search

lion-simba / reink

An utility to reset Epson printer ink counters
GNU General Public License v3.0
113 stars 32 forks source link

Support for Epson Expression series (XP-610, XP-620, XP-630, XP-820, XP-830, etc) #1

Open blenheimears opened 8 years ago

blenheimears commented 8 years ago

These are units that have both a printer and scanner in one. I don't think the cartridge level can be reset, but the waste ink counter should be able to be reset. These printers have Cyan, Yellow, Magenta, Black, and Photo Black cartridges. There are no light cyan or light magenta cartridges, except on the XP-860 and XP-950 (which also don't have the photo black cartridge). These test reports are from an Epson XP-630. I also have an XP-620 (which uses a different cartridge) but I don't have any cartridges for it yet. I can run a test on it once my cartridges arrive.

testreport-epson-xp-630.zip

lion-simba commented 8 years ago

Thanks for the report!

Could you please provide me with approximate level of inks, that were in the printer during these reports being generated?

Is it a new printer or an old one? I'm trying to estimate how much of it's waste ink tanker/counter should be filled for this time.

Couple of new reports for the same printer would be also helpful. Please make two reports consequently (without printing) and then third report after printing one page with black-only text.

blenheimears commented 8 years ago

It's a brand new printer so the waste ink should be relatively low. Another utility says that one waste ink counter is about 6% full (which I thought was unusually high for such a new printer) and the other is less than 1%. I think one counter is referring to the main pad that absorbs ink during head cleaning and charging, and the other is the pad that runs the length of the printer to absorb the edges off borderless photo prints. Not sure which one is which. I have attached three new reports, the first two taken about a minute apart without printing, and the third after printing a page of black text. Also, the ink level is from the printer's LCD right after printing the text. I haven't printed a lot since the first two reports so the level would be only slightly higher for the first two reports. inklevel XP630-testreports3-5.zip

blenheimears commented 8 years ago

If I can find a copy of the official Epson waste pad reset utility that works with this printer I can attach a Wireshark capture of the USB traffic.

lion-simba commented 8 years ago

Yep, USB traffic dump would be helpful too.

lion-simba commented 8 years ago

I think I have identified addresses of all ink counters and one waste ink counter. I was unable to differentiate between cyan and magenta because they have almost same ink level. I was also unable to found second waste ink counter. I have one candidate, but it's located not in sequential addresses, which is weird. Are you sure this printer have two waste ink counters?

In any case, we can start testing what I've found. I created a branch https://github.com/lion-simba/reink/tree/xp630 with added support for XP-630.

Let's try the following: Dump EEPROM before resetting waste ink counter: ./reink -d 0x00-0xFF -r ... > waste1.dump Reset waste ink counter: ./reink -s -r ... Dump EEPROM after resetting waste ink counter: ./reink -d 0x00-0xFF -r ... > waste2.dump Turn the printer off and on. Dump EEPROM after swithing the printer off and on: ./reink -d 0x00-0xFF -r ... > waste3.dump Check that the waste ink counter was reset.

Let's also do the same procedure for black ink: Dump EEPROM before resetting black ink counter: ./reink -d 0x00-0xFF -r ... > ink1-1.dump Reset black ink counter: ./reink -z1 -r ... Dump EEPROM after resetting black ink counter: ./reink -d 0x00-0xFF -r ... > ink1-2.dump Turn the printer off and on. Dump EEPROM after swithing the printer off and on: ./reink -d 0x00-0xFF -r ... > ink1-3.dump Check that the black ink counter was reset.

Then repeat for for other colors: -z2 (cyan), -z3 (magenta), -z4 (yellow), -z7 (photo black).

In any case, attach all the dumps you get.

blenheimears commented 8 years ago

I managed to obtain a copy of the official reset utility for the XP-620 (not the 630). I will post reports of this printer before and after resetting the counters and also a Wireshark USB traffic dump.

blenheimears commented 8 years ago

I do also want to verify that we have the correct addresses with Wireshark before writing to the printer's EEPROM.

blenheimears commented 8 years ago

I tried to do a dump of the eeprom, and I get "Fail to read EEPROM data from address 0." It appears this printer might use a different protocol than others.

Setting debug mode gives: === printer_model === === printer_connect === Opening raw device... OK Entering IEEE 1284.4 mode... OK Perfoming IEEE 1284.4 Init transaction... OK ^^^ printer_connect ^^^ === open_channel === Obtaining IEEE 1284.4 socket for "EPSON-CTRL" service... OK, socket=2. Opening IEEE 1284.4 channel 2-2... OK ^^^ open_channel ^^^ Let's get printer info. Executing "di" command... === printer_transact === Requesting some IEEE 1284.4 credits on channel 2-2... OK, got 1 credits. Writing data to printer... OK Get the answer... OK ^^^ printer_transact ^^^ OK Parsing result... === get_tag === Searching for "MDL:" substring... FOUND, pos=54. Searching for ";" character... FOUND, pos_end=71. Tag value:"XP-630 Series". ^^^ get_tag ^^^ OK Printer "Epson Expression Premium XP-630". === close_channel === Closing IEEE 1284.4 channel 2-2... OK ^^^ close_channel ^^^ === printer_disconnect === Perfoming IEEE 1284.4 Exit transaction... OK Closing raw device... OK ^^^ printer_disconnect ^^^ ^^^ printer_model ^^^ === do_eeprom_dump === === printer_connect === Opening raw device... OK Entering IEEE 1284.4 mode... OK Perfoming IEEE 1284.4 Init transaction... OK ^^^ printer_connect ^^^ === open_channel === Obtaining IEEE 1284.4 socket for "EPSON-CTRL" service... OK, socket=2. Opening IEEE 1284.4 channel 2-2... OK ^^^ open_channel ^^^ Let's get the EEPROM dump (0 - ff)... === read_eeprom_address === Reading eeprom address 0... === printer_transact === Requesting some IEEE 1284.4 credits on channel 2-2... OK, got 1 credits. Writing data to printer... OK Get the answer... OK ^^^ printer_transact ^^^ === get_tag === Searching for "EE:" substring... NOT FOUND. Can't get reply data. Fail to read EEPROM data from address 0.

blenheimears commented 8 years ago

I also created a test report for the XP-620. This created a very large log file (about 12MB uncompressed) and ran for a long time until I interrupted it. I don't know if this log file is very useful but since I have the official reset utility for the XP-620 I can do a wireshark dump of the USB traffic when reading the counters and resetting. testreport.log.zip

blenheimears commented 8 years ago

Here is a Wireshark capture of the USB traffic to/from the printer while reading and resetting both waste ink counters of the XP-620 using the official Epson utility. I think I did this capture correctly but it might not be correct. This was done with the Epson utility on Windows 10 64-bit in VirtualBox as guest, with Wireshark running on the host system (Ubuntu 16.04). Part of the reset procedure requires turning the printer off and back on (although I think this happens after the reset actually happens), which disconnected the printer from VirtualBox for a moment until I reconnected it manually. xp-620-reset.pcapng.zip

lion-simba commented 8 years ago

Regarding failed EEPROM dump, it seems like my mistake. I have missed that this printer is using two-byte addresses. I just corrected this in xp630 branch. Please get the changes and try again.

Also, given that this is two-byte addresses printer, we might actually have seen only part of it's eeprom... Let's try to do a full dump: 0x0000-0xFFFF. Please replace 0x00-0xFF in all commands from my previous comment to 0x0000-0xFFFF.

Test report from XP-620 seems good, although it was not completed (just as you stated). It has checked only 0x2e89 of 0xFFFF possible model codes. And it seems that it was running with enabled debug (REINK_DEBUG). Enabled debug will drastically increase time needed for checking all the model codes. I suggest to re-run the report with disabled debug.

Thanks for the USB traffic log. I'll check it later.

lion-simba commented 8 years ago

I have analysed XP-620's USB traffic log. It revealed the following:

So, if the utility first enquire current values of ink counters prior to resetting them, it must be that the first waste ink counter is at 0x0010-0x0013 and the second is at 0x0006.

The question remains: what are all others address utility is writing to?

blenheimears commented 8 years ago

The mass storage is probably from the printer's SD card slot, but there was not an SD card in the slot when I made that log. The computer might still see it as an empty drive though. Not sure what the other addresses are. I noticed after running the Epson utility that the printer took a long time to print the first time, and moved the print carriage back and forth several times, similar to what it does during a head cleaning. The LCD display on the printer read "Printing" and not "cleaning" though, but it still could have been a head cleaning. The other addresses might have something to do with this.

lion-simba commented 8 years ago

I've added waste ink counter reset for XP-620 in a new xp620 branch. Currently it writes zeroes to 0x0010-0x0013 and 0x0006. Probably it's enough.

Could you please test it? Let's also get the dumps before and after reset. Dump EEPROM before resetting waste ink counter: ./reink -d 0x0000-0xFFFF -r ... > waste1.dump Reset waste ink counter: ./reink -s -r ... Dump EEPROM after resetting waste ink counter: ./reink -d 0x0000-0xFFFF -r ... > waste2.dump Turn the printer off and on. Dump EEPROM after swithing the printer off and on: ./reink -d 0x0000-0xFFFF -r ... > waste3.dump Check that the waste ink counter was reset.

blenheimears commented 8 years ago

Dumping the eeprom appears to work but the result is different from the official utility. It could just be that the official utility formats the data differently. waste1.zip I have attached dumps from both the official utility and ReInk. Resetting the counter doesn't work. This might have to do with the two-byte addresses. Enabling debug mode gives:

=== printer_model === === printer_connect === Opening raw device... OK Entering IEEE 1284.4 mode... OK Perfoming IEEE 1284.4 Init transaction... OK ^^^ printer_connect ^^^ === open_channel === Obtaining IEEE 1284.4 socket for "EPSON-CTRL" service... OK, socket=2. Opening IEEE 1284.4 channel 2-2... OK ^^^ open_channel ^^^ Let's get printer info. Executing "di" command... === printer_transact === Requesting some IEEE 1284.4 credits on channel 2-2... OK, got 1 credits. Writing data to printer... OK Get the answer... OK ^^^ printer_transact ^^^ OK Parsing result... === get_tag === Searching for "MDL:" substring... FOUND, pos=54. Searching for ";" character... FOUND, pos_end=71. Tag value:"XP-620 Series". ^^^ get_tag ^^^ OK Printer "Epson Expression Premium XP-620". === close_channel === Closing IEEE 1284.4 channel 2-2... OK ^^^ close_channel ^^^ === printer_disconnect === Perfoming IEEE 1284.4 Exit transaction... OK Closing raw device... OK ^^^ printer_disconnect ^^^ ^^^ printer_model ^^^ === do_waste_reset === === printer_connect === Opening raw device... OK Entering IEEE 1284.4 mode... OK Perfoming IEEE 1284.4 Init transaction... OK ^^^ printer_connect ^^^ === open_channel === Obtaining IEEE 1284.4 socket for "EPSON-CTRL" service... OK, socket=2. Opening IEEE 1284.4 channel 2-2... OK ^^^ open_channel ^^^ Resetting... === write_eeprom_address === Writing 0 to eeprom address 0x10... === printer_transact === Requesting some IEEE 1284.4 credits on channel 2-2... OK, got 1 credits. Writing data to printer... OK Get the answer... OK ^^^ printer_transact ^^^ === get_tag === Searching for "OK" substring... NOT FOUND. Can't get reply data. Can't write to eeprom.

