CAPT commands documentation #52

ValdikSS · 2026-05-18T01:05:58Z

ValdikSS
May 18, 2026

I'm slowly reverse-engineering captmon2 monitor binary which handles LBP-2900, LBP-3000, LBP-3210 and LBP-3600.

In this document, all data starts with byte 1, not byte 0!

Commands

0xA0A1 GetInputStatus

Request: empty

Response:

1  2  3  4  5  6  7  8  9  10 11 12 13 14 15 16 17 18
-----------------------------------------------------
00 10 d0 00 00 02 b0 09 b3 0d 96 00 fd 01 00 00 00 00

Byte 01: error if any bit it set
Byte 02: byte2 >> 4 is a number of input slots - 1. Example: 0x10: 16 >> 4 = 1, 2 slots.

if ( (byte2 & 0xF0) != 0 ) {
    Parse all other bytes until byte2 >> 4 > i
}
…

Byte 03: Flags ?? Used in paper selection code for LBP3600 printer model (DevID 2230), all other models have media_input_cassette=0
Byte 04: Unk1 ??
Byte 05: Unk2 ??
Byte 06: PaperSize ID
Short 07-08: Width (in pixels as in 300dpi)
Short 09-10: Height (in pixels as in 300dpi)
Short 11-12: Unk3 ??
Byte 13: Unk4 ??
Byte 14: Type ??
Byte 15: Flags2 ??

Repeat the parsing loop for each slot (byte 2)

0xE0A0 GetBasicStatus

Request: empty

Response:

1  2  3  4  5  6  7  8 
-----------------------
04 88 00 00 0f 00 00 00

Byte 01: byte flag mask
- & 0x01 RCF_PRINTER_FREE
- & 0x02 RCF_NOTREADY
- & 0x04 CMD_BUSY
- & 0x08 IM_DATA_BUSY
- & 0x10 RCF_OFFLINE
- & 0x40 UNIT_FREE
- & 0x80 ERROR_BIT
Byte 02:
- & 0x02 need to call GetInputStatus
- & 0x01 something has changed in ExtendedStatus, call it and check what has changed.
Byte 03: Unk
Byte 04: Unk
Short 05-06: Number of 0xC0CA IC_VIDEO_DATA FIFO buffers of GetPrinterInfo_Blk amount left. Maximum is 0x0F (if buffers available are more than 0x0F, then sending IC_VIDEO_DATA blocks won't decrease the counter until it reach 0x0F): (short5_6 & 0xF) * (GetPrinterInfo_Buf << 15) / 15
Byte 7, 8: Unk

0xA1A1 GetPrinterInfo

Request: empty

Response:

1  2  3  4  5  6  7  8  9  10 11 12 13 14 15 16
-----------------------------------------------
00 0b 30 2a 01 01 f0 ff 40 00 04 00 40 00 01 00


17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
-----------------------------------------------
48 03 00 00 6f 08 00 00 e4 0d 00 00 00 00 00 00


33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48
-----------------------------------------------
fa 02 00 00 f6 04 00 00 28 3c 32 32 58 02 58 02


49 50 51 52
-----------
15 03 02 00

Byte 1,2: Unk
Short 3-4: DevID, Device ID
Byte 5-6: Unk
Short 7-8: Blk, Maximum single block size for raster data (0xC0CA IC_VIDEO_DATA)
Short 9-10: Buf, Maximum buffer size (<<15 to get RAM amount)
Byte 11: PFlags ??
Byte 12: NumC ??
Short 13-14: Unk
Byte 15: Unk
Byte 16: Unk

The driver checks if the answer size > 55, but other bytes are not read by the driver.

