Lexmark MB2236ADW 88.40K error story

I'd like to share what I have learned so far about lexmark (dell) printers. If you have anything interesting to add - please, add a comment :)

Introduction, how I got the printer and the error

I bought the printer in 2020 paying about €100 for it on a sale. This is a decent device for the money: a large monochrome laser printer with a scanner and duplex printing. New (or re-filled by lexmark) toner costs around €50 and should last up to 1200 pages printed.

Printer itself is far from being good: it often prints garbage, paper gets stuck, scanner quality is poor. It comes with drivers that connect to the internet to download and install updates. Potentially could also take control over your computer and printer connected to a network could be used to penetrate your home/office network. So caller "driver" is consuming your resources (because it is always running and connects to the internet) but you should be able to install only the core driver, not the full driver suite.

After 1 year of rare printing I started to see a notification about toner to end soon so I should replace it. This can be ignored (still it is not a nice thing).

After another year I have received error 88.40K saying literally "you have printed too much on this toner - pay a bribe to lexmark to use your printer - printer gets blocked until you pay the bribe".

Why printer manufacturers are doing that planned aging of a product

Companies live Volkswagen noticed that after releasing a great and durable car they are selling only 1 car to an owner for the entire life and not earning any more money. Less durable product forces user to buy more and let them earn more (with production of much more garbage in the process - old product must be utilized or thrown away).

Printer manufacturers started to sell printers that are cheaper than average market price. The secret is in selling very expensive refill (either ink or toner or other materials) - customer overpays (materials are sold for over 1000% of their price, often much over that).

Manufacturers and corporations are not here to make good products or to create good things. Their only goal is to make money (preferably by gaining dominance over the market and abusing monopoly situation to rise prices even more).

What are print limit/counter, chip, toner refill

At some point printer manufacturers started print pages counting and created limits after which printer gets blocked. You must pay a bribe to them so they let you use it more. This is often done in several layers:

• printer counts how many pages have been printed - after reaching the limit you must service it (servicing cost is higher than getting a new printer)
• printer counts how many pages were printed with a single ink package or toner - you are forced to replace, not refill, after some number of prints
• your computer could be sending whatever data to the internet (and manufacturer) so they could even block your printer remotely

The print counting could be made within the printer or the materials. lexmark is inserting a simple small PCB with a chip that is used to verify that:

• you have ordered materials (ex. ink, toner) from this manufacturer and not some 3rd party
• you have not messed with the device

If you are lucky then there might be an universal hacked chip that allows you unlimited printing (and likely some expert invested a lot of effort into getting it working). Some printers could allow a counter reset.

 

The cheap approach is to refill toner/ink. Only some manufacturers and devices would allow this (likely those more expensive ones). Then cost of a single print is very low.

If neither works for you then you need to either buy an original overpriced refill or buy a new device.

Possible path to print cheap

Every manufacturer is different. Usually printer firmware is based on some unix and lack any documentation available for you.

lexmark however is using Linux inside its devices. This is both a good and a bad news: Linux is much more secure than other less known systems. But it is much more popular and oftern targeted for attacks so it is more likely that you find an existing known published and exploited security hole. Obviously manufacturers force you to update firmware frequently to fix security holes - that is why I have not updated my firmware and it is currently using version mxlsg.071.016. If firmware can be hacked then we could probably just disable printer counters.

The chips can be probably hacked as well. But the printers are likely to remember every chip used and also modify the chip when used (possibly even binding a chip to a printer so it cannot be reused and writing current print counters to the chip).

Challenges with lexmark device hacking

If there is an UART port - then likely tx line is disabled (you cannot execute any commands).

The best option might be to de-solder flash memory, read it and modify. Unless encrypted (so far it is not yet). If encrypted then you should be still able to decrypt it with some complex techniques.

There is no documentation for the device inner structure or software.

Companies hired skilled people to create such DRM against users.

Challenges with lexmark chip hacking

Encryption and signatures. Probably strong ones. This makes it much more challenging to tamper the chip.

Lack of parts of the documentation.

Many types of devices on the market thus not that many people focused at attacking single device model.

Best but not possible path

Best solution would be to have aware conscious customers who are not buying such crap and instead buying only an open, reusable, durable and good products.