Close

The Protocol

A project log for Ink Tank Encryption

I'm trying to find out how to use the EEPROM chips that might be in CLI-226 ink tanks to share public keys for public-private key encryption

alphaninjaalpha_ninja 08/31/2015 at 05:500 Comments

I'm still working on figuring out the protocol that's used for communication between the printer and the cartridge.

This is what I know so far:

There is a clock signal—it runs at 100KHz. It doesn't stop. Ever. It's also falling-edge triggered.

There is a data signal.

This is a xmission:

These xmissions have a delay of about 76ms in between them.

There's 2 parts. I don't know the significance of this, nor what part pulls data high when for what reason.

This is the first part of an xmission:

I'm also not sure what this is. I think it might be the printer reading from the cartridge's EEPROM—sending a 16 byte address and receiving an 8 byte value. Notably, the fourth value seems to be zero.

This is the second part of an xmission:

Considering the previous part, the logical conclusion is that this is writing to the EEPROM—the packets sent each have 24 bits, so that's probably the address and then the data.

I've extracted all this information from csv dumps via Python. You can see it here.

The xmissions I have recorded, so far, are from when the printer is open. I haven't yet recorded xmissions while printing a page, but this is necessary because that is most likely a time at which the printer will write to the EEPROM. I'll have to do this sometime later.

Discussions