Browsed by
Category: Misc. Electronics Projects

My miscellaneous electronics projects

Fun with (Laser) Printers using PJL

Fun with (Laser) Printers using PJL

Conversing with your Laser Printer:(See disclaimer below)

To extract information from your printer in PJL telnet to its IP address, port 9100 (or by serial, see below), and send it these commands:

<Control+[>%[email protected] <Enter>

Then copy and paste the following commands:


Or even try some newer, more detailed but undocumented ones:


Save your responses, and then type (note: NO <Enter> afterwards):

Then you can disconnect and/or close your Telnet program

Alternately, here is a small BASH script to return all of the information in a dated text file. To use, simply give the script the IP address of the printer as an argument.

#v1.0 – M Lange, 4-Jan-2014
echo -e “Scan of $1 9100 run on `date`:\n——————————-\n” > PJLScan-`date -I`.$1.txt

{ echo -e “\033%[email protected]”;
echo @PJL INFO ID;
echo -e “\033%-12345X”;
sleep 5; } | telnet $1 9100 | sed -e ‘s/\r$//’ >> PJLScan-`date -I`.$1.txt

If you could post your results in the comments, or Pastebin them and post the link, I’d be happy to share them. (Feel free to remove serial numbers if you wish; simply replace them with ‘x’s or ‘-‘s.) I’m trying to get a feel for what the most common options and languages are, as an upcoming open-source project has me parsing raw data and sending it to network printers.

The usual disclaimers apply: I’m not responsible for damages caused to your stuff or expenses incurred (i.e ink/toner/paper). Luckily, the worst case scenario is either A) Print out a page with those commands on it, or B) Hog the printer’s I/O until it times out (or you turn it off and then back on). For this reason, I recommend only trying this on a printer to which you *own* and to which you have physical access.

PJL Commands:

Tip: To run a PJL command,
you need to be in PJL mode. If you’re not in PJL mode (ie you typed something that doesn’t begin with an @, you get bumped into raw text mode), you need to send a <Control+[>%[email protected] <Enter>, then you can type your PJL command, beginning with “@”. To end your PJL session, send <Control+[>%-12345X (with no <Enter> after it)

“@PJL” can be used as a command on its own, or rather, a lack of command (or NOOP). It is used after the Escape Code (…%-12345X) to tell the printer you will be typing some PJL. This is necessary because printers sample the code after the Escape Code (…%-12345X) to try to determine what type of data they are receiving (PJL, PCL, PCLXL, PostScript, etc., depending on the model)

HP LaserJet 4M Plus

HP Color LaserJet CP1518ni:

HP Color Laserjet MFP M275nw:

HP LaserJet 1012:

  • Plugs in by USB only
  • Can interact with it at /dev/usblp0 at 115200,8,n,1 using gtkTerm as root: sudo gtkterm –port /dev/usblp0 –speed 115200 –echo and set “CR LF auto” under the configuration menu
  • Interesting: @PJL SET TESTPAGE=DATASTORE is an interesting (4-page) test page, essentially a printout of the value and meaning of all variables
  • Personalities: PCL, PCLXL
  • Info: HP LaserJet 1012 Info Dump.doc

HP LaserJet 9050:

HP Color LaserJet 9500:

HP Officejet Pro X476dw MFP:

Brother HL-3040cn:

Brother MFC-7440n:

See also:

Please note:

  • I would imagine a number of inkjets use PJL, though honestly I have no inkjet printers on-hand to test on. I posit that a number of inkjets will work, including ones with built-in Ethernet. It may be possible to execute commands over USB as with the LaserJet 1012 (See above for serial terminal settings). If anyone has inkjet dumps, they’re just as welcome as Laser ones.
Kenwood KDC-MP528 Internals

Kenwood KDC-MP528 Internals

The Kenwood KDC-MP528 has the following goodies inside:

  • STMicro TDA7415 (TQFP64) – Car Radio Multimedia Signal Processor
  • STMicro TDA7540 (TQFP80) – AM/FM Car Radio Tuner IC with Stereo Decoder and Intelligent Selectivity System
  • Renesas M30624MWP-A43GP (TQFP100) – Single-Chip 16-Bit CMOS Microcomputer [Resources]
  • TI “HC02A 54K FYEE” (14-pin)
  • “4565 514 JRC” (8-pin)
  • “1930 4ZX4” (10-pin SOIC)
  • “L04 W209 5J” (8-pin)
Acer Aspire 3000 Battery Internals

Acer Aspire 3000 Battery Internals

This is a 4-cell battery; before opening it up, I was under the impression that it was a 3-cell.

