MCU reverse engineering

Start up your IDE, in my case it's MPLab, create a new project for your chip and create a basic hello world program to make sure your chip is going.

Note: My hello world program sends "Hello World!\r\n" over Serial to my computer at 38400bps

#include <p18f2550.h> // Include file specific for this chip
#include <usart.h> // USART Functions
#include <stdio.h> // printf(format,...) , sprintf(string, format, ...), etc...

#include "delay.h"

void main(){

PORTA = 0x00;
PORTB = 0x00;
PORTC = 0x00;

TRISA = 0x00;
TRISB = 0x00;
TRISC = 0x00;

ADCON1 = 0x0F; // This is such a trouble maker, never forget to turn the Analogue pins back to digital! :P

TRISCbits.TRISC7 = 1; // Turns the RX pin into an input (look it up in your datasheet for your chip)

OpenUSART(USART_TX_INT_OFF & USART_RX_INT_OFF & USART_ADDEN_OFF & USART_BRGH_HIGH & USART_CONT_RX & USART_EIGHT_BIT & USART_ASYNCH_MODE,78);

while(1){
putrsUSART("Hello World!\r\n"); // Send a message via Serial

LATAbits.LATA0 = ~LATAbits.LATA0; //Flash an LED by toggling it on and off

DelayMS(500); // A delay function I've created
}
}

This was set up with a 3.3V power supply because the ink cartridges run on 3.3Volts

Why a hello world program? Well, every time I set up a new project on a bread board, I always want to make sure I've got the configureation bits correct and that I'm not getting garbage in the terminal.

I think this is good practice and everyone should do it! :P

If your chip is doing something simple like mine, Great!! on to the next step

At the top of the file add:
#include "epsnCart.h" // the name of the header file we created earlier

Since this microcontroller is pretending to be the host, it's controlling the SCK, SDA and RST signals. so make sure they're outputs, add this with the other TRIS registers inside main():

epsnCartInit();

The next bit of code is what I used inside of the while(1) {
It requests an address starting at 0x00 then increments by one after 32 read bytes:

void main(){
char addr = 0, i = 0;
char string[40];

...
epsnCartInit(); // Initialised the pins used

while(1){ // Loop forever!

sprintf(string, "Reading cartridge with addr: 0x%02X\r\n",addr);
putsUSART(string); // prints a messge like: Reading cartridge with addr: 0x03

epsnCartStart(addr,0); // Start by sending the address in read mode

i = 0;
while(i<32){ // keep looping until i is no longer less than 32
sprintf(string,"0x%02X,",epsnCartRead());
putsUSART(string);
i++;
}

epsnCartStop(); //brings RST back low

putrsUSART("\r\n");

addr++
if(addr>7){
addr = 0;
}
DelayMS(500);
}
}

Here is what I got of my terminal

Addr: 0x01
57,07,02,F2,00,00,00,00,00,50,98,6A,EB,D3,54,A3,39,50,14,15,31,93,E4,B4,24,96,57,04,35,F5,E4,14,

Addr: 0x02
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,

Addr: 0x03
03,00,02,F2,00,00,00,00,00,50,C8,1C,2A,A5,82,00,3B,50,16,17,31,93,E4,B4,24,96,57,04,35,F5,E4,34,

Addr: 0x04
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,

Addr: 0x05
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,

Addr: 0x06
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,

Addr: 0x07
03,00,02,F2,00,00,00,00,00,50,30,9F,74,81,D1,40,3B,50,1A,1B,31,93,E4,B4,24,96,57,04,35,F5,E4,74,

Now, see here how only the odd address returned data except 0x05?
That's because 0x05 is the address of the Magenta ink cartridge which I don't have sadly :(

Emulation Code Routines
Now the fun part!

I need the printer to think that there are four ink cartridges installed 聚焦离子束fib多少钱, to do this we need to implement some emulation functions first. Again from previous knowledge I have predefined these in the header:

• #define epsnCartReady() (_ecRST)
• extern unsigned char espnCartGetAddr(void);
• extern void epsnCartOut(unsigned char data);
• extern unsigned char epsnCartIn(unsigned char data);

epsnCartReady is a macro that is used check if the printer has RST set high.
epsnCartGetAddr returns the address that the print head is requesting.
epsnCartOut is used to send data to the Host controller
epsnCartIn is used to receive data from the Host when it’s writing

