Hacking the Samsung CLP-315 Laser Printer

Posted on March 4, 2012

I am the happy owner of a Samsung CLP-315 laser printer. It is a fantastic printer for the price. Things were

going great until it came time to replace the toner. At the time, the price of a full set of toner cartridges was

around $150. To put things in perspective, the printer itself could be acquired for less on eBay. Not being the

type of person who so easily bends to the will of The Man, I set out on a journey to find a cheaper source of

toner.

A journey? Really? As it turns out, the answer is yes but in the end it was worth it. This is going to be a long

post, so strap yourself in. If youd prefer to cheat, you can skip straight to the good stuff.

How Stuff Works

Since I last purchased a laser printer (my circa 2001 LaserJet 1200 is still kicking) the industry has changed.

Imagine that!? Apparently, it is now common practice for printers and even toner cartridges themselves to count

the number of pages that have been printed in order to track the consumption of toner. The printers then use

these page counts to project how much toner remains in the cartridge. To my knowledge, the cartridges dont

have a way to sense how much toner remains.

Why does this matter, you ask? Essentially, it would be like having a gas gauge in your car that only tracked how

far you had driven, not how much gasoline was left in the tank. Depending on several factors (driving style, load,

tire pressure, etc), the amount of fuel consumed in a mile can vary wildly. The end result; you either waste gas,

or run out. Neither is good. The same can be said for the way modern laser printers track toner.

This causes two problems. First, toner is likely being wasted (which irks me). Second, refilling the cartridges with

toner purchased in bulk does nothing to reset the accumulated page count. It is like putting gasoline in your tank,

but not being able to start the car until the odometer is reset. Knowing all this, the only thing standing between

me and cheap toner refills was finding a way to reset the counters.

Unsurprisingly, I am not the first person to try to address this problem. In fact, there is plenty of published

hackery surrounding this printer. Not wanting to start from scratch, I got to reading. What I discovered is that the

page counts are all stored on an EEPROM chip that is attached to an IC bus (an ST M24C64, in this case). If

Hello World!

Chronicles of an OK programmer

Hacking the Samsung CLP-315 Laser Printer | Hello World! http://rumburg.org/printerhack/

1 de 32 16/07/12 18:50

that last sentence meant nothing to you, you might want to skip to the Reset Procedure section It is going to

get technical for a while.

Sniffing

After doing some homework, I decided to try watching the IC traffic with a logic analyzer to see what memory

locations were getting updated on the EEPROM after each print. I was able to catch the first handful of writes,

but there were so many that I decided to take a slightly different approach.

I wrote an Arduino sketch to dump the entire memory of the EEPROM to the serial port. This allowed me to see a

before and after memory snapshot. So, I would dump the EEPROM, print a page, and dump it again. I then

compared the outputs using a diff program. I looked specifically for writes that looked like they incremented a

value. Like I had suspected, there were lots of locations that were incrementing. Great!

The next thing I did was print off the printers Configuration Report. This is done by holding down The Button

until the green light flashes rapidly. This report includes several counts, including the counts for our toner

cartridges and the printer itself. By searching the dump file for these numbers (after converting them to hex), I

was able to track down which memory locations were used to store which counts.

Now I had a list of memory locations that (I assumed) stored the page counts. I could use another Arduino sketch

to write zeros back into those locations. Using our analogy from before, I hoped this would reset the odometer

and register the tank as full.

I was able to successfully write zeros to all of the incrementing memory locations. Unfortunately, after printing the

configuration report again, the Toner Remaining percentage hadnt updated for any of the cartridges. Also, the

low-toner warning lights remained lit for all colors. Apparently that percentage is a stored value, not one that is

calculated on the fly based on the page count. If the numbers were stored as floating points, this could explain

why they were harder to see, as they may not have changed by exactly 1 like the page counts did.

I needed a better way to analyze and flash the entire address space on the EEPROM. I hooked up my Bus Pirate

to the IC bus, and was going to start writing some software to accomplish this. Here is where things got really

interesting

The Discovery

I rebooted the printer with the Bus Pirate connected (I dont remember which mode I had it in), and it took a really

long time to start-up. I ran the configuration report and it had mysteriously zeroed or erased every field. All

values, serial numbers, dates, and counts were blank or zero. I was terrified that I had bricked my printer!