blenheimears commented 8 years ago

Later I will attach a Wireshark capture of the official utility dumping the EEPROM.

blenheimears commented 8 years ago

Here are three Wireshark dumps, one is the official utility reading the EEPROM, the other is the official utility reading and resetting the waste ink counters (again, just to verify that it does the same thing each time and that there isn't some kind of checksum byte that it's writing to), and the last one is a capture of what ReInk is doing during the failed reset. Just to be safe I would suggest doing the same thing that the official utility does during resetting, because if it's writing to those other bytes there must be a reason. wiresharkdumps-xp620.zip

blenheimears commented 8 years ago

Here is also a test report from the XP-620. testreport-xp620.log.zip

blenheimears commented 8 years ago

Here are the ink levels from the XP-620. xp620-ink-levels

blenheimears commented 8 years ago

Just realized that waste1.dump is an empty file. My bad. I will do a full dump of the eeprom tomorrow.

perdixxx commented 7 years ago

Hi, I encountered the problem of a full ink-waste on my Epson XP-760 when I found this tool and your discussion. Did the reset of the ink-waste work in the end? Would this also work on the XP-760?

I did the testreport, which look in my case like:

testreport.txt

GNUtoo commented 5 years ago

Hi,

Here's a testreport for the Epson XP-700.

It has 4 cartridges:

For some reason, the yellow cartridge is not recognized. I hope that this doesn't affect the test results.

$ sudo ./reink -t -r /dev/usb/lp0 ReInk v0.6 test report. sysname: Linux release: 4.19.8-gnu-1-x86_64 varsion: #1 SMP PREEMPT Sat Dec 22 14:03:34 CET 2018 arch: x86_64

=== printer_connect === Opening raw device... OK Entering IEEE 1284.4 mode... --- EnterD4Mode --- Send: *****@EJL 1284.4 @EJL @EJL

0: 00 00 00 1b 01 40 45 4a 4c 20 31 32 38 34 2e 34 @ E J L 1 2 8 4 . 4 16: 0a 40 45 4a 4c 0a 40 45 4a 4c 0a @ E J L @ E J L
SafeWrite: *****@EJL 1284.4 @EJL @EJL

0: 00 00 00 1b 01 40 45 4a 4c 20 31 32 38 34 2e 34 @ E J L 1 2 8 4 . 4 16: 0a 40 45 4a 4c 0a 40 45 4a 4c 0a @ E J L @ E J L
length: 8 read: 0 8 total: 8 Recv: 0: 00 00 00 08 01 00 c5 00 OK Perfoming IEEE 1284.4 Init transaction... --- Init --- Send: 0: 00 00 00 08 01 00 00 10 SafeWrite: 0: 00 00 00 08 01 00 00 10 length: 9 read: 0 9 total: 9 Recv: 0: 00 00 00 09 01 00 80 00 10 OK ^^^ printer_connect ^^^ === open_channel === Obtaining IEEE 1284.4 socket for "EPSON-CTRL" service... --- GetSocketID --- Send: ** EPSON-CTRL 0: 00 00 00 11 01 00 09 45 50 53 4f 4e 2d 43 54 52 E P S O N - C T R 16: 4c L SafeWrite: ** EPSON-CTRL 0: 00 00 00 11 01 00 09 45 50 53 4f 4e 2d 43 54 52 E P S O N - C T R 16: 4c L length: 19 read: 0 19 total: 19 Recv: *****EPSON-CTRL 0: 00 00 00 13 01 00 89 00 02 45 50 53 4f 4e 2d 43 E P S O N - C 16: 54 52 4c T R L OK, socket=2. Opening IEEE 1284.4 channel 2-2... --- OpenChannel --- Send: 0: 00 00 00 11 01 00 01 02 02 02 00 02 00 00 00 00 16: 00 SafeWrite: 0: 00 00 00 11 01 00 01 02 02 02 00 02 00 00 00 00 16: 00 length: 16 read: 0 16 total: 16 Recv: 0: 00 00 00 10 01 00 81 00 02 02 00 40 02 00 00 00 OK ^^^ open_channel ^^^ === open_channel === Obtaining IEEE 1284.4 socket for "EPSON-DATA" service... --- GetSocketID --- Send: ** EPSON-DATA 0: 00 00 00 11 01 00 09 45 50 53 4f 4e 2d 44 41 54 E P S O N - D A T 16: 41 A SafeWrite: ** EPSON-DATA 0: 00 00 00 11 01 00 09 45 50 53 4f 4e 2d 44 41 54 E P S O N - D A T 16: 41 A length: 19 read: 0 19 total: 19 Recv: ****@EPSON-DATA 0: 00 00 00 13 01 00 89 00 40 45 50 53 4f 4e 2d 44 @ E P S O N - D 16: 41 54 41 A T A OK, socket=64. Opening IEEE 1284.4 channel 64-64... --- OpenChannel --- Send: 0: 00 00 00 11 01 00 01 40 40 02 00 02 00 00 00 00 16: 00 SafeWrite: 0: 00 00 00 11 01 00 01 40 40 02 00 02 00 00 00 00 16: 00 length: 16 read: 0 16 total: 16 Recv: 0: 00 00 00 10 01 00 81 04 40 40 02 00 02 00 00 00 No sufficient resources available now. IEEE 1284.4: "OpenChannel" transaction failed. === printer_transact === Requesting some IEEE 1284.4 credits on channel 2-2... --- CreditRequest --- Send: 0: 00 00 00 0d 01 00 04 02 02 00 80 ff ff SafeWrite: 0: 00 00 00 0d 01 00 04 02 02 00 80 ff ff length: 12 read: 0 12 total: 12 Recv: 0: 00 00 00 0c 01 00 84 00 02 02 00 01 OK, got 1 credits. Writing data to printer... --- Send Data --- SafeWrite: 0: 02 02 00 0b 00 00 64 69 01 00 01 OK Get the answer... --- Credit --- Send: 0: 00 00 00 0b 01 00 03 02 02 00 01 SafeWrite: 0: 00 00 00 0b 01 00 03 02 02 00 01 length: 10 read: 0 10 total: 10 Recv: 0: 00 00 00 0a 01 00 83 00 02 02 Recv: 0: 02 02 00 9d 00 01 toGet: 151 Recv: @EJL ID MFG:EPSON; CMD:ESCPL2,BDC,D4,D4PX,ESCPR2; MDL:XP-700 Series; CLS:PRINTER; DES:EPSON XP-700 Series; CID:EpsonRGB; FID:FXN,DPA,WFA,ETA,AFN,DAN; RID:40; 0: 40 45 4a 4c 20 49 44 0d 0a 4d 46 47 3a 45 50 53 @ E J L I D M F G : E P S 16: 4f 4e 3b 43 4d 44 3a 45 53 43 50 4c 32 2c 42 44 O N ; C M D : E S C P L 2 , B D 32: 43 2c 44 34 2c 44 34 50 58 2c 45 53 43 50 52 32 C , D 4 , D 4 P X , E S C P R 2 48: 3b 4d 44 4c 3a 58 50 2d 37 30 30 20 53 65 72 69 ; M D L : X P - 7 0 0 S e r i 64: 65 73 3b 43 4c 53 3a 50 52 49 4e 54 45 52 3b 44 e s ; C L S : P R I N T E R ; D 80: 45 53 3a 45 50 53 4f 4e 20 58 50 2d 37 30 30 20 E S : E P S O N X P - 7 0 0
96: 53 65 72 69 65 73 3b 43 49 44 3a 45 70 73 6f 6e S e r i e s ; C I D : E p s o n 112: 52 47 42 3b 46 49 44 3a 46 58 4e 2c 44 50 41 2c R G B ; F I D : F X N , D P A , 128: 57 46 41 2c 45 54 41 2c 41 46 4e 2c 44 41 4e 3b W F A , E T A , A F N , D A N ; 144: 52 49 44 3a 34 30 3b R I D : 4 0 ; OK ^^^ printer_transact ^^^ === printer_transact === Requesting some IEEE 1284.4 credits on channel 2-2... --- CreditRequest --- Send: 0: 00 00 00 0d 01 00 04 02 02 00 80 ff ff SafeWrite: 0: 00 00 00 0d 01 00 04 02 02 00 80 ff ff length: 12 read: 0 12 total: 12 Recv: 0: 00 00 00 0c 01 00 84 00 02 02 00 01 OK, got 1 credits. Writing data to printer... --- Send Data --- SafeWrite: 0: 02 02 00 0b 00 00 73 74 01 00 01 OK Get the answer... --- Credit --- Send: 0: 00 00 00 0b 01 00 03 02 02 00 01 SafeWrite: 0: 00 00 00 0b 01 00 03 02 02 00 01 length: 10 read: 0 10 total: 10 Recv: 0: 00 00 00 0a 01 00 83 00 02 02 Recv: 0: 02 02 00 9d 00 01 toGet: 151 Recv: @BDC ST2

              *i**i**i**i**r*
                             *
                              N*
                                N*NN  NN****
                                                  *****unknown****

