Table of Contents
Printers and Scanners
Devices that print, scan, and copy. Most of these will run some ARM or MIPS chip, paired with a custom OS or a Linux-based OS.
Canon Pixmas
Operating Systems
DryOS
now to access the console(s) of MX925
This is what runs stock on the printer. However, they have been used to exploit this DryOS, as it also runs stock on Canon P&S cameras. With some internal hacking, one can access the DryOS shell and more effectively interface with the device. This may be what led to the Doom hack immediately below…
Other
Doom hack
Almost nothing is described about this. There is not even a specific model number for the printer, but nonetheless, this is Doom running on a Canon Pixma. Colors are off, but the creator is very aware of that.
https://www.youtube.com/watch?v=NPWi5yJK3zo
https://www.youtube.com/watch?v=qa2tJQTJkCw (demonstrative talk)
Canon ScanFront 220p
Operating Systems
FreeDOS (running Doom)
You can attach a keyboard, mouse and USB-Drive and boot the scanner to FreeDOS
Sounds like one of the easiest printer hack procedures out there. Probably a good target to find at a thrift store or something - who knows what else this thing can do if running Doom simply takes plugging in a few things.
Epson Artisan 700/800
Operating Systems
UART shell (Linux?)
Selecting '@' will allow you run commands as root on the printer.
It’s possible to obtain a UART shell on these printers. Within this shell, one can enable root commands by simply selecting an option.
Lexmark Pro 805
Operating Systems (ARM)
see below
Other
Firmware vulnerability
the LCD board is a 'fully' independent system, with ARM processor
Attempts by a forum poster to hack this printer’s firmware. It runs off of an ARM processor, unsurprisingly. Never got past a baud rate bottleneck, probably due to laziness of user.
https://www.eevblog.com/forum/projects/lexmark-printer-hacking/
Ricoh MP 2555
Operating Systems
Telnet and more?
Most Ricoh network capable printers include Telnet; that is used by Ricoh for maintenance
For diagnostic purposes, but they’re still there in a functional capacity.
https://luke.geek.nz/misc/how-to-access-the-ricoh-printer-maintenance-shell/