My system is ScanFront 220 and I was able to reset the admin password by renaming the user.hv and system.hv files
ScanFront 220 has Windows CE on it
This solution works with me creating a bootable LIVE DOS USB drive
How to Reset the Administrator Password on a Canon ScanFront 220P Scanner
The Canon imageFormula ScanFront 220P machine is a network scanner that scans boths sides of a page in colour or black/white, scans to PDF, various image formats and will even make a passable attempt at OCR and embed the results in the PDF it generates. It will write the scanned documents to a USB drive, an FTP server or send them via email. It's a very quirky little machine, but by and large it does a reasonable job.
A key quirk is that it's fussy about a lot of config options and, in particular, it is pretty restrictive about what it will accept as a password. No long passwords or 'funny' characters please. This caught me out big time. I changed the password to something that both I, and my fingers, promptly forgot. I didn't put it on the list I keep under my mousepad (that's a joke, Joyce), and try as I might, I couldn't get back in to change settings on the scanner.
(Oh, and because I know you're dying to know. That little recessed 'Reset' button that's just beside the keyboard and mouse ports. That doesn't do anything at all. Well, nothing I could find anyway. Certainly nothing useful.)
So I called Canon. That's what you do, right? Call the manufacturer. Well, that's an hour of my life I'll never get back. The folks at Canon Australia offered me a two step process: (1) Try these canned 'default' passwords we prepared earlier. If those don't work (2) call a service tech out to 'fix' it. Beg, plead, escalate all you like, Canon WILL NOT tell you how to perform a simple password reset on one of these machines. The guy I spoke to from Canon Australia did his best, and I could tell he was frustrated at what he was required to tell me, but I could also see that his hands were well and truly tied by his employer.
A little later on I figured out WHY Canon won't tell you how to reset the password. It's because it's not a simple job. (OK, it isn't that complicated, but it's not the sort of thing the help desk call centre at a major electronics manufacturer will tell random punters over the phone.)
Now, if there's one way to get me to solve a problem, it's to tell me I can't do it. Canon told me I couldn't reset the admin password on my scanner... so I did! And this is my story...
It's just a little PC
I'd figured out reasonably conclusively at some point in the past that this was a Windows CE box ("Wince", never a more appropriate name was chosen, huh?!). At the time, that raised my contempt for the device a bit, but I just filed the knowledge away, not having any real use for it at the time.
I did find it interesting that I could plug a common-or-garden USB keyboard and mouse into this thing (in hindsight, the PS/2 keyboard and mouse ports should have told me something) and operate it with them rather than via the touch screen.
The real breakthrough came when, out of sheer frustration right after the telephone call with Canon, I was banging away at the keyboard whilst powering the scanner up and down. Guess what happened when I banged away on the DEL key whilst it was booting? It threw me to an ordinary Phoenix AwardBIOS screen, just like the one you'd expect to see with any generic personal computer!
You can see where I'm going with this, can't you...
Digging Around
So, I fiddled with boot settings. Told the scanner to boot DOS off of a USB stick I had laying around already. Found that it has a single 128Mb flash disk in it, formatted with a single FAT16 partition, and that there's a very minimalist, but recognizable, DOS/Windows style system on that disk.
I dug through the obvious-looking suspects on the filesystem. Found no obvious things to change. Brought out the big guns.
OK, the small guns. The damn small guns. I installed Damn Small Linux (DSL) on another USB flash drive, and booted that. NOW we're cookin' with gas! Used dd to dump an image of the filesystem. Took that image elsewhere. Parsed, grep'ed, hex-edited, you name it. Didn't make a whole lot of headway. (It's a Wince system, what did you expect?). Found that there's two specific config files, WinCE has much the same concept of a registry 'hive' as does all of the other recent versions of windows. Found a tool to dump those and drew yet another blank.
Then, when reading through various Microsoft documentation on WinCE I stumbled across a rather tasty little tid-bit of information. If you delete the system and user 'hives' from a WinCE system, the next time the system boots it will regenerate them from the defaults stored elsewhere in 'ROM' (in the case of this device, on flash). Having already made dumps of the whole flash disk and the main partition, I had nothing to lose. So I mounted the filesystem, deleted the hives, rebooted the scanner and... it worked. It took a little longer to boot than usual, then it took me through the first-time calibration and setup process.