2012111942 1Tghj^Vggdd^{fdiiiiiidddddddddddddddddddddddd$7** 0: 40 42 44 43 20 53 54 32 0d 0a 8b 00 01 01 00 02 @ B D C S T 2
16: 01 05 06 02 01 01 0e 01 1f 0f 10 03 0b 00 69 03 i
32: 01 69 05 03 69 04 02 69 01 00 72 10 0c 04 0c 4e i i i r N 48: 06 0c 4e 08 4e 4e 09 4e 4e 13 01 01 19 0c 00 00 N N N N N
64: 00 00 00 75 6e 6b 6e 6f 77 6e 1b 01 00 1f 0a 32 u n k n o w n 2 80: 30 31 32 31 31 31 39 34 32 20 31 00 00 00 54 81 0 1 2 1 1 1 9 4 2 1 T
96: 67 68 6a 5e 56 80 67 67 64 64 5e 7b 66 64 69 69 g h j ^ V g g d d ^ { f d i i 112: 69 69 69 69 64 64 64 64 64 64 64 64 64 64 64 64 i i i i d d d d d d d d d d d d 128: 64 64 64 64 64 64 64 64 64 64 64 64 24 02 05 05 d d d d d d d d d d d d $
144: 37 05 02 00 00 00 00 7
OK ^^^ printer_transact ^^^ Searching printer secret model code with brute force. === read_eeprom_address === Reading eeprom address 0... === printer_transact === Requesting some IEEE 1284.4 credits on channel 2-2... --- CreditRequest --- Send: 0: 00 00 00 0d 01 00 04 02 02 00 80 ff ff SafeWrite: 0: 00 00 00 0d 01 00 04 02 02 00 80 ff ff length: 12 read: 0 12 total: 12 Recv: 0: 00 00 00 0c 01 00 84 00 02 02 00 01 OK, got 1 credits. Writing data to printer... --- Send Data --- SafeWrite: 0: 02 02 00 11 00 00 7c 7c 07 00 00 00 41 be a0 00 16: 00 OK Get the answer... --- Credit --- Send: 0: 00 00 00 0b 01 00 03 02 02 00 01 SafeWrite: 0: 00 00 00 0b 01 00 03 02 02 00 01 length: 10 read: 0 10 total: 10 Recv: 0: 00 00 00 0a 01 00 83 00 02 02 Recv: 0: 02 02 00 10 00 01 toGet: 10 Recv: ||:41:NA;

0: 7c 7c 3a 34 31 3a 4e 41 3b 0c | | : 4 1 : N A ;
OK ^^^ printer_transact ^^^ === get_tag === Searching for "EE:" substring... NOT FOUND. Can't get reply data.

dgerber commented 5 years ago

XP-830 here. Model code is 0x28 0x09.

The printer was blocked with "end of life" message a first time; then received a waste ink counter reset with "WIC reset utility" (and ink cartridges were taken off); finally got blocked with EOL message for second time (which Epson says requires a service by them). Below are EEPROM dumps of non-null bytes. Cols 3,5 marks which bytes changed in-between. Found no non-null bytes in 0x282-0xffff.

It seems at least bytes 0x08, 0x10-0x15, 0x34 are involved (and 0x1ed? -- higher bytes were not dumped between the two EOL states).

The second but not least issue is that writing to EEPROM fails. With current reink the response is "||:42:NA;". When mimicking traffic from @blenheimears's dumps above, the device does answer with "||:42:OK;", but subsequent reads still return the original value:

Sending...:
 >> 02 02 00 1A 01 00 7C 7C 10 00 28 09 42 BD 21 34 00 5E 42 6D 75 69 62 66 62 2F
 >>       °        °  |  |     °  (  Ť  B     !  4  °  ^  B  m  u  i  b  f  b  /
Received 16B:
<<  02 02 00 10 00 01 7C 7C 3A 34 32 3A 4F 4B 3B 0C
<<        °     °     |  |  :  4  2  :  O  K  ;
Sending...:
 >> 02 02 00 11 01 00 7C 7C 07 00 28 09 41 BE A0 34 00
 >>       °        °  |  |     °  (  Ť  A        4  °
Received 26B:
<<  02 02 00 1A 00 01 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 33 34 36 38 3B 0C
<<        °     °     @  B  D  C     P  S  Ř     E  E  :  0  0  3  4  6  8  ;

Maybe this would work as long as the printer is not in the (second/last) EOL state?

(It also fails when writing to "protection" byte 0x01ed. @sinopsysHK, have you had any success with PR11?)

EEPROM dumps:

