-
Notifications
You must be signed in to change notification settings - Fork 0
/
PROTO
315 lines (280 loc) · 16.2 KB
/
PROTO
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
== Previous Work ==
USB protocol here: http://da.vidr.cc/2010/07/17/reverse-engineering-the-brother-mfc-7400c/ appears extremely similar.
SF has a sane-driver for usb connected scanners, and a bit of code to handle
network interfaced ones.
== Protocol ==
Upon connecting to the scanner, it will send a status string. Observed
possibilities: "+OK 200" or "-NG 401" (appears to indicate the scanner is in
use, returned if a retry scan occurs too quickly). Both are followed by the
bytes 0x03, 0x0a.
The computer may then send request packets to the scanner, each of which will
recieve a response.
Each request packet sent to the scanner starts with a 0x1b and ends with 0x80.
It contains a sequence of fields composed of ASCII characters. Each field
within a request packet packet is ended with a new line ('\n', 0x0a),
including the final field in the packet.
The first field in the request packet appears to identify the type of the
request packet. They are a single ASCII character. All other fields are a
single ASCII character followed by an equals sign ('='), followed by 1 or more
values delimited by commas.
Known request packet types:
P = pallet data? Scanner responds with non-ascii data and then driver closes
connection, see photo-600x600-256color-w2634px-h5112px-not_at_center.
Potentially pallet data, as this was for 256 color mode.
I = information request? Contains R and M. Scanner responds with a packet
starting with 0x1b 0x00 followed by 7 comma delimited values.
x_res,y_res,?,?,total possible x pixels,?,total possible y pixels.
On the mfc-7820n, the total possible pixel fields indicate the scan bed
size is 8.2666 inches by 13.62166 inches. Actual measurment shows it to
be 9 by 12. Possible misinterp of fields. Also: the mfc-7820n can scan
documents of arbirary length by using its automatic document feeder. The
ratio of field 4 ("total possible x pixels") over x_res (field 0) is
constant through mode & resolution changes. The same is true for the "y"
pair.
X = initiate scan. Contains R, M, C, B, N, A, D. (SF driver uses args:
R,M,C,B,N,U,P,A).
Q (from sf driver) = query capabilities. No arguments. Returns a array of bytes.
magic[2]; size; res1; signalType; colorType; ntsc[2]; pal[2];
secam[2]; hwType; hwVersion; dpi; res2; res3[256];
magic[0] is expected to be 0xC1. No other bytes are examined.
R (from sf driver) = cancel scan. No arguments. No returned data.
Fields:
M = mode. CGRAY = color, ERRDIF = grey (error diffusion), C256 = 256 color,
B = brightness. values from 0 to 100. Default is 50.
N = contrast. values from 0 to 100. Default is 50.
A = area to scan. 4 values. x_left,y_top,x_right,y_bottom.
D = dithering???. Values: "SIN"
C = compression? Values: RLENGTH = run length? (details unknown. Have yet to
observe compressed data). NONE = raw (from usb protocol linked above).
JPEG = from sf driver, noted that no JPEG compression was observed.
R = resolution. 2 values. X,Y . Observed 9600x9600 - 100x100 (all in 100x
steps) going via a I request. Scanner responded with 2400x600.
U (from sf driver) = "autofeeder, etc.?", value "OFF" used in usb driver,
"ON" in network code.
P (from sf driver) = Not documented. value = "OFF".
Image Data Types:
USB guy: 0x40(@)=gray, 0x44(D)=red, 0x48(H)=green, 0x4c(L)=blue
'\', 0x5c = 256 color: 2byte le length followed by a byte representing a color.
'B', 0x42 = black & white. 2 byte le byte count. Encoding of bytes unknown.
Scan Terminators:
USB doc: 0xc200 - there is nothing to scan?
0x81 - finished, another page waiting.
0x80 - finished.
SNMP is used to set up the "Scan Button" functionality (it sends the IP address to contact in various cases). It also can retrieve a status string ("Scanning").
Durring install of the drivers on windows, a broadcast smtp v1 get-request w/community=public is sent with 5 items:
1.3.6.1.4.1.2435.2.3.9.1.1.7.0: 4d46473a42726f746865723b434d443a504a4c2c50434c2c...
SNMPv2-SMI::enterprises.2435.2.3.9.1.1.7.0
1.3.6.1.2.1.1.5.0: 42524e5f383639393637
SNMPv2-MIB::sysName.0
1.3.6.1.2.1.2.2.1.6.1: 008077869967
IF-MIB::ifPhysAddress.1
1.3.6.1.4.1.2435.2.4.3.1240.1.3.0: (Integer32) 2198
SNMPv2-SMI::enterprises.2435.2.4.3.1240.1.3.0
1.3.6.1.2.1.1.1.0: 42726f74686572204e432d36323030682c204669726d7761...
