Printer toner DRM

Some time ago our old printer died - or more exactly, became mostly unusable due to the rollers becoming unable to grab paper from bypass tray. Not long before that I repaired the power board, so that was for nothing but at least bought about a month or so. Replacing rollers might have helped, or some chemical treatments but since I printer was absolutely necessary for normal business operations I couldn't just guess.

So I had to get a new one. Not that big expense, but nevertheless annoying. And of course after only thousand pages or so it started to complain about toner. And now, after few more months it finally refused to print anymore, "change toner cassette". Total to this point was about 2500 pages (I didn't check the counter then and have already printed some amount of pages with new cassette so I can't be exactly sure of the count). Then again, 2500 pages isn't too bad for "starter" cassette these days.

When changing the toner cassette I noticed a small PCB with some pads at one end (printer was delivered to us fully functional so I had no reason to take cassette out before that). Being me - that is, curious (or is that suspicious?), I of course had to take it out, and indeed it was what I suspected - an small PCB with some passives and a small chip on it.

The marking on the chip is "5ME3 R2ES90", and quick search turned out nothing. Not too surprising either, after years of researching random chips one develops kind of "gut feeling" about those markings, and this definitely spelled out "unsearchable" to me.
No matter, when comparing the layout against standard 8-pin I2C EEPROMs it is remarkably similar. So after quick visit on "junk" box I found suitable semi-dead PCB  I could use as base for further exploring (in this context "semi-dead" means that this board was somewhat functional but could not be used in customer devices, even after repairs, so it was put aside for other uses - these typically being some quick prototyping and testing something like this):

The chip visible on main board is a 256kbit EEPROM and there is space for two such chips (sharing common I2C bus) on the board; here the other one was unpopulated so I could solder wires directly there. My guess was that this is small-ish (64, 128 or 256 bytes) I2C EEPROM quick software hack was also needed - I generally use larger (32kB and 64kB) EEPROMS, meaning 16-bit addresses, but dropping hi byte was trivial enough change in C code. And some brief moments later there it is: data dump from the chip itself, all 128 bytes of it:

"T332Q..." part was easiest to decrypt, serial number of the printer as plain text. I just don't like my printer's serial being that readable so it's censored, sorry. No idea however why it is placed in toner memory, maybe every printer the cassette is used in is added there - for what reason I really can't guess.
406972 seems remarkably like a counter, but this printer has done only 2500 pages so the number is a bit high. Also, since these cassettes come in different sizes, I would expect the initial value to be high(ish), decreasing and cassette to be rejected when it reached some low threshold value, so low value would make more sense.

Now, if that 406.. is counter, it would be amount of toner used (instead of raw pages) but I can't really compare it against anything. But then there would have to be cassette type identification somewhere else so printer would know how high value could be which by itself is not that bad idea. However, since printer firmware is practically never updated, no new cassette types could be introduced after first printer was produced - new cassettes need new type ids that need to exist in printer firmware. And in my opinion that is Bad Design.
Another guess for the value would be serial number of cassette, but number doesn't match with anything on the cassette itself, there is only one sticker and it has "MNO" prefix (model number?). That is, unless printer logs lately used cassettes and their print counts, and then just rejects it if cassette "loses" a few prints. But here I may just be paranoid (but then again, that is how I would do it if I had Evil disposition) (off-topic; I have been told that this is actually how modern vehicles (cars, bikes) keep track of the odometer reading - but that is topic for another posting, some time later)

Rest of the data could be anything, your guess is as good as mine. For now I don't even bother to try.

The new cassette is high-capacity one (advertised as 7000+ pages) so I am a bit hesitant on trying to access its chip to compare data, it would suck to make a mistake and lose entire cassette immediately. Maybe later. While I am perfectly aware that it is pretty damn difficult to accidentally write data to chip through I2C I still am hesitating since stupid accidents can and do happen.

Oh, and I did know that inkjet printers use this kinds of chips to track ink usage (this also is why I expected smallish EEPROM, they seem to be commonly used), but so far I had not known laser printers (especially black-and-white ones!) to employ similar idiocy. I know, however, that my next printer very likely will be from some other manufacturer than Ricoh. Just let me use all the toner in the cassette if I want to, damn it.

Led matrix update

After some troubles the LED matrix I quickly mentioned before is functional. Unfortunately taking pictures of it (without diffuser, I don't have any handy right now) is damn difficult so the photos aren't exactly of  the greatest quality.

The pictures really don't show observed brightness or color very well, so you have to take my word for it: it looks way better live. And unfortunately my DSLR is one model too old to have video capture, so I can't even give you that (and webcams/phone cams are absolutely worthless - been there, tried that, immediately decided to forget about it)

The four matrices in pictures are chained together and driven by Arduino Uno showing simple color cycle where each component is assigned value with simple rotating sin function, so nothing fancy. Nevertheless it looks quite nice for demonstration purposes (well, when observed live, at least). Arduino manages to update the matrix at rate of 300 updates per second, not bad, and code for updating it is very very simple.

My original idea was that this would be easy-to-use (no complex driving logic required like so many matrices do!) and fairly cheap  module for hobbyist use - showing text, smallish graphics ("We're OPEN!") and whatnot, possibly even slide show from SD card (by using some suitable Arduino shield or maybe Raspberry Pi - neither of which I have available right now). Unfortunately the initial small production run costs about twice what I was aiming for so this may be a bit too expensive (around 70€, including VAT). Damn.
 However, extending this to 16x16 matrix should be fairly simple (granted, routing will be a huge pain, even with added board area) and yet change in cost should be minimal, so maybe I just forget this smaller one and go for that instead.