addr,waste_dead1,wicreset,afterwic_wo_cartridges,use,waste_dead2
0000,,,,,
0001,,,,,
0002,02,,02,,02
0003,,,,,
0004,68,,68,,68
0005,08,,08,,08
0006,,,,,
0007,,,,,
0008,9D,X,D0,X,9D
0009,,,,,
000A,E4,,E4,X,3B
000B,6C,,6C,X,71
000C,14,,14,X,36
000D,69,,69,X,6D
000E,E6,X,E7,X,3F
000F,6C,,6C,X,71
0010,05,X,B5,X,13
0011,21,X,1D,X,21
0012,,X,D9,,D9
0013,,X,0B,,0B
0014,02,X,,X,5F
0015,25,X,,X,03
0016,58,,58,X,2C
0017,CC,,CC,X,12
0018,16,,16,X,C4
0019,06,,06,X,
001A,C0,,C0,X,E7
001B,9F,,9F,X,8C
001C,85,,85,X,5B
001D,04,,04,X,06
001E,70,,70,X,20
001F,23,,23,X,E1
0020,34,,34,X,FF
0021,02,,02,X,03
0022,AC,,AC,X,CC
0023,7A,,7A,X,F4
0024,06,,06,X,CB
0025,02,,02,X,03
0026,79,,79,X,58
0027,01,,01,X,5E
0028,21,,21,X,52
0029,02,,02,X,06
002A,,,,,
002B,,,,,
002C,,,,,
002D,,,,,
002E,A0,,A0,,A0
002F,73,,73,,73
0030,05,,05,X,03
0031,,,,,
0032,73,,73,X,5F
0033,17,,17,,17
0034,68,X,5E,X,68
0035,5E,,5E,,5E
0036,,X,01,X,
0037,,,,,
0038,,,,,
0039,,,,,
003A,,,,X,01
003B,,,,,
003C,,,,,
003D,,,,,
003E,,,,,
003F,,,,,
0040,36,,36,,36
0041,FF,,FF,,FF
0042,48,,48,X,2B
0043,F9,,F9,X,F1
0044,FF,,FF,,FF
0045,35,,35,X,BA
0046,F6,,F6,X,F8
0047,FF,,FF,,FF
0048,07,,07,X,7E
0049,F3,,F3,X,F5
004A,FF,,FF,,FF
004B,C8,,C8,X,36
004C,F2,,F2,X,F5
004D,FF,,FF,,FF
004E,4A,,4A,X,CB
004F,F2,,F2,X,F6
0050,FF,,FF,,FF
0051,FF,,FF,,FF
0052,FF,,FF,,FF
0053,,,,,
0054,F4,,F4,,F4
0055,02,,02,,02
0056,9C,X,B5,X,14
0057,67,,67,X,6D
0058,22,X,38,X,23
0059,0E,,0E,X,32
005A,3C,X,7E,X,97
005B,79,X,D0,X,5A
005C,DF,X,E0,X,2C
005D,07,,07,X,08
005E,,,,,
005F,,,,,
0060,36,,36,X,FC
0061,CD,,CD,X,D3
0062,,,,,
0063,,,,,
0064,,,,,
0065,,,,,
0066,FF,,FF,,FF
0067,FF,,FF,,FF
0068,,,,,
0069,,,,,
006A,40,,40,,40
006B,01,,01,,01
006C,0B,,0B,,0B
006D,,,,,
006E,05,,05,,05
006F,18,,18,X,19
0070,03,,03,,03
0071,30,,30,X,23
0072,54,,54,X,6A
0073,05,,05,X,06
0074,,,,,
0075,82,,82,X,85
0076,A8,X,A9,X,12
0077,0D,,0D,X,0E
0078,08,,08,,08
0079,1C,,1C,,1C
007A,1E,,1E,,1E
007B,08,,08,,08
007C,B3,,B3,,B3
007D,,,,,
007E,8E,,8E,,8E
007F,26,,26,,26
0080,FF,,FF,,FF
0081,D0,,D0,,D0
0082,01,,01,,01
0083,,,,,
0084,23,,23,,23
0085,05,,05,,05
0086,07,,07,,07
0087,FD,,FD,,FD
0088,04,,04,,04
0089,FD,,FD,,FD
008A,02,,02,,02
008B,FB,,FB,,FB
008C,FE,,FE,,FE
008D,FB,,FB,,FB
008E,09,,09,,09
008F,FB,,FB,,FB
0090,,,,,
0091,02,,02,,02
0092,05,,05,,05
0093,,,,,
0094,,,,,
0095,FD,,FD,,FD
0096,FA,,FA,,FA
0097,,,,,
0098,A8,X,A9,X,12
0099,0D,,0D,X,0E
009A,,,,,
009B,,,,,
009C,,,,,
009D,,,,,
009E,,,,,
009F,,,,,
00A0,82,,82,,82
00A1,01,,01,,01
00A2,D1,,D1,,D1
00A3,0B,,0B,,0B
00A4,A9,,A9,,A9
00A5,01,,01,,01
00A6,37,,37,,37
00A7,05,,05,,05
00A8,67,,67,X,96
00A9,26,,26,,26
00AA,,,,,
00AB,,,,,
00AC,,,,,
00AD,,,,,
00AE,,,,,
00AF,,,,,
00B0,,,,,
00B1,,,,,
00B2,,,,,
00B3,,,,,
00B4,01,,01,,01
00B5,,,,,
00B6,,,,,
00B7,,,,,
00B8,67,,67,,67
00B9,68,,68,,68
00BA,5D,,5D,,5D
00BB,64,,64,,64
00BC,61,,61,,61
00BD,6B,,6B,,6B
00BE,64,,64,,64
00BF,68,,68,,68
00C0,5C,,5C,,5C
00C1,65,,65,,65
00C2,64,,64,,64
00C3,64,,64,,64
00C4,65,,65,,65
00C5,66,,66,,66
00C6,62,,62,,62
00C7,63,,63,,63
00C8,01,,01,,01
00C9,68,,68,,68
00CA,55,,55,,55
00CB,4D,,4D,,4D
00CC,A3,,A3,,A3
00CD,72,,72,,72
00CE,14,,14,,14
00CF,68,,68,,68
00D0,,,,,
00D1,,,,,
00D2,4F,,4F,,4F
00D3,,,,,
00D4,01,,01,,01
00D5,,,,,
00D6,,,,,
00D7,,,,,
00D8,57,,57,,57
00D9,35,,35,,35
00DA,39,,39,,39
00DB,59,,59,,59
00DC,30,,30,,30
00DD,30,,30,,30
00DE,35,,35,,35
00DF,35,,35,,35
00E0,38,,38,,38
00E1,30,,30,,30
00E2,,,,,
00E3,,,,,
00E4,,,,,
00E5,,,,,
00E6,,,,,
00E7,,,,,
00E8,,,,,
00E9,,,,,
00EA,44,,44,,44
00EB,D2,,D2,,D2
00EC,44,,44,,44
00ED,58,,58,,58
00EE,14,,14,,14
00EF,DB,,DB,,DB
00F0,03,,03,,03
00F1,,,,,
00F2,,,,,
00F3,,,,,
00F4,41,,41,,41
00F5,03,,03,,03
00F6,4F,,4F,,4F
00F7,4F,,4F,,4F
00F8,3F,,3F,X,17
00F9,3F,,3F,,3F
00FA,26,,26,,26
00FB,3F,,3F,,3F
00FC,17,,17,,17
00FD,,,,,
00FE,,,,,
00FF,,,,,
0100,,,,,
0101,04,,,,04
0102,21,,,,21
0103,,,,,
0104,,,,,
0105,,,,,
0106,20,,,,20
0107,,,,,
0108,,,,,
0109,,,,,
010A,,,,,
010B,,,,,
010C,AE,,,,AE
010D,01,,,,01
010E,88,,,,88
010F,04,,,,04
0110,,,,,
0111,,,,,
0112,,,,,
0113,0A,,,,0A
0114,,,,,
0115,AE,,,,AE
0116,01,,,,01
0117,88,,,,88
0118,04,,,,04
0119,31,,,,31
011A,,,,,
011B,,,,,
011C,,,,,
011D,04,,,,04
011E,06,,,,06
011F,66,,,,66
0120,,,,,
0121,66,,,,66
0122,,,,,
0123,,,,,
0124,58,,,,58
0125,02,,,,02
0126,,,,,
0127,,,,,
0128,,,,,
0129,,,,,
012A,,,,,
012B,,,,,
012C,,,,,
012D,,,,,
012E,21,,,,21
012F,11,,,,11
0130,,,,,
0131,,,,,
0132,AB,,,,AB
0133,92,,,,92
0134,01,,,,01
0135,,,,,
0136,,,,,
0137,20,,,,20
0138,,,,,
0139,,,,,
013A,,,,,
013B,,,,,
013C,,,,,
013D,,,,,
013E,20,,,,20
013F,,,,,
0140,,,,,
0141,,,,,
0142,,,,,
0143,AE,,,,AE
0144,01,,,,01
0145,88,,,,88
0146,04,,,,04
0147,20,,,,20
0148,,,,,
0149,,,,,
014A,,,,,
014B,03,,,,03
014C,64,,,,64
014D,,,,,
014E,,,,,
014F,,,,,
0150,CC,,,,CC
0151,01,,,,01
0152,74,,,,74
0153,04,,,,04
0154,05,,,,05
0155,06,,,,06
0156,03,,,,03
0157,,,,,
0158,05,,,,05
0159,06,,,,06
015A,01,,,,01
015B,10,,,,10
015C,,,,,
015D,,,,,
015E,21,,,,21
015F,D0,,,,D0
0160,,,,,
0161,,,,,
0162,10,,,,10
0163,03,,,,03
0164,,,,,
0165,,,,,
0166,,,,,
0167,,,,,
0168,,,,,
0169,,,,,
016A,05,,,,05
016B,06,,,,06
016C,,,,,
016D,,,,,
016E,05,,,,05
016F,06,,,,06
0170,01,,,,01
0171,10,,,,10
0172,05,,,,05
0173,06,,,,06
0174,01,,,,01
0175,31,,,,31
0176,,,,,
0177,03,,,,03
0178,,,,,
0179,03,,,,03
017A,22,,,,22
017B,99,,,,99
017C,,,,,
017D,,,,,
017E,,,,,
017F,70,,,,70
0180,99,,,,99
0181,,,,,
0182,05,,,,05
0183,06,,,,06
0184,,,,,
0185,,,,,
0186,,,,,
0187,,,,,
0188,,,,,
0189,,,,,
018A,22,,,,22
018B,30,,,,30
018C,30,,,,30
018D,30,,,,30
018E,30,,,,30
018F,,,,,
0190,02,,,,02
0191,,,,,
0192,,,,,
0193,22,,,,22
0194,69,,,,69
0195,01,,,,01
0196,8D,,,,8D
0197,02,,,,02
0198,66,,,,66
0199,0E,,,,0E
019A,D3,,,,D3
019B,02,,,,02
019C,5B,,,,5B
019D,01,,,,01
019E,F1,,,,F1
019F,0C,,,,0C
01A0,55,,,,55
01A1,0E,,,,0E
01A2,F7,,,,F7
01A3,0C,,,,0C
01A4,,,,,
01A5,,,,,
01A6,,,,,
01A7,,,,,
01A8,,,,,
01A9,,,,,
01AA,,,,,
01AB,,,,,
01AC,01,,,,01
01AD,,,,,
01AE,,,,,
01AF,,,,,
01B0,,,,,
01B1,,,,,
01B2,64,,,,65
01B3,01,,,,01
01B4,AC,,,,AC
01B5,,,,,
01B6,7E,,,,7E
01B7,03,,,,03
01B8,91,,,,91
01B9,,,,,
01BA,B0,,,,B0
01BB,06,,,,06
01BC,56,,,,51
01BD,02,,,,02
01BE,CF,,,,D6
01BF,01,,,,01
01C0,CD,,,,D3
01C1,01,,,,01
01C2,71,,,,76
01C3,01,,,,01
01C4,,,,,
01C5,,,,,
01C6,80,,,,82
01C7,,,,,
01C8,,,,,
01C9,,,,,
01CA,1D,,,,1D
01CB,1C,,,,1C
01CC,,,,,
01CD,,,,,
01CE,,,,,
01CF,,,,,
01D0,,,,,
01D1,,,,,
01D2,,,,,
01D3,,,,,
01D4,,,,,
01D5,,,,,
01D6,,,,,
01D7,,,,,
01D8,,,,,
01D9,,,,,
01DA,,,,,
01DB,,,,,
01DC,,,,,
01DD,,,,,
01DE,,,,,
01DF,,,,,
01E0,,,,,
01E1,,,,,
01E2,,,,,
01E3,,,,,
01E4,,,,,
01E5,,,,,
01E6,,,,,
01E7,,,,,
01E8,,,,,
01E9,,,,,
01EA,,,,,
01EB,,,,,
01EC,02,,,,02
01ED,,,,,
01EE,,,,,
01EF,,,,,
01F0,,,,,
01F1,80,,,,80
01F2,,,,,
01F3,,,,,
01F4,,,,,
01F5,80,,,,80
01F6,02,,,,02
01F7,04,,,,04
01F8,,,,,
01F9,,,,,
01FA,,,,,
01FB,,,,,
01FC,,,,,
01FD,,,,,
01FE,,,,,
01FF,,,,,
0200,F8,,,,FA
0201,EB,,,,ED
0202,,,,,
0203,,,,,
0204,CC,,,,D0
0205,01,,,,01
0206,,,,,
0207,,,,,
0208,,,,,
0209,,,,,
020A,0F,,,,32
020B,,,,,
020C,,,,,
020D,,,,,
020E,,,,,
020F,,,,,
0210,,,,,
0211,,,,,
0212,0A,,,,0A
0213,0B,,,,0B
0214,,,,,
0215,34,,,,34
0216,08,,,,08
0217,,,,,
0218,,,,,
0219,9A,,,,9A
021A,0B,,,,0B
021B,,,,,
021C,,,,,
021D,01,,,,01
021E,,,,,
021F,,,,,
0220,,,,,
0221,,,,,
0222,,,,,
0223,,,,,
0224,,,,,
0225,,,,,
0226,,,,,
0227,,,,,
0228,,,,,
0229,,,,,
022A,,,,,
022B,,,,,
022C,,,,,
022D,,,,,
022E,,,,,
022F,,,,,
0230,,,,,
0231,,,,,
0232,,,,,
0233,,,,,
0234,,,,,
0235,,,,,
0236,,,,,
0237,,,,,
0238,,,,,
0239,,,,,
023A,,,,,
023B,,,,,
023C,,,,,
023D,,,,,
023E,,,,,
023F,01,,,,01
0240,,,,,
0241,,,,,
0242,,,,,
0243,,,,,
0244,,,,,
0245,,,,,
0246,,,,,
0247,0B,,,,0B
0248,,,,,
0249,0B,,,,0B
024A,0B,,,,0B
024B,,,,,
024C,,,,,
024D,25,,,,25
024E,25,,,,25
024F,25,,,,25
0250,25,,,,25
0251,25,,,,25
0252,0B,,,,0B
0253,25,,,,25
0254,25,,,,25
0255,25,,,,25
0256,0B,,,,0B
0257,,,,,
0258,,,,,
0259,0B,,,,0B
025A,0B,,,,0B
025B,,,,,
025C,0B,,,,0B
025D,0B,,,,0B
025E,,,,,
025F,,,,,
0260,,,,,
0261,,,,,
0262,,,,,
0263,,,,,
0264,,,,,
0265,,,,,
0266,,,,,
0267,,,,,
0268,,,,,
0269,,,,,
026A,,,,,
026B,,,,,
026C,,,,,
026D,,,,,
026E,,,,,
026F,,,,,
0270,,,,,
0271,,,,,
0272,,,,,
0273,,,,,
0274,,,,,
0275,,,,,
0276,,,,,
0277,,,,,
0278,,,,,
0279,,,,,
027A,,,,,
027B,,,,,
027C,,,,,
027D,,,,,
027E,,,,,
027F,,,,,
0280,3D,,,,3D
0281,0A,,,,0A
sinopsysHK commented 5 years ago

Hello,

Actually I couldn’t test it because I couldn’t figure out what bytes were to rest before finally using WICReset tool (paying for a key).

But then I could find where the counters are and recorded it here for next time.

On 7 May 2019, at 9:08 PM, Daniel Gerber notifications@github.com wrote:

XP-830 here. Model code is 0x28 0x09.

The printer was blocked with "end of life" message a first time; then received a waste ink counter reset with "WIC reset utility" (and ink cartridges were taken off); finally got blocked with EOL message for second time (which Epson says requires a service by them). Below are EEPROM dumps of non-null bytes. Cols 3,5 marks which bytes changed in-between. Found no non-null bytes in 0x282-0xffff.

It seems at least bytes 0x08, 0x10-0x15, 0x34 are involved (and 0x1ed? -- higher bytes were not dumped between the two EOL states).

