Kuro5hin.org: technology and culture, from the trenches
create account | help/FAQ | contact | links | search | IRC | site news
[ Everything | Diaries | Technology | Science | Culture | Politics | Media | News | Internet | Op-Ed | Fiction | Meta | MLP ]
We need your support: buy an ad | premium membership

[P]
HOW TO: Obtain Free Copies and Do Other Fun Stuff to Copiers

By omghax in Technology
Fri May 28, 2004 at 11:39:59 PM EST
Tags: Focus On... (all tags)
Focus On...

This article will give insight into the inner workings of Canon copiers, and show you how to exploit a curious oversight that allows for free copies. The material in this article is restricted to Canon copiers only, as I have had the most experience in them; however, this is not as narrow as you might imagine. Generally, Canon copiers are seen second in quality only to Xerox in the market; thus, many big-time copy shops and corporations use Canon copiers.

This article will not analyze the philosophical questions of doing anything it demonstrates. Obviously, everything outlined is of dubious morality; if you are not that type of person, see this as an educational article demonstrating how the inner-workings of a copier works. I take absolutely no responsibility for anything anyone does with this information. (Remember: information wants to be free [as in beer])


ADVERTISEMENT
Sponsor: rusty
This space intentionally left blank
...because it's waiting for your ad. So why are you still reading this? Come on, get going. Read the story, and then get an ad. Alright stop it. I'm not going to say anything else. Now you're just being silly. STOP LOOKING AT ME! I'm done!
comments (24)
active | buy ad
ADVERTISEMENT
First, I will examine how to get free copies, and afterwards I will demonstrate how to completely destroy a copier or reduce its effectiveness.

Getting In

Everything in this article will require getting into the "control panel." The control panel is where service men and installation men go to configure a copier, fix its problems, examine firmware, and look through error and jam logs. It offers complete control over the copier and its attachments.

You may think that it would be difficult to get into the control panel, or that it is password protected, but curiously this is not the case. Every Canon copier has an Additional Features or a "Guide" button - it has a asterisk on it, similar to that on the phone. To get into the control panel, in rapid succession, push the asterisk key, the 2 and 8 keys simultaneously, and the asterisk key again. If you did this correctly, you will see something like:

                  Service Mode
Copier
Feeder

Sorter (if its attached)
(other attachments, like edit pads)

There are lots of fun things you can do in the Feeder Service Mode, such as configure it to jam every time a customer or employee puts a piece of paper in. This is for another time, and another place. Hit the "Copier" button on the touchscreen. On the top of the screen, you see:

Display  I/O  Adjust  Function  Option  Test  Counter

These are similar to "tabs" in a modern OS GUI; pushing one of them will bring up a series of push buttons below it, a menu from which you can access various parts of the copier.

You are, by default, in the "Display" menu. You will likely see a variety of nonsensical abbreviations and other meaningless garbage; since buttons have a 6 character limit, abbreviations have to be taken. Any copier serviceman who is worth his weight will be know nearly instinctively what each of these buttons mean; to us, it is just nonsense.

Getting Free Copies

The copy machines you are using are configured in a certain way to use a coin operated slot, key card, or service key (such as those that Kinkos has). Through an interesting "feature" in the firmware, if the copy machine is configured to accept coins or keys, and no machine is hooked up for this, it will give copies for free. Unfortunately, this isn't as helpful as it sounds; anyone with a remedial amount of intelligence who wants to get free copies will try unplugging the instrument first and foremost. As such, it is often impossible without a service key to unplug the apparatus.

Fortunately, there is a work-around. Go into "Service Mode" (using star-2 and 8-star), and push the "Option" tab. Underneath it, push "Acc". A new menu will pop up. Hit the "Coin" button, and enter "0" on the keypad. Once you are done, hit "Enter" or "Apply" (you MUST do this after you change any field; otherwise it will reset the next button you push). Once you are done, hit reset until you are on the main screen. Voila - free copies!