0xA0A8 GetExtendedStatus

Request: empty

Response:

1  2  3  4  5  6  7  8  9  10 11 12 13 14 15 16
-----------------------------------------------
00 88 00 00 0f 00 00 00 84 00 80 00 00 00 01 00


17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
-----------------------------------------------
00 00 00 00 00 00 00 00 57 00 00 00 01 00 00 00


33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48
-----------------------------------------------
00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00

49 50 51 52
-----------
00 00 00 00

Byte 01(Bas): Basic status flag mask, should be the same as GetBasicStatus
- & 0x01 RCF_PRINTER_FREE
- & 0x02 RCF_NOTREADY
- & 0x04 CMD_BUSY
- & 0x08 IM_DATA_BUSY
- & 0x10 RCF_OFFLINE
- & 0x40 UNIT_FREE
- & 0x80 ERROR_BIT
Byte 02 (Bas1): Secondary basic status flags
- & 0x02 call GetInputStatus when set
Byte 03 (Bas2): Unk
Byte 04: Unk
Short 05-06: 0xC0CA IC_VIDEO_DATA FIFO buffer usage/capacity: (short5_6 & 0xF) * (GetPrinterInfo_Buf << 15) / 15
Byte 07: Unk
Byte 08: Unused
Byte 09 bAuxStatus Auxiliary engine status flags
- & 0x02 RCF_PRINTER_BUSY
- & 0x04 RCF_PAPER_DELIVERY
- & 0x80 RCF_SAFE_TIMER (motor is working)
Byte 10 bControllerStatus Engine communication/data flags
- & 0x01 RCF_OVERRUN
- & 0x02 RCF_UNDERRUN
- & 0x04 RCF_MISSING_EOP
- & 0x08 RCF_INVALID_DATA
- & 0x10 RCF_ENGINE_COMM_ERROR
- & 0x20 RCF_ENGINE_RESET_INPROGRESS
- & 0x40 RCF_PRINT_REJECTED
Byte 11 (Pap): bPaperAvailableBits

if ( (bPaperAvailableBits & (128 >> mediasourceinput)) == 0 )
    printf_debug("bPaperAvailableBits & 0x80, No paper in Slot #%d", mediasourceinput);

Used in paper selection code for unknown printer model (DevID 2230), all other models have media_input_cassette=0

Byte 12 (Cnt2): bControllerStatus2
Short 13-14 wEngineReadyStatus
- & 0x0002 RCF_SERVICE_CALL
- & 0x0004 RCF_CLEANING
- & 0x0008 Something is illegally connected, need 0xA2A7 illegal connection status check
- if IllegalConnectionStatus:
  - & 0x1000 RCF_WAITING
  - & 0x2000 RCF_IC_DUPLEX, probably duplex unit incorrectly installed
  - & 0x4000 RCF_IC_ANYCASSETTE
  - & 0x0400 RCF_TEST_PRINTING
  - & 0x0100 RCF_JAM
- & 0x2000 RCF_NO_CARTRIDGE
- & 0x4000 RCF_DOOR_OPEN
Short 15-16 (Start): Page number being decoded/started
Short 17-18 (Printing): Page number currently printing
Short 19-20 (Shipped): Page number being pushed out
Short 21-22 (Printed): Page number completed
Byte 23: if 0x3e, PrintingMode is selected from another MediaTable
Byte 24: unused
Byte 25 (LED): LED/indicator status, possibly used as just internal status signalling mechanism, absolute numbers probably don't matter
Byte 26: Unk
Byte 27 (Cov): Used in paper selection code for unknown printer model (DevID 2230), all other models have media_input_cassette=0
Bytes 28-36: Unk
Long 37-40 dwHostDetectError_36_39
- & 0x4 PCF_SETCLEANINGPAGE
Long 41-45 dwHostDetectError_40_44 unk
Long 46-49 dwHostDetectError_45_48 unk
Bytes 50, 51, 52 unused

0xA2A0 ReserveUnit

Request:

1  2  3  4  5  6  7  8
-----------------------
00 00 00 00 00 00 00 00

All zeros, hardcoded.

Response:

1  2  3  4
-----------
00 00 01 00

Byte 1: error flag
Byte 2: unused
Short 3-4: Job ID (used in 0xE1A1 SetJobInfo2)

0xE0A9 ReleaseUnit

Request:

1  2
-----
01 00

Short 1-2: Job ID (previously acuired by 0xA2A0 ReserveUnit)

Response:

1  2
-----
00 00

Byte 1: error flag

0xE1A1 SetJobInfo2

Request:

1  2  3  4  5  6  7  8  9  10 11 12 13 14 15 16
------------------------------------------------
00 00 00 00 00 00 00 00 1c 00 12 00 20 00 00 00


17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
-----------------------------------------------
03 01 01 00 00 00 00 00 ea 07 04 11 02 0b 3b 00


33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48
-----------------------------------------------
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64
-----------------------------------------------
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


65 66 67 68 69 70 71 72
-----------------------
00 00 00 00 00 00 00 00

Linux driver uses fixed size of 76 (72 for payload) length, even
if it has the code to add hostname, username, and job name to the job,
this seems to be broken, at least for me. And with hardcoded cmd size
I don't know how it is expected to work. WinXP driver sends everything correctly.

