Bricked HP LaserJet 4250 After Failed Firmware Update. Compact Flash Card Recovery Options?

[jleg094]

While performing a firmware update via FTP using cURL, the HP LaserJet 4250 I was working on froze. I had no choice but to cycle the power and hope for the best, but unfortunately it was bricked. The screen no longer lights up when powered on (although I can hear the internals working which is a good sign).

While doing some research, I read it is possible to purchase a 32MB Compact Flash card with the firmware preloaded (http://bit.ly/1BTZGCh), set the jumper pin on the logic board to boot from it, and then re-flash the firmware on the board. It sounds like a sure-fire fix, however I would like to save my company a few bucks if possible.

I was wondering if it is possible to use a Type I, 128MB Compact Flash card I have handy, and load the firmware onto it myself using a USB Compact Flash card reader/writer. Judging by what I read on another forum post (http://bit.ly/1GR6nM7), it sounds feasible to use a Unix/Linux utility such as dd to clone another working Compact Flash card with the firmware preloaded. However, I do not have such a card to clone. What I do have though is another HP LaserJet 4250 in working condition.

So that brings the question, is it possible to insert my own blank Compact Flash card into a working HP LaserJet 4250, and copy the firmware image the logic board to the card using the printer control panel? I assume this would be the only way, if any, to get the firmware on the card.

However, if it is not the only way, is there an easier method to get the firmware on the card? For example, can I simply format the card to FAT32 and copy the RFU firmware file to it, and boot the printer from it? Or does HP use it's own filesystem that is not readable to a PC? Also, would it be possible to use dd and simply copy the RFU file directly to the raw card device itself (no filesystem) and boot from that?

Sorry for the barrage of questions. I tried to find the answers to all these myself, but HP does not seem to provide much in-depth documentation on how the firmware via Compact Flash process works. I would greatly appreciate if someone with experience could provide the answers though! Thanks.

[jleg094 · Accepted solution]

Looks like I'll be solving my own issue here haha. So after peicing together bits of information from various posts and some experimenting, I managed to save my bricked LaserJet!

To fix a bricked HP LaserJet 4250 two things are required: a Type I CompactFlash card and another working HP LaserJet 4250. It's a common printer, so chances are you'll find another one around the office.

Here are the steps to fix the printer:

1. Insert the CompactFlash card into Slot 1 (the bottom slot) on the working printer's logic board. Instructions on how to do so are provided by HP here: http://bit.ly/1NNyIol
   
   
2. (May be optional) Initialize (format) the CompactFlash card as instructed on page 327 of the HP LaserJet 4250 service manual (http://bit.ly/1D22T7R)
   
   a) Turn the printer power off.
   b) Turn the printer power on, and then hold down the MENU button when the memory count begins.
   c) Continue holding down the button until all three printer control-panel lights flash once and then remain on. This might take up to 10 seconds.
   d) Press BACK ARROW button. The display should show INITIALIZE DISK.
   e) Press SELECT (Check Mark) button. The printer initializes the hard disk and continues its power-on sequence.
   
   
3. Now that the CompactFlash card is formatted, it is time to copy the NAND of the working printer to the CompactFlash card.
   
   a) Turn the printer power off.
   b) Turn the printer power on, and then hold down the CANCEL button when the memory count begins.
   c) Continue holding down the button until all three printer control-panel lights flash once and then remain on. This might take up to 10 seconds.
   d) Press SELECT (Check Mark) button.
   e) Press MENU button.
   f) Use the arrows to scroll until you see COPY BOOTLOADER TO SLOT2.
   g) Press SELECT, and the cursor should shift to the word BOOTLOADER. Use the arrows to change this to NAND.
   e) Press SELECT, and the cursor should shift to the word SLOT2. Use the arrows to change this to SLOT1.
   f) Press SELECT. The copy process should begin, and the progress will be reported on the screen.
   g) Once the process is done, turn the printer power off and remove the CompactFlash card.
   
   
4. Now that we have a working NAND on the CompactFlash card, it is time to restore it to our bricked printer. Perform the following steps on the bricked printer.
   
   a) Turn the printer power off.
   b) Insert the CompactFlash card into Slot 1.
   c) Set the jumper on the logic board to the opposite position to boot from the CompactFlash card.
   d) Turn the printer power on, and then hold down the CANCEL button when the memory count begins.
   e) Continue holding down the button until all three printer control-panel lights flash once and then remain on. This might take up to 10 seconds.
   f) Press SELECT (Check Mark) button.
   g) Press MENU button.
   h) Use the arrows to scroll until you see COPY BOOTLOADER TO SLOT2.
   i) Press SELECT, and the cursor should shift to the word BOOTLOADER. Use the arrows to change this to SLOT1.
   j) Press SELECT, and the cursor should shift to the word SLOT2. Use the arrows to change this to NAND.
   k) Press SELECT. The copy process should begin, and the progress will be reported on the screen.
   l) Once the process is done, turn the printer power off, remove the CompactFlash card, and reposition the jumper to the default position.
   m) Turn the printer power on. That's it! Everything should function normally again. Brick no more!

UPDATE (4/7/15): IF YOU DO NOT HAVE ANOTHER HP LASERJET 4250

It turns out you can simply download the firmware from the HP website, and create a bootable image out of it on a CompactFlash card. However, it is not quite as simple as just copying the firmware image. You need to skip the first 633 bytes of the firmware file (at least with version 08.260.1), and then copy the rest to a CompactFlash card. You can accomplish this by executing the following command on Mac OS X or Linux. Download and boot from a Linux live CD such as Ubuntu if necessary.

dd if=lj4240_4250_4350fw_08.260.1.rfu ibs=1 skip=633 of=/dev/disk2

Replace "lj4240_4250_4350fw_08.260.1.rfu" with the appropriate firmware filename, and "/dev/disk2" with the appropriate device if necessary.

If you would rather, a bootable copy of the firmware revision 08.260.1 can be downloaded here: http://bit.ly/1FeF3YP

As you can see in the image below, when opened with a hex editor, the downloaded firmware image from HP starts with bytes 1b 25 2d 31... However, the the printer does not understand this first part of the file when booting, as it is PJL instructions and not binary. The bootable image starts at byte 631 (277 hex) as highlighted. It may be possible that this address could change in future firmware revisions or for different printers, so here is how to tell where the bootable code begins. The first occurence of bytes 00 00 04 24 is where it starts. In ASCII it looks like "...$". In this sequence, the first 00 is the beginning of the bootable code. Below is another image, of what a bootable firmware image should look like.

Non-bootable firmware image, downloaded directly from HP

Bootable firmware image, extracted from download from HP

For fun, I unpacked some of the files embedded in the firmware image, and it turns out the printer runs on LynxOS! Who would have thought?

[Piano_Man]

Thank you so much for this post.  I was able to un-brick my LaserJet 2430dtn using this approach.  The only thing I can add was that in my case after the printer booted I had the following error" 80.0011 JPI Error turn off then on"  This error happend because the Jet Dirrect code was not properly installed.  I was able to fix this by first turning off the JetDirect port and rebooting the printer.  The printer would then boot normally but with no network support.  I then was able to re-send the .rfu file using a pallalel port as if it was a normal Firmware upgrade.  This worked so I removed the compact flash card and read the image.  I noticed that there was more data written to the flash card then was on the original image.  My guess is that durring the upgrade there is some extra data written to the flash card that is needed for the Jet Dirrect to work in my case.