pixma

What is this?

Some little tools to unpack firmware of Canon PIXMA series for analysis.

Motivation

Some Pixma printer is unable to reset the Waste Ink counter and refuses to print now, even though waste ink container has been swapped out. So I was curious about the inner workings of the firmware to find a clue on how to reset the counter. But I soon gave up on it. Nevertheless, it has been interesting and maybe this is useful for other researchers? Basically, I just implemented what has been described at https://www.contextis.com/en/blog/hacking-canon-pixma-printers-doomed-encryption

How to use?

1. Download firmware Check the USB device ID of the Pixma printer, i.e. 04a9:1769 Then downlod the firmware by placing the device ID instead of 1769 in the following command:

wget wget -O - -o /dev/null http://gdlp01.c-wss.com/rmds/ij/ijd/ijdupdate/1769.xml | sed -n 's:.*<url>\(.*\)</url>.*:\1:p'

2. Now decrypt firmware, and decode SREC file to binary You need srec_cat from srecord tools for this, i.e. srecord-1.64: http://srecord.sourceforge.net/

./pixma_decrypt 1769V1100AN.bin decoded.asc grep -v -e '^SF' decoded.asc | srec_cat -o decoded.bin -binary

3. Now you can try to unpack the payload: ./pixma_unpack decoded.bin firmware.bin

Decrypt sdata.bin

If you want to decrypt certificate data (for whatever reason you want to do this... It's just a certificate list for trusted CAs, so no idea why this even has been "crypted"):

wget http://dtv-p.c-ij.com/sdata/struct01/sdata.bin ./dec_sdata sdata.bin sdata.dec