Qu es una tinta Intellidge chip.Epson encaja pequeas placas de circuito a la mayora de sus cartuchos de tinta.

Estos registro de la cantidad de tinta que se estima que en el cartucho. He ledo que la lnea oficial de epson es que es para el beneficio de los clientes, y no un dispositivo antirelleno. Si crees que este o no una maldita molestia a cualquiera que quiera rellenar los cartuchos de tinta a granel o utilizar. Tambin impide que las personas que utilizan cartuchos viejos llenos de disolvente para limpiar los cabezales. Otro problema era los primeros modelos de impresoras no comprueban si se hubiera cambiado el cartucho mientras que el poder estaba en marcha. Esto era bueno si quera engaar a la impresora en la copia de un chip de "lleno" a vaca y, sin embargo, lo contrario tambin era cierto y se puede copiar fcilmente y uno "vaco" en su plena one.They son slo un pequeo dispositivo de memoria tiene 32 bytes de datos, que no miden el nivel de tinta real y tampoco lo hace la impresora. La impresora lee los chips en el arranque, las estimaciones (a veces mal) la cantidad de tinta debern haber sido utilizados y escribe esta vuelta al apagar el equipo. Ellos tienen otros datos como well.So epson ir a la molestia de los chips de ajuste a los cartuchos y la construccin de todas las tomas de corriente adicionales, cableado, electrnica y software en la impresora para que pueda utilizar el ordenador para ver el nivel previsto y puede detenerte impresin si crees que has utilizado suficiente tinta. De gama alta de Canon por el contrario hacer el depsito de tinta transparente para que pueda ver y tienen sensor ptico para detectar el vaco. Esto hace mucho ms sentido - a menos que usted est haciendo un dispositivo anti-relleno es. Canon casi tengo mi negocio esta vez, pero nadie poda encontrar tiene ejecute pigmento en ellos - tambin risky.To moverse por la viruta problemas a alguien por lo general terminan produciendo de slo lectura de chips que siempre ley completo (para su uso con CEI) y reseters chips para aquellos que quieren volver a llenar. Estos no estn disponibles para 2100p en el momento de la escritura como lo que puedo pedir mi tell.Before 2100p hice mi tarea y me pareci bastante probable que un chip de reseter estara disponible en algn momento y de slo lectura fichas tambin. Yo tambin era lo suficientemente arrogante para pensar que poda romper a m mismo y lo he hecho. No vaya tan esperado though.What es lo que quiero hacer? Quiero que la forma ms fcil de engaar a la impresora en la creencia de que tiene cartuchos llenos presentes para que pueda construir mi CIS.What Qu esperaba? Una interfaz lgica para Intellidge es i2c (I cuadrado c) o TWI (interfaz de dos hilos). A continuacin, el chip podra ser slo algunos i2c eeprom estndar. El Intellidge tiene demasiadas pastillas para esto, pero yo tena la esperanza. Despus de que se podran SPI o micro-hilo - una vez ms esto podra ser utilizados fuera de las piezas del estante. Si las patatas fritas eran micro-controladores y luego serie asncrono normal sera mi choice.I haba un look.To ello utilizo un AVR mega323 micro, rechac las ofertas de los analizadores lgicos son un tipo de homebrew de chico. El 323 tiene 2K de memoria RAM interna que es suficiente para algunos el registro de datos minimalista. Era de $ 50AUS en partes ($ 30US) para hacer. Me conect un cartucho para que las seales de salida y ech un vistazo rpido con un voltmeter.Nothing! No haba nada all. Me esperaba algo de poder, pero no, las fichas slo se alimentan brevemente cuando el se accede. He utilizado leds para tener una idea aproximada de lo que fue y lo conect al micro a travs de resistencias para dar un cierto grado de proteccin a la impresora si met la pata. El cdigo en el micro estaba escrito es ensamblador y los datos capturados se ha enviado a travs de RS232 a mi PC donde escrib un programa de Delphi para visualizar y procesar los datos.