So this time, instead of controlling the SCK to go high or low, we need it to wait for it to go high or low, but if the reset goes low, then stop everything and return:

unsigned char espnCartGetAddr(void){
char i=0;
char temp = 0x00;

while((i<4) && _ecRST){ // Loop while i < 4 and RST is HIGH
temp>>=1; // Right Shift Temp by one
while((!_ecSCK) && (_ecRST)); // Wait for the clock to go high
if(_ecSDA){// only if SDA is high
temp |= 0x08; // then set the 4th bit
}
while((_ecSCK) && (_ecRST));// wait for the clock to go low
i++; // increment the counter
}

if(_ecRST == 0){
return 0xFF;//if RST went low, means the Host killed the signal
}
return temp; //return the address and the read/write bit
}

And the Out function:

void epsnCartOut(unsigned char data){
char i = 0;
char temp = data;

_ecSDATRIS = 0; // set the SDA to output
_ecSDALat = 0; // set SDA low

while((i<8) && _ecRST){ // Loop while I < 8 and RST is high
while(!_ecSCK && _ecRST); // Wait for SCK to go high
_ecSDALat = temp&0x01; // fib focused ion beam how much Set SDA high or low according to the first bit

while(_ecSCK && _ecRST); // Wait for SCK to go low
temp>>=1; // Right shift the data by one
i++; // increment the counter by one
}
_ecSDATRIS = 1; // Set SDA to an output
_ecSDA = 1; // not sure if this is needed
}

And finally the In function:

unsigned char epsnCartIn(void){
unsigned char i=0;
char temp = 0x00;

while((i<8) && _ecRST){ // Loop while I < 8 and RST is high
temp>>=1; // Right Shift the temp by one
while(!_ecSCK && _ecRST); // Wait for SCK to go High
if(_ecSDA){ //only id SDA is high
temp |= 0x80; // Set the 8th bit
}

while(_ecSCK && _ecRST);// Wait for SCK to go low
i++; // Increment the counter by one
}
return temp; // return what we have received
}

So what happens now is that we need to set up our microcontroller to contain the data we have dumped. Then allow the printer host to read and write to it.

Now the problem with this is that I don’t want my fake ink cartridges to ever get used up, so to do that is we have a fixed dump that the microcontroller will load into ram everytime it starts up. This will allow the printer to not only read, but write to it as well. When the microcontroller is powered off then back on, the previous data is restored. (Double Bonus)

Storing data arrays in the microcontroller, place this somewhere under the include, but before void main()

Note: This may vary between different microcontroller families, but it works nicely with my PIC18F

Note: Noticed that I don’t have Magenta? That’s because that’s the ink cartridge I don’t have.

The next step is to write a routine that checks which ink cartridge is being requested, and allow the host to read and write to it.
This is how I did it:

void main(){
unsigned char* inkPtr;
char addr = 0x00;
...

While(1){

epsnCartStartListen();

while(epsnCartReady()==1); // Wait for the Ready signal to go back to low

while(epsnCartReady()==0);
addr = espnCartGetAddr();

if(addr&0x7 == 0x01){ // if the first 3 bits is equal to 0x01
inkPtr = &black[0]; // Point to the black data
}else if(addr&0x7 == 0x03){ // if the first 3 bits is equal to 0x03
inkPtr = &cyan[0]; // Point to the cyan data
}else if(addr[i]&0x7 == 0x05){
inkPtr = &cyan[0]; // This is meant to be Magenta, but I don’t have that
}else if(addr[i]&0x7 == 0x07){
inkPtr = &yellow[0];
}else{
continue: // Go back to the beginning of the main loop because we don't know this address
}

if(addr&0x08){//WriteMode – Check to see if the Host wants to write
while(epsnCartReady()){//keep looping until RST goes low
*inkPtr = epsnCartIn();
// the data the pointer is pointing to
// gets written with new data
inkPtr++; // Increment the Pointer
}
}else{//Read Mode
while(epsnCartReady()){
epsnCartOut(*inkPtr);
// Output the data the Pointer is pointing to
inkPtr++; // Inrement the pointer
}
}
}
}

Success!
After programming this new code and turning on my printer, the printer accepted 4 imaginary cartridges thanks to my microcontroller. I'm also quite shocked that I accepted the cyan ink cartridge data for magenta aswell!

