Browsed by
Tag: hp

Fun with (Laser) Printers using PJL

Fun with (Laser) Printers using PJL

Conversing with your Laser Printer:(See disclaimer below)

To extract information from your printer in PJL telnet to its IP address, port 9100 (or by serial, see below), and send it these commands:

<Control+[>%[email protected] <Enter>

Then copy and paste the following commands:


Or even try some newer, more detailed but undocumented ones:


Save your responses, and then type (note: NO <Enter> afterwards):

Then you can disconnect and/or close your Telnet program

Alternately, here is a small BASH script to return all of the information in a dated text file. To use, simply give the script the IP address of the printer as an argument.

#v1.0 – M Lange, 4-Jan-2014
echo -e “Scan of $1 9100 run on `date`:\n——————————-\n” > PJLScan-`date -I`.$1.txt

{ echo -e “\033%[email protected]”;
echo @PJL INFO ID;
echo -e “\033%-12345X”;
sleep 5; } | telnet $1 9100 | sed -e ‘s/\r$//’ >> PJLScan-`date -I`.$1.txt

If you could post your results in the comments, or Pastebin them and post the link, I’d be happy to share them. (Feel free to remove serial numbers if you wish; simply replace them with ‘x’s or ‘-‘s.) I’m trying to get a feel for what the most common options and languages are, as an upcoming open-source project has me parsing raw data and sending it to network printers.

The usual disclaimers apply: I’m not responsible for damages caused to your stuff or expenses incurred (i.e ink/toner/paper). Luckily, the worst case scenario is either A) Print out a page with those commands on it, or B) Hog the printer’s I/O until it times out (or you turn it off and then back on). For this reason, I recommend only trying this on a printer to which you *own* and to which you have physical access.

PJL Commands:

Tip: To run a PJL command,
you need to be in PJL mode. If you’re not in PJL mode (ie you typed something that doesn’t begin with an @, you get bumped into raw text mode), you need to send a <Control+[>%[email protected] <Enter>, then you can type your PJL command, beginning with “@”. To end your PJL session, send <Control+[>%-12345X (with no <Enter> after it)

“@PJL” can be used as a command on its own, or rather, a lack of command (or NOOP). It is used after the Escape Code (…%-12345X) to tell the printer you will be typing some PJL. This is necessary because printers sample the code after the Escape Code (…%-12345X) to try to determine what type of data they are receiving (PJL, PCL, PCLXL, PostScript, etc., depending on the model)

HP LaserJet 4M Plus

HP Color LaserJet CP1518ni:

HP Color Laserjet MFP M275nw:

HP LaserJet 1012:

  • Plugs in by USB only
  • Can interact with it at /dev/usblp0 at 115200,8,n,1 using gtkTerm as root: sudo gtkterm –port /dev/usblp0 –speed 115200 –echo and set “CR LF auto” under the configuration menu
  • Interesting: @PJL SET TESTPAGE=DATASTORE is an interesting (4-page) test page, essentially a printout of the value and meaning of all variables
  • Personalities: PCL, PCLXL
  • Info: HP LaserJet 1012 Info Dump.doc

HP LaserJet 9050:

HP Color LaserJet 9500:

HP Officejet Pro X476dw MFP:

Brother HL-3040cn:

Brother MFC-7440n:

See also:

Please note:

  • I would imagine a number of inkjets use PJL, though honestly I have no inkjet printers on-hand to test on. I posit that a number of inkjets will work, including ones with built-in Ethernet. It may be possible to execute commands over USB as with the LaserJet 1012 (See above for serial terminal settings). If anyone has inkjet dumps, they’re just as welcome as Laser ones.
USB Host on HP Touchpad: Progress…

USB Host on HP Touchpad: Progress…

To access USB Host mode on the Touchpad (to plug in a Keyboard/USB Drive/etc), you need:

  1. A microUSB to USB Female cable (USB-OTG cable), available on ebay for ~$3, shipped [search ‘USB-OTG cable’]
  2. A powered USB Hub (a USB Hub with a spot to plug in an external power supply), available on ebay for under $10, shipped, with power supply  [Search ‘powered usb hub’]

All you need to do is plug the USB Hub into the OTG adapter, and the OTG Adapter into the Touchpad. Power it with a wall adapter, and you’ll have USB devices showing up in dmesg in no time!

