reverse engineering a printer cartridge chip

Question

Is this stack only about reverse-engineering software and firmware? What about hardware?

We have a few semi-industrial ink-jet printers (like $2,000 each so, whatever tier that means to you).

It has these special ink cartridges that have chips in them that don’t allow you to refill the cartridge.

We have found a supplier that sells us replacement chips but they are still quite costly, and still one-time use.

My boss has asked me to investigate if it is possible to find out a way to “manually reset" these chips or otherwise reverse-engineer them with a solution that would not require us to keep buying more chips in order to refill the ink ourselves.

I’m not sure where to start on this.
I’m not sure if the chips have some kind of encrypted communication with the printer rendering the entire plan infeasible.
I’m not sure if the chips are one-time use because something physically changes internally that cannot be undone (if so, then could a replacement chip emulate this functionality, but be resettable?)
I’m not sure on the legality of this endeavor either. Does this fall under break DRM? Can ink have DRM?

I’ve already told my boss that this will likely be more hassle than it is worth in terms of time and the cost to pay a specialist to attempt to reverse engineer a solution. But, he still wants me to look into it.

My one advantage is that I am in Taiwan right now, and I could fly to China easily as well to find someone to do this kind of work. I feel like both those countries are prime candidates for having the technical capability and knowhow, the willingness and motivation to circumvent a product’s security features, and a lower cost of labor. But I’m also willing to entertain the idea of a single professional from any country helping me out.

Anyone have any idea how I would go about starting this? How can I find a person or a firm in China or Taiwan willing to look into this problem?

Answer 1

Start with reversing the circuit diagram of the cartrige. Find what chip is used (MCU or something else) if it is MCU or some kind of FLASH/EEPROM then this could be done by software. But there is a possibility that the info is hardwired into something like broken PCB path or blown up some diode/fuse/resistor.

In case MCU is used try to dump working cartrige and not working cartrige memories and compare/disassemble the differences.

Without more info and access to the HW is very hard to provide more help.

Answer 2

I’m not sure where to start on this.

One should start by looking at available information. I assume there is none.

Generally, you would need an oscilloscope and a logic analyzer. The less «consumer grade» you printer is, the more is the likelihood of finding off-the-shelf parts in the cartridge. Mass-production manufacturers use custom designed ASICs because their volumes are counted in millions, but IC manufacturing is very expensive at low quantities. Dealing with a design that uses commonly available parts will most likely be easier, but I don't think that's the case here.

So, when it's not possible do dump firmware or look up a datasheet, you would need to create a logic probe that will capture all the signals going between the chip and a printer. Then you would need to decode the protocol, compare waveforms for empty and full cartridges, see if the patters is repeated every time you power up a printer, if it's encrypted, etc.

The end result will likely require a small FPGA and a microcontroller which will impersonate the original chip. Maybe just an MCU, if the protocol is simple enough.

I’m not sure if the chips have some kind of encrypted communication with the printer rendering the entire plan infeasible.

It's possible, but most likely there won't be a full-blown RSA + AES, most likely a static key and some checksums.

I’m not sure if the chips are one-time use because something physically changes internally that cannot be undone

Epson definitely did produce cartridges for their inkjet printers. There was a physical fuse on the chip that was blown once the printer decided the cartridge can not be used anymore.

(if so, then could a replacement chip emulate this functionality, but be resettable?)

Looking at resettable cartridges for consumer-grade printers, I think it should be possible. HP (and most likely others) printers also keep a history of chip IDs used before — so I assume resettable ones generate a new ID when needed.

I’m not sure on the legality of this endeavor either. Does this fall under break DRM? Can ink have DRM?

I am not a lawyer and you should probably ask one, but this heavily depends on whether or not you are going to share this fake chip implementation with others. Make sure to disconnect your printer from the internet, though.