Hacker News

Getting debug access on a Brother printer over Telnet(inventor7777.github.io)

167 points by inventor7777 3 days ago | 55 comments

The interesting part to me in there is seeing a TRON kernel in the wild.

In the 80's TRON was Japan's bet for the future of operating systems, but it just lived on as an embedded kernel in cars, printers and other industrial applications.

https://en.wikipedia.org/wiki/TRON_project

https://www.osnews.com/story/145872/japan-tried-to-build-an-...

[–] contingencies 17 hours ago

1982: The movie Tron came out.

1984: The Japanese launched an OS called Tron.

1989: US officials feared Tron could undercut US dominance in computers.

2026: Tron is mostly found dominating printers, and an AI far beyond anything envisaged in the movie Tron explains it to humans.

Truth is stranger than fiction.

[–] sixothree 13 hours ago

1980: TRON is used as a keyword in Microsoft Basic

[–] prideout 12 hours ago

Ah, the complement to TROFF.

[–] Mountain_Skies 11 hours ago

It's interesting how well that particular command fits with the Tron character in the movie but those involved in the movie say it was just a coincidence and Tron comes from "electronic".

[–] jacquesm 12 hours ago

TRace ON.

[55] [12] [13] [14] [15]

[–] MayeulC 18 hours ago

This is something I have been wondering for a while: do custom laser printer firmware projects exist? I'm mostly interested in that to remove toner manufacturer checks, and fix a few annoyances in CUPS and the printers' postscript drivers.

I imagine that is shouldn't be too complicated to support more HW in the agentic age.

[–] ak217 13 hours ago

I would love to see some of this. Brother is awesome because of how accessible the hardware and toner ecosystem is, but a lot of the older models are security hazards.

Unlike inkjet printers, laser printer controllers can actually cause some damage because of the high power fuser unit. Running the fuser continuously will melt the printer (or at least trip the hopefully hardwired thermal protection), and cycling it on and off rapidly can be unpleasant for other devices on the circuit due to the inrush current.

[–] DaSHacka 15 hours ago

This but especially for the tracking dots. In the age of LLMs, I doubt it would be that difficult, so long as you don't hit guardrails.

[–] vessenes 13 hours ago

Do laser printers include tracking dots? I thought that was a color printer thing.

[–] DaSHacka 7 hours ago

I used to assume the same, it's apparently just laser printers and actually not inkjets with the tracking dots. Supposedly the resolution of inkjet printers is too low to embed discreet tracking identifiers that wouldn't be noticeable in the final print.

[–] sixothree 13 hours ago

We know about the yellow tracking dots.

[–] wildzzz 13 hours ago

For some of those devices, they use very bespoke CPUs that are simply not documented publicly.

[–] jordand 17 hours ago

The article linked at the bottom of this is a much more interesting read: https://starlabs.sg/blog/2025/11-breaking-into-a-brother-mfc...

[–] wpm 13 hours ago

> open link

> see "Why this matters" as a header

> close tab

[–] minraws 16 hours ago

I have managed to find zero-days in my Canon with some effort over the last few weeks, me and a cheap model, well it was never really that hard, but I feel like it has given me more time.

I am considering reverse engineering the entire thing, I honestly don't know if that's worth it given I can connect an rpi to the system and get everything done via my own app now.

And keeping printer off of wifi networks was the best decision I ever made imho. Either way printers suck, but I like them so much as a technology, converting digital to physical is such a great thing.

[–] lp92 15 hours ago

It's really surprising we have open source 3D printers with way more complex kinematics, parts, etc than a printer but we don't have a traditional open source printer despite printers existing since the 70s.

[–] pbhjpbhj 12 hours ago

https://www.crowdsupply.com/open-tools/openprinter ?

It's been on HN this year to my recollection. Maybe it has some closed firmware or something that means it's not "open" for you?

[–] sonorous_sub 14 hours ago

Not that surprising.

[–] ynac 11 hours ago

Having found the telnet access on my Denon AVR 6500h, I've built out all the UI the poor little screen and remote control wished it could deliver. Clearly they prepared for amazing features and tools, but I guess only for the dream board or the fancy home integration companies. It's staggering how far I can push the thing and how little is surfaced on the UI.