For example:

[16075.755719] usb 1-1.1: new high speed USB device using msm_hsusb_host and address 3
[16075.775744] get_port_status port=1,portstatus=1503, portchange=10
[16075.868006] usb 1-1.1: New USB device found, idVendor=13fe, idProduct=3323
[16075.868111] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[16075.883769] usb 1-1.1: Product: STORE N GO
[16075.883821] usb 1-1.1: Manufacturer: Verbatim
[16075.894000] usb 1-1.1: SerialNumber: 070007A315074099E8C5
[16075.922270] scsi1 : usb-storage 1-1.1:1.0
[16075.944010] get_port_status port=1,portstatus=1503, portchange=0
[16076.953338] scsi 1:0:0:0: Direct-Access     Verbatim STORE N GO       5.00 PQ: 0 ANSI: 0 CCS
[16076.993863] sd 1:0:0:0: Attached scsi generic sg0 type 0
[16077.204050] sd 1:0:0:0: [sda] 7802880 512-byte logical blocks: (3.99 GB/3.72 GiB)
[16077.204665] sd 1:0:0:0: [sda] Write Protect is off
[16077.216317] sd 1:0:0:0: [sda] Mode Sense: 23 00 00 00
[16077.216329] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.219671] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.227274]  sda: sda1
[16077.237134] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.237234] sd 1:0:0:0: [sda] Attached SCSI removable disk

To be fair, there is most likely a way to enable the Touchpad to power USB OTG devices itself, which would remove the need for the powered hub.

See also: and, which suggest using a USB Y-cable to inject power, and from which I blatantly stole the idea of using a powered USB hub 😉

So far I have tried a USB thumbdrive and a wireless mouse dongle; the thumbdrive was detected flawlessly, while the mouse’s dongle was not.

HP Touchpad Hardware [Preliminary]

HP Touchpad Hardware [Preliminary]

Although this is an article on hardware, I’m going to be using software to probe it. This is from a 32GB HP Touchpad, though the 16GB should be the same, barring the difference in storage.


Processor       : ARMv7 Processor rev 2 (v7l)
processor       : 0
BogoMIPS        : 13.52

Features        : swp half thumb fastmult vfp edsp neon vfpv3
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0x02d
CPU revision    : 2

Hardware        : TENDERLOIN
Revision        : 0000
Serial          : 0000000000000000

The touchpad runs on a Qualcomm Snapdragon dual-core CPU, so I would take this output with a grain of salt: It’s only showing one core, and my touchpad is in powersave mode, so the bogomips, as usual, is way off.

Now for the more interesting stuff, like i2c devices.

cat /sys/bus/i2c/devices/*/name: (with annotations)

mt9m113– Aptina Webcam SoC

  • /sys/devices/i2c-1/1-0078

a6_0 – Battery monitor – Battery?

  • /sys/devices/i2c-3/3-0031
  • This one seems to have information on voltage, charge percentage, etc.
  • Seems to be the battery monitor
  • Here are the values/categories for the Veer (for comparison and info)
  • A6 Version: HW: 255, FW (M.m.B): 2.13.25, ManID: 28769, ProdTyp: 1281

a6_1 – Battery monitor – Charger?