How to Absolutely Destroy Any Canon Copier

Get into Service Mode (star-2 and 8-star), click on Function, and click on Clear. You will see a list of various things you can clear:

Err - Sometimes, when you turn on a copier, it gives you a wrench, a cryptic error code, and information to turn off the machine and contact support. If you star-2 and 8-star, go to this menu, and clear the Error, it "solves" the problem.
Service - Removes the "Call For Maintenance" or "Call For Service" message that happens every 3,000 copies (or 3 months) (oil change joke, it is usually a large number of copies before it requests service).
Jam History - Every copier records the time and jam location for the last 255 jams.
Err-History - Same as Jam History, except for error messages.
E354-Clr and E355-Clr - I'm not sure what these do.

So far, its pretty boring. Now the fun stuff:

DC Con and R-Con - I'm not sure what DC and R actually stand for (they make an appearance in the Display and I/O menus as well), but pushing on these, hitting clear, and confirms it badly messes up the copier. How bad? It requires a serviceman to come out on-site and reload internal software/firmware. This is analogous to doing something to a computer that requires a factory restore (format c: for example). It also resets the hardware settings.

If you really hate a copy center, but want to do something a little drastic, try these:

Laser Adjustment

The laser is the thing that scans each document. Like everything else in the copier, it is adjustable. In the service menu (star-2 and 8-star), go into the "Adjust" tab. Once there, hit the button on the screenpad that says "Laser." The first three entries are Delay, Pwr-A and Pwr-B.

Pwr-A and Pwr-B: This simply indicates how much energy from the capacitor to dump into the laser. It requires a number from 0 to 255. Putting both settings to 0 will give you a white copy (that is, blank sheet), no matter what. A setting of 255 will give you a (nearly) black copy. Note that this is completely independent of the lightening/darkening and print density settings that customers mess around with in the main (non-service) menu.

The best thing about this is that most customer's and employees will assume that they are doing something wrong, and spend a lot of time trying to troubleshoot it first.

Delay - This tells the laser when to "fire" when using a feeder. Setting it to 0 will scan even before the document feeder takes the page into the glass.

Other Laser Adjustments

The X and Y direction offset can be modified too. The offset just tells the laser where to "start" and "stop" scanning. Go into the Service Menu -> Copier -> Adjust -> AdjXY menu. It requires a number from 0-2970 for each X and Y direction (in some, there are an YS and S direction - I'm not sure what these do, and it wasn't readily apparent from experimentation). Setting both of these to 2970 makes the copier virtually unusable.

User Account Fun

The Canon's have an odd feature that most people don't use related to User Management (its part of their "Mailbox" system, which is hardly ever used). If there is only one user (that is, it doesn't ask for a username or password before copying), you can have fun with everyone that uses the copier.

Go to the Service Menu -> Copier -> Option -> User. You will see a 5-screen long list of things you can change. There are two worth mentioning:

Copy-Lim - This limits the number of copy sets the user can do. It typically takes a value of 1-999 or 1-9999. Setting it to 1 will prevent anyone doing multiple copies of an original - this is very annoying.

Copy-Tot - This limits the toal number of copies a user can do. Usually, this is turned off by default. Setting this to an arbitrary number, say, 500, will have the copy suddenly freeze, stop copying, and informing the customer or employee that s/he can no longer do any copies. Again, this is very annoying.

Getting Out

Once you are done with the copy machine, simply hit the "Reset" or "Clear" button until you are at the main menu again. As long as you hit "Apply" or "Enter" and confirmed for all fields in the control panel, your settings will be saved. If you got free copies, don't forget to change the settings back once you are done!

Conclusion

The Service Menu contains many legitimate and user tools that allow servicemen and knowledgeable employees to troubleshoot and fix problems with a copy machine. I didn't discuss any of them. It also contains a portal to laughter, and millions of dollars of lost profits. And free copies! I encourage you to use the techniques outlined in this article wisely and sparingly.

