What about MC-G01?

[michbeck100]

Does this work with MC-G01, too?

[raichea]

I've been looking into this and can see no reason why it wouldn't work for MC-G01 - it uses the same I2C EEPROM and the board looks identical.

One thing was puzzling me. The board appears to have a resistor pulling pin 7 up to Vcc. Pin 7 is WC - write control - same as write protect for other versions of the chip - and when high inhibits writing to the chip. There's no contact connected to pin 7 to pull it to GND to enable writing but the printer obviously does write to the chip. Checking with a multi-meter, however, the
SMD component appears to be open circuit and pin 7 is connected to GND on the board, so the part is not a resistor, it's a capacitor that is simply placed across the supply rails.

[gaby64]

Anyone has a dump of MC-G01?

[gaby64]

I've been looking into this and can see no reason why it wouldn't work for MC-G01 - it uses the same I2C EEPROM and the board looks identical.

One thing was puzzling me. The board appears to have a resistor pulling pin 7 up to Vcc. Pin 7 is WC - write control - same as write protect for other versions of the chip - and when high inhibits writing to the chip. There's no contact connected to pin 7 to pull it to GND to enable writing but the printer obviously does write to the chip. Checking with a multi-meter, however, the SMD component appears to be open circuit and pin 7 is connected to GND on the board, so the part is not a resistor, it's a capacitor that is simply placed across the supply rails.

Is it possible to hex edit the rom to change the counter?
Or can you send me a MC-G01 dump?

Thanks

[raichea]

Is it possible to hex edit the rom to change the counter?

As described in the Wiki

Or can you send me a MC-G01 dump?

Sorry, no - for the reasons given by the author in the Wiki

[gaby64]

Is it possible to hex edit the rom to change the counter?

As described in the Wiki

Or can you send me a MC-G01 dump?

Sorry, no - for the reasons given by the author in the Wiki

That was a reason for not uploading on github, sharing between users is fine.
Pastebin is a nice place for such things if one wishes to stay anonymous.

[wangyu-]

Be aware before sharing the rom with people you don't know.

Previously, there was a person keep trying to ask the rom from me. Later it turns out he was planning to build customer resetter and plan to sell it.

[gaby64]

Has anyone analyzed the contents of the rom? Or a diff of dumps before and after count increment? Are we dealing with crypto signatures or encrypted content? Is it different from one unit to the other?
Given how many knockoff chips and resetter devices there are, I doubt there is any traceability or fingerprinting.

[wangyu-]

Has anyone analyzed the contents of the rom? Or a diff of dumps before and after count increment? Are we dealing with crypto signatures or encrypted content? Is it different from one unit to the other?

For mc-g02, after you use the cartridge once, almost all the chars inside the rom get changed. I couldn't find an obvious counter inside it.

Not sure if they use some encryption (and I believe no). But there seems to be some encoding/decoding used, so that you cannot see the raw counters.

[raichea]

For mc-g02, after you use the cartridge once, almost all the chars inside the rom get changed. I couldn't find an obvious counter inside it.

Not sure if they use some encryption (and I believe no). But there seems to be some encoding/decoding used, so that you cannot see the raw counters.

Exactly - it's not just a simple counter. The cartridge serial number is in the chip as well.

[raichea]

Be aware before sharing the rom with people you don't know.

I agree

Previously, there was a person keep trying to ask the rom from me. Later it turns out he was planning to build customer resetter and plan to sell it.

If someone is that interested in getting the contents, buying a new cartridge isn't that expensive.

[gaby64]

Look what someone was nice enough to post

https://pastebin.com/z24TQ36x

[gaby64]

[wangyu-]

@gaby64 Does the rom in pastebin reset your old mc-g01 successfully?

By the way your rom looks very different from my mc-g02's. Yours contains far more zeros.

[raichea]

I've looked at three sets of data now:

1. My old, supposedly full, maintenance cartridge
2. A brand new genuine maintenance cartridge
3. The pastebin file

The pastebin file looks very similar to the brand new one.

