Archive for November, 2005

Hong Kong and Japan!

Friday, November 25th, 2005

I’ve been out of town for the past two weeks, which is why this month’s name that ware contest is late. I decided I needed a vacation after the big tape-out and a bunch of other important deadlines, so hb, caustik, str1d3r and I headed out for the big .hk and .jp for a little asian adventure. It was a rollicking good time. It was my first time to Hong Kong. It’s an interesting place with a beautiful skyline, but I’ll have to say it’s not my favorite place to visit–the food wasn’t as good as I had hoped it to be, and the city is a little dirty/seedy in some places, although the shopping is pretty good if you’re into that kind of thing. We met up with Alex Kampl and the Lik-Sang crew while we were out there, which was a lot of fun–thanks to Alex for showing us a good night out, and giving us a tour of the Lik Sang facilities!

Japan was a great time as always. This was my fifth time out in Japan, and we went to Asakusa (where we stayed at the Shigetsu Ryokan), Ginza (Sony building), Shinjuku (all around great city, home base, and home to many good restaraunts), Harajuku (Takeshita Dori, great people-watching spot), Shibuya (Xbox 360 Lounge and the main Shibuya drag), Roppongi (clubbing (saw Yoji Biomehanika live at Velfarre) and bar-hopping), Akihabara (electronics town, of course!), Yoyogi Park (cosplay and people watching on a Sunday), Tsukiji Fish Market, Odaiba, and the Ooedo Onsen Monogatari (a hot-bath theme park, which is a really great way to wind up a long trip). There were too many adventures to list here, but it was a great time…Tokyo is an awesome city!

Cosplay in Yoyogi park, おもしろい ね!

HP2600 serial numbers

Wednesday, November 2nd, 2005

Well, it’s been a while since I’ve had a little free time to look at removing watermarks from my printer. Such is the life cycle of a spare time project.

Patrick Murphy did some excellent analysis on the engine board EEPROM, and discovered things such as regular checksum bits and so forth. For those who do not know, Patrick did a lot of the work for the DocuColor tracking dot decoding guide on the EFF’s website.

Long story short, after poking at the engine board EEPROM for a while, he guessed there was no serial number there. It turns out that he is correct. The engine board EEPROM contained only calibration data. So, I soldered the original EEPROM back on and took off the front-end board’s EEPROM. And lo! Here’s the top of the contents of the front-end board’s 64kbit EEPROM:

00000000: fdb8 0000 0001 0000 0000 0000 0000 0043  ...............C
00000010: 4e42 4335 354c 3051 4a00 0000 03f0 2e17  NBC55L0QJ.......
00000020: 0409 4639 3232 314d 3900 0000 0000 0000  ..F9221M9.......
00000030: 0000 0048 6577 6c65 7474 2d50 6163 6b61  ...Hewlett-Packa
00000040: 7264 0000 0000 0000 0000 0000 4850 2043  rd..........HP C
00000050: 6f6c 6f72 204c 6173 6572 4a65 7420 3236  olor LaserJet 26
00000060: 3030 6e00 0000 0000 0000 0000 0000 4850  00n...........HP
00000070: 2043 6f6c 6f72 204c 6173 6572 4a65 7420   Color LaserJet 
00000080: 3236 3030 6e00 0000 0000 0000 0000 0000  2600n...........

Pretty cool, huh? The serial number and a bunch of other data is stored there in plaintext. I’ve been wrong before and I’ll be wrong again. So much to learn, so much to do!

It looks like there is a bit pattern stored in the ROM a bit further down as well that might be the watermark:

00000110: 0000 0000 0000 0000 0000 0000 0100 0000  ................
00000120: 0114 0000 0000 0000 0100 0000 0200 0001  ................
00000130: 0200 0001 0400 0001 0500 0001 0600 0001  ................
00000140: 0900 0001 0b00 0001 0c00 0001 0d00 0001  ................
00000150: 0e00 0001 1400 0001 1500 0001 1600 0002  ................
00000160: 0000 0002 0100 0002 0200 0002 0300 0002  ................
00000170: 0400 0000 0000 0000 0100 0000 0200 0001  ................
00000180: 0200 0000 0100 0001 0500 0001 0600 0001  ................
00000190: 0900 0001 0b00 0001 0c00 0001 0d00 0001  ................
000001a0: 0e00 0001 1400 0001 1500 0001 1600 0000  ................
000001b0: 0100 0000 0100 0000 0100 0000 0100 0000  ................

Hmm, even further down there looks to be some semi-regular binary codes. I hope those aren’t checksums. 0x603-0x1FFF is all 0’s, so it’s a pretty empty device. I’ll tweak with it a bit over the next month or so, still pretty busy these days, unfortunately.