OK, so technically I didn't reset the admin password, I reset the whole box. But at least I got control of the box.
So here's how to do it yourself...
HOWTO: Reverting a Scanfront 220P to ex-Factory State
Stage 1: Make a Bootable USB Key with Linux Installed
There are lots of ways to do this. I happen to have a Windows box on this particular desktop (I have Gentoo servers everywhere, and OS X laptops, but this box is Windows, sigh!) A nice, quick and easy way to do this with Windows is to grab the Universal USB Installer from PenDriveLinux and follow the bouncing ball. I knew exactly what I wanted, and so a nice small Linux system with just the basics was all I needed. Damn Small Linux was the obvious choice, and so DSL 4.4.9 (current at the time) is what I chose. Universal USB Installer helped me download the right image, and installed it on a USB key for me in a couple of minutes. As easy as cake!
Any other Linux ought to work well enough, I chose DSL purely because it was small and I could download it quickly.
Stage 2: Boot the Scanner into Linux
Turn the scanner off. Plug a USB keyboard into the top USB port and the USB flash drive with Linux installed in the bottom port(I found that the box is fussy about detection and boot order. The keyboard didn't come up reliably for me unless the keyboard was in the top port and the USB flash drive was in the bottom port). Turn the scanner on, and go hell-for-leather on the DEL key on the keyboard, just like you would when booting any recalcitrant desktop PC! When it loads the BIOS menu, go to the 'Advanced BIOS Features' menu, and change 'First Boot Device' to 'USB-HDD'. Save and Exit, and let the scanner reboot again.
If all goes according to plan, you'll get a nice Damn Small Linux splash screen, and the standard boot prompt at the bottom of the screen. You'll need to move a little bit quickly, at least press something on the keyboard before the boot prompt times out and it boots to default. I didn't try booting X Windows on this scanner (though it might work), I just wanted a command line. To achieve that, type
dsl 2
and hit enter. NOTE: this will work if you use Damn Small Linux. Other Linuces will require a different boot command. Gentoo, for example, will expect you to type "boot 2", Knoppix will expect "knoppix 2". If you're not using DSL you'll need to RTFM, or at least check the boot examples (try hitting F2 and F3) to see what your choice of linux expects.
... and it begins to boot. It has a disconcertingly long pause at first while it loads the kernel. Remember, you're working with relatively slow embedded hardware here. A Core 2 Duo it ain't, so things take a little time to happen.
There's something kinda nice about seeing a previously locked up box with a single penguin in the top-left of the display! It made me giggle. After a bit of giggling, you'll see the box work through a pretty standard Linux boot process, detecting hardware, loading drivers. Mine even discovered the network interface, launched DHCPcd and helped itself to an IP address (and yes, DSL does include sshd and you can ssh into this scanner while it's running Linux)!
And then you have a command prompt.
Stage 2a: If the Scanner doesn't boot into Linux
I've received some feedback from others who have used these instructions, and tried it a few more times myself. We have, collectively, learned that the scanners can sometimes be a bit fussy about USB flash drives; some will work and some won't. I did the original hack using a 4Gb 'Transcend' branded flash drive. I tried it later with a 16Gb version of the same key and the scanner refused to boot from it. Also, on one attempt, I had to switch the keyboard and flash drive between USB ports for the initial boot to change the boot device, then back later to do the hack. In short, if at first you don't succeed, experiment!
Stage 3: At the Command Prompt
Actually, there's two stage 3's. The conservative 'make a backup' stage, and the not-so-conservative 'hop in and hack' stage. I'll show you both...
Stage 3a: Make a Backup
Hopefully the USB flash drive you chose to boot linux has a bit of free space on it after linux is installed. I used a 2Gb drive with DSL, and I had plenty of space left over. Now, when working with disks, pretty much the safest type of backup you can make is a direct bit-for-bit dump of everything on the disk. Linux (and all unixes) provide a command called 'dd' (Disk Dump). It's safe because it's an absolute no brainer. It just takes all the ones and zeroes, in order, and writes them to wherever you tell it to.