[–] torcete 10 hours ago

I actually would like to downgrade my brother printer's firmware. I have 3rd party ink cartridges and the printer stopped accepting them after an upgrade. In this day and age, looks like new versions of firmware are not fixing problems but introducing limitations.

[–] amstan 20 hours ago

I can't tell if any of this gives you more access than the normal http admin interface.

[–] cheschire 19 hours ago

Well now you can point an LLM at it. I’m not sure that gives you anything either, but I’m not sure the hacker ethos makes that a priority.

Sometimes a hack is just cool because it’s a hack.

[–] dizhn 18 hours ago

As far as I can tell, it doesn't. The web interface is like 90s website but it does have a million suboptions. None of these seem like it needed any hacking. I am not sure about the Debug ones. I'll have to check. I wouldn't be surprised if there was an available api listening with the same commands available. If not that would be the useful outcome from work like this. A CLI that implements these.

Now if you could use to allow firmware downgrades when the installed firmware doesn't, that would be useful too. I disabled updates on mine at a version that already allows it. I bought it a few weeks ago but luckily it didn't come with the latest "I don't like your ink chip" firmware.

[–] robinduckett 12 hours ago

I did this the old fashioned way with a Konica Minolta machine when I was about 20 in 2008 while bored working at a car dealership. A service technician resembling Santa Claus arrived one day to fix it (unrelated to my access attempts) and he told me how they still have the “lp0 on fire” error codes from when he first started working, when the printers had actual drums that could in some cases catch fire if there was a printer jam

[–] ciex 19 hours ago

But what are the things you would want from a printer that is already quite reliable, not DRM'd, and presumably compatible with all the devices you want to use it with?

[–] greyface- 18 hours ago

I'd like to disable the https://en.wikipedia.org/wiki/Printer_tracking_dots

[–] ndriscoll 9 hours ago

> Disables tracking dots

> Only person to do this, creating a unique signature

[–] greyface- 8 hours ago

There are dozens of us. Dozens!

[–] rationalist 16 hours ago

Idk if they still do this, but a long time ago I had a Brother inkjet that wouldn't print black and white if one of the color cartridges was empty (cyan iirc).

[–] onemoresoop 10 hours ago

How about not printing with the cartrige 3 quarters full but digitally empty?

[–] rationalist 4 hours ago

It took me a bit to understand what I think you meant:

Even when the cartridge is physically 3/4 full, the software will claim it is empty and not print.

Yeah, that sucks too.

[–] embedding-shape 17 hours ago

Lots of utterly shit printers limit what ink cartridges you can actually use, being able to mod the firmware to remove that limitation (which should be made illegal but alas) would be a win for humanity at large.

[–] ciex 15 hours ago

Anecdotally, I have never had issues with 3rd party cartridges in my Brother printer.

[–] devy 20 hours ago

Great write up and reverse engineering of firmware! I hope to see Epson MFC inkjet printers to have similar discovery too (perhaps it literally a prompt away with a link to this article).

[–] gregoryl 19 hours ago

I was digging around an epson receipt printers firmware recently; got as far as discovering http endpoints (hardcoded auth) to remotely enable ssh (but not login), and some other diagnostic access. They seem fairly well put together.

[–] xrd 16 hours ago

I keep searching for Brother printers at Goodwill because apparently they are the best for non-DRM cartridges.

But, when I use my little pocket friend (an AI called Gemini, perhaps you know him?) he often indicates that the printer I'm seeing is 12 years old, and probably has wear and tear on the rollers.

Does anyone know if this is true? I would really like to get a printer that avoids the cartridge cartels.

But, Goodwill is no longer really inexpensive, and they often don't let you return things if they are broken. I would pay $20 for a used printer, but the few Brother printers I found are always $69 or thereabouts.

[–] wildzzz 13 hours ago

Printers definitely do wear out. We had a very nice Canon for 10 years and slowly got out of alignment. There's a method to realign the print heads but it got to the point where it was beyond the adjustment limits. You could see the offset between the black and color inks in plain text. An interesting effect but not so much when you're trying to make something look good. Additionally, it would jam more often. The paper dust accumulation in the mechanisms seemed to be what was causing that. Everything went downhill as we were doing a lot of printing for our wedding and it was unfixable by the time we were done. It was a good printer, it deserved its place in Printer Valhalla.