The charge controller circuit board has “LIP8198” and “1-867-277-11” markings in the silkscreen, along with a strip of Kapton tape over the top of the PCB.

The PCB has +/- going to the 4 cells in series, as well as leads between each cell (probably for measuring voltage at each intermediate point), and two temp sensors: one on the battery closest to the circuit board (the one that the board’s “-” connects to) and one on the next one after that (the middle-most one).

The top side has the following ICs:

  • 3182 5J94 (Looks like a tiny EEPROM/Flash)
  • Two unlabelled 8-pin square ICs marked “04” and “07” on the silkscreen
  • 12AH4 SC SF

The bottom has the following:

  • TI bq80201DBT – “Battery ‘Gas Gauge'” for storing the cycle count?
  • TI bq29312PW – “Two, Three and Four Cell Lithium or Lithium-Polymer Battery Protection AFE”
  • A number of various bare-copper test points 🙂

With a bit of digging, it seems that the bq80201 is used for many different battery makes such as Sanyo, Dell, etc.

Relevant URLs:
Battery EEPROM Works (Software; not affiliated with this site, I have no guarantees of how well it works)
Battery EEPROM Works Forum topic re: B80201 support (Forum Thread)
Would still be nice to actually find a listing of the I2C codes that it uses.

Flambeau Brake Control Demo Kit

Flambeau Brake Control Demo Kit

This is a nice item that I found today at Princess Auto… A grey box hiding on the bottom of a grey shelf. The phrase “Demo Kit” caught my eye, and I had to take a peek inside. I was blown away by the beautiful innards, and I just had to have it. It appears to be made by Flambeau (judging from the company name stamped into the front of the case) and the sticker on the lid says it is a “Brake Control Demonstration Kit”

A metal front panel (as seen in the picture) holds a set of terminals, a voltmeter, large Brake and Overload buttons along with various assisting components, such as Output and Stop lights, Battery test button, power switch, 30A removable fuse, and a panel-mount power plug that fits with the included wallwart.

Underneath the panel (picture attached below), reside a 12 Volt, 5 Amp-Hour SLA (Sealed Lead Acid) battery for powering the kit, and some type of coil or capacitor for powering the ‘overload’ button.

Bonus points for the Output and Stop Light lamps: They’re actually incandescent bulbs, not LEDs. (The power light is an LED though, presumably so you can still see that the unit is not DOA even with a near-flat battery.)

Possible uses: (besides requisite attempts to blow various electrical components up with the Overload button)

  • Portable bench power supply (With an adjustable voltage regulator, and maybe an LCD display for kicks?)
  • (Have any suggestions to add? Sound off in the comments!)

(NB, this doesn’t show up on Princess Auto’s website, as it’s probably a new item. It is SKU #8339715 and $19.99 at the time of posting unfortunately, no longer a stocked item.)

MiBook Hacking? (Work in Progress)

MiBook Hacking? (Work in Progress)

I recently acquired an old Photoco MiBook. (Photoco LLC had its assets sold off by creditors, and many MiBooks and associated software are being sold on clearance by stores like The Source by Circuit City). Photoco LLC magically reopened under the name of MiBook LLC, and is currently the subject of a nice big lawsuit from Scripps Networks, the owners of Food Network, etc. It’s an interesting read.

MiBook Reader #1

My first of two MiBook readers that I’ll be looking at is this one, which I got from The Source by Circuit City in a “Home Decorating and Gardening” bundle for $29.96, and a set of “books” on 512MB SD
cards for $1.96 each.

The sticker on the back reads “miBook”, along with voltage/amperage requirements, Serial Number (no barcode) and the FCC logo.

  • Screen: 7″ Color TFT: Unknown Manufactuer M1P82BNB03170  “TS0700AAAD01” on LCD glass, “81P81N27 8C021” in small
  • CPU: Amlogic AML6210A (128-Pin QFP)
  • Memory: 64MB SDRAM: EtronTech EM638165TS-6G (54-Pin SSOP)
  • Boot Flash: 16Mbit Flash: Spansion S29AL016D70TF102 (48-Pin TSOP)
  • Real-Time Clock: Intersil ISL1208 (ISL1208IB8Z, marked “1208 ZI”) (8-Pin SOIC)
  • DAC (96kHz, Stereo): Cirrus Logic 4334-KSZ (8-Pin SOIC) (Probably)
  • Op-Amp: JRC 3414A (8-Pin SSOP)
  • Unknown/Audio Amp?: STH 63BJRC STH49S6H0 ??? (20-Pin QFN)
  • Unknown/Power-Related: 8A068 3213D (8-Pin SSOP)

MiBook Reader #2

I also have another MiBook reader which I got as a prize from DigiKey. It came as just the MiBook/charger/USB/Remote combination, and didn’t have any SD-card “books” like the Source’s bundle. This one is a little newer, and is better-built overall: the stand snaps into place, the charging LED is more visible, the buttons are better quality inside, the plastic pieces are formed better, the exterior screws are larger and much easier to remove, etc.

