Inventor7777 · October 22, 2026
\nAs it turns out, the Brother NC-8700w Command Console is more interesting than it first appears.
\nI’ve always enjoyed seeing how things work. It started with hardware and trying to take interesting devices apart, and now I do the same with software.\nAnd as I’ve learned how software works, one of the goals I like is accessing hidden features. On Linux based devices, that’s getting a root Linux shell. But what about the printer?
\nIs the family Brother MFC-L8900CDW. Unlike the reputations of certain other printer brands and models, this one connects and prints every time. mDNS doesn’t randomly stop working, the paper doesn’t randomly jam, and the toner lasts forever. However, the vendor CLI is limited when it comes to deep system information. (one of these functions is not like the other)
\nThe first step to figuring things out in this day and age is getting a firmware binary and then using AI to attack it from all angles. (Some people are, of course, skilled enough to do this themselves, but I am not one of those people.) On some devices you can straight up download a firmware image, but in Brother’s case, they expect you to use their own downloader. My AI agent first tried just going to the link found in the Brother firmware updater app, but their server rejected a guessed XML request. So after digging a bit deeper into the firmware update tool, we found the list of models and stuff that it accepts. While writing this, I also discovered an interesting tool that might have saved me some reversing trouble had I known about it, but the Brother app had enough info to work it out manually. While Brother could change the format at any time, this is the request that worked for my printer.
\ncurl -sS \\\n 'https://firmverup.brother.co.jp/kne_bh7_update_nt_ssl/ifax2.asmx/fileUpdate' \\\n -H 'Content-Type: text/xml' \\\n --data-binary @- <<'XML'\n<REQUESTINFO>\n <FIRMUPDATETOOLINFO>\n <FIRMCATEGORY>MAIN</FIRMCATEGORY>\n <OS>MAC</OS>\n <INSPECTMODE>0</INSPECTMODE>\n </FIRMUPDATETOOLINFO>\n <FIRMUPDATEINFO>\n <MODELINFO>\n <NAME>MFC-L8900CDW series</NAME>\n <SPEC>0001</SPEC>\n <DRIVER>EWS</DRIVER>\n <FIRMINFO>\n <FIRM>\n <ID>MAIN</ID>\n <VERSION>ZU2605160228</VERSION>\n </FIRM>\n </FIRMINFO>\n </MODELINFO>\n <DRIVERCNT>1</DRIVERCNT>\n <LOGNO>2</LOGNO>\n <NEEDRESPONSE>1</NEEDRESPONSE>\n </FIRMUPDATEINFO>\n</REQUESTINFO>\nXMLYou can replace the firmware version with B0000000000 instead, and that also works.
In response, Brother’s API returned:
\n<RESPONSEINFO>\n <FIRMUPDATEINFO>\n <VERSIONCHECK>0</VERSIONCHECK>\n <MEMORYVERSION>a</MEMORYVERSION>\n <FIRMID>MAIN</FIRMID>\n <LATESTVERSION>ZV2608181949</LATESTVERSION>\n <PATH>http://update-akamai.brother.co.jp/CS/D009UD_ZV.djf</PATH>\n <DLTIME>175000</DLTIME>\n </FIRMUPDATEINFO>\n</RESPONSEINFO>Some very descriptive versions, I must say…
\nNow that the firmware was in hand, GPT-6.1 Sol got to work.
\nHere is what it found, in its own words:
\nConclusion\nThe main application firmware uses the TRON-family T-Kernel real-time\noperating system on 32-bit little-endian ARM. Confidence: high. Exact\nT-Kernel release, CPU core, and SoC have not been established.\nThis is positive T-Kernel evidence, not just an absence of Linux strings.\n\nEvidence in extracted/ZlibRo.bin (hex offsets relative to that file)\n0x004b0168: T-Kernel/OS SVC in execution\n0x019c0450: Software Interrupt (SWI) #6 (T-Kernel/OS & Extended SVC)\n0x019c050f: Software Interrupt (SWI) #9 (T-Kernel/DS)\n0x019c7d7b: OS_Ver\n0x019c7d82: TSysName\n0x019c7d8b: T-Kernel\n0x019c7d94: TMaxTskId (followed by semaphore/mutex/etc. configuration names)\n0x0002a624: TASK STACK INFORMATION for ITRON\n0x002b3014: MFC-L8900CDW series (also at 0x00c40f4c and 0x00c4148c)\n\nEvidence in extracted/KernelRo.bin\n0x0000e188: T-Monitor Initialize\n0x0000e8a5: TM> prompt\n0x00009154: Undefined Instruction (ARM)\n0x00009170: Undefined Instruction (THUMB)\nARM exception registers R0-R15/CPSR and ARM processor modes are present.\nThe opening words decode as ARM little-endian instructions, including\nSUB lr, lr, #4 (0xe24ee004) and PUSH {r3,r12,lr} (0xe92d5008).\nThe RTOS kernel is a separate 141,932-byte section loaded at 0x40100000.\n\nStorage and libraries: embedded identification strings, not a security audit\nZlibRo.bin 0x010050e4: Datalight Reliance Nitro v3.0.6 Build 2306EC\nZlibRo.bin 0x003302e4: RTOS Edition for arm; compiled Dec 21 2015\nZlibRo.bin 0x010d6b50: Datalight FlashFX Tera v3.1 Build 2772E\nZlibRo.bin 0x00f391e0: Lua 5.2.3 version identification\nZlibRo.bin 0x008ddaa4: OpenSSL 1.0.1c; other sections identify OpenSSL 1.0.2\nZlibRo.bin 0x005377b8: libpng version 1.6.43\nZlibRo.bin 0x00692ec8: gSOAP/2.7\nZlibRo.bin 0x019bb300: wpa_supplicant v0.5.7-Devicescape\nVersion labels can survive vendor backports; they do not establish\nwhich vulnerabilities are present or that every bundled module is active.