Canon CPNP protocol ------------------- This is another attempt to formalize the CPNP spec. Taken from the CP900 All fields are BIG ENDIAN unless otherwise specified. Packet Header: 16 bytes 43:50:4e:50 'CPNP' YX:XX Command. Bit 15 is 0 for request, 1 for resp. 00:00:00:00 Msg Sequence Num -- should increment monotically and responses must have the same seq as request. 00:00:00:00 Options for command, usually null 00:00 Payload length Identified commands: * 0x000 NULL ??? No idea what this does * 0x101 DISCOVER * 0x110 START_TCP * 0x111 END_JOB ?? Sent at end of job * 0x120 GET_STATUS * 0x121 DATA * 0x130 GET_ID (IEEE1284 Printer ID) * 0x151 FLUSH DISCOVER_REQ (0x0101) --------------------- 43:50:4e:50 CPNP 01:01 DISCOVER 00:00:00:06 SEQUENCE 00:00:00:00 (no args) 00:00 (no payload) DISCOVER_RESP (0x8101) ---------------------- 43:50:4e:50 CPNP 81:01 DISCOVER 00:00:00:06 SEQUENCE 00:00:00:00 (no args) 00:10 16-byte payload 00:01:08:00 (???) 06 MAC ADDR length 04 IP ADDR length 18:0c:ac:a4:b8:17 Printer MAC Address c0:a8:01:b5 IP address (192.168.1.181) GET_ID_REQ (0x0130) ------------------- 43 50 4e 50 CPNP 01 30 GET_ID 00 00 00 07 SEQUENCE 00 00 00 00 (no args) 00 04 4-byte payload 00 00 00 00 GET_ID_RESP (0x8130) -------------------- 43 50 4e 50 CPNP 81 30 GET_ID 00 00 00 07 SEQUENCE 00 00 00 00 (no args) 00 47 71-byte payload 00 45 IEEE1284 string length [rest] IEEE1284 data, semicolon separated tokens FLUSH_REQ (0x0151) ------------------- 43 50 4e 50 CPNP 01 51 FLUSH 00 00 00 07 SEQUENCE 00 00 00 00 (no args) 00 04 4-byte payload 00 00 00 00 FLUSH_RESP (0x8151) -------------------- 43 50 4e 50 CPNP 81 51 FLUSH 00 00 00 07 SEQUENCE 00 00 00 00 (no args) 00 04 4-byte payload 00 00 10 00 START_TCP_REQ (0x0110) ------------------- 43 50 4e 50 CPNP 01 10 START_TCP 00 00 00 07 SEQUENCE 00 00 00 00 (no args) 01 88 392-byte payload 00 00 00 00 00 00 00 00 00 4b 00 41 00 4c 00 41 00 4d 00 41 00 54 00 41 00 00 00 00 00 00 00 00 PC name (UTF-16) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 69 00 7a 00 7a 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 username (UTF-16) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 65 00 73 00 74 00 20 00 50 00 61 00 67 00 65 00 00 00 00 00 00 Job name (UTF-16) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 START_TCP_RESP (0x8151) -------------------- 43 50 4e 50 CPNP 81 10 START_TCP 00 00 00 07 SEQUENCE 00 00 00 00 (no args) 00 08 8-byte payload 30 30 30 30 PP PP 00 00 PP == TCP PORT. NULL_REQ (0x0000) ----------------- 43 50 4e 50 CPNP 00 00 NULL 00 00 00 08 SEQUENCE 00 00 00 00 (no args) 00 00 (no payload) NULL_RESP (0x8000) ------------------ 43 50 4e 50 CPNP 00 00 NULL 00 00 00 08 SEQUENCE 00 00 00 00 (no args) 00 08 (8-byte payload) 86 09 01 00 (???) 00 00 00 00 GET_STATUS_REQ (0x0120) ----------------------- 43 50 4e 50 CPNP 01 20 GET_STATUS 00 00 00 00 SEQUENCE 00 XX 00 00 (??? Job ID for TCP? 0x01 or 0x02?) 00 00 (no payload) GET_STATUS_RESP (0x8120) over UDP ---------------------------------- 43 50 4e 50 CPNP 81 20 GET_STATUS 00 00 00 00 SEQUENCE 00 00 00 00 (always null) 02 00 (512-byte payload) 01 01 YY XX YY paper, XX ribbon. 01 = missing, 04 = ready. 43 61 6e 6f 6e 20 43 50 39 30 30 00 == 'Canon CP900' (ie printer identifier) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 01 02 01 01 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 40 00 40 00 40 1f 40 1f d0 04 10 07 03 00 00 00 01 00 00 00 11 0f 2f 32 00 00 00 00 01 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 GET_STATUS_RESP (0x8120) over TCP ---------------------------------- 43 50 4e 50 CPNP 81 20 GET_STATUS 00 00 00 00 SEQUENCE 00 XX 00 00 (seen 0x01 or 0x02 -- maybe job id?) 00 40 (64-byte payload) [ Attempt to decode the details ] 00 00 01 10 04 04 00 00 00 00 00 00 00 00 00 00 PP 00 SS 00 01 00 00 00 XX XX XX XX YY YY YY YY 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SS: State. 