Try getting a log of a small area, low resolution, black and white scan using this tool:
http://www.pcausa.com/Utilities/UsbSnoop/ Then compress the result and post it back to the list. someone might recognize it. allan On Sat, Apr 24, 2010 at 10:38 AM, Carsten Juttner <carjay at gmx.net> wrote: > Hi everyone, > > Just joined the list or I would have replied to the "any sniff volunteers > unsupported Canon scanners: 4200F, 5200F, 9900F, 9950F" thread. > > As indicated in the topic I have one of those scanners ( > http://www.sane-project.org/unsupported/canon-4200f.html ) and would like to > help make it usable under Linux in SANE hopefully covering similar devices > as well. > > I'm new to USB so read a lot about it and took a look at the components > involved. I didn't take the scanner apart and would like to avoid doing this > since I have no dustfree environment and it's tough enough to keep the > surface clean on the outside :) . > > Maybe this is old news, the scanner is driven on windows from user space > side using a DLL that interfaces with the scanner using the Windows USB > Still Image I/O Control Codes (as "\\.\usbscan0", easy to spot since > IOCTL_[READ/WRITE]_REGISTERS control codes have fixed values for the USB > control transfer: requestType 0xc0 and request is either 0x0c (for a length > of 1) or 0x04). > > The initial programming sequence after plugging in (different once the > firmware is downloaded) looks similar to this (the actual values read back > and written differ somewhat, they are obviously read and only certain bits > masked off): > > IOCTL_READ_REGISTERS 0xe1:0xfe1f:1read from scanner: 26 > IOCTL_READ_REGISTERS 0xe1:0xffef:1read from scanner: 00 > IOCTL_WRITE_REGISTERS 0xe0:0xffef:2 write to scanner: 20 01 > IOCTL_READ_REGISTERS 0xe1:0xffb4:1read from scanner: 0b > IOCTL_WRITE_REGISTERS 0xe0:0xffb4:2 write to scanner: 2b 01 > IOCTL_READ_REGISTERS 0xe1:0xffed:1 read from scanner: 03 > IOCTL_WRITE_REGISTERS 0xe0:0xffed:2 write to scanner: 03 01 > IOCTL_READ_REGISTERS 0xe1:0xffe3:1 read from scanner: 05 > IOCTL_WRITE_REGISTERS 0xe0:0xffe3:2 write to scanner: 05 01 > IOCTL_READ_REGISTERS 0xe1:0xffe2:1 read from scanner: 00 > IOCTL_READ_REGISTERS 0x40:0x00:8 read from scanner: 00 00 00 0c 58 02 00 00 > IOCTL_WRITE_REGISTERS 0xf0:0x00:5 write to scanner: 00 00 00 00 a8 > IOCTL_READ_REGISTERS 0x40:0x00:8 read from scanner: 00 00 00 0c 58 02 00 00 > IOCTL_WRITE_REGISTERS 0xf3:0x00:4 write to scanner: 00 52 00 00 (this is the > length of the bulk transfer 0xa400 in 2-byte size) > > the numbers are <value>:<index>:<length> > As mentioned the other parameters of the USB control transfer are fixed. > > After that 41984 bytes are written to the scanner by bulk transfer > (firmware). > This block is read back immediately and verified. > > I have no log of a real scan yet but working on that. > > So far, anyone recognizing this sequence? If so, is there any work on this > in progress somewhere? > > Regards, > Carsten > > > -- > sane-devel mailing list: sane-devel at lists.alioth.debian.org > http://lists.alioth.debian.org/mailman/listinfo/sane-devel > Unsubscribe: Send mail with subject "unsubscribe your_password" > ? ? ? ? ? ?to sane-devel-request at lists.alioth.debian.org > -- "The truth is an offense, but not a sin"