Short 1-2: hard-coded 0
Short 3-4: hard-coded 0
Long 5-8: hard-coded 0
Short 9-10: UTF16 memlen of hostname
Short 11-12: UTF16 memlen of username
Short 13-14: UTF16 memlen of job name
Short 15-16: hard-coded 0
Byte 17: job flag
- 1 - job start
- 2 - job continuation
- 3 - job end
- 4 - job abort?
- 6 - windows driver uses this instead of 3 for job end
Byte 18: number-up
Short 19-20: JobID from ReserveUnit
Short 21-22: UTC Timezone offset in minutes compared to local timezone
- +300 for UTC-5
- -180 for UTC+3
Short 23-24: The same timezone value again
Short 25-26: Job year
Byte 27: Job month
Byte 28: Job day
Byte 29: Job hour
Byte 30: Job minute
Byte 31: Job second
Byte 32-72: hard-coded 0
Bytes after 72: UTF16 hostname, UTF16 username, UTF16 job name. Could be omitted if corresponding shorts are 0

Response:

1  2
-----
00 00

Byte 1: error flag
Byte 2: unused

0xE1A2 SetLEDStatus

This one, despite the name, does not control only LEDs, and apparently
does not only control GPIOs as Alexey assumed as well.

Request:

1  2  3  4  5  6  7  8  9  10 11 12
-----------------------------------
16 00 00 00 00 00 00 00 00 00 00 00

Byte 1: Linux driver sends its internal state (error_code) to the printer. WinXP does not use it.

