How to hack MFP / MFD RTOS ( Operating System )

[PA3040]

Good luck with Ricoh RSA firmware encrypted system.

Still I could not find abbreviation for RSA......sorry

[Eric1968]

Those are valuable details and information

But unfortunately majority of our machines are non connectivity machines. Therefore we have to develop wireless connection to connect mobile Network, That is the only way I think we have to gather the information's

in our case all tech's must collect the copy counts of each machines from 25th to 30 each months for Invoice

any advice

You're talking about Ricoh MFP's. MFP means that it's a multifunctional machine. So you're saying that all of these MFP's are not connected to a network? So the customer buys a machine (let's say an MP C3001, which can do network scanning, printing, etc.) and uses this machine without connecting it to the network, which leaves only the copy function available????

[PA3040]

[QUOTE=Eric1968;424186]You're talking about Ricoh MFP's. MFP means that it's a multifunctional machine. So you're saying that all of these MFP's are not connected to a network? So the customer buys a machine (let's say an MP C3001, which can do network scanning, printing, etc.) and uses this machine without connecting it to


Our models are MP2000 and MP2001L AA versions those are MFP's but No NIC

Sorry if you got misunderstood by my wrong explained

[Eric1968]

[QUOTE=PA3040;424192]

You're talking about Ricoh MFP's. MFP means that it's a multifunctional machine. So you're saying that all of these MFP's are not connected to a network? So the customer buys a machine (let's say an MP C3001, which can do network scanning, printing, etc.) and uses this machine without connecting it to


Our models are MP2000 and MP2001L AA versions this are MFP's but No NIC

Sorry if you get misunderstood by my wrong explained

No problem.

If the machines are not networked you've got a challenge!

[rthonpm]

To get anywhere on the heavily modified version of BSD Ricoh is using, you'd need super user access, which you won't get. If you were, you'd still have the issue of getting any kind of connection to a mobile network. With old school offline machines, your easiest way of getting metres is going to be the equally old school way of getting faxed metre sheets, or a manual collection once a month.

[skynetto]

majority of our machines are only USB and not connected to PC.

My experiment models are Ricoh kir c3 and kir c4

Both models FRAM are communicating with BICU using SPI protocol, I can develop the embedded system to communicate with SPI to collect copy volume, apart from that not that much hard


Do you have any idea in this regard

Well in SPI mode I don't think you can do much because every application installed on SD card (and you need an SD card to run your app on the machine) needs to be approved by Ricoh, signed with their private key, decrypted using MFP public key and SD serialNumber, and if everything matchs you're allowed to run your app. It takes two weeks for Ricoh to respond back with a signed app from Ricoh server if you are a fully qualified Ridp developer so it want be to easy. Sorry to disencourage you but have read all the Ricoh protection system and the only way to hack it is to find some SD with CID field writeable in SPI mode wich is impossible as it is a read only manufacturer field. Maybe Arduino would help in hacking it as it has some software wich allowes sending SPI command 26 (write CID).

[Eric1968]

To get anywhere on the heavily modified version of BSD Ricoh is using, you'd need super user access, which you won't get. If you were, you'd still have the issue of getting any kind of connection to a mobile network. With old school offline machines, your easiest way of getting metres is going to be the equally old school way of getting faxed metre sheets, or a manual collection once a month.

X2

Even if you could become the root user, there's still the fact that the machine has no outbound connection. One should have remote access to the counter, copy the counter value and send it somehow to a GSM- or Network connection, I'd say : Impossible!!

[PA3040]

To get anywhere on the heavily modified version of BSD Ricoh is using, you'd need super user access, which you won't get. If you were, you'd still have the issue of getting any kind of connection to a mobile network. With old school offline machines, your easiest way of getting metres is going to be the equally old school way of getting faxed metre sheets, or a manual collection once a month.

I don't got BSD

What do you mean supper user access?

No. it shouldn't that much hard, I can simply input the mechanical counter signals to my embedded system. Apart from that I can manage

My concern is to take the signals or data from OS or any other digital out

As you advised at the moment we are collecting counters by FAX and those who do not have fax tech's go and collect

[PA3040]

Well in SPI mode I don't think you can do much because every application installed on SD card (and you need an SD card to run your app on the machine) needs to be approved by Ricoh, signed with their private key, decrypted using MFP public key and SD serialNumber, and if everything matchs you're allowed to run your app. It takes two weeks for Ricoh to respond back with a signed app from Ricoh server if you are a fully qualified Ridp developer so it want be to easy. Sorry to disencourage you but have read all the Ricoh protection system and the only way to hack it is to find some SD with CID field writeable in SPI mode wich is impossible as it is a read only manufacturer field. Maybe Arduino would help in hacking it as it has some software wich allowes sending SPI command 26 (write CID).

Really really thanks your reply
it is never discourage and I am happy to hear from you
Now I am gathering lot's of information's from this forum

The SPI i mean, That is the protocol ( Serial Peripheral Interface ) which communicate with FRAM that is using in the model of Ricoh kir c3 and kir c4

From the my first post I asked to reverse engineering OS. but in the middle I changed to at least collect copy count from the system and send to the main server in the our office via mobile network

[PA3040]

X2

Even if you could become the root user, there's still the fact that the machine has no outbound connection. One should have remote access to the counter, copy the counter value and send it somehow to a GSM- or Network connection, I'd say : Impossible!!

It is possible the way I explained in my post #18. can you please advice me to develop it?

No. it shouldn't that much hard, I can simply input the mechanical counter signals to my embedded system. Apart from that I can manage

Thanks in advance