The second but not least issue is that writing to EEPROM fails. With current reink the response is "||:42:NA;". When mimicking traffic from @blenheimears's dumps above, the device does answer with "||:42:OK;", but subsequent reads still return the original value:

Sending...:

02 02 00 1A 01 00 7C 7C 10 00 28 09 42 BD 21 34 00 5E 42 6D 75 69 62 66 62 2F ° ° | | ° ( Ť B ! 4 ° ^ B m u i b f b / Received 16B: << 02 02 00 10 00 01 7C 7C 3A 34 32 3A 4F 4B 3B 0C << ° ° | | : 4 2 : O K ; Sending...: 02 02 00 11 01 00 7C 7C 07 00 28 09 41 BE A0 34 00 ° ° | | ° ( Ť A 4 ° Received 26B: << 02 02 00 1A 00 01 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 33 34 36 38 3B 0C << ° ° @ B D C P S Ř E E : 0 0 3 4 6 8 ; Maybe this would work as long as the printer is not in the (second/last) EOL state?

(It also fails when writing to "protection" byte 0x01ed. @sinopsysHK, have you had any success with PR11?)

EEPROM dumps:

addr,waste_dead1,wicreset,afterwic_wo_cartridges,use,waste_dead2 0000,,,,, 0001,,,,, 0002,02,,02,,02 0003,,,,, 0004,68,,68,,68 0005,08,,08,,08 0006,,,,, 0007,,,,, 0008,9D,X,D0,X,9D 0009,,,,, 000A,E4,,E4,X,3B 000B,6C,,6C,X,71 000C,14,,14,X,36 000D,69,,69,X,6D 000E,E6,X,E7,X,3F 000F,6C,,6C,X,71 0010,05,X,B5,X,13 0011,21,X,1D,X,21 0012,,X,D9,,D9 0013,,X,0B,,0B 0014,02,X,,X,5F 0015,25,X,,X,03 0016,58,,58,X,2C 0017,CC,,CC,X,12 0018,16,,16,X,C4 0019,06,,06,X, 001A,C0,,C0,X,E7 001B,9F,,9F,X,8C 001C,85,,85,X,5B 001D,04,,04,X,06 001E,70,,70,X,20 001F,23,,23,X,E1 0020,34,,34,X,FF 0021,02,,02,X,03 0022,AC,,AC,X,CC 0023,7A,,7A,X,F4 0024,06,,06,X,CB 0025,02,,02,X,03 0026,79,,79,X,58 0027,01,,01,X,5E 0028,21,,21,X,52 0029,02,,02,X,06 002A,,,,, 002B,,,,, 002C,,,,, 002D,,,,, 002E,A0,,A0,,A0 002F,73,,73,,73 0030,05,,05,X,03 0031,,,,, 0032,73,,73,X,5F 0033,17,,17,,17 0034,68,X,5E,X,68 0035,5E,,5E,,5E 0036,,X,01,X, 0037,,,,, 0038,,,,, 0039,,,,, 003A,,,,X,01 003B,,,,, 003C,,,,, 003D,,,,, 003E,,,,, 003F,,,,, 0040,36,,36,,36 0041,FF,,FF,,FF 0042,48,,48,X,2B 0043,F9,,F9,X,F1 0044,FF,,FF,,FF 0045,35,,35,X,BA 0046,F6,,F6,X,F8 0047,FF,,FF,,FF 0048,07,,07,X,7E 0049,F3,,F3,X,F5 004A,FF,,FF,,FF 004B,C8,,C8,X,36 004C,F2,,F2,X,F5 004D,FF,,FF,,FF 004E,4A,,4A,X,CB 004F,F2,,F2,X,F6 0050,FF,,FF,,FF 0051,FF,,FF,,FF 0052,FF,,FF,,FF 0053,,,,, 0054,F4,,F4,,F4 0055,02,,02,,02 0056,9C,X,B5,X,14 0057,67,,67,X,6D 0058,22,X,38,X,23 0059,0E,,0E,X,32 005A,3C,X,7E,X,97 005B,79,X,D0,X,5A 005C,DF,X,E0,X,2C 005D,07,,07,X,08 005E,,,,, 005F,,,,, 0060,36,,36,X,FC 0061,CD,,CD,X,D3 0062,,,,, 0063,,,,, 0064,,,,, 0065,,,,, 0066,FF,,FF,,FF 0067,FF,,FF,,FF 0068,,,,, 0069,,,,, 006A,40,,40,,40 006B,01,,01,,01 006C,0B,,0B,,0B 006D,,,,, 006E,05,,05,,05 006F,18,,18,X,19 0070,03,,03,,03 0071,30,,30,X,23 0072,54,,54,X,6A 0073,05,,05,X,06 0074,,,,, 0075,82,,82,X,85 0076,A8,X,A9,X,12 0077,0D,,0D,X,0E 0078,08,,08,,08 0079,1C,,1C,,1C 007A,1E,,1E,,1E 007B,08,,08,,08 007C,B3,,B3,,B3 007D,,,,, 007E,8E,,8E,,8E 007F,26,,26,,26 0080,FF,,FF,,FF 0081,D0,,D0,,D0 0082,01,,01,,01 0083,,,,, 0084,23,,23,,23 0085,05,,05,,05 0086,07,,07,,07 0087,FD,,FD,,FD 0088,04,,04,,04 0089,FD,,FD,,FD 008A,02,,02,,02 008B,FB,,FB,,FB 008C,FE,,FE,,FE 008D,FB,,FB,,FB 008E,09,,09,,09 008F,FB,,FB,,FB 0090,,,,, 0091,02,,02,,02 0092,05,,05,,05 0093,,,,, 0094,,,,, 0095,FD,,FD,,FD 0096,FA,,FA,,FA 0097,,,,, 0098,A8,X,A9,X,12 0099,0D,,0D,X,0E 009A,,,,, 009B,,,,, 009C,,,,, 009D,,,,, 009E,,,,, 009F,,,,, 00A0,82,,82,,82 00A1,01,,01,,01 00A2,D1,,D1,,D1 00A3,0B,,0B,,0B 00A4,A9,,A9,,A9 00A5,01,,01,,01 00A6,37,,37,,37 00A7,05,,05,,05 00A8,67,,67,X,96 00A9,26,,26,,26 00AA,,,,, 00AB,,,,, 00AC,,,,, 00AD,,,,, 00AE,,,,, 00AF,,,,, 00B0,,,,, 00B1,,,,, 00B2,,,,, 00B3,,,,, 00B4,01,,01,,01 00B5,,,,, 00B6,,,,, 00B7,,,,, 00B8,67,,67,,67 00B9,68,,68,,68 00BA,5D,,5D,,5D 00BB,64,,64,,64 00BC,61,,61,,61 00BD,6B,,6B,,6B 00BE,64,,64,,64 00BF,68,,68,,68 00C0,5C,,5C,,5C 00C1,65,,65,,65 00C2,64,,64,,64 00C3,64,,64,,64 00C4,65,,65,,65 00C5,66,,66,,66 00C6,62,,62,,62 00C7,63,,63,,63 00C8,01,,01,,01 00C9,68,,68,,68 00CA,55,,55,,55 00CB,4D,,4D,,4D 00CC,A3,,A3,,A3 00CD,72,,72,,72 00CE,14,,14,,14 00CF,68,,68,,68 00D0,,,,, 00D1,,,,, 00D2,4F,,4F,,4F 00D3,,,,, 00D4,01,,01,,01 00D5,,,,, 00D6,,,,, 00D7,,,,, 00D8,57,,57,,57 00D9,35,,35,,35 00DA,39,,39,,39 00DB,59,,59,,59 00DC,30,,30,,30 00DD,30,,30,,30 00DE,35,,35,,35 00DF,35,,35,,35 00E0,38,,38,,38 00E1,30,,30,,30 00E2,,,,, 00E3,,,,, 00E4,,,,, 00E5,,,,, 00E6,,,,, 00E7,,,,, 00E8,,,,, 00E9,,,,, 00EA,44,,44,,44 00EB,D2,,D2,,D2 00EC,44,,44,,44 00ED,58,,58,,58 00EE,14,,14,,14 00EF,DB,,DB,,DB 00F0,03,,03,,03 00F1,,,,, 00F2,,,,, 00F3,,,,, 00F4,41,,41,,41 00F5,03,,03,,03 00F6,4F,,4F,,4F 00F7,4F,,4F,,4F 00F8,3F,,3F,X,17 00F9,3F,,3F,,3F 00FA,26,,26,,26 00FB,3F,,3F,,3F 00FC,17,,17,,17 00FD,,,,, 00FE,,,,, 00FF,,,,, 0100,,,,, 0101,04,,,,04 0102,21,,,,21 0103,,,,, 0104,,,,, 0105,,,,, 0106,20,,,,20 0107,,,,, 0108,,,,, 0109,,,,, 010A,,,,, 010B,,,,, 010C,AE,,,,AE 010D,01,,,,01 010E,88,,,,88 010F,04,,,,04 0110,,,,, 0111,,,,, 0112,,,,, 0113,0A,,,,0A 0114,,,,, 0115,AE,,,,AE 0116,01,,,,01 0117,88,,,,88 0118,04,,,,04 0119,31,,,,31 011A,,,,, 011B,,,,, 011C,,,,, 011D,04,,,,04 011E,06,,,,06 011F,66,,,,66 0120,,,,, 0121,66,,,,66 0122,,,,, 0123,,,,, 0124,58,,,,58 0125,02,,,,02 0126,,,,, 0127,,,,, 0128,,,,, 0129,,,,, 012A,,,,, 012B,,,,, 012C,,,,, 012D,,,,, 012E,21,,,,21 012F,11,,,,11 0130,,,,, 0131,,,,, 0132,AB,,,,AB 0133,92,,,,92 0134,01,,,,01 0135,,,,, 0136,,,,, 0137,20,,,,20 0138,,,,, 0139,,,,, 013A,,,,, 013B,,,,, 013C,,,,, 013D,,,,, 013E,20,,,,20 013F,,,,, 0140,,,,, 0141,,,,, 0142,,,,, 0143,AE,,,,AE 0144,01,,,,01 0145,88,,,,88 0146,04,,,,04 0147,20,,,,20 0148,,,,, 0149,,,,, 014A,,,,, 014B,03,,,,03 014C,64,,,,64 014D,,,,, 014E,,,,, 014F,,,,, 0150,CC,,,,CC 0151,01,,,,01 0152,74,,,,74 0153,04,,,,04 0154,05,,,,05 0155,06,,,,06 0156,03,,,,03 0157,,,,, 0158,05,,,,05 0159,06,,,,06 015A,01,,,,01 015B,10,,,,10 015C,,,,, 015D,,,,, 015E,21,,,,21 015F,D0,,,,D0 0160,,,,, 0161,,,,, 0162,10,,,,10 0163,03,,,,03 0164,,,,, 0165,,,,, 0166,,,,, 0167,,,,, 0168,,,,, 0169,,,,, 016A,05,,,,05 016B,06,,,,06 016C,,,,, 016D,,,,, 016E,05,,,,05 016F,06,,,,06 0170,01,,,,01 0171,10,,,,10 0172,05,,,,05 0173,06,,,,06 0174,01,,,,01 0175,31,,,,31 0176,,,,, 0177,03,,,,03 0178,,,,, 0179,03,,,,03 017A,22,,,,22 017B,99,,,,99 017C,,,,, 017D,,,,, 017E,,,,, 017F,70,,,,70 0180,99,,,,99 0181,,,,, 0182,05,,,,05 0183,06,,,,06 0184,,,,, 0185,,,,, 0186,,,,, 0187,,,,, 0188,,,,, 0189,,,,, 018A,22,,,,22 018B,30,,,,30 018C,30,,,,30 018D,30,,,,30 018E,30,,,,30 018F,,,,, 0190,02,,,,02 0191,,,,, 0192,,,,, 0193,22,,,,22 0194,69,,,,69 0195,01,,,,01 0196,8D,,,,8D 0197,02,,,,02 0198,66,,,,66 0199,0E,,,,0E 019A,D3,,,,D3 019B,02,,,,02 019C,5B,,,,5B 019D,01,,,,01 019E,F1,,,,F1 019F,0C,,,,0C 01A0,55,,,,55 01A1,0E,,,,0E 01A2,F7,,,,F7 01A3,0C,,,,0C 01A4,,,,, 01A5,,,,, 01A6,,,,, 01A7,,,,, 01A8,,,,, 01A9,,,,, 01AA,,,,, 01AB,,,,, 01AC,01,,,,01 01AD,,,,, 01AE,,,,, 01AF,,,,, 01B0,,,,, 01B1,,,,, 01B2,64,,,,65 01B3,01,,,,01 01B4,AC,,,,AC 01B5,,,,, 01B6,7E,,,,7E 01B7,03,,,,03 01B8,91,,,,91 01B9,,,,, 01BA,B0,,,,B0 01BB,06,,,,06 01BC,56,,,,51 01BD,02,,,,02 01BE,CF,,,,D6 01BF,01,,,,01 01C0,CD,,,,D3 01C1,01,,,,01 01C2,71,,,,76 01C3,01,,,,01 01C4,,,,, 01C5,,,,, 01C6,80,,,,82 01C7,,,,, 01C8,,,,, 01C9,,,,, 01CA,1D,,,,1D 01CB,1C,,,,1C 01CC,,,,, 01CD,,,,, 01CE,,,,, 01CF,,,,, 01D0,,,,, 01D1,,,,, 01D2,,,,, 01D3,,,,, 01D4,,,,, 01D5,,,,, 01D6,,,,, 01D7,,,,, 01D8,,,,, 01D9,,,,, 01DA,,,,, 01DB,,,,, 01DC,,,,, 01DD,,,,, 01DE,,,,, 01DF,,,,, 01E0,,,,, 01E1,,,,, 01E2,,,,, 01E3,,,,, 01E4,,,,, 01E5,,,,, 01E6,,,,, 01E7,,,,, 01E8,,,,, 01E9,,,,, 01EA,,,,, 01EB,,,,, 01EC,02,,,,02 01ED,,,,, 01EE,,,,, 01EF,,,,, 01F0,,,,, 01F1,80,,,,80 01F2,,,,, 01F3,,,,, 01F4,,,,, 01F5,80,,,,80 01F6,02,,,,02 01F7,04,,,,04 01F8,,,,, 01F9,,,,, 01FA,,,,, 01FB,,,,, 01FC,,,,, 01FD,,,,, 01FE,,,,, 01FF,,,,, 0200,F8,,,,FA 0201,EB,,,,ED 0202,,,,, 0203,,,,, 0204,CC,,,,D0 0205,01,,,,01 0206,,,,, 0207,,,,, 0208,,,,, 0209,,,,, 020A,0F,,,,32 020B,,,,, 020C,,,,, 020D,,,,, 020E,,,,, 020F,,,,, 0210,,,,, 0211,,,,, 0212,0A,,,,0A 0213,0B,,,,0B 0214,,,,, 0215,34,,,,34 0216,08,,,,08 0217,,,,, 0218,,,,, 0219,9A,,,,9A 021A,0B,,,,0B 021B,,,,, 021C,,,,, 021D,01,,,,01 021E,,,,, 021F,,,,, 0220,,,,, 0221,,,,, 0222,,,,, 0223,,,,, 0224,,,,, 0225,,,,, 0226,,,,, 0227,,,,, 0228,,,,, 0229,,,,, 022A,,,,, 022B,,,,, 022C,,,,, 022D,,,,, 022E,,,,, 022F,,,,, 0230,,,,, 0231,,,,, 0232,,,,, 0233,,,,, 0234,,,,, 0235,,,,, 0236,,,,, 0237,,,,, 0238,,,,, 0239,,,,, 023A,,,,, 023B,,,,, 023C,,,,, 023D,,,,, 023E,,,,, 023F,01,,,,01 0240,,,,, 0241,,,,, 0242,,,,, 0243,,,,, 0244,,,,, 0245,,,,, 0246,,,,, 0247,0B,,,,0B 0248,,,,, 0249,0B,,,,0B 024A,0B,,,,0B 024B,,,,, 024C,,,,, 024D,25,,,,25 024E,25,,,,25 024F,25,,,,25 0250,25,,,,25 0251,25,,,,25 0252,0B,,,,0B 0253,25,,,,25 0254,25,,,,25 0255,25,,,,25 0256,0B,,,,0B 0257,,,,, 0258,,,,, 0259,0B,,,,0B 025A,0B,,,,0B 025B,,,,, 025C,0B,,,,0B 025D,0B,,,,0B 025E,,,,, 025F,,,,, 0260,,,,, 0261,,,,, 0262,,,,, 0263,,,,, 0264,,,,, 0265,,,,, 0266,,,,, 0267,,,,, 0268,,,,, 0269,,,,, 026A,,,,, 026B,,,,, 026C,,,,, 026D,,,,, 026E,,,,, 026F,,,,, 0270,,,,, 0271,,,,, 0272,,,,, 0273,,,,, 0274,,,,, 0275,,,,, 0276,,,,, 0277,,,,, 0278,,,,, 0279,,,,, 027A,,,,, 027B,,,,, 027C,,,,, 027D,,,,, 027E,,,,, 027F,,,,, 0280,3D,,,,3D 0281,0A,,,,0A — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

