Donkey-Punching the Tektronix Phaser 740 Imaging Unit

Summary: The Tektronix Phaser 740 contains an expensive color imaging unit which tracks of the total number of page images it has processed. When the image count exceeds a set number the printer will no longer function until the unit is replaced, regardless of its continued viability. G-Cipher has vowed to reverse engineer and defeat the image count mechanism.

Exhibit A: Tektronix Phaser 740 and Imaging Unit

Since the printer uses a four-color process, each page passes through the imaging unit and increments the image counter four times.

Tektronix Phaser 740 Phaser 740 imaging unit
Exhibit B: Top-sekrit serial EEPROM for image count storage

The image count board cannot be removed without radical disassembly of the imaging unit; however, the board connector, located at upper left in the third picture, is accessible beneath an easily removed plastic side cover.

24WC04 4Kb Serial EEPROM Datasheet

Exhibit C: Schematic of EEPROM board

eeprom board schematic

The board contains a photosensor on a separate circuit from the EEPROM which counts passes of a black area on the back of the photosensitive imaging belt. The board pinout persists unchanged through a 5-pin extension cable to pins 1-5 of the imaging unit docking connector seen above.

Exhibit D: EEPROM contents

Since agents Resin and Amatus were AWOL, and source code for Project: Donkey-Punch was not available, G-Cipher's in-house serial EEPROM tool could not be used and another method to read the contents was needed. PonyProg for Linux was used with the Easy I²C Bus interface.

A bar-code label is affixed to the imaging unit with the following text:

COLOR IMAGING KIT *MN41400420*H

The numeric string is the unit's serial number, which also appears at location 10b in the rom data. We read the data from two imaging units: MN41400420, which had exceeded its maximum page count and would no longer work in the printer, and MN03602297, which read 82% life remaining at 10412 images on the consumables test page.

MN41400420.bin MN41400420.hex

00000000  66 00 04 00 01 02 03 04  00 01 02 03 04 00 01 02  |f...............|
00000010  03 04 00 01 02 03 04 00  01 02 03 04 00 01 02 03  |................|
00000020  04 00 01 02 03 04 00 01  02 03 00 00 00 00 00 00  |................|
00000030  00 fc fd fe ff 00 00 00  00 00 00 00 00 00 00 00  |.üýþÿ...........|
00000040  00 00 00 00 00 00 00 00  00 8a 05 27 ea 74 29 05  |...........'êt).|
00000050  28 92 6a 31 05 28 a7 5d  ec 05 27 42 7e 00 00 00  |(.j1.(§]ì.'B~...|
00000060  00 00 00 00 00 00 00 52  01 31 11 0f aa 01 31 57  |.......R.1..ª.1W|
00000070  21 bc 01 31 5f 2b f8 01  30 ca fd 00 00 00 00 00  |!¼.1_+ø.0Êý.....|
00000080  00 00 00 00 00 d0 00 fd  7a 59 94 00 fd 9a fd e7  |.....Ð.ýzY..ý.ýç|
00000090  00 fd 9c 4e 0b 00 fd 59  b5 00 00 00 00 00 00 00  |.ý.N..ýYµ.......|
000000a0  00 00 00 65 01 41 a8 7b  25 01 41 c9 1a 6f 01 41  |...e.A¨{%.AÉ.o.A|
000000b0  cd 60 a5 01 41 87 dc 00  00 00 00 00 00 00 00 00  |Í`¥.A.Ü.........|
000000c0  00 fe 01 b7 b6 90 c0 01  b7 d7 31 19 01 b7 de 83  |.þ.·¶.À.·×1..·Þ.|
000000d0  3c 01 b7 95 ef 00 00 00  00 00 00 00 00 00 00 28  |<.·.ï..........(|
000000e0  29 26 27 00 00 5b 00 a8  b3 67 00 a8 bf 76 00 a8  |)&'..[.¨³g.¨¿v.¨|
000000f0  ce 4f 00 a8 a7 00 00 00  00 00 00 00 00 00 00 00  |ÎO.¨§...........|
00000100  01 08 00 11 09 e3 e3 30  30 4d 4e 34 31 34 30 30  |.....ãã00MN41400|
00000110  34 32 30 00 de a8 00 00  04 e6 d5 80 00 ea 60 00  |420.Þ¨...æÕ..ê`.|
00000120  00 05 28 30 c0 01 01 d0  00 00 06 76 07 66 00 00  |..(0À..Ð...v.f..|
00000130  00 00 00 00 00 00 00 00  00 84 c3 00 75 30 00 84  |..........Ã.u0..|
00000140  c2 00 00 00 00 00 84 c3  03 05 07 d5 03 05 07 d5  |Â......Ã...Õ...Õ|
00000150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

From MN03602297 we took rom snapshots after each of three consecutive pages.

