Hacking Ricoh SP C250DN toner cartridges

Although the printer prices have fallen hard in recent years, the average cost per page has not really changed. The most expensive parts on these modern printers are the replacement cartridges. Just a few month ago our color laser printer indicated low toner on 3 of 4 cartridges. I've heard a lot about resetting chips and so I could not resist to try it. Because these cartridges have to be as cheap as possible to manufacture they have to use "of the shelf" parts. So after disassembling one of these PCBs' from one of the cartridges I researched the part number (yes the marking wasn't removed :) ) and after checking power pins I was almost entirely sure that they use a BR24Lxxx-W IIC EEProm. Because these ICs are eeproms I should be able to rewrite them indicating full. Furthermore they use the standard I2C interface so it should be pretty easy to write some software on a 8bit µC to reset the cartridges. 

With that in mind I simply wrote a small piece of software to scan all standard addresses and wait for a reply by the chip. Unfortunately I got no response at all. A quick check was made to verify the cartridge was still working... Thankfully it was. So maybe I was simply to fast for the IC while sweeping across the addresses. So I slowed it down really hard but still got nothing. Changing the pullup also hasn't affected the result in any way. So I thought maybe these ICs don't use the standard address space. And I was right after increasing the search radius I finally got a response on 0xA7. Nice! Next thing was reading back the eeprom. I really wasn't sure my code was working properly because the result was just a huge mess. But after reading a fresh cartridge back I got a different but consistent result. So last thing to do was writing to it. This was not as easy as spoken but after slowing down the writing speed I finally was able to write and read back successfully. With that done I copied the data from a fresh full cartridge to a "empty" one inserted it into the printer and a huge smile took hold. It WORKS! 

Last thing I plan for the future is to make it standalone and portable. Also finishing it up with a nice 3d printed case would really be cool. 

While searching for the datasheet to link it into this blog, I found this page where someone else already covered reverse engineering these cartridges. So please refer to his blog he really has described it well better than I ever could. He has got the same speed and address issues as I got so I assume my setup wasn't the limiting factor. Sometimes I really should research a lot more on the web before trying to reverse engineer something but I can't help myself... It's just way to much fun!

The following Link guides you to all the files I still have from the Project. This also contains a zip file with code that has been given to me from someone who has written the code in Arduino. You use this all at your own risk!

 LINK

If you have any further questins don't hesitate to ask.

Chip dimensions

Arduino clone as a cheap development platform

Serial output from the µC