8

Is this stack only about reverse-engineering software and firmware? What about hardware?

We have a few semi-industrial ink-jet printers (like $2,000 each so, whatever tier that means to you).

It has these special ink cartridges that have chips in them that don’t allow you to refill the cartridge.

We have found a supplier that sells us replacement chips but they are still quite costly, and still one-time use.

My boss has asked me to investigate if it is possible to find out a way to “manually reset" these chips or otherwise reverse-engineer them with a solution that would not require us to keep buying more chips in order to refill the ink ourselves.

I’m not sure where to start on this.
I’m not sure if the chips have some kind of encrypted communication with the printer rendering the entire plan infeasible.
I’m not sure if the chips are one-time use because something physically changes internally that cannot be undone (if so, then could a replacement chip emulate this functionality, but be resettable?)
I’m not sure on the legality of this endeavor either. Does this fall under break DRM? Can ink have DRM?

I’ve already told my boss that this will likely be more hassle than it is worth in terms of time and the cost to pay a specialist to attempt to reverse engineer a solution. But, he still wants me to look into it.

My one advantage is that I am in Taiwan right now, and I could fly to China easily as well to find someone to do this kind of work. I feel like both those countries are prime candidates for having the technical capability and knowhow, the willingness and motivation to circumvent a product’s security features, and a lower cost of labor. But I’m also willing to entertain the idea of a single professional from any country helping me out.

Anyone have any idea how I would go about starting this? How can I find a person or a firm in China or Taiwan willing to look into this problem?

  • 1
    How about starting with the product name/serial? – drum Jun 3 '16 at 14:55
4

Start with reversing the circuit diagram of the cartrige. Find what chip is used (MCU or something else) if it is MCU or some kind of FLASH/EEPROM then this could be done by software. But there is a possibility that the info is hardwired into something like broken PCB path or blown up some diode/fuse/resistor.

In case MCU is used try to dump working cartrige and not working cartrige memories and compare/disassemble the differences.

Without more info and access to the HW is very hard to provide more help.

  • I don’t know if this is inappropriate to ask here, and I see that there is no way to send a direct / private message on Stack Exchange... I don’t have the skills to do this myself. Are you available for hire (pay for time spent) for a project like this? Or do you know someone who is? I can send a sample cartridge (“new” and “used”) to examine and see if it is possible. – Daniel Jun 14 '16 at 7:58
  • @Daniel I got too many projects at hand already for at least 10 following years. Both commercial and private so sorry I am not available for hire (for few years now and I take only critical jobs as people in my field of work are almost extinct in my part of world). – Spektre Jun 14 '16 at 8:02
  • OK, do you know where I can find someone? – Daniel Jun 14 '16 at 8:07
  • @Daniel Wish I could ... – Spektre Jun 14 '16 at 8:14
  • ninjajobs.com would be a possible way to hire people with this skillset on a contractual basis, however im almost 100% sure this violates ToS, CFAA (Intellectual Property laws) or something that can open you up to legal retribution – grepNstepN Jun 23 '16 at 20:20
2

I’m not sure where to start on this.

One should start by looking at available information. I assume there is none.

Generally, you would need an oscilloscope and a logic analyzer. The less «consumer grade» you printer is, the more is the likelihood of finding off-the-shelf parts in the cartridge. Mass-production manufacturers use custom designed ASICs because their volumes are counted in millions, but IC manufacturing is very expensive at low quantities. Dealing with a design that uses commonly available parts will most likely be easier, but I don't think that's the case here.

So, when it's not possible do dump firmware or look up a datasheet, you would need to create a logic probe that will capture all the signals going between the chip and a printer. Then you would need to decode the protocol, compare waveforms for empty and full cartridges, see if the patters is repeated every time you power up a printer, if it's encrypted, etc.

The end result will likely require a small FPGA and a microcontroller which will impersonate the original chip. Maybe just an MCU, if the protocol is simple enough.

I’m not sure if the chips have some kind of encrypted communication with the printer rendering the entire plan infeasible.

It's possible, but most likely there won't be a full-blown RSA + AES, most likely a static key and some checksums.

I’m not sure if the chips are one-time use because something physically changes internally that cannot be undone

Epson definitely did produce cartridges for their inkjet printers. There was a physical fuse on the chip that was blown once the printer decided the cartridge can not be used anymore.

(if so, then could a replacement chip emulate this functionality, but be resettable?)

Looking at resettable cartridges for consumer-grade printers, I think it should be possible. HP (and most likely others) printers also keep a history of chip IDs used before — so I assume resettable ones generate a new ID when needed.

I’m not sure on the legality of this endeavor either. Does this fall under break DRM? Can ink have DRM?

I am not a lawyer and you should probably ask one, but this heavily depends on whether or not you are going to share this fake chip implementation with others. Make sure to disconnect your printer from the internet, though.

  • So where could I find someone that would do all that? Or who could give me a cost estimate to begin with? – Daniel Oct 25 '16 at 1:45
  • The level of skill needed to solver your task varies quite widely depending on some initial details, like printer model, a couple of photos of cartridge PCB (if there's one). You'll need this to ask an estimate from someone. Unfortunately, I am not aware of any freelance-type websites for this kind of work. – John Doe Oct 25 '16 at 11:17
  • Yea... considering the possible legal issues involved, I hesitate to make the printer brand / model and any other identifying marks public knowledge here. I have no intention to resell any developed solution either. So I have to find someone willing to do an estimate and then I will deal with the details with that person in private. How to find such a person that is capable and interested is my first challenge... – Daniel Oct 25 '16 at 16:24
  • Ask a lawyer about it, I can't imagine what kind of legal issues this will lead to outside of US. – John Doe Oct 25 '16 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.