My digging around told me that my scanner's internal flash 'disk' was presented by BIOS as the first IDE disk. In unix terms, that's at device node /dev/hda . The disk in my scanner had a single FAT16 partition on that disk, called /dev/hda1
To back it up, just tell dd to dump it. I saved my backups to the /cdrom partition that DSL mounted when it booted (that's actually a writable partition on the USB flash drive). So, a command like this
dd if=/dev/hda of=/cdrom/scanfront-220p-hda.dd bs=512
tells dd to do a bit-for-bit dump of the device at /dev/hda into a file called /cdrom/scanfront-220p-hda.dd, 512 bytes at a time. If you want to be double-careful, or you just want a raw dump of the partition to loopback mount and dig around in later, also dump the hda1 partition
dd if=/dev/hda1 of=/cdrom/scanfront-220p-hda1.dd bs=512
That takes care of the backups. Do it, it's good insurance. It saved my butt!
Stage 3b: Hop in and Hack
Now, all that's left to be done is to remove the two 'hive' files and reboot the scanner. NOTE: this isn't a password reset, this is a complete factory reset. ALL of your settings will be deleted if you do this. It's lucky you made that backup of the settings back when you remembered the password, isn't it!
This is simple enough. Mount the hda1 filesystem on the scanner's internal flash drive. Remove two files. Reboot. You're done. Here are the steps:
Mount the hda1 partition
mount /mnt/hda1
(This works because DSL parses the partition tables on all disks present at boot time, and writes appropriate entries in /etc/fstab and creates mount points in /mnt .) If that doesn't work for you, try:
mkdir /mnt/hda1
mount -t vfat /dev/hda1 /mnt/hda1
Once it's mounted, just change into the DOS partition, and hunt down the files we need to remove.
First, get the 'system' hive...
cd /mnt/hda1/Documents\ and\ Settings/
ls
You'll see a few files sitting there, including 'system.hv'. That's the system hive, the system part of the WinCE registry
If you're feeling brave, type
rm system.hv
and answer yes to the "Are you sure" question. If you're feeling conservative, just rename it so you can put it back later if you think you need to
mv system.hv system.hv.old
Either approach will have the same effect on the booting system. Factory reset. Now, do the same for the user hive, user.hv
cd /mnt/hda1/Documents\ and\ Settings/Default
ls
You'll see user.hv sitting there, quivering by now. Again, either delete it..
rm user.hv
(and answer Yes), or rename it
mv user.hv user.hv.old
I don't know that DOS filesystems really care, but properly unmounting things is good practice. Move out of the filesystem, then unmount the DOS filesystem
cd /
umount /mnt/hda1
And you're done. Just shut down the DSL Linux (don't just power it off, you want to ensure the USB flash is unmounted properly to preserve the backups you just made)
shutdown -h now
and wait. When you get the 'DSL Halted' message (or equivalent "I'm done!" message), remove the USB flash drive, and power the scanner off by holding the power button down for five-ish seconds.
Stage 4: Booting back into WinCE/Scanner OS
This part is easy enough. Just don't forget to go back into BIOS and change the 'First Boot Device' back to HDD-0. If you don't do that, you'll scratch your head for hours wondering why, when you did everything right, the silly machine just won't boot. You'll wonder what could possibly have gone wrong (dd is foolproof, right?) and you'll wonder how you're going to explain to your boss that you just bricked a $2500 scanner. Then you'll feel like a right goose when you realise what you've done.
So don't forget to change the first boot device back like I did, OK! :-)
Once you've done that, Save and Exit, let the scanner reboot, and enjoy your factory fresh scanner!
If You REALLY Messed It Up
I kept copies of my own backups. They might work on your machine. Ask me, I'll help if I can.
Hardware Details: Canon ScanFront 220P
Because I found the hardware in this scanner rather interesting, I guess that other geeks might also find it worth a look. So while I had it booted with Linux, I gathered up some hardware specs. They pretty much speak for themselves, but I'll say it anyway. This is a reasonably serviceable PC-like device with a flat panel touchscreen display, 128Mb of flash on-board in presented as a generic IDE drive. It has PS/2 keyboard and mouse ports, two USB ports, a 10/100 ethernet interface two (one top, one bottom) kick ass scanners built in, a nice quick sheet feeder, the ability to detect misfed sheets AND a fingerprint scanner. Someone's gotta have some nice ideas about what to do with a bit of kit like this!