00 wait/01 flags/02 data req/03 done/04 error XX: Data req offset (Little endian) YY: Data req length (Little endian) PP: Next Plane => 00 == Y, 01 == M, 02 == C. [ Examples of output I've seen ] 00 00 01 10 04 04 00 00 00 00 00 00 00 00 00 00 (??? variation 1) 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 04 04 00 00 00 00 00 00 00 00 00 00 (??? variation 2) 00 00 01 00 01 00 00 00 00 00 00 00 98 8f 01 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 01 00 00 00 00 00 04 00 (??? variation 3) 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 04 04 00 00 01 ff 00 00 00 00 00 00 (??? variation 4) 00 00 01 00 01 00 00 00 00 00 00 00 98 8f 01 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ data payload starts ] 00 00 01 10 04 04 00 00 05 ff 00 00 00 00 00 00 (??? variation 5) 02 00 02 00 00 00 00 00 00 00 00 00 98 8f 01 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 04 04 00 00 03 ff 00 00 00 00 00 00 (??? variation 6) 02 00 02 00 00 00 00 00 00 00 00 00 98 8f 01 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 04 04 00 00 07 ff 00 00 00 00 00 00 (??? variation 6) 02 00 02 00 00 00 00 00 00 00 00 00 98 8f 01 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 04 04 00 00 09 ff 00 00 00 00 00 00 (??? variation 7) 02 00 02 00 00 00 00 00 00 00 00 00 98 8f 01 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 04 04 00 00 0a ff 00 00 00 00 00 00 (??? variarion 8) 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 40 00 00 00 00 00 00 00 00 00 00 00 (??? variation 9. done?) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [... printing with exhausted ribbon ...] 00 00 01 10 04 04 00 00 01 ff 00 00 00 00 00 00 (??? variation 5a) 00 00 00 00 00 00 00 00 00 00 00 00 98 8f 01 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 10 04 04 00 00 00 ff 00 00 01 02 02 00 (??? variation 5b) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 DATA (0x0121) ----------------------- 43 50 4e 50 CPNP 01 21 DATA 00 00 00 00 SEQUENCE 00 ZZ 00 00 (args/jobid?) 00 40 (payload len, varies) Four variations. First one is flags: 00 ?? 00 00 XX XX XX XX TT TT TT TT YY YY YY YY XX == msg len (0x40) TT == 0x01 ??? YY == 00 00 40 00 (for YMC???) ?? == 0x01 ?? seems to match ZZ?? 00 00 00 RR 00 00 00 00 00 00 00 00 00 00 00 00 RR: 03 border, 02 none 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Second variation is for planar YMC data, consisting of 28B plane header, filled to 4KiB of size: 00 00 01 00 XX XX XX XX 01 00 00 00 YY YY YY YY XX == total data len, YY == plane len (delta is header len, ie 28 bytes) HH HH 00 00 VV VV 00 00 ?? 00 00 00 HH == rows (1232) VV == cols (1808) ?? == plane (00/01/02 == Y/M/C) [... initial payload ...] Third one is pure payload, used by jpeg printing. Fourth one is the end of job stuff: 00 00 03 00 XX XX XX XX 00 00 00 00 00 00 00 00 XX == msg len (64) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 DATA_RESP (0x8121) -------------------- 43 50 4e 50 CPNP 81 21 DATA 00 00 00 00 SEQUENCE 00 01 00 00 (args) 00 04 (payload len) Payload is always 4 bytes: 00 00 LL LL LL == bytes received END_JOB_REQ (0x0111) -------------------- 43 50 4e 50 CPNP 01 11 END_JOB 00 00 00 00 SEQUENCE 00 01 00 00 (args, also seen 0x02) 00 00 (no payload) END_JOB_RESP (0x8111) --------------------- 43 50 4e 50 CPNP 81 11 END_JOB 00 00 00 00 SEQUENCE 00 01 00 00 (args) 00 00 (no payload)