\n\nFlash layout and extraction\nThe update wrapper starts with PJL EXECUTE BRDOWNLOAD / PROGRAM=FIRM.\nThis package maps file offset 0x93 to flash address 0xe0060000.\nA table of 20-byte labels plus 32-bit little-endian values begins at\npackage offset 0x8497. It names the kernel, page table, and zlib sections.\nThe main compressed stream starts at package offset 0x2b2e7, after its\n4-byte length. Three streams are stored sequentially. Each stream passed\nzlib checksum/end checks and exactly matches the table's expanded size.\nThe RW source addresses describe their installed flash destinations;\nthe update package packs those streams immediately after the RO stream.\n\nOutput Bytes Load address\nPageTable.bin 33,792 0xe0060000\nKernelRo.bin 141,932 0x40100000\nZlibRo.bin 28,186,916 0x40222b00\nZlibRw.bin 700 0x41e00d00\nZlib2Rw.bin 1,526,396 0x43cb8f00\n\nBinwalk found embedded images and other assets in the expanded main\nsection, but no recognizable Linux filesystem/kernel image. This does\nnot prove that no separate chip runs other firmware.\n\nHardware\nBrother's model datasheet specifies an 800 MHz main processor, 133 MHz\nsubprocessor, and 512 MB memory (regional model variations are possible).\nThe image contains SubCPU/print-engine control messages. This is consistent\nwith an RTOS application coordinating printing, scanning, UI, networking,\nand a separate engine controller. We have not analyzed SUB1 1.35.\nGeneric CPU vendor names in diagnostic tables do NOT identify the SoC.\nThe kernel has a T-Monitor debugger/monitor, but that does not establish\nthat it is accessible through the network telnet port. The firmware also\ncontains Brother network-configuration telnet commands. A telnet service\nis not by itself evidence of a Unix shell.\n\nSources and comparison material\nTRON Forum: T-Kernel and T-Monitor roles\nhttps://www.tron.org/tron-project/what-is-t-kernel/t-kernel/\nTRON Forum: official source downloads\nhttps://www.tron.org/source-code-download/\nBrother model datasheet (processor/subprocessor/memory)\nhttps://www.brother.lt/-/media/product-downloads/devices/printers/mfc/mfcl8900cdw/mfc-l8900cdw.ashx\nSTAR Labs: independently inspected a different Brother model using\nT-Kernel and similar named/compressed segments. Used as a format lead;\nour OS conclusion is based on this package's own extracted evidence.\nhttps://starlabs.sg/blog/2025/11-breaking-into-a-brother-mfc-j1010dw-three-security-flaws-in-a-seemingly-innocent-printer/\n\n...\n\nConfiguration records in ZlibRo.bin are 20 bytes each:\n integer value; name pointer; type; count; pointer to own value.\nRecords for TmConsEnable/TmDebugPort/TmBaudRate have values 0/0/115200.\nKernel code at 0x40109344 reads TmConsEnable and at 0x40109360-0x40109368\nskips initial serial-console initialization when that value is zero.\nThese are compiled defaults, not measurements of current RAM settings.\nSeparate application records ConsDrvEnable=1 and DEBUGPORT=2 exist;\nthese names alone do not establish UART pin numbers or a remote route.\n\nT-Monitor character I/O accesses memory-mapped hardware at 0xd0c00000:\n 0x4010e058: output character routine\n 0x4010e0d0: serial initialization, writes T-Monitor Initialize\n 0x4010e1a0: input character routine\n 0x4010e7c4 and 0x4010e8c0: interactive loops with TM> prompt\nInput/output can lazily initialize the serial block even when initial\nconsole initialization was skipped, so TmConsEnable=0 does not prove\nthat later monitor entry is impossible.\n\nAt 0x4010e280 the command dispatcher loads table address 0x41e00e18.\nIt walks 12-byte records (name, alias, handler), stopping at a null name.\nThe initial table is in extracted/ZlibRw.bin at offset 0x118:\n Help, H, handler 0x4010e318\n null, null, handler 0x4010e1f8\nThe terminator's handler prints Unsupported command. No full memory,\nregister, breakpoint, or step-command suite is present in this initial\ntable. This narrows the generic T-Monitor description from earlier.\n\nSeparate Brother debug console\nThe application contains telnetddebug and /telnetdebug_q identifiers,\nEnter debug user mode text, and help strings for debug symbols, task\nstacks, heap usage, uptime, and console output redirection. Their presence\nis a lead; it does not establish successful access or T-Monitor bridging.If you skipped past that, I can’t blame you. It could be interesting to some folks, though, which is why I included it.