SNMPv2-MIB::sysDescr.0
The MFC-7280N responds with the above values.
All but the noted item are OctetStrings.
More detail:
1.3.6.1.4.1.2435.2.3.9.1.1.7.0: "MFG:Brother;CMD:PJL,PCL,PCLXL,POSTSCRIPT;MDL:MFC-7820N;CLS:PRINTER;"
"BRN_869967"
(binary)
(binary)
"Brother NC-6200h, Firmware Ver.H ,MID 8C5-A15,FID 2"
0000 42 72 6f 74 68 65 72 20 4e 43 2d 36 32 30 30 68 Brother NC-6200h
0010 2c 20 46 69 72 6d 77 61 72 65 20 56 65 72 2e 48 , Firmware Ver.H
0020 20 20 2c 4d 49 44 20 38 43 35 2d 41 31 35 2c 46 ,MID 8C5-A15,F
0030 49 44 20 32 ID 2
Next, 2 directed smtp v1 get-requests occur:
1.3.6.1.4.1.2435.2.3.9.2.101.3.11.2.0: (Integer32) 1
1.3.6.1.4.1.2435.2.3.9.2.101.3.12.2.0: (Integer32) 1
[Result values are from MFC-7280N]
{{{
When setting up the scanning buttons, 2 directed smtp v1 get-requests w/community=internal:
1.3.6.1.2.1.43.5.1.1.2.1: (Integer32) 1
SNMPv2-SMI::mib-2.43.5.1.1.2.1
"Button Rows"?
1.3.6.1.2.1.43.7.1.1.4.1.1: (Integer32) 4
SNMPv2-SMI::mib-2.43.7.1.1.4.1.1
"Button Columns"?
Followed by a (single) set-request (community = internal):
1.3.6.1.4.1.2435.2.3.9.2.11.1.1.0: 545950453d42523b425554544f4e3d5343414e3b55534552...
TYPE=BR;BUTTON=SCAN;USER="user-PC";FUNC=IMAGE;HOST=192.168.123.104:54925;APPNUM=1;DURATION=360;
1.3.6.1.4.1.2435.2.3.9.2.11.1.1.0: 545950453d42523b425554544f4e3d5343414e3b55534552...
TYPE=BR;BUTTON=SCAN;USER="user-PC";FUNC=OCR;HOST=192.168.123.104:54925;APPNUM=3;DURATION=360;
1.3.6.1.4.1.2435.2.3.9.2.11.1.1.0: 545950453d42523b425554544f4e3d5343414e3b55534552...
TYPE=BR;BUTTON=SCAN;USER="user-PC";FUNC=EMAIL;HOST=192.168.123.104:54925;APPNUM=2;DURATION=360;
1.3.6.1.4.1.2435.2.3.9.2.11.1.1.0: 545950453d42523b425554544f4e3d5343414e3b55534552...
TYPE=BR;BUTTON=SCAN;USER="user-PC";FUNC=FILE;HOST=192.168.123.104:54925;APPNUM=5;DURATION=360;
}}}
Then another get-request (comunity=public) (purpose unknown).
1.3.6.1.2.1.25.3.2.1.5.1: (Integer32) 2
HOST-RESOURCES-MIB::hrDeviceStatus.1
1.3.6.1.2.1.25.3.5.1.1.1: (Integer32) 1
HOST-RESOURCES-MIB::hrPrinterStatus.1
1.3.6.1.2.1.25.3.5.1.2.1: (OctetString) 00
HOST-RESOURCES-MIB::hrPrinterDetectedErrorState.1
The above sequece to set up the scanning buttons is repeated ~150 seconds after the first.
----- "Photo", Color 256, 600x600, width=2634px, hieght=5112px. Not centered (scan area was a box in the middle).
>
+OK 200
<
0000 1b 49 0a 52 3d 36 30 30 2c 36 30 30 0a 4d 3d 43 .I.R=600,600.M=C
0010 32 35 36 0a 80 256..
>
0000 1b 00 36 30 30 2c 36 30 30 2c 32 2c 32 30 39 2c ..600,600,2,209,
0010 34 39 36 30 2c 33 34 36 2c 38 31 37 33 4960,346,8173
<
0000 1b 58 0a 52 3d 36 30 30 2c 36 30 30 0a 4d 3d 43 .X.R=600,600.M=C
0010 32 35 36 0a 43 3d 52 4c 45 4e 47 54 48 0a 42 3d 256.C=RLENGTH.B=
0020 35 30 0a 4e 3d 35 30 0a 41 3d 31 33 38 36 2c 31 50.N=50.A=1386,1
0030 30 32 36 2c 34 30 32 36 2c 36 31 33 38 0a 44 3d 026,4026,6138.D=
0040 53 49 4e 0a 80 SIN..
