I need help identifying a chip and how to reset it from a new Brother's toner cartridge TN227 and TN223. This comes from the new Brother HL-L3230CDW laser printer.
There is currently no information on how to reverse engineer these chips to reset them, so I decided to investigate further, however I'm currently stuck.
Here are some pictures of the starter TN223 chip that my printer came with:
The pictures are shown as following:
- Pads of chip with numbers I added
- Back of Chip
- Light shining through chip
I then opened the printer to determine which pins go to what. I first used a multi-meter to determine that pads 2,3,4 are shorted to each other on each chip for each color C, Y, M, BK. I then found pad 2 was shorted to the printer frame, so I assumed that was ground. Then I looked at the wiring color. It's matched as the following:
- 1: purple, 2: white, 3: black, 4: red
When I attempted to measure any voltages from any of the pads during power-on, I was unable to measure anything.
I then connected a logic analyzer to the printer with the chip attached to see if I could figure out what protocol it was using. Assuming white is GND, Here's a sample of the Sigrok Pulseview received:
I ran the test twice and attached the Sigrok file results here and here.
These can be opened in Pulseview (free program) for a graphical representation of the data
It appears that the data is only sending when pad 4 goes high, I assume this is VCC. I then measured the voltage from pad 4 when communication occurs using an arduino and measured 3.3V. I now assume the chip is using 3.3V logic.
I still don't know if the pad 2 is GND since pad 3 is black which usually indicated ground, however as previously stated pad 2 is shorted to the frame of the printer. I then attempted to connect pad 3 as GND to my logic analyzer and connect pad 2 as not ground, however something strange occurred, and the printer no longer accepted the cartridge I was messing around with. Going back to pad 2 as ground, and it started working again. I'm now assuming pad 2 is ground.
When investigating the data further, there seems to be a little difference between two runs. I simply turned the printer on and recorded data then immediately turned it off then back on to get my second run, however the data seemed to change slightly. To ensure it wasn't due to sampling error, I increased the sampling to 20 MHz, which includes about 20 samples per clock cycle which should be sufficient to measure the wave forms consistently. When measuring the clock rate, I found it to be between 432-457Khz.
One idea I currently have is to analyze the data and find the ASCII text "brother" since each chip is required to have a manufacturing name and because the cartridges I have are from brother. More info can be found in Brothers white paper.
I'm not sure the best approach to analyze the binary data, since I can't identify the communication protocol, and I'm concerned that it might be encrypted. After searching patents to see if I could find more info on the chip, this was all I could find: http://www.freepatentsonline.com/y2013/0070279.html This suggests that the chip may be using crypto to hide info on the chip. If so, would it possible to crack it?
I tried analyzing the data as if it were I2C, but this doesn't seem right, Also I'm pretty sure it's not SPI. I do know there's a clock involved, so I know it has to be synchronous, but any help would be appreciated!
