Monday, 31 December 2018

Resetting the Page Count on a Samsung Laserjet (MLT-R116 Drum)

  /     /   26 comments   
Our Samsung M2835 printer's drum unit (MLT-R116, not toner, the drum unit) finally hit its software-programmed end-of-life of 10,000 pages.  This is annoying for several reasons:

  • Page 9,999 was perfectly fine
  • I disagree with business practices involving software-enforced obsolescence 
  • Other printers (Brother and HP) provide an option to reset the page count
After some research, it turns out drum unit uses the same technique as toner cartridges to enforce end-of-life.  It uses a small 4Kbit i2c EEPROM to store the page count.  

There are some great resources for resetting almost the same EEPROM on toner cartridges on Samsung printers.  I used and adapted these to reset the drum counter.

Here's the Chip with contacts soldered to it so I can plug it into my raspberry Pi.





And here's the chip by itself:





And here's the connection to the RPI:



 So once connected, dumping and re-writing the ROM is easy.  Use the above links to enable i2c on the RPI and then:

  • python speer.py -b 0x50.bin --addr 0x50
  • python speer.py -b 0x51.bin --addr 0x51
  • bvi 0x50.bin
    • Change offset 0x0C to 00 00 00 00  # See Note Below!
  • python speer.py -r 0x50.bin --addr 0x50
Now the drum counter reports 0 and the printer will print again.  Note: from what I have been reading, some versions of the firmware require modifications to other offsets too.  It's probably easiest to take a snapshot of the eeprom, save it somewhere safe, and then reload the eeprom 5 years later when the page counter is too high.

 Note: Thanks to Joe Cooper, you may also, or instead, have to reset bytes of the 0x50.bin starting at 0x26 to 00 00, and at 0x2E to 00 00.    It's possible different printer models/firmware are storing the page count at different offsets.


26 comments:

  1. Joe Cooper25 July 2019 at 11:51

    I followed this guide, but the counter kept resetting back to 27 10 every time, which means 10,000 in decimal, which is the page count.

    I looked through the data dump some more and found another 27 10 at 0x46 and 0x47. However, each time my printer resets this back to 27 10 and still says end of life. If anyone has working dumps, please can you share?

    Oh and a little tip, don't solder the cables to the chip, you can tape them to card board and just push them against the chip. Getting them the wrong way around wont fry it as long as you don't do it for long!

    ReplyDelete
    Replies
    1. Dave25 July 2019 at 13:15

      I was using gator clips and cardboard but got tired of disconnecting the chip and putting it back into the printer to see what happened... i soldered the wires on and put the whole thing back in the printer.. i have 4 wires sticking out of my printer now that i can connect to my RPI and reprogram the drum anytime :)

      Delete
  2. Joe Cooper25 July 2019 at 12:20

    Aha! Ignore the 27 10... Look for 23 28 which means 9000 pages. I had it twice in 0x50. After setting to 00 00, it works again! Now to reset the toner...

    ReplyDelete
  3. Dave25 July 2019 at 13:13

    That is fantastic. I will check my offsets later too, which offsets did you find 23 28 at? Was your drum at 9000? Or 10000?

    ReplyDelete
  4. Joe Cooper25 July 2019 at 13:40

    Ah soldering them to be able to access outside is a good idea!

    The page count is a bit weird. The printers counter now says 10,003. But the counter I had to reset in the imaging unit was at 9,000 when it stopped. The offsets were 0x26 / 0x27 and 0x2E / 0x2F. (both were 23 / 28).

    ReplyDelete
  5. Dave25 July 2019 at 21:28

    Interesting. In wonder if different printers use different offsets to store different things. On my original 0x50 image, 0x26/27 was 03 e9 when it stopped printing, and 0x2E/2F was FF FF. I didn't touch either to reset it.

    My original at 0x0C was 00 00 27 12, which is close to the 27 10 you quoted. This I reset to 00 00 00 00 and the pages reset.



    ReplyDelete
    Replies
    1. Gelchup2 January 2020 at 21:28

      This comment has been removed by the author.

      Delete
  6. Gelchup2 January 2020 at 21:29

    Hello, thanks for this article.

    I followed it but i don't succeed yet.