dgerber commented 5 years ago

So, the suffix in write commands seems to be a (model specific?) opaque key... In what looks like the manufacturer's "adjustment program" for the XP-830, XP-530, XP-630 and XP-635, it's hardcoded as "4A 73 6A 74 68 62 73 6E" (ASCII: "Jsjthbsn", in place of "Bmuibf b/" in the above wireshark logs), and it does work on an XP-830.

sinopsysHK commented 5 years ago

So it means reink in current version do not enable the reset as this command suffix isn't supported hence the failure on XP-620 I guess.

Obviously my proposed PR will not work neither for XP-821 neither as I didn't add this suffix (I thought it could have been par of the USB protocol)

But reviewing the code and the trace it is clear that this 8 bytes suffix is fully part of the command but I have no clue it it is dynamically computed (kind of checksum) or if it is static kind of internal key. I couldn't find any reference on that matter :(

deinhofer commented 4 years ago

Hi, Here is the report for my XP-510. Are you still trying to support the XP-models?? epson-xp-510-1strun.txt

thank you!!

Typhon0 commented 3 years ago

Hi, by searching how to reset the waste ink counter on my XP-510 I found a blog using an snmpget command to reset the waste ink counter.

snmpget.exe -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.121.4.66.189.33.17.0.0.72.112.116.116.122.113.106.118

It's actually working, but I don't know if the snmp packets are useful to support this model in reink.

gravasio commented 2 years ago

Hi, just to add a hint I found the OID for the XP-540: snmpget.exe -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.20.4.66.189.33.17.0.0.71.106.115.110.106.98.111.98

sinopsysHK commented 2 years ago

So, the suffix in write commands seems to be a (model specific?) opaque key... In what looks like the manufacturer's "adjustment program" for the XP-830, XP-530, XP-630 and XP-635, it's hardcoded as "4A 73 6A 74 68 62 73 6E" (ASCII: "Jsjthbsn", in place of "Bmuibf b/" in the above wireshark logs), and it does work on an XP-830.

Thank you very much for your eagle eyes !!! I did make the change as per your comments for my device model AND IT WORKS !!!!

I was just facing this F%&@#!!! Waste INK Full message again.

sinopsysHK commented 2 years ago

Hi Giuseppe,

Do you know from where this hint is coming? It would be convenient to get the same for other models!

On 9 Nov 2021, at 4:14 AM, Giuseppe Ravasio @.***> wrote:

 Hi, just to add a hint I found the OID for the XP-540: snmpget.exe -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.20.4.66.189.33.17.0.0.71.106.115.110.106.98.111.98

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

Earnestly commented 2 years ago

@sinopsysHK

I've worked out a bit of the OID and managed to dump EEPROM via SNMP from my XP-625. I used a bit of brute force enumeration to find the model number.

Based on @gravasio's example, I found the following meaning:

Read

SNMPv2-SMI::enterprises EPSON oidPrvCtrl ? \ \ (0x7C 0x7C) read Model Not sure Addr2 Addr1
1.3.6.1.4.1 .1248 .1.2.2.44.1.1.2 .1 .124.124 .7.0 .20.4 .65.190.160 .17 .0

Write

SNMPv2-SMI::enterprises EPSON oidPrvCtrl ? \ \ (0x7C 0x7C) write Model Not sure Addr2 Addr1 Value Write key
1.3.6.1.4.1 .1248 .1.2.2.44.1.1.2 .1 .124.124 .16.0 .20.4 .66.189.33 .17 .0 .0 .71.106.115.110.106.98.111.98

The rest of the OID is essentially the same bytes seen in the dump but decimal encoded. Hopefully of some help.

