Reverse engineering questions about peripage-a6-bluetooth HOT 15 CLOSED

the print code 1d76300048008f01 consists of the following:
1d763000 - action code, defines printing mode
4800 - width in bytes (72 in my case, 48 in your case)
8f01 - height in format 01 8f -> 399 lines
Printer accepts input image in any formatting: single packet, splitted packets, e.t.c.
For example, line 0x0f0f0f0f - which is 8 white pixels, 8 black pixels repeated can be transferred with packets like 0x0f 0x0f 0x0f 0x0f or 0x0f0f 0x0f0f or 0x0f0f0f 0x0f, e.t.c

opcode 1b4a6c prints page break
opcode 10fffe45 returns 0xaa if printer is not in printing mode (or finished printing)

@eliasweingaertner, your printing code limits image by 1408 pixels in height

from peripage-a6-bluetooth.

A6 and A6+ are sharing the same protocol for requesting printer HW/SW info. While printer modes differs because of the different image resolution.
I'm currently trying to figure out what does each opcode do and working on a documentation for each opcode that returns a response.
In my case 1d76300030008005 code has the value 1d76300048006500 and varying from the input image.
I still haven't reversed the application, and currently i'm tracing the bluetooth log and performing analysis.
In my assumption, default double-press print function can not be overloaded because of hardcoded bitmap and qr code. It still may have default print scheme tor this label, but this theory have to be checked first.
In addition, i've contacted with the vendor and requested any documentation, but still waiting for the response.
By the way, i'm currently working on compiling all together into the python library and pushing it to the pypi

from peripage-a6-bluetooth.

I've added a small tutorial notebook for the module and developing CLI utility in very lazy mode

from peripage-a6-bluetooth.

Wow, a first issue! Great :)

I've just added a time.sleep command, thanks for the hint. In fact, I did not run into this problem.
Regarding the reverse engineering process, I didn't look at the applications at all so far. Just looking at the bluetooth traffic, the protocol looks also a little awkward. If you find the time, feel free to do more analysis and provide a pull-request!

from peripage-a6-bluetooth.

I'm having a Peripage A6+, so in my case there is a different page width and printing delays are required. If i'll succeed in reversing the protocol/app, i'll pull request support library for it

from peripage-a6-bluetooth.

In addition, receive callback information from printer and add thermal overheat protection

from peripage-a6-bluetooth.

Using the poke method i've found out that it has additional configuration commands, but now i've lost ability to print text and get S/N

UPD: S/N break code 10ff20f4
UPD2: Write [0x10ff20f4, 'S/N'] will overwrite S/N with new value 'S/N'. String has to be terminated with '\0'
UPD3: 10ffff** configures print modes
UPD4: I don't understand it, sending any raw string makes printer print it

from peripage-a6-bluetooth.

Hey, great findings!

The first question I have is the following: You have a PeriPage A6+ (304 DPI) and I have the old A6 (203) DPI.
Does the script work with the A6+ as well? I assume you might need to pump up the pixel width of the image from 384 pixels to 575 pixels... Did you try that?

Do we know if the A6+ and the legacy A6 use the same protocol?

Second, regarding your poking experiments:

• Figuring out you could change the S/N on the A6 is awesome. However don't know if we should implement a feature that allows the users to change their S/N 😆
• I also discovered randomly that you can print raw text by simply sending it.

My biggest questions related to the printer communication are the following:

• In the image printing mode of the script, I use this command "1d76300030008005" to define the length of the printed content. The last two bytes essentially control how much image content is printed, but I don't have a clue what this means. In my bluetooth snoop logs, I saw this value changed for images of different length. I actually figured out using trial and error that 8005 was working well for me. I counted bytes, length of chunks but I don't know what this means.
• Printing Modes: We now know how to print images and raw text. But what else is this thing capable of printing? Reason I am asking: The printer itself can generate a QR code containing its bluetooth MAC address and the firmware version. Hence, it contains logic to generate a QR code. Is there a hidden QR code printing mode? Can we implement QR Code printing without generating an image first?
• Is there a way to read the firmware, possibly via USB?
• Does the USB interface use the same printing commands or different ones?

from peripage-a6-bluetooth.

It seems like this printer does not have any print stop codes, overheat callback, renaming, cover open handlers.
Any suggestions needed or btdumps with printer stopped printing after request.

from peripage-a6-bluetooth.

Merging all functions into module class ppa6.py, but currently under development

from peripage-a6-bluetooth.

@bitrate16 Again, great to see you're impacting our progress so much. I also looked at your ppa6 library, which looks absolutely how things should be.

from peripage-a6-bluetooth.

How many characters fit in a single line on Peripage A6?
UPD: 32

from peripage-a6-bluetooth.

the print code 1d76300048008f01 consists of the following:
1d763000 - action code, defines printing mode
4800 - width in bytes (72 in my case, 48 in your case)
8f01 - height in format 01 8f -> 399 lines

@bitrate16 Thank you, I've just updated the code to fix the static content length.
I've also taken a look at your ppa6 code. I'm impressed, and linked your project in my Readme.

Closing the issue for now.

from peripage-a6-bluetooth.

Is there any chance we could use the GPD files shipped with the Windows driver version for determining how to execute special functions?

from peripage-a6-bluetooth.

determining how to execute special functions

We can decompile driver, for example, with IDA and reverse-engineer it

from peripage-a6-bluetooth.