Click here for more traces. This is the sort of thing I got. No protocol I ever seen. Obviously synchronous with bidirectional data, very short format. I was confused a little by how short it was - because I expect much better precision for the ink level.The traces seem to be.Top some sort of sync line, this always goes low before the start of transmission.Next power this goes low (off) between chip reads at printer startup but stays high during the shutdown when data is written to the chip.Next the clock, data is read of the rising edge and changed on the falling.Bottom bi-directional data, the first 4 bits are always from printer to the chip, the rest depend on whether it is a read or write. LSB first (left). Convert to binary and some patterns emerge.It was not real obvious how the chips were addressed or which bits encoded ink levels. Some more data when some ink had been used made it easier. Below is one chip being read at startup, there are 7 accesses one for each chip. Only 3 block

have data the other chips must be hooked to different data lines.

Below is the complete shutdown stream. Again we can only see 3 chips from here.

After printing a few bits near the beginning of the bit stream did change. It looks to me like the first 3 bits are the chip address the next is a write bit then the ink level, I get the feeling there aren't many bits used to encode it (later looks like 6). So the top one shows 252 bits of data being read out of the chip. The first part of the shutdown shows just the ink level being read out, this is to check the same chip is there. The second part is the ink-level and some other stuff (printer serial number maybe) being written into the chip. Seeing I didn't use any ink the bit-stream is identical to the read except for bit 3 presumably the write bit.

Tuesday 24 Sept 2002. I fooled the printer.

The interesting thing about this screen grab is the black cartridge is really only two thirds full. I spoofed the printer by pulling the serial data line low during the time the ink level bits are being clocked out of the ink chip. This is means 6 bits starting at the 5'th bit in the stream. The first 3 bits appear to be the chip address, I guess the next is a read/write select. I used a AVR mega323 to detect the start of the serial transmission look for the address of chip1+read (black apparently) then pull data low

for 6 clock edges. I'm sure I can reset 3 of the chips by tapping into chip1 signal. Reseting the rest will mean tapping into at least one more. The current set up is for experimentation only it is not the real thing. Shorting the data to ground may be a bit drastic but it is only for a very brief time. I hoped the data line would be open collector but this doesn't seem to be the case.

Tuesday 1'st October. - reading the chip without the printer.

I don't really need to do this but I wanted to see if I really understood the protocol. I wrote code for the micro to act as a master for the chip. I knew the chip was a low voltage part but I hoped it would be 5 volt tolerant and save me some trouble. After getting no sense out of two chips and confirming the printer couldn't read them either I assume I've killed them. I went shopping and bought 3V3 zeners and 330R resistors to limit the output of the micro port to 3V3. Data started to flow. The micro would not read it because is was below the input threshold so I added a pull up to the data pin (on the micro side of the 330R current limiting resistors so the inkchip didn't see 5V). I could then read the contents of the chip. I then spent the afternoon trying to write to it without any success.

Wednesday 2'nd October reseting the chip without the printer.

After sleeping on it, I wrote a better trigger routine for my data-logging program so I could get a better look at what the printer did differently. The trace revealed all.

What you see here is the printer starting a write sequence at normal speed then after transmitting the address and write bit the clock (2'nd from bottom) slowed down to around 1 Khz. I wrote a slow write routine and presto I can write to it. My code simply writes zeros to the first 8 bits in the chip. I repeat the process 7 timse using every chip address. The proof was to take an empty cartridge - zap it and feed it to the printer. The printer said yum and did it's charging thing - then showed a full cartridge on the status monitor. I won't bore you with another image of it. A chip reseter could be made with a $2 micro and not much else the socket is a problem. Most people can't program micros but for those who can it is trivial now that the protocol is knonw. My hacked about code is too ugly to show here. Alan Chan has sent me this hoping it would help people ID their chips.