Reverse Engineering to Emulate Ink Cartridges for a Epson Printer

Step 8 Emulating Ink Cartridges

So what happens now is that we need to set up our microcontroller to contain the data we have dumped. Then allow the printer host to read and write to it.

Now the problem with this is that I don’t want my fake ink cartridges to ever get used up, so to do that is we have a fixed dump that the microcontroller will load into ram everytime it starts up. This will allow the printer to not only read, but write to it as well. When the microcontroller is powered off then back on, the previous data is restored. (Double Bonus)

Storing data arrays in the microcontroller, place this somewhere under the include, but before void main()

Note: This may vary between different microcontroller families, but it works nicely with my PIC18F

ram unsigned char black[32] = {0x10,0x00,0x02,0xF2,0x00,0x00,0x00,0x00,0x00,0x50,0x90,0x6A,0x17,0xE3,0x54,0xA3,0x39,0x50,0x14,0x15,0x31,0x93,0xE4,0xB4,0x24,0x96,0x57,0x04,0x35,0xF5,0xE4,0x14};
ram unsigned char cyan[32] = {0x4C,0x04,0x01,0xF2,0x00,0x00,0x00,0x00,0x00,0x50,0x90,0x5A,0x19,0xF0,0x94,0x03,0x3B,0x50,0x16,0x17,0x31,0x93,0xE4,0xB4,0x24,0x96,0x57,0x04,0x35,0xF5,0xE4,0x34};
ram unsigned char yellow[32] = {0x4A,0x04,0x01,0xF2,0x00,0x00,0x00,0x00,0x00,0x50,0x90,0x6A,0x8B,0xC9,0xA4,0x41,0x3B,0x50,0x1A,0x1B,0x31,0x93,0xE4,0xB4,0x24,0x96,0x57,0x04,0x35,0xF5,0xE4,0x74};

Note: Noticed that I don’t have Magenta? That’s because that’s the ink cartridge I don’t have.

The next step is to write a routine that checks which ink cartridge is being requested, and allow the host to read and write to it.
This is how I did it:

void main(){
    unsigned char* inkPtr;
    char addr = 0x00;
    ...

    While(1){

        epsnCartStartListen();

        while(epsnCartReady()==1); // Wait for the Ready signal to go back to low

        while(epsnCartReady()==0);
        addr = espnCartGetAddr();

        if(addr&0x7 == 0x01){ // if the first 3 bits is equal to 0x01
            inkPtr = &black[0]; // Point to the black data
        }else if(addr&0x7 == 0x03){ // if the first 3 bits is equal to 0x03
            inkPtr = &cyan[0]; // Point to the cyan data
        }else if(addr[i]&0x7 == 0x05){
            inkPtr = &cyan[0]; // This is meant to be Magenta, but I don’t have that
        }else if(addr[i]&0x7 == 0x07){
            inkPtr = &yellow[0];
        }else{
            continue: // Go back to the beginning of the main loop because we don't know this address
        }

        if(addr&0x08){//WriteMode – Check to see if the Host wants to write
            while(epsnCartReady()){//keep looping until RST goes low
                *inkPtr = epsnCartIn();
                // the data the pointer is pointing to
                // gets written with new data
                inkPtr++; // Increment the Pointer
            }
        }else{//Read Mode
            while(epsnCartReady()){
               epsnCartOut(*inkPtr);
               // Output the data the Pointer is pointing to
               inkPtr++; // Inrement the pointer
           }
       }
    }
}

Success!
After programming this new code and turning on my printer, the printer accepted 4 imaginary cartridges thanks to my microcontroller. I'm also quite shocked that I accepted the cyan ink cartridge data for magenta aswell!

This is a huge achievement for me as this is my first real world reverse engineering I’ve ever done and I got promising results.
Now I can continue with turning the printer into a 3D printer

I hope you guys liked this, this is my second instructable and this took me a while to write :P

If you wan, you guys are more than welcome to download the source files

Cheers!
Roman