    I have succesfuly read my eeprom, and i have 00 00 27 10 in 0x0C.
    i have changed it to 00 00 00 00 but when i put it back on the printer, the printer doesn't want to print :/ After that, i checked and 0x0C was reset to 00 00 27 10.

    I have double check, i succesfuly write on the eeprom.

    Do you have any idea ? Maybe you can share you backup with me ?

    there is a screen capture of 0x50 : https://i.ibb.co/wzjDjfB/r116-0x50.jpg

    I have read the comments of Joe Cooper but 0x2E is ff ff and 0x26 is 03e8 in my case, i have tried to put 0x26 to 00 00 but it don't solve my problem :/

    Thanks

    ReplyDelete
    Replies
    1. Gelchup4 January 2020 at 10:57

      Hello,

      I tried a few things and tried to understand the organization by doing reverse engineering, and I found a solution to my problem.

      0x51 is the place which contains all the information of the unit (serial number, brand, date of manufacture etc ...), it contains in particular, the max capacity of the unit!
      0x51 is never changed by the printer.

      0x50 is the part that is changed by the printer each print.

      By parsing byte by byte, in 0x50:
      we have from 0x00 to 0x03 the date of first use
      0x04 to 0x07 the date of last use
      from 0x0c to 0x0F the page number counter.
      from 0xB0 to 0xBF the serial number of the printer

      In 0x51:
      from 0x05 to 0x0F we have the serial number of the unit
      from 0x15 to 0x1E we have the brand of the unit (Samsung export in my case)
      from 0x24 to 0x27 and 0x2C to 0x2F: 00 00 23 28, which is effectively 9000 and is directly linked to the capacity of the unit.

      I think Joe Cooper's solution is in 0x51 and not 0x50

      My M2825ND printer have protection in the current firmware, if I modify 0x0c for 00 00 00 00, the printer resets to the previous value. I was in the same situation as Joe Cooper.

      2 solutions:

      First solution,:

      So I put 0 the 2 places where 9000 appears (0x51.bin) and it works (as Joe Cooper said), I printed the detailed sheet and in fact it passes the capacity to 0 which breaks the verification on the number of page.
      However my printer continued to advert me that the drum was almost full but I could continue to print.

      Instead i tried to go from 9000 to 900000, it works well, the maximum capacity of the drum is simply increased. No more printer warning. This solution is interesting because we will never again have any restrictions on printing because we will never have reached the maximum capacity.

      Second solution, make a complete reset of the unit:

      As in the article, we offset 0x0C in 0x50.bin to 00 00 00 00 (if we only do that, certain printers including mine will reset to the real value of the counter).
      The trick is to modify the serial number of the drum by modifying in 0x51.bin a random number (offset 0x05 to 0x0F) for example in 0x0D. Which makes the printer think it's a new drum.

      So that's what I found, I hope it will be useful to other people.
      Thanks for the article

      Delete
    2. Dave6 January 2020 at 13:01

      Thanks Gelchup, that's fantastic and useful info, I'll update the article shortly. With both your solutions I could probably fork the speer.py code and add an option to automatically fix the drum count, or submit a change back to the author so speer.py can fix both the toner and the drum.

      Thinking back, changing only 0x0C on mine may not have actually worked, but I was swapping back and forth between two drums, so that may have tricked it at one point (reset page count to 0, swap drum, swap back and with the serial number change the printer accepts the 0 page count).

      Neat stuff, thanks so much for all your work with this!

      Delete
  7. Zlomennypez24 March 2020 at 08:22

    Hi guys,

    thanks for your help. I have MLT-116R and the solution of the problem is simple:

    If you want to reset drum, set all parts of 0x50 to 0. After reboot it will be 100% and parts of 0x51 will be modified automaticaly.

    If you want do more, you can modify 0x51.

    Here is link to modified 0x50.bin and 0x51.bin, which gives you 900K pages and drum is reset.

    0x50erased.bin: https://mega.nz/#!oQ5TUTQS
    0x51modified.bin: https://mega.nz/#!BRpDTJ4b

    In speer you have to send command:
    sudo python speer.py -r 0x50erased.bin --addr 0x50
    sudo python speer.py -r 0x51modified.bin --addr 0x51

    Hope it helps!


