Hacking the Fiery X3e and X2

The Fiery is a standalone print server to which you can connect any printer and turn it into a network printer, kind of like a souped-up version of a JetDirect box. There are several different Fiery units, some MIPS based, some on a PCI card, and some x86 based. We got a couple of these from work, and now Justice and I are working on them and trying to hack them into MP3 servers or something. Read on for more details.

Updated 7/16/04: Pictures, details on the hard drives…
Updated 7/19/04: Partial file listing from the X2 drive!

Fiery X3e
CPU: 366MHz Celeron
RAM: 64MB (3 slots, max 512MB)
Interfaces: 2x 3.3v PCI, 1x NuBus(?)
Network: EtherExpress 100Mbit (using a 3C509 because of driver issues)
External: Parallel/Serial/USB
Disk Controller: 40-pin IDE, 44-pin IDE
HDD: 8GB ext3 (stock is 10GB ext2)
LCD: /dev/ix1284
OS: Fedora Core 1 (stock is a custom Debian)

We removed the hard drive and mounted it in another Linux system. First thing we did was reset the root password. The partition table was as follows:

Disk /dev/hdb: 10.2 GB, 10262568960 bytes
255 heads, 63 sectors/track, 1247 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
/dev/hdb1 Linux (128MB, /boot)
/dev/hdb2 Linux (512MB, /)
/dev/hdb3 Linux swap (256MB)
/dev/hdb4 Linux (9+ GB, /scsi0, spool?)

The bootloader was LILO, and loaded the default image of diablo. Diablo stands for Diagnostics, Install and Boot LOader. The default console is the serial port, so we used HyperTerm to boot. The system boots to a Debian login. It is a very barebones install, however apt-get is installed. There is no DNS support, everything is in /etc/hosts. The only apt sources were for the EFI servers. No GCC, no wget, nothing of any real use. There is an efisys process running which appears to control the LCD. There were well over 150 processes started.

A person by the name of Fumiaki Okushi seems to be involved with the X3e development. fumiaki appears in several log files, and there is a fumiaki who works at EFI and has posted in Linux dev lists (Google for it).

To replace this, we did a clean install of FC1 on an 8GB drive. After installing, we removed GRUB (the X3e didnt like it at all) and replaced it with LILO. /etc/lilo.conf and /etc/inittab were updated to run a console on the serial port and everything went fine from there. The system finds an EtherExpress Pro 100 network card, but fails to initialize it, complaining about an invalid EEPROM. Were using a 3C509 for the time being.

The LCD is controlled by the ixSerial driver, and is an IX232. It is available at /dev/ix1284 with maj 254 min 0. Software for the LCD appears to be available in LCD.dpkg file on /boot or lcd_1.02.tar.gz in /packages. The command to control the LCD is /bin/dialog, but I havent tested this in a non-Debian system.

Now we need to find an audio card for it.

Fiery X2
RAM: 64MB (4 slots, max ???)
Interfaces: 1x 5v PCI, 1x 64-bit PCI(?)
Network: Unknown (100Mbit, has ethernet & token ring)
External: Parallel/Serial/USB, and what appears to be either SCSI or a custom Epson interface
Disk Controller: 40-pin IDE, 68(?)-pin SCSI, 34-pin floppy
HDD: 4GB HDD (unknown partition type)
LCD: Same as X3e but on non-standard connector
OS: Unknown, proprietary, possibly BSD based

The hard drive has no partition table that I can find. I dumped the drive to an image on my linux machine. Running strings on the image turns up quite a few tidbits, some CSH scripts, and what looks like assembly or some Adobe scripting code, complete with comments. Heres one of the many copyright notices in there:

“(c) Copyright 1998 Electronics for Imaging, Inc. (EFI). All Rights Reserved EFI products contain certain trade secrets and confidential and proprietary information of EFI. Use, reproduction, disclosure, distribution by any means are prohibited, except pursuant to a written license from EFI. Modification, translation, reverse engineering, decompiling, disassembling, and creating derivative works based on this software are prohibited, except pursuant to a written license from EFI. Use of copyright notice does not imply publication or disclosure.”

I managed to get the drive image mounted, but its not working quite right yet. All files are unreadable and show up as 538,976,288 bytes. Mount lists the filesystem as vfat, but Im guessing thats not correct.

[root@localhost temp]# ls
adobe drivers lcdstr pspages startup..o
boot feature_.not libs queuedic.t sysdict
boot.st fonts65 mx_insta.ll rebooton system
calib halftone net release..ver system.d.ict
color httpd nvram res.dict tmp
config.l.ist hwdecomp..of passdict spool videodic.t
dev0 initdict product..ver start
disable..pcl l10n project_.mxw start.no.tel


Sorry then link to the forum didn’t work anymore
anyways while goggling for “fiery hack print controller” this is the most relevant thing out there. Yeah, these are pretty cool little boxes, I found a pi6200 today for 10 bucks. I just wanted the lcd out of it, I had NO idea what this thing was till I got it home. After cracking it open and seeing pci slots and and reading this post I’ve gotta try installing linux on it. It seems to work just fine so should I just try to talk to through the com port?