Any ideas or requests, anyone?

TV antenna amplifier (another one)

I had this old antenna amplifier ready to be thrown out, but just out of curiosity I decided to open it and see what's inside. Our house was built in early 90s, and according to our neighbors the family that originally lived there was quite religious, in this context meaning that they did not have TV. The area has cable TV but it was never connected to this house. At least the inside wiring was done so connecting TV should be easy later.

Next family living there was ... well, cheap. I've been finding their half-assed fixes (and I'm using the word very liberally here) since moving in, fixing them properly one by one. Even the TV setup was cheap; apparently they bought old antenna, with associated electronics from one neighbor that was updating their system. So this amplifier is likely from the 80s.

Outside there's on/off switch, gain control, indicator LED, one input and two outputs, so quite usual configuration there. The plastic has gotten quite brown and slightly broken from some places.

Assuming that it has usual clips holding it together I tried to pry it open. Whoops. And I didn't even have to use a lots of force.

Right, here's the screw, under the sticker. Finding it first wouldn't have helped anyway, plastic was so badly deteriorated that it would have broken anyway, just from different place.

And the PCB. Top left is on/off switch, below it a fuse (whopping 500mA! Why exactly has someone decided that this thing is allowed to consume 100W is beyond me. Damn thing seems now more like a house fire waiting to happen. Of course I have no way of knowing if the fuse is original or one of those half-assed fixes mentioned earlier), then transformer, on right of it diode bridge and smoothing capacitor. Two round black things with text on them are RF transistors (types BFR 90 and BFR 91A), rest miscellaneous resistors, capacitors and inductors. Nothing too special here.

 So there. Now this thing goes back to trash bin. For good.

Teardown of a top-set TV box

Some years ago I signed on Elisa's (local internet/mobile provider) "Viihde" ("Entertainment") service. Original (only) reason for signing up was ADSL (originally 20/1M) but it also includes Tivo-like functionality (by connecting to their servers, you are given about 4TB of (virtual) space for recordings) and on-demand movie rental (also in 1080p) by using their custom top-set box. Total is about 40€/month, not bad (rentals on top of that, if used).

When I signed on I still had my old Topfield box which was quite sufficient, but it finally broke (actually it became unreliable - HD wouldn't wake up sometimes. I still have it but don't really know what to do with it, aside throwing it away - I did examine it but couldn't find the culprit for problems) so I moved on using Elisa's box and was actually quite surprised. I didn't suck - not too much at least.

Unfortunately the TV reception of the original box had grows progressively worse over the time, so I had it replaced with newer model. No need to return the old one so of course I had to take the old one apart to see what's inside. Unfortunately it was pretty much what I expected - system-on-chip solution with minimal external parts.

Here's the board (warning, large image).

The main processor is as expected, "SMP8635LF Secure Media Processor". I couldn't find a datasheet with quick search so I'd expect it to be under NDA. No matter, it isn't too difficult to guess that it contains relatively secure boot loader and loading (possibly encrypted) software from external flash (chip below it, sticker on top) and possibly also encryption of external memory contents (four chips up and right from it). Most likely some tampering detection thrown in for good measure. From system design perspective the datasheet might provide interesting read though.

Lower left corner (highlighted in red) is a bit more interesting. Larger chip is STM32F family MCU , but smaller one is NRF24L01 - "Ultra low power 2.4GHz RF Transceiver". This is not WLAN chip, it can only transmit relatively small data frames, so my guess would be an RF remote control or possibly programming the customer-specific parameters to the unit (each unit is tied to your account and since my account is now moved to new unit, this one will only report error when trying to connect to server). Provided remote was typical IR-based one so if they had RF capability it wasn't used. Pity, I'd love to hide this kind of units that don't need physical access behind TV or other such place where it wouldn't take real estate from units that need to be accessible (like DVD player).

The smaller red square highlight another mildly interesting part of the board. This actually appears to be USB connector. Since this is not available from outside and traces go directly to the main processor, this might be the production programming interface (there is distinctly JTAG-looking header on the bottom of the board, though)

The USB connector right from there is accessible from outside, but it can only be used for time shifting live TV (as in pausing program). There is another USB connector at back of the board too. I think I never used either of those.

On the other (bottom) side there is usual load of passives (resistors and bypass caps for chips), and a card reader module with interface chip. The is also a card interface, accessible through a slot in bottom of the (fully assembled) unit. Box has ability to subscribe to paid channels through your account IPTV so it doesn't really need card, but still it could be useful for accessing usual OTA channels, say, if your fried brings his card over.

Empty footprints at left from the processor and empty connectors look interesting too. Possibly SATA interface for optional internal hard drive? (and other large empty place - PATA connector? I don't  recognize any of those footprint patterns definitely so these are just educated guesses)

At the upper part there are connectors. TV in and out (with associated RF stuff, here with can cover removed), HDMI, another video connector (looks kinda like S-Video but has 9 pins, some non-standard connector?), headphone, optical out, another USB, Ethernet and power, each with their associated interface electronics. And on right power supplies (chip in middle has markings "Summit 113 1085LA1033" - again quick search finds nothing, but my guess is some kind power management controller).

So, all in all, this is another demonstration of current trend of electronics design. Single-purpose unit with any ability to hack or repair it very carefully removed (granted, I kinda understand it in this case, being able to receive and show HD content over internet). But that seems to be the direction we're going now. Doesn't mean that I have to be happy about it though.