I've also done some basic analysis of the contents of the used one and this corresponds with the contents of the others.

The 2048 bytes of the chip are organised as six distinct sections:

Section 1 - 64 bytes.
Bytes 0-1: not sure what these are (possibly checksum digits).
Bytes 2-11: Next 10 bytes are the cartridge 9-character serial number (as little-endian 16-bit values) padded with a 0x00 byte.
Bytes 12-13: not sure what these are (possibly checksum digits)
Remaining bytes all 0x00

Section 2 - duplicate of section 1

Section 3 - 320 bytes
Bytes 0-1: 0xA5A5 in a brand new cartridge, followed by all 0x00s
Bytes 0-257: Hex data followed by 62 0x00s

Section 4 - duplicate of section 3

Section 5 - 640 bytes
Bytes 0-1: 0xA5A5 in a brand new cartridge, followed by all 0x00s
Bytes 0-513: Hex data followed by 126 0x00s

Section 6 - duplicate of section 5

Each section has checksum bytes (1st or last two bytes?) such that if you add contents as little-endian 16-bit numbers, each section sums to 0xA5A5, ignoring any overflow.

The duplicate sections are - presumably - to mitigate against data corruption. There is exactly twice the amount of data in section 5 as in section 3, so I imagine these are tables logging something about each time ink is deposited in the cartridge. I also suspect that the first warning given to the user about replacing the cartridge is given when a certain number of entries is reached and the printer stops printing altogether when the tables are full or very close to full.

That's all I've got.

[gaby64]

This service mode eeprom report data might be usefull:

For full:
MTC D=100.0 MTC ST=2023/06/13-04:11
MTC SN(SN0=KNSX00215 SN1= ) MTC CH=003
MTC PC(M=009 R=012 S=001 T=001 D=000 C=001 I=005)

For empty:
MTC D=000.0 MTC ST=2023/10/13-06:29
MTC SN(SN0=KNSX00215 SN1= ) MTC CH=001
MTC PC(M=000 R=000 S=000 T=000 D=000 C=000 I=000)

[gaby64]

@gaby64 Does the rom in pastebin reset your old mc-g01 successfully?

The rom did successfully reset my old mc-g01

[Nickduino]

Can anyone confirm the hack works on the MC-G01 cartridge?

[wangyu-]

Can anyone confirm the hack works on the MC-G01 cartridge?

@gaby64 seems to have confirmed. But I am not sure if he was using the tool in this repo unchanged.

[gaby64]

Can anyone confirm the hack works on the MC-G01 cartridge?

@gaby64 seems to have confirmed. But I am not sure if he was using the tool in this repo unchanged.

I used it unchanged, can confirm it works.

[MChamarinda]

This works for me too❤️

[MChamarinda]

[MChamarinda]

Write the dump before cartridge fill.

[Nickduino]

Look what someone was nice enough to post

https://pastebin.com/z24TQ36x

That someone is a really nice person!
I can confirm the sketch works with the MC-G01 and a good dump.

[Nickduino]

And I see they sell new sponge for the cartridge on Aliexpress if you don't want to make a mess cleaning it.

5 for 16.41€, that's cheaper than one cartridge from Canon:
https://www.aliexpress.com/item/1005005284132715.html

[raichea]

Having looked inside both a Canon cartridge and an AliExpress one, I don't think those pads will fit a genuine Canon maintenance cartridge.

[Nickduino]

Just to confirm...you looked inside a MC-G01 specifically?

[raichea]

Yes - I took it apart to have a go at cleaning the pads. Quite a messy process!

I took pictures but may not have them any more. I'll see if I can find them.

[Nickduino]

I hope you'll find your pics.

On this one, you see how they're supposed to fit:

(Which means the top of the stack of the Aliexpress replacement sponge goes to the bottom of the cartridge)

[raichea]

You're in luck, I found the pictures in my computer's trash bin.