PS. Potential model numbers and keys

Model No. Hex Write key ASCII Caesar shift seems interesting (flower names?)
XP-315 .129.8 0x81 0x08 .88.98.108.98.117.112.99.106 Xblbupcj Wakatobi
XP-422 .85.5 0x55 0x05 .78.118.116.100.98.115.106.47 Nvtdbsj/ Muscari.
XP-435 .133.5 0x85 0x05 .81.112.109.122.121.102.111.98 Qpmzyfob Polyxena
XP-510 .121.4 0x79 0x04 .72.112.116.116.122.113.106.118 Hpttzqjv Gossypiu
XP-530 .40.9 0x28 0x09 .74.115.106.116.104.98.115.110 Jsjthbsn Irisgarm
XP-540 .20.4 0x14 0x04 .71.106.115.110.106.98.111.98 Gjsnjbob Firmiana
XP-610 .121.4 0x79 0x04 .72.112.116.116.122.113.106.118 Hpttzqjv Gossypiu
XP-620 .87.5 0x57 0x05 .66.109.117.105.98.102.98.47 Bmuibfb/ Althaea.
XP-625 .87.5 0x57 0x05 .66.109.117.105.98.102.98.47 Bmuibfb/ Althaea.
XP-630 .40.9 0x28 0x09 .74.115.106.116.104.98.115.110 Jsjthbsn Irisgarm
XP-700 .40.0 0x28 0x00 ? ? ?
XP-830 .40.9 (?) 0x28 0x09 .74.115.106.116.104.98.115.110 Jsjthbsn Irisgarm
XP-850 .40.0 0x28 0x00 .73.106.99.106.116.100.118.116 Ijcjtdvt Hibiscus
XP-7100 .40.5 0x28 0x05 .77.102.118.100.112.107.118.110 Mfvdpkvn Leucojum
L4160 .73.8 0x49 0x08 .66.115.98.111.117.106.103.112 Bsboujgp Arantifo

PPS. Why Addr2 then Addr1? After a bit of decoding I get the following pattern:

.0.2        02 00 F8
.1.2        02 01 EC
.2.1        01 02 21
... and so on

Read/Write EEPROM on XP-625

The XP-620 write key appears to work with the XP-625. Below is a demonstration of writing an 0x01 byte to 0x0000 (.0.0). (I've cleaned up snmpwalk output a bit)

Read from address 0x0000

% snmpwalk -OQ -Ov -OT -v1 -c public "$ipaddr" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.87.5.65.190.160.0.0
"00 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 30 30 30 30 3B 0C [.@BDC PS\r\nEE:000000;\f]"

Write 0x01 to address 0x0000

% snmpwalk -OQ -Ov -OT -v1 -c public "$ipaddr" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.87.5.66.189.33.0.0.1.66.109.117.105.98.102.98.47
"00 7C 7C 3A 34 32 3A 4F 4B 3B 0C   [.||:42:OK;\f]"

Read from address 0x0000

% snmpwalk -OQ -Ov -OT -v1 -c public "$ipaddr" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.87.5.65.190.160.0.0
"00 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 30 30 30 31 3B 0C [.@BDC PS\r\nEE:000001;\f]"

Some addresses don't appear to work such as 0x001C (.28.0) in that they always return the initial value. Perhaps some bytes use different keys; if I use the incorrect key for the locations which do work, they will then fail. This means the write key is correct and necessary. Another explanation is needed for the "readonly" addresses.

GNUtoo commented 2 years ago

Hi,

I've managed to get more info on the XP-700, before I didn't have the time to look in the code so I thought it was stuck, but instead it was doing some kind of bruteforce trying to read various addresses.

I've not yet managed to find the addresses in the eeprom though:

    [PM_XP700] = {
        .name = "Epson Expression Premium XP-700",
        .model_name = "XP-700 Series",
        .model_code = {0x28, 0x00},
        .twobyte_addresses = 1,
        .inkmap = {
            .mask =         INK_BLACK | INK_CYAN | INK_YELLOW | INK_MAGENTA | INK_PHOTOBLACK,
            .black =        {0x00, 0x00, 0x00, 0x00},
            .cyan =         {0x00, 0x00, 0x00, 0x00},
            .magenta =      {0x00, 0x00, 0x00, 0x00},
            .yellow =       {0x00, 0x00, 0x00, 0x00},
            .photoblack =       {0x00, 0x00, 0x00, 0x00},
        },
        .wastemap = {
            .len =          0,
            .addr =         {0x00, 0x00, 0x00, 0x00},
        },
    },

The issue is that the printer is now stuck on a message like that "A printer's ink pad is at the end of its service life. Please contact Epson support", so I cannot do multiple eeprom dump and try to compare them to try to find the ink counters.

Though there are still some data being changed between power on/off and even with that message on I can still dump the eeprom.

Are the ink pad counters still modified with that message?

Here's the report logs:

report1.log report2.log

Chris6077 commented 1 year ago

Hey there! Is there anything I can do to help? My XP-540 WIC is almost full.

Earnestly commented 1 year ago

@Chris6077 Check if the write key works via snmp, as demonstrated in https://github.com/lion-simba/reink/issues/1#issuecomment-1229037410

To then find the WIC address, I can't help much with, but verifying the key is a good first step.

@GNUtoo You will have to find out what the write key is for that model. How this has been accomplished by others is using one of those dodgy services, buying a token, and then monitoring the usb transaction to recover the key. Those which are known, that I have found, are listed in a table above.

I'm not aware of how the key was found initially. As they appear to be flower names (the genus, mostly) - truncated to 8 characters (or padded with 0's) and then caesar shifted by one (based on ascii, so 0 is shifted to /) - it might be possible to bruteforce it.

r1m commented 1 year ago

I successfully reset my XP-540 counters using this. Use at your own risk...

snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.20.4.66.189.33.16.0.0.71.106.115.110.106.98.111.98
snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.20.4.66.189.33.17.0.0.71.106.115.110.106.98.111.98
snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.20.4.66.189.33.18.0.0.71.106.115.110.106.98.111.98
snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.20.4.66.189.33.19.0.0.71.106.115.110.106.98.111.98

# May be optionnal ¯\_(ツ)_/¯
snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.20.4.66.189.33.20.0.0.71.106.115.110.106.98.111.98
snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.20.4.66.189.33.21.0.0.71.106.115.110.106.98.111.98
                                                                                                    ^^      
                                                                                                     | adresses 16.0 to 21.0 changed to 0

I figured the OIDs using WICReset logs that could be found in %APPDATA%\wicreset\application.log. Using network mode, it shows all oids read during read counters. In USB it shows DD4 frames.

If you use the TRIAL key to reset them to 80%, you will also see OIDs used to write them. Adresses and write keys can be guessed from the decoding scheme described in Earnestly's comment.

I don't know why WICReset also changes values of adresses 237.1(ED 01), 52.0(35 00) and 53.0(34 00) 😕. Maybe to remove the overflow error or a way to flag a printer already reset using trial...

Below the full log in DD4 mode to set counters to 80% in trial. (I discovered the logs after reseting it in USB) Hex values matches decimal OIDs 

RemoteControl::RESET_GUID RESET GUID: XP-540 Series 1004 KEY
Core::EpsonRemoteResetData Reset waste counters for the XP-540 Series
Core::EpsonRemoteResetData Code TRIAL will be used for waste reset.
IEEEManager::commandDD4Enter IEEE ENTER
IEEEManager::commandDD4Init IEEE INIT
IEEEManager::commandDD4CHID IEEE CHID: 2 EPSON-CTRL
IEEEManager::commandDD4Open IEEE OPEN: 2 2 512 33792
IEEEManager::sendMessageDD4 IEEE [SEND]: 76 69 01 00 00
IEEEManager::readMessageDD4 IEEE [READ]: 76 69 3A 30 30 3A 4E 4C 31 31 4A 31 3B 0C
PrinterEpsonDD4::getLegend LEGEND: NL11J1 11/01/2019
IEEEManager::sendMessageDD4 IEEE [SEND]: 73 74 01 00 01
IEEEManager::readMessageDD4 IEEE [READ]: 40 42 44 43 20 53 54 32 0D 0A 89 00 01 01 00 02 01 10 06 02 01 01 0F 10 03 0B 00 69 03 01 69 05 03 69 04 02 69 01 00 69 13 01 01 19 0C 00 00 00 00 00 75 6E 6B 6E 6F 77 6E 1B 01 00 20 31 00 64 64 63 71 6C 65 64 64 65 71 67 67 64 64 64 75 66 64 6A 6A 6A 6A 6A 6A 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 24 02 00 00 37 05 02 02 00 00 00 39 01 00 3F 0A 01 01 01 00 00 00 00 00 00 00 40 0A 58 32 45 41 30 36 34 37 37 37
PrinterEpsonDD4::getStatus STATUS: Error Waste ink pad counter overflow error
Core::EpsonRemoteResetData Reset started. Do not turn off the printer.
RemoteControl::RESET_GUID RESET GUID: XP-540 Series 1004 KEY
RemoteControl::RESET_DATA RESET DATA: 0 - 7C 7C 10 00 14 04 42 BD 21 10 00 04 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 10 00 04 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 1 - 7C 7C 10 00 14 04 42 BD 21 11 00 0F 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 11 00 0F 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 2 - 7C 7C 10 00 14 04 42 BD 21 06 00 00 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 06 00 00 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 3 - 7C 7C 10 00 14 04 42 BD 21 34 00 5E 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 34 00 5E 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 4 - 7C 7C 10 00 14 04 42 BD 21 14 00 00 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 14 00 00 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 5 - 7C 7C 10 00 14 04 42 BD 21 15 00 00 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 15 00 00 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 6 - 7C 7C 10 00 14 04 42 BD 21 12 00 81 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 12 00 81 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 7 - 7C 7C 10 00 14 04 42 BD 21 13 00 06 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 13 00 06 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 8 - 7C 7C 10 00 14 04 42 BD 21 06 00 00 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 06 00 00 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 9 - 7C 7C 10 00 14 04 42 BD 21 35 00 5E 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 35 00 5E 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 10 - 7C 7C 10 00 14 04 42 BD 21 ED 01 00 47 6A 73 6E 6A 62 6F 62 REAL
IEEEManager::sendMessageDD4 IEEE [SEND]: 7C 7C 10 00 14 04 42 BD 21 ED 01 00 47 6A 73 6E 6A 62 6F 62
IEEEManager::readMessageDD4 IEEE [READ]: 7C 7C 3A 34 32 3A 4F 4B 3B 0C
RemoteControl::RESET_DATA RESET DATA: 11 - FF REAL
Core::EpsonRemoteResetData Reset completed. Please restart the printer immediately.