Image count 10416:
MN03602297_1.bin MN03602297_1.hex

00000000  66 00 04 00 01 02 03 04  00 01 02 03 04 00 01 02  |f...............|
00000010  03 04 00 01 02 03 04 00  01 02 03 04 00 01 02 03  |................|
00000020  04 00 01 02 03 04 00 01  02 03 00 00 00 00 00 00  |................|
00000030  00 04 01 02 03 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 ac 00 d3 b2 27 55 00  |.........¬.Ó²'U.|
00000050  d3 44 3e 38 00 d3 5d 08  ef 00 d3 73 a9 00 00 00  |ÓD>8.Ó].ï.Ós©...|
00000060  00 00 00 00 00 00 00 54  00 55 80 7f 93 00 55 55  |.......T.U....UU|
00000070  e9 03 00 55 5f 4f e3 00  55 68 26 00 00 00 00 00  |é..U_Oã.Uh&.....|
00000080  00 00 00 00 00 d8 00 2c  6b 41 2a 00 2c 5d a1 5b  |.....Ø.,kA*.,]¡[|
00000090  00 2c 62 cd 00 00 2c 67  6d 00 00 00 00 00 00 00  |.,bÍ..,gm.......|
000000a0  00 00 00 11 00 26 d2 19  c6 00 26 bb e5 e5 00 26  |.....&Ò.Æ.&»åå.&|
000000b0  c0 ff 7e 00 26 c5 93 00  00 00 00 00 00 00 00 00  |Àÿ~.&Å..........|
000000c0  00 6b 00 2a f4 4d cc 00  2a d4 ce ef 00 2a d9 ec  |.k.*ôMÌ.*ÔÎï.*Ùì|
000000d0  8a 00 2a de 82 00 00 00  00 00 00 00 00 00 00 04  |..*Þ............|
000000e0  05 02 03 00 00 d8 00 28  b0 a4 00 28 7c b0 00 28  |.....Ø.(°¤.(|°.(|
000000f0  88 bc 00 28 94 00 00 00  00 00 00 00 00 00 00 00  |.¼.(............|
00000100  01 08 00 11 0a 28 a5 30  30 4d 4e 30 33 36 30 32  |.....(¥00MN03602|
00000110  32 39 37 00 de a8 00 00  04 e6 d5 80 00 ea 60 00  |297.Þ¨...æÕ..ê`.|
00000120  00 05 28 30 c0 01 01 d0  00 00 06 76 07 66 00 00  |..(0À..Ð...v.f..|
00000130  00 00 00 00 00 00 00 00  00 00 01 00 75 30 00 00  |............u0..|
00000140  00 00 00 00 00 00 00 00  08 0b 07 d5 08 0b 07 d5  |...........Õ...Õ|
00000150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