    ReplyDelete
    Replies
    1. BiBaButze21 April 2020 at 06:22

      This comment has been removed by the author.

      Delete
  8. BiBaButze21 April 2020 at 06:23

    ...but downloading https://mega.nz/#!BRpDTJ4b needs a cryptokey...

    ReplyDelete
  9. BiBaButze21 April 2020 at 06:46

    ...and the same? key for https://mega.nz/#!oQ5TUTQS

    ReplyDelete
  10. BiBaButze27 April 2020 at 23:25

    I'm still waiting for the key...
    The links are useless without them...

    ReplyDelete
    Replies
    1. Zlomennypez28 April 2020 at 21:54

      Sorry for that, now it should be OK. But I have find another solution withou any hacking.

      In you web browser go to the page of your printer (IP address)

      Login
      Default Username: admin
      Default passord: sec00000

      Go Settings - Machine Settings
      On the left side Setup - System Setup

      And there is Imaging unit stop set to ON

      Change it to of and printer will not stop!

      Delete
    2. Zlomennypez28 April 2020 at 22:03

      Mega doesn´t work, try this one:

      https://uloz.to/file/pGsScs2Wxxy0/0x50erased-bin
      https://uloz.to/file/nZODfsPIDW4e/0x51modified-bin

      Delete
  11. Joe Cooper28 April 2020 at 06:55

    Back again as the unit is displaying "The Imaging Unit has reached its end-of-life cycle" and won't print. We've certainly not printed 9000 pages on it, but I checked the counters anyway on 0x26 0x2E and they were showing slightly over 1,000 pages printed which is about right. I reset back to 00 00 but still same issue. I suspect something else is preventing it from working.

    ReplyDelete
    Replies
    1. Gelchup28 April 2020 at 14:57

      have you tried the solutions i give in previous comments ? it's still working for me ;)

      Delete
    2. Joe Cooper28 April 2020 at 15:25

      I did but each time it printed one page to say replace, not seen that before. I gave in and ordered a new one as it has a waste toner unit built in and will eventually fail anyway. I plan to get a eeprom dump before I even use it. Will upload and post links here.

      Delete
  12. Zlomennypez28 April 2020 at 21:56

    SOLUTION WITHOUT NEED CAHNGING EEPROM:

    In you web browser go to the page of your printer (IP address)

    Login
    Default Username: admin
    Default passord: sec00000

    Go Settings - Machine Settings
    On the left side Setup - System Setup

    And there is Imaging unit stop set to ON

    Change it to OFF and printer will be OK!

    ReplyDelete
    Replies
    1. Joe Cooper29 April 2020 at 10:11

      Thanks, this worked for me. But not before I went out and bought a new imaging unit!

      Delete
  13. Joe Cooper29 April 2020 at 10:14

    Zlomennypez's solution of accessing the web interface and disabling the setting that prevents printing when the imaging unit is end of life is by far the best option if you're able to do this.

    I bought a new imaging unit before I knew about this, and even before putting it in the printer, I got a dump from it. Here are those eeprom dumps:

    https://mangoonline.co.uk/0x50-new
    https://mangoonline.co.uk/0x51-new

    You can write these back to an old imaging unit to trick the printer into thinking it's a new unit. After the first time, you may need to tweak the serial number within 0x51 to make it different to the first, but not sure if this is really needed.

    ReplyDelete
  14. Unknown23 September 2020 at 11:25

    Hey guys, can I program chip with USB programmer? Anyone maybe try program it from Windows?

    ReplyDelete
  15. someonenotyou21 January 2021 at 02:04

    Hi.
    Is this the correct dump? https://i.ibb.co/tLMM5gm/image-2021-01-21-120149.png
    Sorry, this is first time for me and don`t know where to begin.
    How can I reset the count?

    ReplyDelete
  16. kadirov200511 December 2021 at 12:26

    hello here is my experience
    I used ch341a programmer to read chip from m2835dw then changed 23 28 to 00 twice in the same line write again to 24c04 counter is reset to zero
    https://drive.google.com/file/d/1BKz5PqNTkVmsrdS_LJTEzhnbbz2_sDdn/view?usp=sharing

    ReplyDelete