Logs after my snmp calls in network mode

EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.20.4.65.190.160.16.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 30 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 10 00
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.20.4.65.190.160.17.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 31 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 11 00
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.20.4.65.190.160.6.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 30 36 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 06 00
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.20.4.65.190.160.18.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 32 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 12 00
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.20.4.65.190.160.19.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 33 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 13 00
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.20.4.65.190.160.6.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 30 36 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 06 00
PrinterEpsonDD4::inkWasteQuery Counter 0.00% This counter is ok.
PrinterEpsonDD4::inkWasteQuery Counter 0.00% This counter is ok.
isi-ttter commented 1 year ago

Hey everyone,

I helped someone out who had the waste ink error on the XP-530 and used the wicreset tool (with a proper key) while dumping the USB Traffic with Wireshark. I found this repo afterward and thought some of you might be interested in it. Seems to have done more or less the same as it did in r1ms logs. The write key for that Model is 4a 73 6a 74 68 62 73 6e aka Jsjthbsn and the model number seems to be 0x28 0x09 or 40.9 (like the XP-830?). The printer was reset using the trial key just before, so at that time there was no overflow message anymore, also have a dump of that if someone is interested.

xp-530_reset_dump.pcapng.zip

Earnestly commented 1 year ago

The XP-530 write sequence appears to be almost identical to the example I have found for the XP-620:

Earnestly commented 1 year ago

Finally the time came for the ink pad maintainence error for my XP-625. I can confirm that the XP-620 sequence used in https://github.com/lion-simba/reink/issues/1#issuecomment-1329225501 via snmpget worked to reset the counter. The 0x0034 address was already 0x5e in my case.

russdan commented 1 year ago

Guys, wanted to say a massive thank you for this thread! Successfully reset my XP-422 today using the info above, specifically the info from @r1m and @Earnestly. I grabbed the application.log from when resetting to 80% using the trial key, which looked like this:

1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.85.5.66.189.33.24.0.120.78.118.116.100.98.115.106.47
1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.85.5.66.189.33.25.0.12.78.118.116.100.98.115.106.47
1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.85.5.66.189.33.26.0.44.78.118.116.100.98.115.106.47
1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.85.5.66.189.33.27.0.10.78.118.116.100.98.115.106.47
1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.85.5.66.189.33.28.0.0.78.118.116.100.98.115.106.47
1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.85.5.66.189.33.29.0.0.78.118.116.100.98.115.106.47
1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.85.5.66.189.33.30.0.0.78.118.116.100.98.115.106.47

I then changed the 120, 12, 44 and 10 values on the first 4 lines to 0 and snmpgetd them, all went through with STRING: ".||:42:OK; responses and rechecking the counters they're back to 0%, awesome!

Hopefully this helps fill in a few more of the blanks for others......

axel-1267 commented 1 year ago

Hi guys, amazing work here. Finally bringing down this WIC-reset-key racket which has been proliferating for years. I will study and try to reset my old XP-325, giving back to the community. In the past used the trial reset key, sadly didn't keep logs.

RealBC commented 1 year ago

I could not say better than axel-1667 "bringing down this WIC-reset-key and" ...i just add => Epson

Epson xp-435 was down msg french "Erreur tampon encreur en fin de vie blablabla"

using nmap to find printer ip

sudo apt install snmp

snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.133.5.66.189.33.16.0.0.81.112.109.122.121.102.111.98 snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.133.5.66.189.33.17.0.0.81.112.109.122.121.102.111.98 snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.133.5.66.189.33.18.0.0.81.112.109.122.121.102.111.98 snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.133.5.66.189.33.19.0.0.81.112.109.122.121.102.111.98 snmpget -Oa -v1 -c public $printer_ip 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.133.5.66.189.33.20.0.0.81.112.109.122.121.102.111.98

switch off / on printer ....bingo! it's chrismas :)

Dj33as commented 1 year ago

I used a WIC reset key to reset my XP-315 to zero, i have the logs here and i dont know how to use Reink to reset my printer again , is there any titorial explaining the procedure steps for noob like me ? application.log

Earnestly commented 1 year ago

Thanks @Dj33as, I've updated the table above with the information.

The write sequence from your logs appears to be:

0x0018 0x00
0x0019 0x00
0x001E 0x00
0x001C 0x00
0x001D 0x00
0x002E 0x5E
0x001A 0x00
0x001B 0x00
0x0022 0x00
0x002F 0x5E
0x0031 0x00

And the write key is Xblbupcj (or .88.98.108.98.117.112.99.106).

You wrote that you have already reset your printer, reink currently doesn't reset XP (expression) printers, hence this issue. But why do you need to reset the printer if you've already done so? Has it come time to do it again?

If you're on linux then using snmpget is possible to do this. I used gawk to extract the writes from your log and converted it to decimal using:

gawk '$3 == "[SEND]:" && $6$7 == "1000" {for(i=4; i<=NF; ++i) printf ".%d", strtonum("0x" $i); printf "\n"}' application.log

With that, combine them with the 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1 OID and arrange it for snmpget:

$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.24.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.25.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.30.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.28.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.29.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.46.0.94.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.26.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.27.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.34.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.47.0.94.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.49.0.0.88.98.108.98.117.112.99.106

See https://github.com/lion-simba/reink/issues/1#issuecomment-1229037410 for my attempt to explain what these OIDs mean. It goes without saying to use at your own risk; please validate this to the best of your own satisfaction before using it.

3BIUM commented 1 year ago

Hi all,

thanks to this thread I was able to finally reset my Epson XP-850 that was sitting getting dust for four years. I gathered all the information using that dodgy WIC reset utility (using the "trial" key) and reading the logs (as per @r1m post). For my model, it behaved exactly the same as it did for @r1m. The only different thing I did, was set back to the previous values addresses 52.0, 53.0, 237.1, but it always failed to modify 273.1 and I left it as is. I'm not that knowledgeable to understand why, but the utility managed to do so with the same write key.

It should be obvious, but: if you want to replicate it, do it at your own risk.

Just one note in case you only use the WIC utility with the "trial" key: be aware that if your printer has two WICs, it will reset both to 80% and, in my case, only the first one was above 100%, the second was at 12%.

@Earnestly if you want, you can update the table: Epson XP-850 Model Number: .40.0 Key: .73.106.99.106.116.100.118.116 - Ijcjtdvt (Hibiscus)

axel-1267 commented 1 year ago 
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.24.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.25.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.30.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.28.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.29.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.46.0.94.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.26.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.27.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.34.0.0.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.47.0.94.88.98.108.98.117.112.99.106
$ snmpget -Ov -OQ -v1 -c public "$network_address_of_printer" 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.16.0.129.8.66.189.33.49.0.0.88.98.108.98.117.112.99.106

Hello, i've tried this on my XP-325 (identical to XP-315) but it does not work. snmpget report always this when i send commands: "00 7C 7C 3A 34 32 3A 4E 41 3B 0C " Don't tell me the write key is different also for this clone model... image Screenshot from 2023-01-02 13-16-53

Earnestly commented 1 year ago

Thanks @3BIUM, updated.

@axel-1267 Those bytes, 7C 7C 3A 34 32 3A 4E 41 3B 0C represent ||:42:NA; which indicates failure, likely because the write key isn't accepted but there may be other reasons I'm not familiar with.

I'm not sure how accurate the wicreset tools are (it seems like it "sprays" a bunch of bytes in certain ranges), or how they're even determining the counter values. I've isolated from examples that it reads 2 or 3 addresses (oid ~24..34) which are used to produce the percent levels for both ink counters.

E.g. The two ink counters here appear to consist of three addresses:

EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.129.8.65.190.160.24.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 38 36 46 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 18 6F
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.129.8.65.190.160.25.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 39 31 32 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 19 12
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.129.8.65.190.160.30.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 45 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 1E 00
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.129.8.65.190.160.26.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 41 36 43 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 1A 6C
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.129.8.65.190.160.27.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 31 42 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 1B 00
EpsonCommonIONET::perform SNMP [SEND]: 1.3.6.1.4.1.1248.1.2.2.44.1.1.2.1.124.124.7.0.129.8.65.190.160.34.0
EpsonCommonIONET::perform SNMP [READ]: 40 42 44 43 20 50 53 0D 0A 45 45 3A 30 30 32 32 30 30 3B 0C
PrinterEpsonDD4::memoryQuery MEMORY READ: 22 00

And from this, it determines:

PrinterEpsonDD4::inkWasteQuery Counter 68.39% This counter is ok.
PrinterEpsonDD4::inkWasteQuery Counter 3.32% This counter is ok.

I have not yet found no way to correlate this. The bit patterns interpreted as IEEE, various fixed-point formats, integer types, etc. don't seem to produce anything that could correspond to the percentages the tool prints.

More application.log examples might be useful to determine more about this.

The next step might be trying to map the EEPROM to note where values are stored, e.g. ~192..201 appears to be the serial ID.

marcows commented 1 year ago

truncated to 8 characters (or padded with 0's) and then caesar shifted by one (based on ascii, so 0 is shifted to /)

@Earnestly, instead of 0 the key is padded with . which is the ASCII character before /

Great investigation, will soon have a look at the XP-610 I got from my parents-in-law.

Earnestly commented 1 year ago

Good insight, updated to . which is the correct shift direction. Should be possible to express the shift more programmatically with LC_ALL=C tr '[!-~]' '[~-~!-}]'.

Earnestly commented 1 year ago

It seems like the ink counter calculation can be figured out, given the log above:

PrinterEpsonDD4::memoryQuery MEMORY READ: 18 6F
PrinterEpsonDD4::memoryQuery MEMORY READ: 19 12
PrinterEpsonDD4::memoryQuery MEMORY READ: 1E 00
PrinterEpsonDD4::memoryQuery MEMORY READ: 1A 6C
PrinterEpsonDD4::memoryQuery MEMORY READ: 1B 00
PrinterEpsonDD4::memoryQuery MEMORY READ: 22 00
...
PrinterEpsonDD4::inkWasteQuery Counter 68.39% This counter is ok.
PrinterEpsonDD4::inkWasteQuery Counter 3.32% This counter is ok.

Here the values 6F 12 00 seem to be for the first percentage counter and 6C 00 00 for the second. The third byte seems to be a bit of an outlier as it is always 00 and the addresses aren't in sequence; so discarding it.

Interpreting 0x6F12 as 0x126F results in 4719 (other way is too large), and dividing that by its percentage of .6839 (68.39/100) produces roughly 6900. Using this as the factor, it appears to correctly produce the percentages for the first ink counter:

$ gawk 'BEGIN {print strtonum("0x126f") / 69.00}'
68.3913

$ gawk 'BEGIN {print strtonum("0x125e") / 69.00}'
68.1449

For the second counter, the factor appears to be 3257.

$ gawk 'BEGIN {print strtonum("0x006c") / 32.57}'
3.31593

$ gawk 'BEGIN {print strtonum("0x0072") / 32.57}'
3.50015

The address locations may be model specific though, so I'm not sure how useful this is.