[sane-devel] anyone working on the Canoscan 4200F protocol?

[Carsten Juttner]

Hi everyone,

Just joined the list or I would have replied to the "any sniff 
volunteers unsupported Canon scanners: 4200F, 5200F, 9900F, 9950F" thread.

As indicated in the topic I have one of those scanners ( 
http://www.sane-project.org/unsupported/canon-4200f.html ) and would 
like to help make it usable under Linux in SANE hopefully covering 
similar devices as well.

I'm new to USB so read a lot about it and took a look at the components 
involved. I didn't take the scanner apart and would like to avoid doing 
this since I have no dustfree environment and it's tough enough to keep 
the surface clean on the outside :) .

Maybe this is old news, the scanner is driven on windows from user space 
side using a DLL that interfaces with the scanner using the Windows USB 
Still Image I/O Control Codes (as "\\.\usbscan0", easy to spot since 
IOCTL_[READ/WRITE]_REGISTERS control codes have fixed values for the USB 
control transfer: requestType 0xc0 and request is either 0x0c (for a 
length of 1) or 0x04).

The initial programming sequence after plugging in (different once the 
firmware is downloaded) looks similar to this (the actual values read 
back and written differ somewhat, they are obviously read and only 
certain bits masked off):

IOCTL_READ_REGISTERS 0xe1:0xfe1f:1read from scanner: 26
IOCTL_READ_REGISTERS 0xe1:0xffef:1read from scanner: 00
IOCTL_WRITE_REGISTERS 0xe0:0xffef:2 write to scanner: 20 01
IOCTL_READ_REGISTERS 0xe1:0xffb4:1read from scanner: 0b
IOCTL_WRITE_REGISTERS 0xe0:0xffb4:2 write to scanner: 2b 01
IOCTL_READ_REGISTERS 0xe1:0xffed:1 read from scanner: 03
IOCTL_WRITE_REGISTERS 0xe0:0xffed:2 write to scanner: 03 01
IOCTL_READ_REGISTERS 0xe1:0xffe3:1 read from scanner: 05
IOCTL_WRITE_REGISTERS 0xe0:0xffe3:2 write to scanner: 05 01
IOCTL_READ_REGISTERS 0xe1:0xffe2:1 read from scanner: 00
IOCTL_READ_REGISTERS 0x40:0x00:8 read from scanner: 00 00 00 0c 58 02 00 00
IOCTL_WRITE_REGISTERS 0xf0:0x00:5 write to scanner: 00 00 00 00 a8
IOCTL_READ_REGISTERS 0x40:0x00:8 read from scanner: 00 00 00 0c 58 02 00 00
IOCTL_WRITE_REGISTERS 0xf3:0x00:4 write to scanner: 00 52 00 00 (this is 
the length of the bulk transfer 0xa400 in 2-byte size)

the numbers are <value>:<index>:<length>
As mentioned the other parameters of the USB control transfer are fixed.

After that 41984 bytes are written to the scanner by bulk transfer 
(firmware).
This block is read back immediately and verified.

I have no log of a real scan yet but working on that.

So far, anyone recognizing this sequence? If so, is there any work on 
this in progress somewhere?

Regards,
Carsten