Sponsors

Voxel dot net
o Managed Hosting
o VoxCAST Content Delivery
o Raw Infrastructure

Login

Related Links
o Also by omghax


Display: Sort:
HOW TO: Obtain Free Copies and Do Other Fun Stuff to Copiers | 83 comments (61 topical, 22 editorial, 0 hidden)
Question (2.16 / 6) (#3)
by epepke on Fri May 28, 2004 at 03:13:08 AM EST

As the Glaswegian said to the Londoner, is this a 2600 article or a meringue?


The truth may be out there, but lies are inside your head.--Terry Pratchett


I bow down (2.28 / 7) (#4)
by starX on Fri May 28, 2004 at 03:14:45 AM EST

Before your 1337 photocopy h4X1ng skillz

"I like you starX, you disagree without sounding like a fanatic from a rock-solid point of view. Highfive." --WonderJoust
Now that Canon has laid you off, (2.83 / 6) (#5)
by BadDoggie on Fri May 28, 2004 at 03:19:03 AM EST

Will you be looking for a job at Xerox or Kodak? I hope so because I see a lot more of their machines than Canons.

woof.

"Eppur si muove." -- Galileo Galilei
"Nevertheless, it moves."

Can anyone confirm this? (2.80 / 15) (#9)
by Kasreyn on Fri May 28, 2004 at 04:12:50 AM EST

Oh - of course, I meant, can any certified Canon service personnel confirm whether this is true?

Because I certainly did NOT mean, can someone go out and fuck over a Canon and report back to this k5 thread ASAP. Certainly not! Because that would be wrong.

hint. Hint. HINT.


-Kasreyn


"Extenuating circumstance to be mentioned on Judgement Day:
We never asked to be born in the first place."

R.I.P. Kurt. You will be missed.
what the author wants (none / 2) (#12)
by dimaq on Fri May 28, 2004 at 05:28:22 AM EST

is to get a mitnick-tyle job at Canon. that is after serving time in federal prison and suffering all other forms of goverment harassment :)

+1 FP, Dont we all love hacking (2.16 / 6) (#13)
by trezor on Fri May 28, 2004 at 05:38:16 AM EST

And if anyone is in need for the service-menu for Thomseon tv-sets, just ask! That might be argued even useful and legal :)

Oh. And that +1 FP is the second this gets out of editing.


--
Richard Dean Anderson porn? - Now spread the news

props /nt (none / 0) (#15)
by Farq Q. Fenderson on Fri May 28, 2004 at 06:51:02 AM EST



farq will not be coming back
HOW TO: reenact getting free beer from omghax (2.92 / 160) (#16)
by K5 ASCII reenactment players on Fri May 28, 2004 at 07:07:47 AM EST

#1 - find a CROWBAR
       ____
      / __<
     / /
    / /
   / /
  / /
 /_/


#2a - apply CROWBAR to omghax's WINDOW
            ////////
Heh heh     |
1 4m 1337!  |_
          O | |
         <\-|_|
          | |  
         /| |____


#2b - OR just SMASH the FUCKING WINDOW
            ////////
It's just   |
h4xx0r1ng!  |_  *tinkle*
          O |#|
         <\/|#|
          | |  
         /| |____


#3 - CLIMB through the WINDOW

             ////////
Full         |
penetration! |_
            \__|       
           _/ _|
             | 
             |___


#4 - FIND the BEER

I TOTALLY
knew he'd
put it in         ___
the fridge! \O |\ /__/|
What a       |V|&|&&&||
14m3rz!      | |&|&&&||
            /|  \|___|/


#5 - DRINK the BEER

You need a
reenactment     &O     
for THIS? J00   V|Z
R teh 14m3r!     |
                 |\



#6 - RE-FILL the EMPTIES

It's domestic,   O
he'll never     /|Z
know the        &|
difference!  &   |\ & &



#7 - REPLACE in FRIDGE

                      ___
See, it's not  \O |\ /__/|
stealing!       |V|&|&&&||
                | |&|&&&||
               /|  \|___|/


#8 - make your ESCAPE


Wait until   ////////
he finds     |
what I left  |_
in his sock. O_|       
             /_|
             | 
             |___


#9 - DOCUMENT your SPLOIT for POSTERITY

Uhhh... yeah... you like that?  You like
that shit, you little l4m3r beeyatches?
Urrrr... who's your daddy?  WHO'S YOUR
FUCKING DADDY, BEEYATCHES? 


