David A Roberts

Reverse Engineering the Brother MFC-7400C

2010-07-17T00:00:00+10:00

I have an old Brother MFC-7400C, which doesn't work as a printer or fax machine anymore, but the document feeder makes it useful for scanning multi-page documents. Unfortunately, it doesn't seem to be supported under Linux, so I figured I'd try writing my own implementation by reverse engineering the scanning protocol.

SniffUSB was used for analysing the USB traffic. By obtaining logs whilst various operations are performed with the scanner, it is possible to determine the characteristics of the protocol relatively easily.

Reading the SniffUSB Logs

After installing the filter, logs were obtained for device initialisation, scanning with default settings with 0, 1, and 2 pages in the document feeder, as well as scanning with various other setting configurations with no pages in the feeder. After this, it is a matter of extracting the relevant information (the libusb Documentation and the USB 2.0 Specification, particularly sections 9.3 and 9.6, come in handy here). For example, in the following snippet of a control transfer:

[136533 ms]  >>>  URB 277 going down  >>> 
-- URB_FUNCTION_VENDOR_DEVICE:
  TransferFlags          = 00000003 (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 000000ff
  Request                 = 00000001
  Value                   = 00000002
  Index                   = 00000000
[136535 ms]  <<<  URB 277 coming back  <<< 
-- URB_FUNCTION_CONTROL_TRANSFER:
  TransferBufferMDL    = 81d6bc88
    00000000: 05 10 01 02 00

The following request characteristics can be extracted:

Data transfer direction = Device-to-host (IN)
Type = Vendor
Recipient = Device
Request = 0x01
Value = 0x02
Index = 0x00
Length = 0xff
Device responds 0x05 0x10 0x01 0x02 0x00

With libusb, this can be performed via the following call:

NUM_BYTES_READ = libusb_control_transfer(DEVICE_HANDLE,
        LIBUSB_ENDPOINT_IN |
        LIBUSB_REQUEST_TYPE_VENDOR |
        LIBUSB_RECIPIENT_DEVICE,
        0x01, 0x02, 0x00, BUFFER, 0xff, TIMEOUT);
/* BUFFER = { 0x05, 0x10, 0x01, 0x02, 0x00 } */

Similarly, the following outbound bulk transfer to endpoint number 3, with equivalent C code:

[692026 ms]  >>>  URB 3034 going down  >>> 
-- URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:
  PipeHandle           = 81d0d24c [endpoint 0x00000003]
  TransferFlags        = 00000002 (USBD_TRANSFER_DIRECTION_OUT, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 00000004
  TransferBuffer       = 00000000
  TransferBufferMDL    = 81e773b8
    00000000: 1b 58 0a 80

BUFFER = { 0x1b, 0x58, 0x0a, 0x80 };
libusb_bulk_transfer(DEVICE_HANDLE, LIBUSB_ENDPOINT_OUT | 0x03,
        BUFFER, 0x04, &NUM_BYTES_SENT, TIMEOUT);

And an inbound bulk transfer on endpoint number 4:

[137544 ms]  >>>  URB 284 going down  >>> 
-- URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:
  PipeHandle           = 81d0d26c [endpoint 0x00000084]
  TransferFlags        = 00000003 (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 00001000
[137545 ms]  <<<  URB 284 coming back  <<< 
-- URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:
  TransferBufferLength = 00000002
  TransferBufferMDL    = 81cf9dd0
    00000000: c2 00

libusb_bulk_transfer(DEVICE_HANDLE, LIBUSB_ENDPOINT_IN | 0x04,
        BUFFER, 0x1000, &NUM_BYTES_READ, TIMEOUT);
/* BUFFER = { 0xc2, 0x00 } */

From this, the following protocol characteristics can be determined:

While idling a control transfer is sent every 500ms (type=3,value=0,index=0,length=255), to which the device responds 0x04100300
Scanning is initiated with control transfer (type=1,value=2,index=0,length=255), device responds 0x0510010200
Configuration data sent to scanner with outbound bulk transfer (endpoint=3)
Image data is read from the scanner with inbound bulk transfer (endpoint=4,length=0x1000)
Scanning is ended with control transfer (type=2,value=2,index=0,length=255), device responds 0x0510020200

Configuration Data

The configuration data is an ASCII key=value string, which can be decoded with a few lines of Python:

# set dump to hexdump of configuration data
out = ''
for line in dump.strip().split('\n'):
    line = line[line.find(': ')+2:].strip()
    for byte in line.split():
        out = out + chr(int(byte, 16))
print repr(out)

Correlating various configurations with their respective configuration strings yields the following pattern: the string always begins with "\x1bX\n", followed by 7 key=value pairs each terminated by "\n", followed by "\x80". The following key=value combinations are available:

R=X_RESOLUTION,Y_RESOLUTION (where both resolutions must be a multiple of 100, with the x- and y-resolutions capped at 300 and 600 respectively)
M=CGRAY (color mode), M=GRAY64 (grey-scale mode), M=TEXT (text mode)
C=RLENGTH (run-length encoding?), C=NONE (uncompressed)
B=100
N=100
U=OFF
A=0,0,WIDTH,HEIGHT

Raw Image Data

Inbound bulk transfers usually contain a payload of raw image data, but the following message can also be received:

empty payload: wait 200ms and try again
0xc200: there is nothing to scan
0x80: finished scanning the page, no more pages
0x81: finished scanning the page, another page ready (in which case an empty configuration string is sent ("\x1bX\n\x80"), and the next page is scanned)

The uncompressed raw image data is relatively easy to decode. The following snippet shows a color scan of an 816 (0x330) pixel wide plain white image.

