[sane-devel] anyone working on the Canoscan 4200F protocol?

[m. allan noah]

Try getting a log of a small area, low resolution, black and white
scan using this tool:

http://www.pcausa.com/Utilities/UsbSnoop/

Then compress the result and post it back to the list. someone might
recognize it.

allan

On Sat, Apr 24, 2010 at 10:38 AM, Carsten Juttner <carjay at gmx.net> wrote:
> Hi everyone,
>
> Just joined the list or I would have replied to the "any sniff volunteers
> unsupported Canon scanners: 4200F, 5200F, 9900F, 9950F" thread.
>
> As indicated in the topic I have one of those scanners (
> http://www.sane-project.org/unsupported/canon-4200f.html ) and would like to
> help make it usable under Linux in SANE hopefully covering similar devices
> as well.
>
> I'm new to USB so read a lot about it and took a look at the components
> involved. I didn't take the scanner apart and would like to avoid doing this
> since I have no dustfree environment and it's tough enough to keep the
> surface clean on the outside :) .
>
> Maybe this is old news, the scanner is driven on windows from user space
> side using a DLL that interfaces with the scanner using the Windows USB
> Still Image I/O Control Codes (as "\\.\usbscan0", easy to spot since
> IOCTL_[READ/WRITE]_REGISTERS control codes have fixed values for the USB
> control transfer: requestType 0xc0 and request is either 0x0c (for a length
> of 1) or 0x04).
>
> The initial programming sequence after plugging in (different once the
> firmware is downloaded) looks similar to this (the actual values read back
> and written differ somewhat, they are obviously read and only certain bits
> masked off):
>
> IOCTL_READ_REGISTERS 0xe1:0xfe1f:1read from scanner: 26
> IOCTL_READ_REGISTERS 0xe1:0xffef:1read from scanner: 00
> IOCTL_WRITE_REGISTERS 0xe0:0xffef:2 write to scanner: 20 01
> IOCTL_READ_REGISTERS 0xe1:0xffb4:1read from scanner: 0b
> IOCTL_WRITE_REGISTERS 0xe0:0xffb4:2 write to scanner: 2b 01
> IOCTL_READ_REGISTERS 0xe1:0xffed:1 read from scanner: 03
> IOCTL_WRITE_REGISTERS 0xe0:0xffed:2 write to scanner: 03 01
> IOCTL_READ_REGISTERS 0xe1:0xffe3:1 read from scanner: 05
> IOCTL_WRITE_REGISTERS 0xe0:0xffe3:2 write to scanner: 05 01
> IOCTL_READ_REGISTERS 0xe1:0xffe2:1 read from scanner: 00
> IOCTL_READ_REGISTERS 0x40:0x00:8 read from scanner: 00 00 00 0c 58 02 00 00
> IOCTL_WRITE_REGISTERS 0xf0:0x00:5 write to scanner: 00 00 00 00 a8
> IOCTL_READ_REGISTERS 0x40:0x00:8 read from scanner: 00 00 00 0c 58 02 00 00
> IOCTL_WRITE_REGISTERS 0xf3:0x00:4 write to scanner: 00 52 00 00 (this is the
> length of the bulk transfer 0xa400 in 2-byte size)
>
> the numbers are <value>:<index>:<length>
> As mentioned the other parameters of the USB control transfer are fixed.
>
> After that 41984 bytes are written to the scanner by bulk transfer
> (firmware).
> This block is read back immediately and verified.
>
> I have no log of a real scan yet but working on that.
>
> So far, anyone recognizing this sequence? If so, is there any work on this
> in progress somewhere?
>
> Regards,
> Carsten
>
>
> --
> sane-devel mailing list: sane-devel at lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/sane-devel
> Unsubscribe: Send mail with subject "unsubscribe your_password"
>            to sane-devel-request at lists.alioth.debian.org
>



-- 
"The truth is an offense, but not a sin"