         / 
 *fap* O   _  *tap*
 *fap* \\=|_| *tap*
       |~ ---
      /|  | | 


Am I the only one... (2.54 / 24) (#17)
by MotorMachineMercenary on Fri May 28, 2004 at 07:07:53 AM EST

...who thinks it is appalling to have an article on how to steal on k5? Next in the series: "HOW TO: Obtain free diamonds and other fun stuff with jewellers." I know the western world is morally and ethically bankrupt, but do we have to flaunt it?

I'm not a troll or a prude, but think what omghax's article is about. Yes, he does have some 1337 h4X0ring skillz - most likely obtained at a job he got laid-off from -, but most of his instructions will be used to break the law. To instruct how to break the law might not be unlawful in your jurisdiction, but that doesn't make it a-okay.

--
"In a time of universal deceit, telling the truth is a revolutionary act."
-- George Orwell


DC Con & R Con Demystified (sort of) (2.80 / 5) (#22)
by Ricochet Rita on Fri May 28, 2004 at 10:46:50 AM EST

DC Con and R-Con - I'm not sure what DC and R actually stand for (they make an appearance in the Display and I/O menus as well)...

According to these service bulletins (Google is your friend): first, second, and third,

the Con -part simply means "Control" (or Config). These are Firmware Configuration numbers.

So by nuking the values, you're effectively removing the copier's operating baseline (or maybe it's look-ups). It probably no longer knows how to communicate internally or how respond to users, without these reference numbers. Something like that...

I didn't invest the effort to really persue what the DC and R (& MN) stand for.

FABRICATUS DIEM, PVNC!

sweet! (2.80 / 5) (#32)
by horny smurf on Fri May 28, 2004 at 01:10:09 PM EST

k5 needs more articles like this. I remember searching out and downloading this kind of stuff in my BBS days. Usually bullshit/out of date instrustions on stealing from coke machines, building a red/blue/green/pink box, or making crystal meth with OTC cold medicine.

Anyone else nostalgic for that kind of stuff (actually any 1980s/early 90s eary BBS text files) should check out Textfiles.com

+1FP (2.36 / 11) (#36)
by Aaron Aaronnson on Fri May 28, 2004 at 01:51:25 PM EST

I wholeheartedly approve of turning K5 into the Web equivalent of a hackers' BBS, especially since being ten years old I have never had experience of one.

interesting, but... (2.90 / 11) (#38)
by Mindcrym on Fri May 28, 2004 at 02:16:36 PM EST

I liked the bit about getting into maintenance mode and getting free copies.  However, the bit on how to destroy the firmware was a bit lame.
  I'd have liked to have seen a troubleshooting guide that makes use of the maintenance mode so that one could fix the copier instead of having to call the service guy.  That would be much more useful, non-destructive, and would serve to improve life for oneself if not others who needed to use the copier.
  Had this story been a useful troubleshooting guide I would +1 it, but as its more likely to be used by 14 year olds to wreak havoc at the local copy shop I'm going to -1 it.
  -Mindcrym

pwr-a and pwr-b (none / 0) (#40)
by guyjin on Fri May 28, 2004 at 02:56:26 PM EST

what do you get if you set one to 0 and the other to the max? gray?
-- 散弾銃でおうがいして ください
OMG (none / 1) (#41)
by wji on Fri May 28, 2004 at 04:00:40 PM EST

+1 fp, I got chills. Will K5 be getting a Legend of the Red Dragon II web-game? That'd be great.