The sticker on the back reads “PHOTOCO miBook”, along with voltage/amperage, Serial Number with Barcode and the FCC logo. (It is interesting to note that this one is labelled specifically a PHOTOCO product. Old stock that they brought over from Photoco LLC to Mibook LLC? Check out the link at the beginning of the article for information on Photoco/Mibook/etc.)

  • Screen: 7″ Color TFT: Unknown Manufactuer HLLB-0302A1 HL080414D010075
  • CPU: Amlogic AML6210A (128-Pin QFP)
  • Memory: 64MB SDRAM: EtronTech EM638165TS-6G (54-Pin SSOP)
  • Boot Flash: 16Mbit Flash: MXIC 29LV160CBTC (48-Pin TSOP)
  • Real-Time Clock: S35390A (8-Pin SOIC)
  • Unknown: “C” or “e” C04558 (8-Pin SOIC)
  • Audio Amplifier (300mW Stereo): National LM4853L (20-Pin Mini-SOIC)
  • DAC (96kHz, Stereo): Cirrus Logic 4334-KSZ (8-Pin SOIC) (Probably)
  • Power Conversion/Adjustable VREG: STMicro LD1117A (3-Pin package)
  • Power Conversion/Switching PS Converter: Aimtron AT1380P (8-Pin TSOP?)

See also

Wii Off-brand Nunchuck Internals

Wii Off-brand Nunchuck Internals

Nyko “Kämä” Wired Remote:
MCU: Atmel ATMega 48 TQFP (The PCB also has pads for MLF package, based on availability?)
Accelerometer: Freescale A7260
EEPROM: Macronix (MXIC) MX25L4005 (4 Mbit)

Definitely a good nunchuck for hacking; it’s well-built, and the analog stick appears to be mostly metal-based, instead of plastic like others.

I wonder if the ATMega is read-locked? If so, I wonder how hard it would be to rewrite/repurpose it…

Biogenik OG1-CHUK:
The only thing of interest was a single epoxy blob on the PCB.

Madcatz Z-CHUK Wireless: (FCCID: P25S1MC5746U1709C, 2.405-2.475Ghz)
MCU: Epoxy blob of unknown origin
Accelerometer: Unknown. “033 A841 013”?
EEPROM: STMicroelectronics M24C02 (2 Kbit)

Wireless is nice, and might make for some interesting projects, and at $10/piece from XSCargo, it’s definitely an affordable way to get into wireless (and accelerometers, etc). The internals of this remote look almost identical to the actual Wii Nunchuck, with the exception of the battery and transmitter.

“Nintendo” and “Wii” are registered trademarks of Nintendo of America Inc. This site is not affiliated with, or endorsed by, Nintendo, Madcatz or Nyko.

Seiko/Epson RG9013F-NZ LCD Screen

Seiko/Epson RG9013F-NZ LCD Screen

I got this LCD screen free with one of my computer-related eBay purchases.

The label on the bubblewrap says:

Seiko/Epson RG9013F-NZ VGA 640×480 Mono for Dragonball EZ
Used/Excellent – Full Factory Spec Sheet At: [ link]

Spec Sheet [PDF, link]

According to, the EG9013FNZ1 is an STN Passive Transmissive 6.3″ 640×480 Monochrome LCD display with a CCFL backlight.

POM PPM Parking Meter

POM PPM Parking Meter

I found this parking meter at Princess Auto yesterday. Made by POM Inc., this meter is called the PPM.

I got it to work by adding a rubber band with just enough tension to depress the turn-detect lever when the lever is turned. The meter has knobs where a tensioned spring was attached. I’ll have to find a decent spring somewhere.

Opening it up, I found that the coin detector uses a series of armatures and four switches to detect which coin was inserted.

