No subject

already deduced the working boot procedure, some scan
head control commands and partial procedure to make a
full plate scan.

The controlling procedure involves three types of=20
control "commands". There are direct writes to/reads from
the external memory space of the MCU, some high addresses
of which seem to be memory mapped peripherals.
These are the single byte vendor write and read requests
0x0c (read) and 0x04 (write) to wValue 0x00e1 (read)
and 0x00e0 (write) with the address at wIndex.
Then there are command with varying values and
indices of varying length (some of which have easy
to find uses (like write to value 0x0071 index 0 which=20
homes the scan head, read form value 0x0040 index 0
which returns some status information like whether
the scan head is moving and if it is at home position,
values 0x0023 and 0x0024 index 0 which move the
scan head forward and backward by given length etc.)
Some are not so easy to deduce.
Third type of "command" is upload of several blocks
of data to the external memory space of the MCU
(at address 0xdd00) which seem to contain various
masking, ramping etc. data details of which is
unknown to me but which directly affects e.g. whether
the scan comes out as all black or something visible
and also seems to affect the motor operation.

If anyone can deduce from the description above more
about the on-board controller, I would like to hear.

I am in process of preparing a more detailed collection
of my findings, but if there is already a project to
make the back-end for this scanner, I would like
to submit the findings to that common pool.

With best regards,

Lauri Pirttiaho
Oulu
Finland

...................................................................
Luukku Plus paketilla p=E4=E4set eroon tila- ja turvallisuusongelmista.
Hanki Luukku Plus ja helpotat el=E4m=E4=E4si. http://www.mtv3.fi/luukku