Printer toner DRM

Some time ago our old printer died - or more exactly, became mostly unusable due to the rollers becoming unable to grab paper from bypass tray. Not long before that I repaired the power board, so that was for nothing but at least bought about a month or so. Replacing rollers might have helped, or some chemical treatments but since I printer was absolutely necessary for normal business operations I couldn't just guess.

So I had to get a new one. Not that big expense, but nevertheless annoying. And of course after only thousand pages or so it started to complain about toner. And now, after few more months it finally refused to print anymore, "change toner cassette". Total to this point was about 2500 pages (I didn't check the counter then and have already printed some amount of pages with new cassette so I can't be exactly sure of the count). Then again, 2500 pages isn't too bad for "starter" cassette these days.

When changing the toner cassette I noticed a small PCB with some pads at one end (printer was delivered to us fully functional so I had no reason to take cassette out before that). Being me - that is, curious (or is that suspicious?), I of course had to take it out, and indeed it was what I suspected - an small PCB with some passives and a small chip on it.

The marking on the chip is "5ME3 R2ES90", and quick search turned out nothing. Not too surprising either, after years of researching random chips one develops kind of "gut feeling" about those markings, and this definitely spelled out "unsearchable" to me.
No matter, when comparing the layout against standard 8-pin I2C EEPROMs it is remarkably similar. So after quick visit on "junk" box I found suitable semi-dead PCB  I could use as base for further exploring (in this context "semi-dead" means that this board was somewhat functional but could not be used in customer devices, even after repairs, so it was put aside for other uses - these typically being some quick prototyping and testing something like this):

The chip visible on main board is a 256kbit EEPROM and there is space for two such chips (sharing common I2C bus) on the board; here the other one was unpopulated so I could solder wires directly there. My guess was that this is small-ish (64, 128 or 256 bytes) I2C EEPROM quick software hack was also needed - I generally use larger (32kB and 64kB) EEPROMS, meaning 16-bit addresses, but dropping hi byte was trivial enough change in C code. And some brief moments later there it is: data dump from the chip itself, all 128 bytes of it:

"T332Q..." part was easiest to decrypt, serial number of the printer as plain text. I just don't like my printer's serial being that readable so it's censored, sorry. No idea however why it is placed in toner memory, maybe every printer the cassette is used in is added there - for what reason I really can't guess.
406972 seems remarkably like a counter, but this printer has done only 2500 pages so the number is a bit high. Also, since these cassettes come in different sizes, I would expect the initial value to be high(ish), decreasing and cassette to be rejected when it reached some low threshold value, so low value would make more sense.

Now, if that 406.. is counter, it would be amount of toner used (instead of raw pages) but I can't really compare it against anything. But then there would have to be cassette type identification somewhere else so printer would know how high value could be which by itself is not that bad idea. However, since printer firmware is practically never updated, no new cassette types could be introduced after first printer was produced - new cassettes need new type ids that need to exist in printer firmware. And in my opinion that is Bad Design.
Another guess for the value would be serial number of cassette, but number doesn't match with anything on the cassette itself, there is only one sticker and it has "MNO" prefix (model number?). That is, unless printer logs lately used cassettes and their print counts, and then just rejects it if cassette "loses" a few prints. But here I may just be paranoid (but then again, that is how I would do it if I had Evil disposition) (off-topic; I have been told that this is actually how modern vehicles (cars, bikes) keep track of the odometer reading - but that is topic for another posting, some time later)

Rest of the data could be anything, your guess is as good as mine. For now I don't even bother to try.

The new cassette is high-capacity one (advertised as 7000+ pages) so I am a bit hesitant on trying to access its chip to compare data, it would suck to make a mistake and lose entire cassette immediately. Maybe later. While I am perfectly aware that it is pretty damn difficult to accidentally write data to chip through I2C I still am hesitating since stupid accidents can and do happen.

Oh, and I did know that inkjet printers use this kinds of chips to track ink usage (this also is why I expected smallish EEPROM, they seem to be commonly used), but so far I had not known laser printers (especially black-and-white ones!) to employ similar idiocy. I know, however, that my next printer very likely will be from some other manufacturer than Ricoh. Just let me use all the toner in the cassette if I want to, damn it.