So, I disconnected the Bus Pirate and printed another configuration report. Everything looked as I had left it with

one exception. Now, the black toner cartridge registered zero pages and 100% remaining toner. And the warning

light for the black toner was off Eureka! (I didnt really say that, but I think I did run and show my wife who said

Thats nice, honey. Im such a nerd.)

So what happened, and how could I now make it happen for the color cartridges, too? I hooked up the scope to

Hacking the Samsung CLP-315 Laser Printer | Hello World! http://rumburg.org/printerhack/

2 de 32 16/07/12 18:50

Original After Hack After Print After Reboot

the SDA and SCL lines of the bus so I could watch what was happening while booting with the Bus Pirate

connected. After a couple of tries, I noticed that the SDA line was being held low by the Bus Pirate (like I said,

Im not sure what mode I had it in). I could see the clock line getting toggled as it booted, but holding the data line

low seemed to be interrupting the flow of data between the EEPROM and the main processor. I can only assume

that when this happens during a boot up, all of the count variables are left initialized to zero in the main

processors memory.

So, the idea struck me. What if I interrupt the communications during boot (letting the in-memory values initialize

to zero), but then print a page and see if it would run the same incrementing logic and write 1s for the page

counts back to the EEPROM. Is double eureka a thing? It worked. All toner levels, page counts, image counts

and everything had been written back to the EEPROM as if they had started at zero.

Reset Procedure

After printing a few more pages (and giggling like a child to the wife), I was able to refine the reset process a bit.

Here are the steps to perform the reset:

Open the printer and solder a wire to the SDA pin of the EEPROM (see video below)1.

Power up the printer with this line held to ground until it finishes initializing2.

You can use chassis near the USB port is an easy spot to ground to.A.

The printer will take longer than normal to initialize; dont be alarmedB.

Disconnect the SDA line from ground3.

Print the demo page by pushing The Button until you see a slowly blinking green light (about 2 seconds)4.

Print the configuration page by pushing The Button until you see a rapidly blinking green light (about 6

seconds)

5.

Hacking the Samsung CLP-315 Laser Printer | Hello World! http://rumburg.org/printerhack/

3 de 32 16/07/12 18:50

76 THOUGHTS ON HACKING THE SAMSUNG CLP-315 LASER PRINTER

Turn off the power6.

Turn on the power, and wait for it to initialize7.

Print the configuration report again8.

All your base are belong to us9.

Notes

One thing worth noting; my printer still has its original toner cartridges which are chipless. Retail replacement

cartridges have a chip with its own EEPROM that has a unique identifier and stores its own count. Since I dont

have toner cartridges with these chips, I dont know (but I suspect) that a different approach or additional steps

may be necessary to reset the counts.

You may be able to tape off the exposed pads on the toner chips before performing this procedure and get the

same effect, but I havent got the chipped cartridges to test with. (nor will I be buying any for $150!) YMMV.

Demo Time!

Conclusion

It took some time to get there, but I think it was worth the effort. This printer is now happily kicking out full-color

pages for 2 versus a whopping 15 (ouch). Life is good. Enjoy!

This entry was posted in Hacks and tagged Arduino, CLP-315, Hack, I2C, Printer by Brian. Bookmark the

permalink [http://rumburg.org/printerhack/] .

Hacking the Samsung CLP-315 Laser Printer | Hello World! http://rumburg.org/printerhack/

4 de 32 16/07/12 18:50

Pingback: Resetting the page count on a laser printer - Hack a Day

Mad Professor

on March 5, 2012 at 1:21 pm said:

I have a Samsung CLP-300N, and it uses a PDIP Package: ATMEL

24C64A eeprom, in a socket.

One of my toners was showing as empty, but if you remove the

eeprom chip and power on the printer, it takes longer to boot up, but

like your video shows it resets eveything, and is able to print, but as

soon as you put the chip back it, and power cycle the printer, it then

shows the toner is empty again.

For now I am just going to leave the eeprom chip out.

brian

on March 5, 2012 at 3:14 pm said:

It sounds like pulling the SDA line low might work for your

printer, too. Let me know how it goes if you decide to give it a

try!

Karel

on March 25, 2012 at 2:11 pm said:

I tried doing it (CLP-300), but now it wont do anything

at all anymore. (No LED lights, and the roller only turns

5degrees and makes a click.

This time the wife wasnt to happy with me >_