Upon examination, it has 6 buttons:

  • (Top Left) Yellow button for debug output
  • (Bottom Left) Yellow button for turn-sense
  • White buttons (4) for coin sense

When a Quarter is inserted into the proper slot and the arm is turned…

  1. As the coin lever is turned, the turn button is pressed.
  2. As it passes the buttons, the quarter makes the arm hit all 4 white buttons, in a clockwise order starting with the top left.
  3. When the turn lever is released, it returns to its original position, and releases the turn button.

When a Dime is inserted into the proper slot and the arm is turned…

  1. As the coin lever is turned, the turn button is pressed.
  2. As it passes the buttons in a clockwise order starting with the top left, the quarter makes the arm skip the first white button, and hits the remaining 3 white buttons.
  3. When the turn lever is released, it returns to its original position, and releases the turn button.

When a Nickel is inserted into the proper slot and the arm is turned…

  1. As the coin lever is turned, the turn button is pressed.
  2. As it passes the buttons in a clockwise order starting with the top left, the quarter makes the arm skip the first 2 white buttons, and hits the remaining 2 white buttons.
  3. When the turn lever is released, it returns to its original position, and releases the turn button.

When you press the Debug button, the front LCD shows the following:

  1. Test pattern: “c2:2c”, where the last ‘c’ is backwards.
  2. Firmware Version?: “0159”, also the number writen on a sticker on top of the ST27C256
  3. Parking Limit: “0002”, maximum number of hours allowed to park
  4. Route?: “0321”, also printed on a sticker on the back of the meter. This was the same for other meters i saw.
  5. Unknown: “8:5”, “8:6”

Interesting innards:


  • LCD1: LCD, Front: 4-digit, “88:88” LCD
  • LCD, Back: Red, Clear background. No text.
  • D3: Red LED, (clear casing)
  • D4: IR LED
  • D5: IR Sensor


  • SW5,6: Yellow Switches (Surface mount)
  • SW1,2,3,4: White Switches (Surface mount)


  • U6: Motorola MC14519B – Four bit AND/OR selector
  • U2: Motorola MC14521B –
  • U7: Motorola MC145453FN – LCD 33-Segment LCD Driver, Serial, CMOS
  • U5: Motorola MC68HC11A1FN – Motorola 8-bit Microcontroller, 256 Kbit RAM, A/D converter, EEPROM
  • U4: Fairchild MM74HC373WM

    – 3-STATE Octal D-Type Latch

  • U3: THMOS ST27C256 – 256Kbit (32Kx8) CMOS 3-STATE (UV-Erasable?) EPROM
  • U1: 271BC – Programmable Low-Power OP-Amp
  • U8: Motorola HC20 – Dual 4-input NAND gate
  • U9: 74HC02M – Quad 2-Input NOR Gate


  • J2: 4-pin header
  • JP4, JP3, JP2, JP1: Jumpers, unpopulated, to ground certain pins on U5

See also:
Pics in action:

Anadigi GPS-R02 DIY GPS Kit

Anadigi GPS-R02 DIY GPS Kit

I got this little “Anadigi GPS-R02 DIY” car gps kit from eBay seller anadigi-hk, and it was mailed direct from Hong Kong.

[Edit: Apparently, the eBay Store and user are no more.]

It came with the GPS Circuit board and a little plastic case for it, an MMCX antenna with magnetic base, and a matching USB cable. The mini-CD came with drivers and a few test and diagnostic programs.

It works great; by the time my computer comes out of hibernation, it already has a signal lock. Talk about bang for the buck!

The receiver is based on the NemeriX NJ1030A [Datasheet –], and includes WAAS/EGNOS support.

Markings on the box: (They look like the vitals for the GPS Antenna)

  • Product Model: GPS
  • Center Frequency: 1575.42 +/-3Mhz
  • LNA Gain (Without Cable): 28dB
  • Noise Figure: <1.5dB
  • VSWR: <2.0
  • DC Current: 10mA Max
  • Mounting: Magnetic Base
  • Housing: Black
  • Working Temp: -40*C ~ +85*C
  • Vibration: Sine sweep lg(0-p) 10~50~10Hz each axis
  • Humidity: 95%-100%RH
  • Weatherproof: 100% Weatherproof
  • Cable Length: 3m
  • Voltage: 3-5V
  • Connector: MMCX
  • USB to Serial Converter (onboard): PL-2303* (but the Prolific Windows driver doesn’t like it, errors with Code 10: Cannot start”, according to the Prolific website, that means it’s likely a counterfeit PL-2303 chip. I’ll have to dig out the CD that came with it again.)

Update: How to add GPS to your Eee PC @ – That’s definitely one of the first things I’d do with an Eee.