0x16 = PrinterReadyToPrint

Format:
<int_status, hs_code, led_code, error_code, errorstring, errorstring2>

<0, 2, 1, 0, offset aCncheckingstat, offset aSCheckStatus>; 0 ; "CNCheckingStatus" ...
<5, 1, 0Ah, 0, offset aCnprinterportb, offset aSBusy>; 0 ; "CNPrinterPortBusy" ...
<8001h, 1, 0Bh, 0, offset aCnprintercomme, \ ; "CNPrinterCommError" ...
 offset aSCantComm>; 0
<8003h, 1, 14h, 0, offset aCnnomemory, \ ; "CNNoMemory" ...
 offset aSNoMemory>; 0
<8004h, 1, 1Eh, 19h, offset aCnservicecall, \ ; "CNServiceCall" ...
 offset aSServiceCall>; 0
<8, 0, 1Fh, 0Dh, offset aJam, offset aSJam>; 0 ; "Jam" ...
<10h, 0, 1Fh, 0Dh, offset aJam, offset aSJam2>; 0 ; "Jam" ...
<7, 0, 20h, 0Dh, offset aCoveropen, offset aSDoorOpen>; 0 ; "CoverOpen" ...
<0Ah, 1, 21h, 0Dh, offset aMarkertonercar, \ ; "MarkerTonerCartridgeMissing" ...
 offset aSNoCartridge>; 0
<8002h, 1, 28h, 0Dh, offset aCninvaliddata, \ ; "CNInvalidData" ...
 offset aSInvalidData>; 0
<9, 0, 29h, 35h, offset aInputmediasupp, \ ; "InputMediaSupplyEmpty" ...
 offset aSNoPaper>; 0
<0Eh, 0, 29h, 35h, offset aInputmediasupp, \ ; "InputMediaSupplyEmpty" ...
 offset aSNoPaper2>; 0
<0Bh, 1, 2Ah, 0Dh, offset aCndataxfererro, \ ; "CNDataXferError" ...
 offset aSXferError>; 0
<0Ch, 0, 2Bh, 35h, offset aCnchangepapers, \ ; "CNChangePaperSize" ...
 offset aSChangeSize>; 0
<0Fh, 0, 2Bh, 35h, offset aCnchangepapers, \ ; "CNChangePaperSize" ...
 offset aSChangeSize2>; 0
<0Dh, 0, 29h, 35h, offset aCncleaning, \ ; "CNCleaning" ...
 offset aSSetCleaningpa>; 0
<8005h, 1, 27h, 17h, offset aCncleaning, \ ; "CNCleaning" ...
 offset aSCleaning>; 0
<2, 2, 50h, 17h, offset aCnprinting, offset aSPrinting>; 0 ; "CNPrinting" ...
<3, 2, 50h, 17h, offset aCnprinting, \ ; "CNPrinting" ...
 offset aSPrintingCs>; 0
<4, 2, 51h, 17h, offset aCnpaused, offset aSPause>; 0 ; "CNPaused" ...
<6, 1, 64h, 0, offset aCnprinteroffli, offset aSOffline>; 0 ; "CNPrinterOffline" ...
<1, 2, 65h, 16h, offset aPrinterreadyto, offset aSReady>; 0 ; "PrinterReadyToPrint" ...
<8006h, 1, 3E7h, 0, offset aCnunknown, offset aSUnknown>; 0 ; "CNUnknown" ...
<11h, 0, 20h, 0Dh, offset aCoveropen, \ ; "CoverOpen" ...
 offset aSCoverOpenTone>; 0
<12h, 0, 20h, 0Dh, offset aCoveropen, \ ; "CoverOpen" ...
 offset aSCoverOpenTop>; 0
<13h, 0, 20h, 0Dh, offset aCoveropen, \ ; "CoverOpen" ...
 offset aSCoverOpenDupl>; 0
<14h, 0, 27h, 35h, offset aInputmediasupp, \ ; "InputMediaSupplyEmpty" ...
 offset aSCassetteOpen>; 0
<15h, 0, 1Fh, 0Dh, offset aIllegalconnect, \ ; "IllegalConnection" ...
 offset aSOptDuplex>; 0
<16h, 0, 1Fh, 0Dh, offset aIllegalconnect, \ ; "IllegalConnection" ...
 offset aSOptCassette>; 0

Byte 2: hard-coded 0
Byte 3: HS Code from the table below:
- int_status == 1 (PrinterReadyToPrint): hs_code = 0
- int_status == 4 (CNPaused): hs_code = 5
- int_status == 9 (InputMediaSupplyEmpty, no paper): hs_code = 1
- int_status == 11 (CNDataXferError): hs_code = 4
- int_status == 12 (CNChangePaperSize): hs_code = 2
- int_status == 2 (InputMediaSupplyEmpty, cassette open): hs_code = 7
Byte 4: papersize from tPaperSizeTbl (second parameter)
Byte 5: hard-coded 0 on Linux, could be 1 on WinXP
Byte 6: mediasourceinput (0 for DeviceID != 2230, don't know which printer is that)
Short 7-8: hard-coded 0
Long 9-12: Error code or flags. You will see these flags in ExtendedStatus Long 37-40 dwHostDetectError_36_39
- int_status == 1: flag = 0
- int_status == 4: flag = 0x1000000
- int_status == 9: flag = 0x10000
- int_status == 11: flag = 0x8000
- int_status == 12: flag = 0x80000
- int_status == 13: flag = 4
- int_status == 20: flag = 8

tPaperSizeTbl:

