Hi everyone, Just joined the list or I would have replied to the "any sniff volunteers unsupported Canon scanners: 4200F, 5200F, 9900F, 9950F" thread.
As indicated in the topic I have one of those scanners ( http://www.sane-project.org/unsupported/canon-4200f.html ) and would like to help make it usable under Linux in SANE hopefully covering similar devices as well. I'm new to USB so read a lot about it and took a look at the components involved. I didn't take the scanner apart and would like to avoid doing this since I have no dustfree environment and it's tough enough to keep the surface clean on the outside :) . Maybe this is old news, the scanner is driven on windows from user space side using a DLL that interfaces with the scanner using the Windows USB Still Image I/O Control Codes (as "\\.\usbscan0", easy to spot since IOCTL_[READ/WRITE]_REGISTERS control codes have fixed values for the USB control transfer: requestType 0xc0 and request is either 0x0c (for a length of 1) or 0x04). The initial programming sequence after plugging in (different once the firmware is downloaded) looks similar to this (the actual values read back and written differ somewhat, they are obviously read and only certain bits masked off): IOCTL_READ_REGISTERS 0xe1:0xfe1f:1read from scanner: 26 IOCTL_READ_REGISTERS 0xe1:0xffef:1read from scanner: 00 IOCTL_WRITE_REGISTERS 0xe0:0xffef:2 write to scanner: 20 01 IOCTL_READ_REGISTERS 0xe1:0xffb4:1read from scanner: 0b IOCTL_WRITE_REGISTERS 0xe0:0xffb4:2 write to scanner: 2b 01 IOCTL_READ_REGISTERS 0xe1:0xffed:1 read from scanner: 03 IOCTL_WRITE_REGISTERS 0xe0:0xffed:2 write to scanner: 03 01 IOCTL_READ_REGISTERS 0xe1:0xffe3:1 read from scanner: 05 IOCTL_WRITE_REGISTERS 0xe0:0xffe3:2 write to scanner: 05 01 IOCTL_READ_REGISTERS 0xe1:0xffe2:1 read from scanner: 00 IOCTL_READ_REGISTERS 0x40:0x00:8 read from scanner: 00 00 00 0c 58 02 00 00 IOCTL_WRITE_REGISTERS 0xf0:0x00:5 write to scanner: 00 00 00 00 a8 IOCTL_READ_REGISTERS 0x40:0x00:8 read from scanner: 00 00 00 0c 58 02 00 00 IOCTL_WRITE_REGISTERS 0xf3:0x00:4 write to scanner: 00 52 00 00 (this is the length of the bulk transfer 0xa400 in 2-byte size) the numbers are <value>:<index>:<length> As mentioned the other parameters of the USB control transfer are fixed. After that 41984 bytes are written to the scanner by bulk transfer (firmware). This block is read back immediately and verified. I have no log of a real scan yet but working on that. So far, anyone recognizing this sequence? If so, is there any work on this in progress somewhere? Regards, Carsten
