The adventure of repairing a MFC-L5750DW printer

What and why

I just got a broken Brother MFC-L5750DW from the trash bin.

Soon as it’s connected to the network the printer restarts.

Sometimes it also shows ‘Receiving data…’ and restart after a while.

I wanted to play with it because I just felt it’s a ‘soft’ error and there is some hope to fix it. If it succeds, I will have a nice home printer, if it fails I will get some experience!

First steps

There is not much I can do with a printer always restarting if connected to the network. I can’t use the touchscreen panel, nor use the Embedded Web Server for configuration. Maybe the printer is trying to download some information from the internet and it crashes. Ok, let’s make a DHCP reservation for the printer and block all the internet traffic.

After creating the firewall rule on my router, the printer stays connected to the network and don’t restart.

Did I just fix it? Let’s try to print a test page!

‘Receiving data…’ and resets after a while.

Ok, let’s search with Google then…

https://help.brother-usa.com/app/answers/detail/a_id/76176/~/please-wait%2C-printing%2C-receiving%2C-or-receiving-data-message-frozen-on

Not much luck; it just says to reset to factory default and send it to a repair service (if it’s in warranty of course, this wasn’t the case)

Brother printers maybe doesn’t shine for quality, but for sure they are very good for reparability: service manuals can be easily found and also there is always some ‘secret’ maintenance menu to play with :-)

I entered mainenance mode and tried to initialize EEPROM parameters, but still no luck.

What can cause the reboot?

Ok, we have a printer that reboot when talks to the internet and also when it receives data to print. If the architecture is similar to a PC, surely it has something to do with the RAM. Surely a printing job is written to the RAM.

I disassembled the printer to reveal the main PCB, and immediatly found the SK Hynix 2Gb DDR3 SDRAM module.

A new one from Aliexpress costs about 3 euro. Let’s try!

After just 14 days (combined shipping is great!) I got the new RAM, but I am not good at BGA soldering. I kindly asked to a local smartphone repair shop, and they did a great job at replacing the module. The total expenses are now 30+3 euro. It’s getting serious.

New RAM module: No more reboots!

After the RAM replace, the printer can connect to the internet without rebooting! But when priting, it still shows ‘Receiving data…’ and nothing happens. DOH. It’s becoming a personal battle now.

Still can’t print: maybe the firmware is damaged?

I wanted to rewrite the firmware. Maybe the damaged RAM caused some problem during an update.

The official firmware update tool just locks the printer (it uses print jobs to retreive printer information and write the firmware, in my case print jobs are not an option).

The web server have a ‘Check new firmware version’ button, the printer still locks itself.

Firmware: how to get it?

Brother does not offer a way to get the firmware files, but surely the printer can get it from somewhere. What request is she doing? MITMPROXY to the rescue!

I started a proxy on my home pc and set it as a Proxy on the printer. For some reason (maybe something to do with certificates), I can’t get the full request, but I got a hostname: firmverup.brother.co.jp

Ok, let’s search with Google and yes! Someone else out there is trying the same thing!

Based on the findings:

I learn that the printer (or the update tool) makes a request containing some printer information and it gets the link to the right firmware as answer. The request is in XML format:

<?xml version="1.0" encoding="UTF-8"?>
<REQUESTINFO>
    <FIRMUPDATETOOLINFO>
        <FIRMCATEGORY>MAIN</FIRMCATEGORY>
        <OS>MAC_10.10</OS>
        <OSVERSION>10.16</OSVERSION>
        <INSPECTMODE>null</INSPECTMODE>
    </FIRMUPDATETOOLINFO>
    <FIRMUPDATEINFO>
        <MODELINFO>
            <SELIALNO>E75395BXXXXXXXX</SELIALNO>
            <NAME>MFC-L5750DW series</NAME>
            <SPEC>0616</SPEC>
            <DRIVER>MFC-L5750DW series</DRIVER>
            <FIRMINFO><FIRM>
    <ID>MAIN</ID>
    <VERSION>ZQ0000000000</VERSION>
</FIRM><FIRM>
    <ID>SUB1</ID>
    <VERSION>1.00</VERSION>
</FIRM></FIRMINFO>
        </MODELINFO>
        <DRIVERCNT>1</DRIVERCNT>
        <LOGNO>2</LOGNO>
        <ERRBIT></ERRBIT>
        <NEEDRESPONSE>1</NEEDRESPONSE>
    </FIRMUPDATEINFO>
</REQUESTINFO>

The mandatory information are: SERIALNO, NAME, SPEC

They can be found with this command:

snmpwalk -v 2c -c public IPADDRESS iso.3.6.1.4.1.2435.2.4.3.99.3.1.6.1.2

Please notice that firmware names (MAIN, SUB1) may change for each printer, and request should be changed accordingly.

Firmware versions are not very important, in my case I can write any number I want after ‘ZD’.

The request can be simulated with this command:

curl -X POST -d @request.xml https://firmverup.brother.co.jp/kne_bh7_update_nt_ssl/ifax2.asmx/fileUpdate -H "Content-Type:text/xml"

The response should look like this one, containing the URL to the desired firmware.

<?xml version="1.0" encoding="UTF-8" ?><RESPONSEINFO><FIRMUPDATEINFO><VERSIONCHECK>0</VERSIONCHECK><MEMORYVERSION>a</MEMORYVERSION><FIRMID>MAIN</FIRMID><LATESTVERSION>ZQ2109240227</LATESTVERSION><PATH>http://update-akamai.brother.co.jp/CS/D001G9_ZQ.djf</PATH><DLTIME>115000</DLTIME></FIRMUPDATEINFO></RESPONSEINFO>

Repeat the request with <FIRMCATEGORY>SUB1</FIRMCATEGORY> to get the SUB1 firmware (it seems this printer have 2 flash with 2 firmwares).

Firmware: how to flash it?

Excluding official ways (update tool or web page), there are also two advanced ways: by usb key or by usb maintenance tool driver. The last one is very tricky because it requires some special driver and tool that are not easily available.

The usb way described in the service manual seems easier:

Format a usb drive with FAT32 (try also with FAT16)
Create an empty file on the root of the drive called _@$UPD$OP0.8080
Create a folder on the root of the drive called “FIRM”
Place the file obtained with the XML request inside the FIRM folder
Start the printer with the USB drive connected
Flash should start automatically

Conclusion

After changing RAM and reflashing the MAIN and SUB1 firmwares, everything is working. I can fully use the printer. The only downsite is that my printer came with a ‘compatible’ toner and drum, so if I want to use seriuosly I need to invest 150/200 euro in consumables.

TL;DR

My road to repair was very twisty. If someone other encounteer the same problem, I would suggest this more cleaner and logical approach:

Find service manual for your printer
Maintenance Mode: 01 Initialize EEPROM parameters
Maintenance Mode: 25 Display software version -> Select “ROM Check Sum” -> press SET. It will automatically conduct checksum for each ROM. NG -> Not good / OK -> Pass. (In my case SUB1 related checksums were failing)
Reflash firmwares with the XML/USB key method
If the problem persist, change ram module or check power supply
Throw it away. Your time is valuable. Or well, it depends if you want to play and learn new things ;-)