  • /sys/devices/i2c-3/3-0032
  • This one has info in acc_data_*, but not voltage
  • Seems to be the battery charging circuit
  • A6 Version: HW: 255, FW (M.m.B): 2.7.23, ManID: 28769, ProdTyp: 1793

LM8502– National Semiconductor “Smart Lighting” IC

  • /sys/devices/i2c-3/3-0033
  • Fun: The LM8502 driver brings out the vibrator, LEDs (home button LEDs?), flash (for camera? I dont’ think the TP has one),

wm8958– Wolfson Microelectronics Audio Hub w/ 3 Digital Audio interfaces & DSP

  • /sys/devices/i2c-4/4-001a
  • Fun: Driver brings out some GPIO pins

maXTouch– Atmel’s family of “Unlimited-Touch” Touchscreen controllers

pm8058-core – Qualcomm Power Management IC

  • /sys/devices/i2c-6/6-0055
  • The datasheet for this one is kept under wraps?
  • From what the driver brings out, we can see that it controls power to the charger, GPIO, MPP (Multi-Purpose Pins), PWM, Power button, RTC, TM (IC Temperature Monitor), UPL(?), and the vibrator

pm8901-core – Qualcomm Power Management IC (No datasheet?)

  • /sys/devices/i2c-7/7-0055
  • The datasheet for this one is kept under wraps?
  • The driver brings out MPP (Multi-Purpose Pins), regulators, and a Temperature Monitor.
  • (Maybe this one is used for large loads, whereas the pm8058 is for smaller loads?)

QUP I2C adapter – (Six) – Qualcomm Universal Peripheral [cite]

  • /sys/devices/i2c-0 all the way through i2c-5

MSM SSBI adapter – (Three) – Qualcomm MSM-series “Single-Wire Serial Bus Interface” [cite]

  • /sys/devices/i2c-6 through i2c-8

cat /etc/fstab:

  • # <filesystem>  <mount point>   <type>  <options>       <dump>  <pass>
  • rootfs  /       ext3    ro,suid,dev,exec,auto,nouser,async,noatime      1       1
  • /dev/mapper/store-var   /var    ext3    noatime,data=writeback  0       0
  • /dev/mapper/store-cryptodb      /var/db ext3    noauto,noatime,data=ordered     0       0
  • /dev/mapper/store-cryptofilecache       /var/file-cache ext3    noauto,noatime,user_xattr       0       0
  • /dev/mapper/store-log   /var/log        ext3    noatime 0       0
  • /dev/mapper/store-update        /var/lib/update ext3    noauto,noatime  0       0
  • proc    /proc   proc    defaults        0       0
  • devpts  /dev/pts        devpts  mode=0620,gid=5 0       0
  • tmpfs   /tmp    tmpfs   size=40M,mode=1777      0       0
  • tmpfs   /var/run        tmpfs   size=16M,mode=1777      0       0
  • tmpfs   /var/tmp        tmpfs   size=32M,mode=1777      0       0
  • tmpfs   /media/ram      tmpfs   defaults        0       0
  • /dev/mapper/store-media /media/internal vfat    utf8,shortname=mixed,umask=0000 0       0

/dev/input/event0 is the home button and volume button device
/dev/input/event1 is the power button device
/dev/bt_uart is the Bluetooth serial stream

/proc/tty/drivers: (showing some promising signs of USB-Host ability)

/dev/tty             /dev/tty        5       0 system:/dev/tty
/dev/console         /dev/console    5       1 system:console
/dev/ptmx            /dev/ptmx       5       2 system
/dev/vc/0            /dev/vc/0       4       0 system:vtmaster
usbserial            /dev/ttyUSB   188 0-253 serial
acm                  /dev/ttyACM   166 0-31 serial
msm_serial_hsl       /dev/ttyS     243 0-3 serial
pty_slave            /dev/pts      136 0-1048575 pty:slave
pty_master           /dev/ptm      128 0-1048575 pty:master
pty_slave            /dev/ttyp       3 0-255 pty:slave
pty_master           /dev/pty        2 0-255 pty:master
smd_tty_driver       /dev/smd      253 0-36 serial
unknown              /dev/tty        4 1-63 console

More to come.