struc_8058D00 <8, 1, offset aSSizeA3>; 0
                        ; DATA XREF: LOAD:08048680↑o
                        ; .got:tPaperSizeTbl_ptr↑o
                        ; "s_size_a3"
struc_8058D00 <9, 2, offset aSSizeA4>; 0 ; "s_size_a4"
struc_8058D00 <0Bh, 3, offset aSSizeA5>; 0 ; "s_size_a5"
struc_8058D00 <0Ch, 6, offset aSSizeB4>; 0 ; "s_size_b4"
struc_8058D00 <0Dh, 7, offset aSSizeB5>; 0 ; "s_size_b5"
struc_8058D00 <7, 0Ah, offset aSSizeExecutive>; 0 ; "s_size_executive"
struc_8058D00 <5, 0Ch, offset aSSizeLegal>; 0 ; "s_size_legal"
struc_8058D00 <3, 0Bh, offset aSSizeLedger>; 0 ; "s_size_ledger"
struc_8058D00 <1, 0Dh, offset aSSizeLetter>; 0 ; "s_size_letter"
struc_8058D00 <2Bh, 0Eh, offset aSSizePostcard>; 0 ; "s_size_postcard"
struc_8058D00 <52h, 0Fh, offset aSSizeDblPostca>; 0 ; "s_size_dbl_postcard"
struc_8058D00 <1Ch, 15h, offset aSSizeEnvC5>; 0 ; "s_size_env_c5"
struc_8058D00 <14h, 16h, offset aSSizeEnv10>; 0 ; "s_size_env_10"
struc_8058D00 <25h, 17h, offset aSSizeEnvMonarc>; 0 ; "s_size_env_monarch"
struc_8058D00 <1Bh, 18h, offset aSSizeEnvDl>; 0 ; "s_size_env_dl"
struc_8058D00 <22h, 19h, offset aSSizeEnvB5>; 0 ; "s_size_env_b5"
struc_8058D00 <5Bh, 1Ah, offset aSSizeEnvY4>; 0 ; "s_size_env_y4"
struc_8058D00 <1Fh, 1Ch, offset aSSizeEnvY2>; 0 ; "s_size_env_y2"
struc_8058D00 <47h, 1Bh, offset aSSizeEnvK2>; 0 ; "s_size_env_k2"
struc_8058D00 <10CCh, 37h, offset aSSize4x1Postca>; 0 ; "s_size_4x1_postcard"
struc_8058D00 <6, 3Ch, offset aSSizeStatement>; 0 ; "s_size_statement"
struc_8058D00 <23Ah, 40h, offset aSSizeIndexcard>; 0 ; "s_size_indexcard"

Response:

1  2
-----
00 00

Byte 1: error flag
Byte 2: unused

mounaiban · 2026-05-23T15:08:23Z

mounaiban
May 23, 2026
Maintainer

Thanks for going the extra mile on sussing out the details.

On GetPrinterInfo/0xA1A1

Were you using an LBP3000?
On my device the response payload begins with 00 0b 30 2a 02 00 which is different from yours: 00 0b 30 2a 01 01, while the rest is the same.

Response size > 55 might be a cheap way of checking if the response is CAPT 2.1 (56B) or CAPT 3.x (64B).

I guess you figured out the block size and buffer size before I could but I was so close! I'll update the details in agalakhov#38 soon..

Meanwhile, I suspect PFlags to indicate whether a device supports colour printing, networking, paper trays and so on, and that the format changed between CAPT 2.0 and CAPT 2.1. We need info from more devices...

On ReserveUnit/0xA2A0, ReleaseUnit/0xE0A9 and SetJobInfo/0xE1A1

These commands look like they're part of some kind of network support, even USB-only CAPT printers have network capability when used with the Canon-official Axis Ethernet dongles and the NetSpot manager software.

1 reply

ValdikSS May 23, 2026
Author

Were you using an LBP3000?

Yes.
I've improved the driver, and the specs have been improved by LLM from my parsed traffic dumps.
Take a look:
https://github.com/ValdikSS/captdriver/tree/val/info

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CAPT commands documentation #52

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

CAPT commands documentation #52

Uh oh!

Uh oh!

ValdikSS May 18, 2026

Commands

0xA0A1 GetInputStatus

0xE0A0 GetBasicStatus

0xA1A1 GetPrinterInfo

0xA0A8 GetExtendedStatus

0xA2A0 ReserveUnit

0xE0A9 ReleaseUnit

0xE1A1 SetJobInfo2

0xE1A2 SetLEDStatus

Replies: 1 comment · 1 reply

Uh oh!

mounaiban May 23, 2026 Maintainer

Uh oh!

ValdikSS May 23, 2026 Author

ValdikSS
May 18, 2026

Replies: 1 comment 1 reply

mounaiban
May 23, 2026
Maintainer

ValdikSS May 23, 2026
Author