366 lines
11 KiB
Plaintext
366 lines
11 KiB
Plaintext
Canon CPNP protocol
|
|
-------------------
|
|
|
|
This is another attempt to formalize the CPNP spec.
|
|
|
|
Taken from the CP900
|
|
|
|
All fields are BIG ENDIAN unless otherwise specified.
|
|
|
|
Packet Header: 16 bytes
|
|
|
|
43:50:4e:50 'CPNP'
|
|
YX:XX Command. Bit 15 is 0 for request, 1 for resp.
|
|
00:00:00:00 Msg Sequence Num -- should increment monotically
|
|
and responses must have the same seq as request.
|
|
00:00:00:00 Options for command, usually null
|
|
00:00 Payload length
|
|
|
|
Identified commands:
|
|
|
|
* 0x000 NULL ??? No idea what this does
|
|
* 0x101 DISCOVER
|
|
* 0x110 START_TCP
|
|
* 0x111 END_JOB ?? Sent at end of job
|
|
* 0x120 GET_STATUS
|
|
* 0x121 DATA
|
|
* 0x130 GET_ID (IEEE1284 Printer ID)
|
|
* 0x151 FLUSH
|
|
|
|
DISCOVER_REQ (0x0101)
|
|
---------------------
|
|
43:50:4e:50 CPNP
|
|
01:01 DISCOVER
|
|
00:00:00:06 SEQUENCE
|
|
00:00:00:00 (no args)
|
|
00:00 (no payload)
|
|
|
|
DISCOVER_RESP (0x8101)
|
|
----------------------
|
|
43:50:4e:50 CPNP
|
|
81:01 DISCOVER
|
|
00:00:00:06 SEQUENCE
|
|
00:00:00:00 (no args)
|
|
00:10 16-byte payload
|
|
|
|
00:01:08:00 (???)
|
|
06 MAC ADDR length
|
|
04 IP ADDR length
|
|
18:0c:ac:a4:b8:17 Printer MAC Address
|
|
c0:a8:01:b5 IP address (192.168.1.181)
|
|
|
|
GET_ID_REQ (0x0130)
|
|
-------------------
|
|
43 50 4e 50 CPNP
|
|
01 30 GET_ID
|
|
00 00 00 07 SEQUENCE
|
|
00 00 00 00 (no args)
|
|
00 04 4-byte payload
|
|
|
|
00 00 00 00
|
|
|
|
GET_ID_RESP (0x8130)
|
|
--------------------
|
|
43 50 4e 50 CPNP
|
|
81 30 GET_ID
|
|
00 00 00 07 SEQUENCE
|
|
00 00 00 00 (no args)
|
|
00 47 71-byte payload
|
|
|
|
00 45 IEEE1284 string length
|
|
[rest] IEEE1284 data, semicolon separated tokens
|
|
|
|
FLUSH_REQ (0x0151)
|
|
-------------------
|
|
43 50 4e 50 CPNP
|
|
01 51 FLUSH
|
|
00 00 00 07 SEQUENCE
|
|
00 00 00 00 (no args)
|
|
00 04 4-byte payload
|
|
|
|
00 00 00 00
|
|
|
|
FLUSH_RESP (0x8151)
|
|
--------------------
|
|
43 50 4e 50 CPNP
|
|
81 51 FLUSH
|
|
00 00 00 07 SEQUENCE
|
|
00 00 00 00 (no args)
|
|
00 04 4-byte payload
|
|
|
|
00 00 10 00
|
|
|
|
START_TCP_REQ (0x0110)
|
|
-------------------
|
|
43 50 4e 50 CPNP
|
|
01 10 START_TCP
|
|
00 00 00 07 SEQUENCE
|
|
00 00 00 00 (no args)
|
|
01 88 392-byte payload
|
|
|
|
00 00 00 00 00 00 00 00
|
|
|
|
00 4b 00 41 00 4c 00 41
|
|
00 4d 00 41 00 54 00 41 00 00 00 00 00 00 00 00 PC name (UTF-16)
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00
|
|
|
|
00 70 00 69 00 7a 00 7a
|
|
00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 username (UTF-16)
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00
|
|
|
|
00 54 00 65 00 73 00 74
|
|
00 20 00 50 00 61 00 67 00 65 00 00 00 00 00 00 Job name (UTF-16)
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00
|
|
|
|
START_TCP_RESP (0x8151)
|
|
--------------------
|
|
43 50 4e 50 CPNP
|
|
81 10 START_TCP
|
|
00 00 00 07 SEQUENCE
|
|
00 00 00 00 (no args)
|
|
00 08 8-byte payload
|
|
|
|
30 30 30 30 PP PP 00 00 PP == TCP PORT.