So, without further ado, some info about hardware. res ipsa loquitur
/proc/cpuinfo
processor : 0 vendor_id : AuthenticAMD cpu family : 5 model : 10 model name : Geode(TM) Integrated Processor by AMD PCS stepping : 2 cpu MHz : 498.061 cache size : 128 KB fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 1 wp : yes flags : fpu de pse tsc msr cx8 sep pge cmov clflush mmx mmxext 3dnowext 3dnow bogomips : 992.87
/proc/meminfo
total: used: free: shared: buffers: cached: Mem: 519118848 150822912 368295936 0 3776512 52633600 Swap: 0 0 0 MemTotal: 506952 kB MemFree: 359664 kB MemShared: 0 kB Buffers: 3688 kB Cached: 51400 kB SwapCached: 0 kB Active: 19776 kB Inactive: 35320 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 506952 kB LowFree: 359664 kB SwapTotal: 0 kB SwapFree: 0 kB
output from lspci -v
00:01.0 Host bridge: Advanced Micro Devices [AMD] CS5536 [Geode companion] Host Bridge (rev 31) Subsystem: Advanced Micro Devices [AMD] CS5536 [Geode companion] Host Bridge Flags: bus master, 66MHz, medium devsel, latency 248 I/O ports at ac1c [size=4] 00:01.1 VGA compatible controller: Advanced Micro Devices [AMD] Geode LX Video (prog-if 00 [VGA controller]) Subsystem: Advanced Micro Devices [AMD] Geode LX Video Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 10 Memory at ee000000 (32-bit, non-prefetchable) [size=16M] Memory at efff0000 (32-bit, non-prefetchable) [size=16K] Memory at effec000 (32-bit, non-prefetchable) [size=16K] Memory at effe8000 (32-bit, non-prefetchable) [size=16K] Memory at efff8000 (32-bit, non-prefetchable) [size=16K] 00:01.2 Entertainment encryption device: Advanced Micro Devices [AMD] Geode LX AES Security Block Subsystem: Advanced Micro Devices [AMD] Geode LX AES Security Block Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 10 Memory at efff4000 (32-bit, non-prefetchable) [size=16K] 00:0d.0 Ethernet controller: National Semiconductor Corporation DP83815 (MacPhyter) Ethernet Controller Subsystem: National Semiconductor Corporation DP83815 (MacPhyter) Ethernet Controller Flags: bus master, medium devsel, latency 64, IRQ 11 I/O ports at fc00 [size=256] Memory at effff000 (32-bit, non-prefetchable) [size=4K] Expansion ROM at [disabled] [size=64K] Capabilities: [40] Power Management version 2 Kernel modules: natsemi 00:0f.0 ISA bridge: Advanced Micro Devices [AMD] CS5536 [Geode companion] ISA (rev 03) Subsystem: Advanced Micro Devices [AMD] CS5536 [Geode companion] ISA Flags: 66MHz, medium devsel I/O ports at 6000 [size=8] I/O ports at 6100 [size=256] I/O ports at 6200 [size=64] I/O ports at 1000 [size=32] I/O ports at 9d00 [size=128] I/O ports at 9c00 [size=64] 00:0f.2 IDE interface: Advanced Micro Devices [AMD] CS5536 [Geode companion] IDE (rev 01) (prog-if 80 [Master]) Subsystem: Advanced Micro Devices [AMD] CS5536 [Geode companion] IDE Flags: bus master, 66MHz, medium devsel, latency 248 I/O ports at ff00 [size=16] 00:0f.3 Multimedia audio controller: Advanced Micro Devices [AMD] CS5536 [Geode companion] Audio (rev 01) Subsystem: Advanced Micro Devices [AMD] CS5536 [Geode companion] Audio Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 11 I/O ports at fe00 [size=128] 00:0f.4 USB Controller: Advanced Micro Devices [AMD] CS5536 [Geode companion] OHC (rev 02) (prog-if 10 [OHCI]) Subsystem: Advanced Micro Devices [AMD] CS5536 [Geode companion] OHC Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 11 Memory at efffe000 (32-bit, non-prefetchable) [size=4K] Capabilities: [40] Power Management version 2 Kernel modules: usb-ohci 00:0f.5 USB Controller: Advanced Micro Devices [AMD] CS5536 [Geode companion] EHC (rev 02) (prog-if 20 [EHCI]) Subsystem: Advanced Micro Devices [AMD] CS5536 [Geode companion] EHC Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 11 Memory at efffd000 (32-bit, non-prefetchable) [size=4K] Capabilities: [40] Power Management version 2 Kernel modules: ehci-hcd
Output from lspci -v (note that the Dell Keyboard, Dell Keyboard Hub and the USB flash drive listed here are the devices I had plugged in to the scanner at the time)
Bus 002 Device 001: ID 0000:0000
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x0000
idProduct 0x0000
bcdDevice 0.00
iManufacturer 0
iProduct 2 USB OHCI Root Hub
iSerial 1 e0332000
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x40
Self Powered
MaxPower 0mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type none
wMaxPacketSize 2
bInterval 255
Language IDs: (length=4)
0000 (null)((null))
Bus 002 Device 002: ID 413c:1003 Dell Computer Corp.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x413c Dell Computer Corp.
