I really like your work and must appreciate you work for the canon toner cartridges nice blog.
    canon toner cartridges

    ReplyDelete