|
|
|
|
NULL_REQ (0x0000)
|
|
-----------------
|
|
43 50 4e 50 CPNP
|
|
00 00 NULL
|
|
00 00 00 08 SEQUENCE
|
|
00 00 00 00 (no args)
|
|
00 00 (no payload)
|
|
|
|
NULL_RESP (0x8000)
|
|
------------------
|
|
43 50 4e 50 CPNP
|
|
00 00 NULL
|
|
00 00 00 08 SEQUENCE
|
|
00 00 00 00 (no args)
|
|
00 08 (8-byte payload)
|
|
|
|
86 09 01 00 (???)
|
|
00 00 00 00
|
|
|
|
GET_STATUS_REQ (0x0120)
|
|
-----------------------
|
|
43 50 4e 50 CPNP
|
|
01 20 GET_STATUS
|
|
00 00 00 00 SEQUENCE
|
|
00 XX 00 00 (??? Job ID for TCP? 0x01 or 0x02?)
|
|
00 00 (no payload)
|
|
|
|
GET_STATUS_RESP (0x8120) over UDP
|
|
----------------------------------
|
|
43 50 4e 50 CPNP
|
|
81 20 GET_STATUS
|
|
00 00 00 00 SEQUENCE
|
|
00 00 00 00 (always null)
|
|
02 00 (512-byte payload)
|
|
|
|
01 01
|
|
YY XX YY paper, XX ribbon. 01 = missing, 04 = ready.
|
|
43 61 6e 6f 6e 20 43 50 39 30 30 00 == 'Canon CP900' (ie printer identifier)
|
|
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 01 01 02 01 01 01
|
|
00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
ff ff ff ff 40 00 40 00 40 1f 40 1f d0 04 10 07
|
|
03 00 00 00 01 00 00 00 11 0f 2f 32 00 00 00 00
|
|
01 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
GET_STATUS_RESP (0x8120) over TCP
|
|
----------------------------------
|
|
43 50 4e 50 CPNP
|
|
81 20 GET_STATUS
|
|
00 00 00 00 SEQUENCE
|
|
00 XX 00 00 (seen 0x01 or 0x02 -- maybe job id?)
|
|
00 40 (64-byte payload)
|
|
|
|
[ Attempt to decode the details ]
|
|
|
|
00 00 01 10 04 04 00 00 00 00 00 00 00 00 00 00
|
|
PP 00 SS 00 01 00 00 00 XX XX XX XX YY YY YY YY
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
SS: State. 00 wait/01 flags/02 data req/03 done/04 error
|
|
XX: Data req offset (Little endian)
|
|
YY: Data req length (Little endian)
|
|
PP: Next Plane => 00 == Y, 01 == M, 02 == C.