This entire project is a prime example of how reverse engineering can unlock the potential of proprietary hardware. By understanding the communication protocol, I effectively performed a firmware extraction of the EEPROM contents, although the data was small. In a more complex system, one might need to dump flash memory from a microcontroller to analyse its code. The EEPROM in these cartridges acts as a tiny secure storage, but without any lockbit or encryption, it's trivial to read-out the data. Some modern printer cartridges include a lock mechanism that prevents reuse, but here the only protection was the obscure protocol. This obscurity is not security, as I proved by successfully emulating the missing cartridge. The ability to duplicate the cartridge identity would allow infinite refills, which is exactly what printer manufacturers try to prevent. They often use fuses or one-time programmable bits to mark a cartridge as empty, but this EEPROM is fully rewritable. My microcontroller now acts as a man-in-the-middle, intercepting read requests and serving stored data. This is essentially a simple form of firmware recovery for the printer, as I restored full functionality without the original part. The code I wrote is small but effective, and it could be adapted to other devices with similar serial EEPROMs. I've often wondered if printer makers intentionally leave these vulnerabilities to allow third-party cartridges. Regardless, this project taught me a lot about hardware protocols and embedded systems. The MCU I used, a PIC18F, was more than capable of handling the timing requirements. In fact, I could have used a smaller microcontroller, but the PIC gave me plenty of room for future expansion. The whole setup runs on 3.3V, matching the cartridge's internal voltage. One challenge was ensuring that the SDA line was correctly driven in both directions, as the printer and my MCU alternate control. I had to carefully manage the TRIS registers to avoid bus conflicts. This is a common issue in any multi-master system, but here it's a single host and a slave emulator. The timing diagrams from the patent were invaluable; they gave me the exact clock edge relationships. Without that, I would have spent days guessing. This experience underscores the importance of documentation, even if it's hidden in patents. I also learned that sometimes the simplest solution works best – just storing the dump in RAM and refreshing it on power-up. This ensures that the ink levels never decrease, which is a nice bonus. However, for a real product, I would need to consider wear-leveling and power-loss protection. But for a hobby project, this is perfect. I'm now confident that I can tackle more complex reverse engineering tasks in the future. The next step might involve sniffing the communication between the printer and the print head motor drivers. That would allow me to precisely control the XY movement for my 3D printer conversion. But that's a story for another instructable. For now, I'm thrilled that my emulation works flawlessly. I've even tested it with multiple power cycles and it retains the data each time. The RAM array is reinitialized with the hardcoded values on every boot, so the cartridge always appears fresh. The printer never complains about counterfeit cartridges because the data is a perfect copy of a genuine one. This is essentially a duplicate of the original cartridge's identity. In a commercial setting, such a technique could be used for unauthorized cloning, but here it's for legitimate repurposing. I'm careful to only use it for my own projects. The knowledge gained from this exercise is applicable to many other consumer electronics that use simple serial memories. Many devices have similar EEPROMs that store calibration data or serial numbers. By reading them out, you can backup and restore critical information. That's a form of firmware extraction in itself, even if the firmware is just configuration data. I've seen projects where people decrypt the firmware from a smart meter using similar methods. But that involves much more complex crypto and often a lockbit to prevent read-out. Here, there is no such lock, so it's wide open. Some might argue that this is a security flaw, but for me it's an opportunity. I've already started planning a version that uses a smaller ATtiny MCU to save space. The code size is tiny, so it could fit in an 8-pin package. I might even add a feature to simulate different cartridge types via a DIP switch. That would be handy for testing various inks. The possibilities are endless. I'm also considering sharing my code on GitHub for others to adapt. This open-source approach encourages collaboration and innovation. Many hackers have already done similar things with other printer brands. The community is very active in reverse engineering consumables to reduce waste and save money. It's a win-win for the environment and the user. I hope my instructable inspires others to look under the hood of their own devices. With a logic analyser and a bit of patience, you can uncover hidden protocols. The key is to start small, like I did with this simple EEPROM. Once you master the basics, you can move on to more challenging targets. I'm looking forward to the day I can 3D print with my converted printer. This is just the first milestone. The next big step is to interface the print head drivers and build the mechanical frame. But that's a project for another season. For now, I'm savoring this victory. It's a tangible proof that reverse engineering is not just for hackers; it's a valuable skill for any engineer. By understanding how things work at the lowest level, you can truly make them your own. That's the spirit of making and tinkering. So go ahead, grab an old printer and start probing. You'll be surprised at what you can achieve. And remember, always document your findings so others can learn from your journey. That's how our community grows and evolves. With that, I'll wrap up this section. Enjoy the rest of the instructable and happy hacking!