# Note that 4026-1386 = 2640 ~= 2634, which was the requested width.
# 6138 - 1026 = 5112 = 5112, the requested height.
# Image data
5c 50 0a ff ff ff ... # \xff repeated 2640 (0x0A50, le= 0x500A) times.
5c 50 0a ff ff ff ... # \x5c = indicates "image data"?
...
# Terminator.
80
-----
----- web, black & white, 9600x9600, width = 8064, height = 8640
>
0000 2b 4f 4b 20 32 30 30 0d 0a +OK 200..
<
0000 1b 49 0a 52 3d 39 36 30 30 2c 39 36 30 30 0a 4d .I.R=9600,9600.M
0010 3d 54 45 58 54 0a 80 =TEXT..
>
0000 1d 00 36 30 30 2c 32 34 30 30 2c 32 2c 32 30 39 ..600,2400,2,209
0010 2c 34 39 36 30 2c 33 34 36 2c 33 32 36 39 32 ,4960,346,32692
<
0000 1b 58 0a 52 3d 36 30 30 2c 32 34 30 30 0a 4d 3d .X.R=600,2400.M=
0010 54 45 58 54 0a 43 3d 52 4c 45 4e 47 54 48 0a 42 TEXT.C=RLENGTH.B
0020 3d 35 30 0a 4e 3d 31 32 0a 41 3d 31 38 31 38 2c =50.N=12.A=1818,
0030 35 34 30 30 2c 32 33 33 30 2c 37 35 36 30 0a 44 5400,2330,7560.D
0040 3d 53 49 4e 0a 80 =SIN..
>
# width = 2330 - 1818 = 256.
42 02 00 c1 00 42 02 00 c1 00 42 02 00 c1 00 42 02 00 c1
...
<
80
-----
## How to read this document:
> = from printer
< = to printer
# = note
Scanning (this was a mostly white scan with no paper loaded):
Connect on TCP port 54921 (after a bunch of SNMP)
# Ident
> 2b 4f 4b 20 32 30 30 0d 0a
+ O K 2 0 0 \x0d \x0a
# Request to Scan @ resolution 300x300 (What is M?)
< 1b490a523d3330302c3330300a4d3d43475241590a80
I
R=300,300
M=CGRAY
> 1b003330302c3330302c322c3230392c323438302c3334362c34303836
0000 1b 00 33 30 30 2c 33 30 30 2c 32 2c 32 30 39 2c ..300,300,2,209,
0010 32 34 38 30 2c 33 34 36 2c 34 30 38 36 2480,346,4086
<
0000 1b 58 0a 52 3d 33 30 30 2c 33 30 30 0a 4d 3d 43 .X.R=300,300.M=C
0010 47 52 41 59 0a 43 3d 52 4c 45 4e 47 54 48 0a 42 GRAY.C=RLENGTH.B
0020 3d 35 30 0a 4e 3d 35 30 0a 41 3d 30 2c 30 2c 32 =50.N=50.A=0,0,2
0030 34 38 30 2c 33 32 32 39 0a 44 3d 53 49 4e 0a 80 480,3229.D=SIN..
> # note \x44 is a type, 0x09b0 (2480) is the length.
0000 44 b0 09 cb d2 e4 eb f2 f1 f8 fa fb fa fa fd ff D...............
0010 fe fd ff fe fd ff fc ff fd fd fe fc ff ff fd ff ................
0020 ff ff ff ff fd ff ff ff ff ff ff ff ff fe ff ff ................
0030 ff ff ff fe fe fe ff fe ff ff fd fe ff ff ff ff ................
0040 fe ff fe ff ff ff ff ff ff ff ff fe fe fc fe ff ................
0050 ff fd fe ff fe ff fe ff ff ff fe ff ff ff fd ff ................
0060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ................
0070 ff ff fd fb fe fd fd ff fd fe fe fd ff fe ff ff ................
0080 ff ff fe fd ff ff ff ff ff ff ff ff ff ff ff ff ................
0090 ff ff ff ff ff ff ff ff fd ff ff ff ff ff ff fe ................
00a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
00b0 ff ff ff ff ff ff ff ff ff ff fd ff ff ff ff ff ................
00c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
00d0 ff ff ff ff ff fe ff fd ff ff fd ff ff ff ff ff ................
00e0 ff ff ff fe ff ff fe fd ff ff ff ff ff fd ff ff ................
00f0 ff ff ff fd fe fd fe ff ff ff fe ff fe fe ff fe ................
0100 ff fd ff ff ff ff ff ff fd ff fe fe ff ff ff ff ................
0110 ff ff ff fd fe fe ff fd ff ff fe fe ff ff fd ff ................
0120 ff ff ff ff fd fe ff fd ff ff ff ff fe fe ff ff ................