Now we have a Brother that is also very nice but lacks the photo printing quality that the Canon had. We so rarely print photos anyway that it's just easier to send an order to CVS or Walgreens to have them do it.

[–] nekusar 16 hours ago

Yeah, Goodwill is pretty much a scam these days, for everyone either working for or buying from. It used to be better. Not great, but at least they used to serve the community.

And since they opened up their auction site (like an early eBay) it's just gone upside down stupid.

I'm also unsure how they even keep their 501c3 status.

[–] throwup238 15 hours ago

> I'm also unsure how they even keep their 501c3 status

There’s a special carveout in the law. As long as they’re only selling donated items, they can remain tax exempt (or to be precise, that income is not counted as “unrelated business income” so they can keep it under the nonprofit).

[–] sixothree 12 hours ago

I used to believe it was an ideal way to curb waste from consumerism via reuse. But the high prices force people into a decision that often ends with them just purchasing a new item, the exact discussion happening here.

[–] ragall 12 hours ago

Due to automation, the used market has gotten more efficient so places like Goodwill are no longer a good deal because they're selling their high value items (like good electronics or 4K Blu-ray discs) to various intermediaries.

[–] greyface- 20 hours ago

The same SET USER 640184.571119 command works on my 2012 Brother MFC-9460CDN.

[–] mlfreeman 17 hours ago

It also works on my Brother HL-L3280CDW

[–] wpm 12 hours ago

No issues getting it to work on my MFC-L3720CDW

This is awesome

[–] commandersaki 17 hours ago

I hope there is a way to reset the toner level/page count detection as that would let me refill the new toners which are chipped.

[–] gradous 17 hours ago

Cool post, I was interested in doing this to my own Brother printer too!

[–] nubinetwork 19 hours ago

But what do those numbers mean?

[–] josteink 19 hours ago

This piece had potential but IMO was a bit disappointing. The entire thing could be summarized as:

1. "I used AI to download and analyze a firmware image, and found a way to unlock DEBUG mode."

2. "I didn't actually explore the DEBUG mode at all, but here are the commands the AI found for me (link)"

I'd love for the author to at least put in a little real effort, explore some of these debug commands, and tell us why they are interesting.

As this is - I find it to be very minimum-effort, AI-assisted blog-slop. Sorry!

(Now for the link[1] to the actual (unexplored) debug-commands... It has really weird casing of the descriptions in the "behaviour"-column. Does anyone know why that is?)

[1] https://inventor7777.github.io/brother-mfc-commands-list.htm...

[–] DrinkyBird 16 hours ago

Seriously, this article is so fucking dull. So are most security or programming write-ups these days. "ChatGPT said this, Claude did this..." Same thing with that Switch 2 exploit. I so dearly miss the days of hearing stories of people discovering things and actually solving problems, instead of just asking some LLM and copy-pasting the output with no understanding.

[–] lmz 18 hours ago

The weird casing seems to be a minimum accepted prefix for the keywords.

[–] nekusar 16 hours ago

Hmm.

So this should also be an entry point to disable the yellow dots tracking, and also save Y ink.

https://en.wikipedia.org/wiki/Printer_tracking_dots

[–] cellsstudio 20 hours ago

This is a really cool little project. Also, the title gave me a strong hit of like mid 2000's internet "hacking" content that I tore through when I was in high school.

[–] NitpickLawyer 19 hours ago

The e-zines can make a comeback, there's probably enough content now. phreak2030s: "put the local load in the bearing firmwares". Or something :)

[–] petesergeant 16 hours ago

One recent project that LLMs has made easy has been properly segmenting my home network, which my boss archly described as "the internet of everything" for the sheer number of weird devices on it including a Brother printer under my bed.

I have a special sandboxed agent with encrypted credentials (and on its own locked down physical box) that's set me up vLANs and the like on a bunch of MikroTic hardware that I wouldn't have bothered to do myself if I'd had to be hand-maintaining it.

Been connecting a Raspberry Pi Zero to various points of it via ethernet and wireless to scan the intended segmentation works fine, and it does look that way.