In conclusion, the Powerpuff Girls are a reactionary, pseudo-feminist enterprise.
Passwd (2.75 / 4) (#47)
by bugmaster on Fri May 28, 2004 at 05:15:28 PM EST

Is this "*28-*" control key combo password-protectable ? I have difficulty believing that Canon would release wide-open copiers, so that jerks like you can jam them up. My guess is that there's supposed to be a password, but no one has it configured right (sort of like routers distributed by Earthlink/PacBell/etc.)
>|<*:=
Hypocrisy (again, but topical) (1.71 / 14) (#49)
by Ptyx on Fri May 28, 2004 at 05:34:03 PM EST

Claiming "I take absolutely no responsibility for anything anyone does with this information" about this article is like providing transporations and explosives to terrorists and  claiming "I take absolutely no responsibility for anything they do with the planes and guns I gave them".
The potential damage is certainly not the same, but the only difference I can find is the same than between a stupid jerk and a dangerous jerk.

Informations wants to be free and should be free, but it is the responsibility of the information provider to at least encourage others to use it wisely.
-- "On voudrais parfois être cannibale, moins pour le plaisir de dévorer tel ou tel que pour celui de le vomir... " Cioran

Other functions? (2.80 / 5) (#56)
by kumquat on Sat May 29, 2004 at 12:19:38 AM EST

Is there a menu function that automatically fixes grocer's apostrophes in copies?

Various comments lead me to believe this was in the editing queue for some time. Is basic punctuation really so hard to grasp?

drum damage possible? (2.92 / 14) (#63)
by brettd on Sat May 29, 2004 at 03:51:22 AM EST

The laser is the thing that scans each document.

Ok, you know shit about copiers- the laser does NOT scan the document, it exposes the selenium drum. The document is scanned by a CCD or CMOS sensor in electronic copiers, and the document it lit by cold cathode tube or LEDs.

Modifying the laser power could be very evil, depending upon how idiot-proof the setting is...the drum might be damaged by overexposure(I know they're damaged very easily by light exposure). Presumably Canon was smart enough to make the top value not high enough to cause damage, but who knows- maybe upper power levels are necessary as the drum ages and desensitizes. I don't know, and neither do you.

All in all the whole article seems colossally stupid. People really don't need to know how to bypass copy-payment/control devices- I see a lot of public libraries getting ripped off by people using this info, and I despise the "I'm a rebel, I'm making evil information free for the fuck of it, hear me r0wr!" attitude you have. You want to tell people how to get into the service menus, fine- that's handy info since it's Top Secret info as far as most companies are concerned- but don't give people a fucking step by step guide to ripping off copy centers and public libraries, kay?

Well, now if that stupid machine eats your quarter (none / 1) (#70)
by Mysidia on Sun May 30, 2004 at 12:15:41 AM EST

You could get your copy anyhow in theory.. Yeah

So with info like that spreading now copy centers that use their printers will just need to install video cameras to make sure nobody's messing with the copier's controls before putting money in, yeah... expect the prices of copies to go up.

On the other hand, fixing the little problem is probably just a firmware update a way (Change the code required to gain access to the service menu)



Don't be too hard on omghax (none / 2) (#72)
by ElMiguel on Sun May 30, 2004 at 06:19:49 AM EST

I think he is just showing his credentials for the CMF presidency.

Hm. This kind of story is a first. . . (1.58 / 12) (#73)
by Fantastic Lad on Sun May 30, 2004 at 05:54:31 PM EST

First psychological harassment of Rusty. "I'll just take my toys and go home!"

Now this idiocy.

I wonder who would want a place like this one shut down in the next year or so. . ?

Paypal has pulled accounts from several alternative news and information sites. I can think of three big ones (Freenet, Black Box Voting, Signs of the Times), all within the space of ten days.

Now what, oh, WHAT could this be in preparation for, do you think. . ?