After looking at the three cartridges as described in my post on 14 Oct 2023, I bought one of those Chinese versions and read the data on the chip (which is as expected but with a, presumably, random serial number encoded in the first two blocks of 64 bytes. I also dismantled it to see why the pads advertised on AliExpress looked so different to the ones I found in the genuine Canon cartridge.

Internally the design is quite different. The Canon cartridge divides the internal space with plastic barriers and uses 12 unique custom-cut pads. I photographed them as I removed them for cleaning, labelling them with a marker pen to help with reassembly after cleaning and drying (some hope - the pads went all very dark after soaking and rinsing to remove the ink - but I was able to reassemble OK).

Anyway - here are the pictures of the Canon internals as I removed the pads:

[Nickduino]

Thank you, that's very interesting. So the Chinese pads might work in a Chinese cartridge, but that's it.

[raichea]

I believe they're designed to fit the Chinese cartridges which all seem to be the same design (based on identical labelling on all versions I've found on the web).

[Nickduino]

Look what someone was nice enough to post

https://pastebin.com/z24TQ36x

It looks like someone pasted the same but after one purge of the printer to compare the differences:
https://pastebin.com/7VTMcAKr

So it looks like you could erase all data, except for the serial number and strategically place a few 0xA5 values to end up with an "empty" cartridge.

But I wonder if the printer remembers the serial number of the last cartridge and throws out an error.

[Vrobenmat]

Does this still work for anyone? the pastebin dumps don't work for me, printer throws error 1725 'the maintenance cartridge cannot be recognised'. I've verified the ROM to make certain the data is correct. It looks like canon may be reading this as well and blocked these dumps in a firmware update.

[gaby64]

what printer model ?

[Vrobenmat]

what printer model ?

GX7050

[Nickduino]

It looks like canon may be reading this as well and blocked these dumps in a firmware update.

That would be such a dick move!

Have you read your EEPROM before reflashing it? Maybe you could use your original serial number and just clear the purging values

[Vrobenmat]

It looks like canon may be reading this as well and blocked these dumps in a firmware update.

That would be such a dick move!

Have you read your EEPROM before reflashing it? Maybe you could use your original serial number and just clear the purging values

Yeah, I read out the full cartridge, but it looks like it zaps the original structure - ended up with a block of 512 bytes repeated 4 times, and no serial number in sight. I have a new (3rd party) MC-G01 cartridge arriving today - will read it out before installing.

Pisses me off - the whole point of going the ink tank route was not to deal with cartridge crap anymore. I guess they still find a way to screw you on replacements. Happy to pay a higher base price for a printer that I can fix on the spot - why do none of these companies actually make a decent consumer/prosumer printer?

[bertybuttface]

@Vrobenmat I'm as pissed off as you are. I'm looking to update this code to make a simple ESP based device with the correct pinout that just clears these cartridges. If you can post another dump in addition to the pastebin above I'd really appreciate it. If I can compare a few I can write some code to just zero these out.

[Nickduino]

I have a new (3rd party) MC-G01 cartridge arriving today - will read it out before installing.

Did you read the virgin cartridge and again after a couple cycles to see which bits change?

[Vrobenmat]

I honestly threw it in without reading (because I needed to bloody print something...) Not used it that much since then, will pull it out and give it a read.

[hansipete]

Look what someone was nice enough to post

https://pastebin.com/z24TQ36x

I copied that over to the sketch_hack_write.ino and flashed my MC-G01 using a Seeduino Xiao.

GX6050 is printing again — Thank you so much guys!

[bertybuttface]

I honestly threw it in without reading (because I needed to bloody print something...) Not used it that much since then, will pull it out and give it a read.

I did the same thing, I have a used one and a partially used one I'll read out and post here. Hoping to work out how to generate a random serial number and zero the correct slots.

That way we won't need to share a ROM but the reading part won't be neccessary. Also should stop Canon blocking by serial number if they decide to do that (e.g. keeping a list of used serials on the printer or a blacklist).