|
|
|
|
[ Examples of output I've seen ]
|
|
|
|
00 00 01 10 04 04 00 00 00 00 00 00 00 00 00 00 (??? variation 1)
|
|
00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 01 10 04 04 00 00 00 00 00 00 00 00 00 00 (??? variation 2)
|
|
00 00 01 00 01 00 00 00 00 00 00 00 98 8f 01 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 00 00 40 00 00 00 01 00 00 00 00 00 04 00 (??? variation 3)
|
|
00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 01 10 04 04 00 00 01 ff 00 00 00 00 00 00 (??? variation 4)
|
|
00 00 01 00 01 00 00 00 00 00 00 00 98 8f 01 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
[ data payload starts ]
|
|
|
|
00 00 01 10 04 04 00 00 05 ff 00 00 00 00 00 00 (??? variation 5)
|
|
02 00 02 00 00 00 00 00 00 00 00 00 98 8f 01 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 01 10 04 04 00 00 03 ff 00 00 00 00 00 00 (??? variation 6)
|
|
02 00 02 00 00 00 00 00 00 00 00 00 98 8f 01 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 01 10 04 04 00 00 07 ff 00 00 00 00 00 00 (??? variation 6)
|
|
02 00 02 00 00 00 00 00 00 00 00 00 98 8f 01 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 01 10 04 04 00 00 09 ff 00 00 00 00 00 00 (??? variation 7)
|
|
02 00 02 00 00 00 00 00 00 00 00 00 98 8f 01 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 01 10 04 04 00 00 0a ff 00 00 00 00 00 00 (??? variarion 8)
|
|
00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 03 00 40 00 00 00 00 00 00 00 00 00 00 00 (??? variation 9. done?)
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
[... printing with exhausted ribbon ...]
|
|
|
|
00 00 01 10 04 04 00 00 01 ff 00 00 00 00 00 00 (??? variation 5a)
|
|
00 00 00 00 00 00 00 00 00 00 00 00 98 8f 01 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
00 00 01 10 04 04 00 00 00 ff 00 00 01 02 02 00 (??? variation 5b)
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
DATA (0x0121)
|
|
-----------------------
|
|
43 50 4e 50 CPNP
|
|
01 21 DATA
|
|
00 00 00 00 SEQUENCE
|
|
00 ZZ 00 00 (args/jobid?)
|
|
00 40 (payload len, varies)
|
|
|
|
Four variations. First one is flags:
|
|
|
|
00 ?? 00 00 XX XX XX XX TT TT TT TT YY YY YY YY XX == msg len (0x40)
|
|
TT == 0x01 ???
|
|
YY == 00 00 40 00 (for YMC???)
|
|
?? == 0x01 ?? seems to match ZZ??
|
|
00 00 00 RR 00 00 00 00 00 00 00 00 00 00 00 00 RR: 03 border, 02 none
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
|
|
Second variation is for planar YMC data, consisting of 28B plane header, filled to 4KiB of size:
|
|
|
|
00 00 01 00 XX XX XX XX 01 00 00 00 YY YY YY YY XX == total data len, YY == plane len (delta is header len, ie 28 bytes)
|
|
|
|
HH HH 00 00 VV VV 00 00 ?? 00 00 00 HH == rows (1232)
|
|
VV == cols (1808)
|
|
?? == plane (00/01/02 == Y/M/C)
|
|
[... initial payload ...]
|
|
|
|
Third one is pure payload, used by jpeg printing.
|
|
|
|
Fourth one is the end of job stuff:
|
|
|
|
00 00 03 00 XX XX XX XX 00 00 00 00 00 00 00 00 XX == msg len (64)
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
DATA_RESP (0x8121)
|
|
--------------------
|
|
43 50 4e 50 CPNP
|
|
81 21 DATA
|
|
00 00 00 00 SEQUENCE
|
|
00 01 00 00 (args)
|
|
00 04 (payload len)
|
|
|
|
Payload is always 4 bytes:
|
|
|
|
00 00 LL LL
|
|
|
|
LL == bytes received
|
|
|
|
END_JOB_REQ (0x0111)
|
|
--------------------
|
|
43 50 4e 50 CPNP
|
|
01 11 END_JOB
|
|
00 00 00 00 SEQUENCE
|
|
00 01 00 00 (args, also seen 0x02)
|
|
00 00 (no payload)
|
|
|
|
END_JOB_RESP (0x8111)
|
|
---------------------
|
|
43 50 4e 50 CPNP
|
|
81 11 END_JOB
|
|
00 00 00 00 SEQUENCE
|
|
00 01 00 00 (args)
|
|
00 00 (no payload)
|