0130 ff ff ff ff fe ff fe fe ff ff ff ff fe ff f8 f7 ................
0140 fb fe fe fd ff fe fe fe ff fe ff fd ff ff ff ff ................
0150 ff ff ff ff ff ff fe ff fe ff ff ff ff ff ff ff ................
0160 fe ff ff fe fd fe fe ff ff ff ff fe fe fc fc fe ................
0170 fe ff fe ff fd ff ff ff fd fe fc fd fd fc fc fc ................
0180 fd fd fd fe fe fd ff fd fd fe fd fe fd fe ff ff ................
0190 fe fc fd ff fe fe fe ff fe fd ff fd fe fe ff fd ................
01a0 fe ff ff ff fe ff fd fc fe fe ff fc fc ff fd fc ................
01b0 fe fe ff fe fd fc fa ff fb fe ff fe fd ff fe ff ................
01c0 fd fd ff fe ff fd fd fe fd ff ff fc ff fd fd fd ................
01d0 fe fb fe fd ff fd ff fe fe fe fc fe fd fd fb fe ................
01e0 fe fe fe fe fc fc fe ff ff fb fd fe fd fd fd fb ................
01f0 fc ff fe fd fc fb fc fd fd fe fd fb ff fc fd ff ................
0200 fb fc fc fd fd fc fe fe ff fe fd fe ff ff fd fe ................
0210 fe fe fe fc fe ff fd fe fc fc fd fe fe fc ff fc ................
0220 fd ff ff fc ff fe fe fd ff fe ff ff ff ff fe ff ................
0230 ff ff ff fe fc fc fe ff ff ff ff fe ff ff ff ff ................
0240 fd ff fd fc ff ff ff fe fe fe fe ff fe ff fe fe ................
0250 ff ff ff fe ff ff fd fd fe fe ff fd fe ff ff fc ................
0260 fd fd fe fe fd fe fe fd fd ff fd fe fd fd fd fe ................
0270 ff ff fe ff fe fd fe fb fd fb fb fd fb fb fd fe ................
0280 ff fd fd fe fc fd fd fb ff fd ff fd fd ff ff fd ................
0290 ff fe fa fc fd ff fd fe ff ff fc ff fd fd fd fd ................
02a0 fc ff ff fe fd ff fd fe fe ff fe ff fe ff fe ff ................
02b0 ff fe ff fe fd fd ff ff ff fd fe ff fe ff ff fd ................
02c0 ff fe fd fe fe ff ff fc ff fe ff ff fe ff ff fd ................
02d0 ff ff fd fe ff fd fe fe fe ff ff ff ff ff ff ff ................
02e0 fa ff ff ff fe ff fd fd ff ff ff fb ff ff fd ff ................
02f0 fe ff ff fd ff fe ff fe ff fe ff ff fe ff ff fd ................
0300 ff fd fb ff fe ff fe ff ff ff ff ff fe fe ff ff ................
0310 ff ff ff ff ff fd fd fc ff ff fe ff ff ff ff fd ................
0320 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0330 ff ff ff fe ff ff fe ff fe ff ff ff ff ff fe ff ................
0340 ff fe ff ff ff ff ff ff ff fd fe ff ff ff ff ff ................
0350 ff fe ff ff fe ff fd ff ff ff ff ff ff ff ff ff ................
0360 ff fe ff ff ff ff ff fc fd ff ff ff ff fe ff ff ................
0370 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0380 ff ff ff ff ff ff ff fe ff ff fe ff ff ff ff ff ................
0390 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
03a0 ff ff ff ff ff ff ff ff fe ff ff ff ff ff ff fe ................
03b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
03c0 ff ff fe fd ff ff ff ff ff fd ff ff ff ff ff fe ................
03d0 ff fe ff ff ff ff ff fe ff ff ff ff ff ff ff ff ................
03e0 ff fc eb f7 ff ff ff ff ff ff ff ff ff fe ff ff ................
03f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0400 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0410 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0420 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0430 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0440 ff ff ff ff ff ff ff ff ff ff ff ff fe ff ff ff ................
0450 ff ff ff ff ff ff ff ff fe ff ff ff ff ff ff ff ................
0460 fd ff fd ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0470 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0480 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0490 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
04a0 ff ff ff ff ff ff ff ff fe ff ff ff ff ff ff ff ................
04b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
04c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
04d0 ff ff ff ff ff ff ff ff ff ff fe ff ff ff ff ff ................
04e0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
04f0 ff ff ff fe ff ff ff ff fe ff ff ff ff ff ff ff ................
0500 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0510 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0520 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0530 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0540 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0550 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0560 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0570 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0580 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
0590 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
05a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
05b0 ff ff ff ff ....
>> lots of packets, mostly full of 0xff
> \x80
< closing connection