idProduct 0x1003
bcdDevice 2.00
iManufacturer 1 Dell
iProduct 2 Dell USB Keyboard Hub
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 2
bmAttributes 0xa0
Remote Wakeup
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 2 Dell USB Keyboard Hub
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type none
wMaxPacketSize 1
bInterval 24
Language IDs: (length=4)
0409 English(US)
Bus 002 Device 003: ID 413c:2010 Dell Computer Corp.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0 Interface
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x413c Dell Computer Corp.
idProduct 0x2010
bcdDevice 2.00
iManufacturer 1 Dell
iProduct 3 Dell USB Keyboard
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 59
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 3
bmAttributes 0xa0
Remote Wakeup
MaxPower 50mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 3 Human Interface Devices
bInterfaceSubClass 1 Boot Interface Subclass
bInterfaceProtocol 1 Keyboard
iInterface 3 Dell USB Keyboard
HID Device Descriptor:
bLength 9
bDescriptorType 33
bcdHID 1.10
bCountryCode 0
bNumDescriptors 1
bDescriptorType 34 Report
wDescriptorLength 65
cannot get report descriptor
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type none
wMaxPacketSize 8
bInterval 10
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 3 Human Interface Devices
bInterfaceSubClass 0 No Subclass
bInterfaceProtocol 0 None
iInterface 3 Dell USB Keyboard
HID Device Descriptor:
bLength 9
bDescriptorType 33
bcdHID 1.10
bCountryCode 0
bNumDescriptors 1
bDescriptorType 34 Report
wDescriptorLength 142
cannot get report descriptor
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type none
wMaxPacketSize 4
bInterval 255
Language IDs: (length=4)
0409 English(US)
Bus 001 Device 001: ID 0000:0000
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 1
bMaxPacketSize0 8
idVendor 0x0000
idProduct 0x0000
bcdDevice 2.04
iManufacturer 3 Linux 2.4.31 ehci_hcd
iProduct 2 PCI device 1022:2095 (Advanced Micro Devices [AMD])
iSerial 1 00:0f.5
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x40
Self Powered
MaxPower 0mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type none
wMaxPacketSize 2
bInterval 12
Language IDs: (length=4)
0000 (null)((null))
Bus 001 Device 002: ID 058f:6387 Alcor Micro Corp.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 Interface
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x058f Alcor Micro Corp.
idProduct 0x6387
bcdDevice 1.42
iManufacturer 1 JetFlash
iProduct 2 Mass Storage Device
iSerial 3 4WX83IYU
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk (Zip)
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type none
wMaxPacketSize 512
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type none
wMaxPacketSize 512
bInterval 0
Language IDs: (length=4)
0409 English(US)The original post is from
https://web.archive.org/web/20190913190200/http://www.geoffbreach.com/hacks/scanfront
and you can find it here as well
http://www.geoffbreach.com/hacks/scanfront
Also, Points to the answer above
https://www.alexbilz.com/post/2020-06-01-repair_canon_scanfront_220p/