Have some of you noticed your email getting extraordinarily flakey over the last six months? Emails not getting through to you when they ought? I know of several people pinpointed for this kind of annoyance. I'm one of them. It's happened before with a previous ISP, and when I checked with my sources, the answer was, "Yes. There was a lot of nothing, and then all of a sudden there was a big file on you. They were especially sensitive with the launch of the war in Iraq." Public opinion can sway and cause damage at such times, so they clamp down like nuts on those who can see. (Yes. I was among the very few shouting about the new Viet Nam while all the other idiots were cheering on the troops. Even here on 'enlightened' K5.)

Anyway, they like to drive you nuts with irritations and interruptions and that sort of thing.

The only reason I'm mentioning any of this is that the black-hats have been fucking with my email again for the past few months and it's been getting worse. --I want to say this: I'm not sure they would understand why, but I actually respect their drive to control those who should know better, but they (*ahem*) MUST also respect my efforts to show people their options. --Otherwise their actions are invalidated. Choice is of vast importance in this whole game. A willing slave is worth something. A forced slave is virtually worthless. As such, there must be an allowed trickle of escapees, and pissing me off directly is only going to make me louder, and the trickle may become something more. In other words, cut it the hell out. (And speaking very directly, doesn't your boss want it quiet around here? How secure is your job? You think nobody is looking over your shoulder? Consider who you're working for, genius!)

See, it's like this. . .

Some people claim that K5 and similar boards are not important, that nobody pays attention to the things discussed, but this is simply not true. Tens of thousands of regular people read this board, and they are important despite what they have been led to believe. Think of the kinds of thoughts and ideas which have been hashed over and made available thanks to the internet. K5 not important? BULLSHIT, and I am not speaking from the ego, so don't even go there.

Butterflies. . .

-FL

Whiny pissants (none / 2) (#75)
by aminorex on Sun May 30, 2004 at 07:40:29 PM EST

There are those of us, perhaps the majority (I have no basis for such an assessement), who believe in freedom of information. We generally regard the vocal minority of whining control freaks who post pissy complaints about the personal taboos being violated by the statements of other people as impotent fascist wannabees.

The supposed reductio argument, "selling explosives to terrorists" fails not because of its absurd premises, but because even the example is invalid. Explosives salesmen sell explosives. Terrorists effect terror. To shift responsibility for terror from the latter to the former is the blind reactionary violence of a fascist mind.

'eh... (none / 1) (#78)
by Skwirl on Wed Jun 02, 2004 at 03:35:40 AM EST

Something to play with to make my workday at the copy place slightly less boring. Let's keep in mind, though, kiddies, that the real evil corporate muckity mucks are far too well shielded for any of your petty vandalism to affect them and that the buck is pretty much going to stop with some poor wageslave like myself.

Also, sabotaging access to cheap, public, no-questions-asked presses probably isn't the most efficient way to spread the cause of freedom of information. (See also: The comment referring to libraries.) Wake me when you figure out a way to sabotage Monsanto, Rupert Murdoch or Big Oil.

--
"Nothing in the world is more distasteful to a man than to take the path that leads to himself." -- Herman Hesse

the proper usage is.. (none / 0) (#83)
by imperium on Sun Jun 27, 2004 at 05:48:05 PM EST

shopkeepers' apostrophes, as grocers are too limiting a category to capture this particular annoyance. At least you didn't use an unnecessary tautology, though!

x.
imperium

HOW TO: Obtain Free Copies and Do Other Fun Stuff to Copiers | 83 comments (61 topical, 22 editorial, 0 hidden)
Display: Sort:

kuro5hin.org

[XML]
All trademarks and copyrights on this page are owned by their respective companies. The Rest © 2000 - Present Kuro5hin.org Inc.
See our legalese page for copyright policies. Please also read our Privacy Policy.
Kuro5hin.org is powered by Free Software, including Apache, Perl, and Linux, The Scoop Engine that runs this site is freely available, under the terms of the GPL.
Need some help? Email help@kuro5hin.org.
My heart's the long stairs.

Powered by Scoop create account | help/FAQ | mission | links | search | IRC | YOU choose the stories!