00000000: 44 30 03 fd fd fd fd fd fd fd fd fd fd fd fd fd
00000010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
...
00000320: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
00000330: fd fd fd 48 30 03 fd fd fd fd fd fd fd fd fd fd
00000340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
...
00000650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
00000660: fd fd fd fd fd fd 4c 30 03 fc fc fc fc fc fc fc
00000670: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
...
00000980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
00000990: fc fc fc fc fc fc fc fc fc 44 30 03 fd fd fd fd
000009a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
...
00000cb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
00000cc0: fd fd fd fd fd fd fd fd fd fd fd fd 48 30 03 fd
00000cd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
...

It can be seen that the data consists of a series of 816-byte rows each prefixed with a 3 byte header. The first byte of the header describes the type of the row (0x40=gray, 0x44=red, 0x48=green, 0x4c=blue), and the following two bytes describe the length of the row in little-endian format.

Protocol Implementation

Having gathered the necessary information, two C programs were written for communicating with the device and converting the raw image data to PNM:

LLJVM 0.2: C to JVM Bytecode Compiler

2009-12-31T00:00:00+10:00

LLJVM 0.2 has been released. Currently, there are 6 software packages known to work with LLJVM (7 including newlib): libjpeg, zlib, libpng, lua, datalog, and several utilities (banner, morse, number, pig) from bsd-games.

For further information, including a pre-compiled demonstration of the above packages, see the project page.

Open source Photosynth: PixelStruct 0.2 released

2009-09-18T00:00:00+10:00

PixelStruct 0.2 has been released. This version has two main changes from the previous version. Firstly, several new transition modes are available, allowing near seamless transition between photos. Secondly, various bugs have been fixed, allowing larger image sets to be viewed, such as the following 715-image reconstruction of Notre Dame.

For more information, including download links, please see the project homepage.

Converting videos to 3GP in Ubuntu Intrepid 8.10 with FFmpeg

2009-02-28T00:00:00+10:00

The default installation of FFmpeg in Ubuntu Intrepid 8.10 doesn't support conversion to 3GP. According to this, installing ubuntu-restricted-extras should fix this, but that didn't work in my case. So, you may need to manually install the required packages:

sudo aptitude install \
libavcodec-unstripped-51 \
libavdevice-unstripped-52 \
libavformat-unstripped-52 \
libavutil-unstripped-49 \
libpostproc-unstripped-51 \
libswscale-unstripped-0

Then, to convert a video, you can either go the command-line route:

ffmpeg -i input.mpg \
-vcodec h263 -s qcif -r 15 -b 100k \
-acodec libfaac -ac 1 -ar 32000 -ab 64k \
output.3gp

Which will convert to input.mpg to output.3gp with:

H.263 video codec
QCIF video resolution (176x144)
15fps
100 kb/s video bitrate
AAC audio codec (through libfaac)
1 audio channel
32000 Hz audio sampling frequency
64 kb/s audio bitrate

Alternatively, if you prefer using a GUI, you can try Mobile Media Converter (direct link to v.1.4.1 .deb), which seems to work pretty well, and also supports downloading videos directly from YouTube.

Command-line scanning

2008-12-07T00:00:00+10:00

First you need to find the ID of the required device:

scanimage -L

Output:

device `v4l:/dev/video0' is a Noname Acer CrystalEye webcam virtual device
device `net:linux-box.local:hpaio:/usb/Photosmart_C4100_series?serial=XXXXXXXXXXXXXX' is a Hewlett-Packard Photosmart_C4100_series all-in-one

In this case the device ID is net:linux-box.local:hpaio:/usb/Photosmart_C4100_series?serial=XXXXXXXXXXXXXX Then, for colour scanning:

scanimage -d "net:linux-box.local:hpaio:/usb/Photosmart_C4100_series?serial=XXXXXXXXXXXXXX" \
--mode Color --resolution 300dpi | pnmtopng - > image.png

Or for greyscale scanning:

scanimage -d "net:linux-box.local:hpaio:/usb/Photosmart_C4100_series?serial=XXXXXXXXXXXXXX" \
--mode Gray --resolution 300dpi | pnmtopng - > image.png

Spellchecking LaTeX documents

2008-09-29T00:00:00+10:00

To spellcheck a LaTeX document, run the following command (replacing 'file.tex' with the name of your document):

aspell -a -t < 'file.tex' | grep "&" | sort -u

Setting paper size and margins in LaTeX

2008-09-29T00:00:00+10:00

Personally I dislike the large margins LaTeX defaults to. Adding the following line to the preamble allows you to adjust these (as well as setting the paper size):

\usepackage[a4paper,left=2.25cm,right=2.25cm,top=2.5cm,bottom=2.5cm]{geometry}

Removing borders around links when using hyperref

2008-09-29T00:00:00+10:00

By default, the hyperref package adds borders around links in the document. Adding the following lines to your preamble fixes this:

\hypersetup{colorlinks,
 linkcolor=black,
 filecolor=black,
 urlcolor=black,
 citecolor=black
}

Printing the 'therefore' symbol in LaTeX

2008-09-29T00:00:00+10:00

The AMS packages provide this functionality (as well as many other things). Add the following lines to the preamble:

\usepackage{amsmath}
\usepackage{amsfonts}
\usepackage{amssymb}

Then the therefore symbol can be used:

$ ... \therefore ... $

Indenting only subsequent lines in paragraphs in LaTeX

2008-09-29T00:00:00+10:00

In order to remove the indent at the beginning of paragraphs, and indent subsequent lines if present, add the following to your preamble:

\newcommand{\hangpara}{
 \setlength{\parindent}{0cm} % don't indent new paragraphs
 \hangindent=0.7cm % indent all subsequent lines
}

Then add \hangpara before each new paragraph, for example:

\hangpara
The quick brown fox jumps over the lazy dog.

\hangpara
The quick brown fox jumps over the lazy dog again.