How to program your permanent reset chip

It's almost a year that I own this beautiful printer

and it's some time right now that I know a couple of very interesting tricks to enjoy it even more.

First of all Samsung just released clp-310 (and it's black version: the clp-315): for all the owners of the clp300 unfortunately it means that they are planning to dismiss this printer, since the new toner cartridges
for clp-315 and clp-310 are very different from the older ones for clp-300.

Now I will present herein a technique that permits to turn the vast majority of aftermarkets (non OEM
chips) into permanent reset chips; this means that you can turn a single chip into one that will last
forever, since it will never expire. Common reset chips are cheap (4-7 dollars each), but they should be
replaced as soon as the toner inside the cartridge finishes.

The total refill cost is quite expensive, because you have to add to the toner powder ($6 per recharge) the
reset chip ($7). Let's see how to cut the costs related to the chips with a permanent reset chip.

To accomplish this task, you will need:

1.

I2C eeprom programmer; I will not describe how to build one on your own. Please refer to the
very detailed schemes here: Chiprecharge Serial Programmer

2. Ponyprog software or similar one

3. Two aftermarket chips (aftermarket reset chips based onat34c02)
4. Basic soldering skills
The Lock Protection

Samsung clp-300 (the printer) track of the total number of the pages printed (referred as PAGES), it
remembers other things as well, like the number of the print jobs (referred as JOBS) performed so far and
the serial number of the toner cartridge (referred as CRUM number).

Each cartridge has a chip on it, which is basically a serial eeprom. This eeprom is costantly written by the
printer during all its lifetime span, and it's permanently locked when it expires. I have used the
term expire because locked cartridges are not necessarily empty.

The printer has an internal counter which is associated to the last read CRUM number. The internal
counter starts with a number of 0 and ends at 2000 for the black cartridge, or at 1000 for the other colors.
The counter is increased by 1 for every printed page; when the counter reaches i.e. "2000", the chip on the
toner is marked as empty and permanently locked.

When a new toner is inserted in the printer, the printer performs the following operations:
1.

For the very first 1000 pages the chip is not required (toner sold with the printer have no chip)

2. The printer checks if the new CRUM on the chip is different from the previous one stored
internally (date is NOT checked, just the CRUM)
3. If the new CRUM number is valid for color and region, the printer writes 2 bytes (value A5) at
0x004A and 0x004B, to check if the eeprom has not been locked
4. If 0x004A and 0x004B are both "A5", the printer sets its internal counter for PAGES and JOBS
reading these data from the chip at 0x00C2-0x00C4 (PAGES), 0x00D4 (JOBS). Note: PAGES
seem to be crumbled and xored with some data like the CRUM number.
5.

Finally the printer stores internally the new CRUM number

Note: Point n. 4 is controversal, because some people say that the printer resets its internal counter when
the the installed toner is swapped with one that has been used but not finished. I can say that this
behaviour maybe depends from the software inside the printer, since from the tests performed with my
printer, exchanging toner never increased the number of pages for that particular cartridge.

The following image shows the bytes that are changed over time:

When the toner finishes the process is the following one:

1.

Array 0x0080 - 0x00F0 is moved to 0x0000 - 0x0070

2. 0x004A is turned into AA

3. Permanent (software) write protection is turned on

As it's possible to see, this lock protection has several flaws:

1.

No encryption is used

2. Validation is performed by writing the same values at always the same locations
3. Printer does't check if the writing operations on the chip were succesfully accomplished
Now the steps that we should perform to have a fully permant chips are quite clear:
1.

Our chip should have the value A5, A5 at ox004A ox004B

2. The crum number, the color and the other information should be set correctly
3. PAGES and JOBS should have the minimum value recognized as valid (i.e. 01, 01)
4. The whole array should be write protected, so the printer is not able to change PAGES, JOBS and
to lock the cartridge with "AA" at 0x004A.

Let's build our Permanent Chip

The following image represent the dump I used on my "Black"permanent reset chip for EUR region. Of
course for different colours, the byte at 0x009B and 0x009E should change.

Now that we have the correct dump, we can transfer it on the chip using our home made I2C serial
programmer. If you have any doubt on how to perform this operation, please read"FixYourOwnPrinter"
thread before going any further.

You can use a very simple serial programmer like the one I made by myself:

Once the image is transferred correctly, we should

enable the write protection. As specified on the Atmel documentation for 34c02 here, in addition to the
Software Write Protection, we have the Hardware Write protection: "The WP pin can be connected to
VCC, GND, or left floating. Connecting the WP pin to V will write protect the entire array, regardless of
whether or not the software write protection has been enabled". Hardware protection prevents the
printer from modify a single byte inside our chip, and of course it's reversible and leaves the write protect
register untouched.

The most difficult part of this process is that the WP pin could be grounded (e.g. connected to GND -). If

we cannot connect directly the WP to VCC, because it will result in a short circuit, we have to lift the WP
pin. You can take a little help from a very thin steel wire (Wire Wrap), while you are heating the contacts:

The final stage is to solder the WP pin on top of the

VCC pin:

The procedure it's almost finished. Almost, because

when the toner finishes, our permanet chip is not erased, but the printer still remembers the CRUM
number on it. To refill we should insert the second aftermarket chip once, and soon after swapping it with
the permanent one. The easiest way, from my point of view, is to have 2 toner cartridges with 2 different
permanent chips on it and alternatively using one and the other one after.

Note: this method of write protecting valid data with hardware protection, could work against other
printers as well, including ones with encryption.