Image count 10420:
MN03602297_2.bin MN03602297_2.hex

00000000  66 00 04 00 01 02 03 04  00 01 02 03 04 00 01 02  |f...............|
00000010  03 04 00 01 02 03 04 00  01 02 03 04 00 01 02 03  |................|
00000020  04 00 01 02 03 04 00 01  02 03 00 00 00 00 00 00  |................|
00000030  00 04 01 02 03 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 ac 00 d3 b2 27 14 00  |.........¬.Ó²'..|
00000050  d3 c6 7b 38 00 d3 5d 08  ef 00 d3 73 a9 00 00 00  |ÓÆ{8.Ó].ï.Ós©...|
00000060  00 00 00 00 00 00 00 54  00 55 80 7f 5d 00 55 88  |.......T.U..].U.|
00000070  80 03 00 55 5f 4f e3 00  55 68 26 00 00 00 00 00  |...U_Oã.Uh&.....|
00000080  00 00 00 00 00 d8 00 2c  6b 41 0b 00 2c 6c 73 5b  |.....Ø.,kA..,ls[|
00000090  00 2c 62 cd 00 00 2c 67  6d 00 00 00 00 00 00 00  |.,bÍ..,gm.......|
000000a0  00 00 00 11 00 26 d2 19  0e 00 26 d6 12 e5 00 26  |.....&Ò...&Ö.å.&|
000000b0  c0 ff 7e 00 26 c5 93 00  00 00 00 00 00 00 00 00  |Àÿ~.&Å..........|
000000c0  00 6b 00 2a f4 4d 9a 00  2a fb 75 ef 00 2a d9 ec  |.k.*ôM..*ûuï.*Ùì|
000000d0  8a 00 2a de 82 00 00 00  00 00 00 00 00 00 00 04  |..*Þ............|
000000e0  05 02 03 00 00 d8 00 28  b0 dc 00 28 b4 b0 00 28  |.....Ø.(°Ü.(´°.(|
000000f0  88 bc 00 28 94 00 00 00  00 00 00 00 00 00 00 00  |.¼.(............|
00000100  01 08 00 11 0a 28 a5 30  30 4d 4e 30 33 36 30 32  |.....(¥00MN03602|
00000110  32 39 37 00 de a8 00 00  04 e6 d5 80 00 ea 60 00  |297.Þ¨...æÕ..ê`.|
00000120  00 05 28 30 c0 01 01 d0  00 00 06 76 07 66 00 00  |..(0À..Ð...v.f..|
00000130  00 00 00 00 00 00 00 00  00 00 01 00 75 30 00 00  |............u0..|
00000140  00 00 00 00 00 00 00 00  08 0b 07 d5 08 0b 07 d5  |...........Õ...Õ|
00000150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

Image count 10424:
MN03602297_3.bin MN03602297_3.hex

00000000  66 00 04 00 01 02 03 04  00 01 02 03 04 00 01 02  |f...............|
00000010  03 04 00 01 02 03 04 00  01 02 03 04 00 01 02 03  |................|
00000020  04 00 01 02 03 04 00 01  02 03 00 00 00 00 00 00  |................|
00000030  00 04 01 02 03 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 ac 00 d3 b2 27 14 00  |.........¬.Ó²'..|
00000050  d3 c6 7b 7e 00 d3 da d1  ef 00 d3 73 a9 00 00 00  |ÓÆ{~.ÓÚÑï.Ós©...|
00000060  00 00 00 00 00 00 00 54  00 55 80 7f 5d 00 55 88  |.......T.U..].U.|
00000070  80 66 00 55 90 81 e3 00  55 68 26 00 00 00 00 00  |.f.U..ã.Uh&.....|
00000080  00 00 00 00 00 d8 00 2c  6b 41 0b 00 2c 6c 73 3e  |.....Ø.,kA..,ls>|
00000090  00 2c 6d a5 00 00 2c 67  6d 00 00 00 00 00 00 00  |.,m¥..,gm.......|
000000a0  00 00 00 11 00 26 d2 19  0e 00 26 d6 12 0c 00 26  |.....&Ò...&Ö...&|
000000b0  da 0c 7e 00 26 c5 93 00  00 00 00 00 00 00 00 00  |Ú.~.&Å..........|
000000c0  00 6b 00 2a f4 4d 9a 00  2a fb 75 cb 00 2b 02 9e  |.k.*ôM..*ûuË.+..|
000000d0  8a 00 2a de 82 00 00 00  00 00 00 00 00 00 00 04  |..*Þ............|
000000e0  05 02 03 00 00 d8 00 28  b0 dc 00 28 b4 e0 00 28  |.....Ø.(°Ü.(´à.(|
000000f0  b8 bc 00 28 94 00 00 00  00 00 00 00 00 00 00 00  |¸¼.(............|
00000100  01 08 00 11 0a 28 a5 30  30 4d 4e 30 33 36 30 32  |.....(¥00MN03602|
00000110  32 39 37 00 de a8 00 00  04 e6 d5 80 00 ea 60 00  |297.Þ¨...æÕ..ê`.|
00000120  00 05 28 30 c0 01 01 d0  00 00 06 76 07 66 00 00  |..(0À..Ð...v.f..|
00000130  00 00 00 00 00 00 00 00  00 00 01 00 75 30 00 00  |............u0..|
00000140  00 00 00 00 00 00 00 00  08 0b 07 d5 08 0b 07 d5  |...........Õ...Õ|
00000150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

Conclusion:Agent Jay has identified the differences between the three snapshots, which seem to indicate a definite pattern. Using PonyProg, we were able to clone the rom data from the working unit to the expired one. The printer no longer displayed an error, and indicated 82% life remaining on the cloned unit, but due to an unrelated event predating the project it would only print blank pages and so we were unable to verify functionality of the unit.