\nThe printer runs T-Kernel, a TRON-family real-time OS.
\n| Component | Info |
|---|---|
| CPU architecture | 32-bit ARM, little-endian |
| Storage filesystem | Datalight Reliance Nitro 3.0.6 |
| Flash management | Datalight FlashFX Tera 3.1 |
| Scripting | Lua 5.2.3 |
| Other libraries | OpenSSL, gSOAP, libpng, wpa_supplicant |
| Firmware structure | Separate kernel, compressed application code, embedded web/UI assets |
Brother specifies an 800 MHz main processor, 133 MHz subprocessor, and 512 MB RAM. The firmware contains messages for communicating with that subprocessor and controlling the print engine. Brother datasheet
\nThis is probably the part you came for!
\nIf you have telnet enabled on your printer (easy to enable via the web UI), it is very easy to access the three debugging modes.
\n\nUse these at your own risk! You can seriously mess up the system if you modify the parameters incorrectly.
Log into the command console using your admin password and just hit enter when it asks for username. Once you’re at the Local> prompt, simply type SET USER 640184.571119
inventor7777@Mac-Studio - 20:17 ~ % telnet 192.168.50.16\nTrying 192.168.50.16...\nConnected to 192.168.50.16.\nEscape character is '^]'.\n\nWelcome. Type <return>, enter password at # prompt\n\n# \nBrother NC-8700w Command Console\n Copyright(C) 2000-2017 Brother Industries, Ltd.\n KASAGO TCP/IP Copyright (c) 2011 ZUKEN ELMIC, Inc.\n\n Interface 1 : NC-9200h, Ethernet 10/100/1000BASE-T (Inactive)\n Interface 2 : NC-8700w, IEEE 802.11b/g/n (Active)\n Interface 2 is selected for configuration\n\n Type HELP for command list\n\nEnter username> \nLocal> SET USER 640184.571119\n\nEnter debug user mode.\n\nLocal> HELP\n\nEXIT/^D Exit program\nHElp Information on available commands\nINitialize Reset unit\nCLear Remove configuration item\nSET Modify unit parameters\nSHow Display unit parameters\nZEro Zero statistical counts\nDEbug Execute debug functions\nREDirect Redirect printf() output\nWATch [<addr>[ <intvl/cond>[ <unit>]]] Watch memory function\nSNTPDEBUG SNTP for debug functions\n\nType 'HElp <cmd>' for more informationThe firmware also contains wireless QA and wireless development access modes, which I haven’t looked deeply into. Wireless QA is accessible via SET USER 031227, and wireless development is available via SET USER 031227.040119
I haven’t played around with the debug console (or the CLI in general, for that matter) very much, but the firmware reveals a TON of commands. Instead of making this post crazy long, my AI compiled this HTML of every command available. I haven’t tested them all, so take it with a grain of salt, but GPT-6.1 Sol is actually pretty smart!
\nAgain, I did not extensively test any of these commands as I prefer to have a working printer, but it’s pretty interesting. I did check the heap using DEBUG SHOW HEAP, and it really does give a full list of all running tasks and how much heap they use. Neat!
If this post didn’t satisfy your hunger for Brother printer reverse engineering, another interesting read is this Star Labs Brother investigation, where they dive a bit deeper into how these printers actually work.
\nOriginally published at Inventor7777.
","headings":[{"level":2,"text":"Some context","id":"some-context"},{"level":2,"text":"The unsuspecting subject","id":"the-unsuspecting-subject"},{"level":2,"text":"The journey begins","id":"the-journey-begins"},{"level":2,"text":"The firmware has landed","id":"the-firmware-has-landed"},{"level":2,"text":"Printer’s tech stack","id":"printer-s-tech-stack"},{"level":2,"text":"The interesting part: getting debug access without modifying anything","id":"the-interesting-part-getting-debug-access-without-modifying-anyt"}]}}