Ich habe dann diese Anleitung gefunden, welche auch mit ein paar Abänderungen (s. unten) funktionierte:
How to Reset the Administrator Password on a Canon ScanFront 220P Scanner
The Canon imageFormula ScanFront 220P machine is a network scanner that scans boths sides of a page in colour or black/white, scans to PDF, various image formats and will even make a passable attempt at OCR and embed the results in the PDF it generates. It will write the scanned documents to a USB drive, an FTP server or send them via email. It's a very quirky little machine, but by and large it does a reasonable job.
A key quirk is that it's fussy about a lot of config options and, in particular, it is pretty restrictive about what it will accept as a password. No long passwords or 'funny' characters please. This caught me out big time. I changed the password to something that both I, and my fingers, promptly forgot. I didn't put it on the list I keep under my mousepad (that's a joke, Joyce), and try as I might, I couldn't get back in to change settings on the scanner.
(Oh, and because I know you're dying to know. That little recessed 'Reset' button that's just beside the keyboard and mouse ports. That doesn't do anything at all. Well, nothing I could find anyway. Certainly nothing useful.)
So I called Canon. That's what you do, right? Call the manufacturer. Well, that's an hour of my life I'll never get back. The folks at Canon Australia offered me a two step process: (1) Try these canned 'default' passwords we prepared earlier. If those don't work (2) call a service tech out to 'fix' it. Beg, plead, escalate all you like, Canon WILL NOT tell you how to perform a simple password reset on one of these machines. The guy I spoke to from Canon Australia did his best, and I could tell he was frustrated at what he was required to tell me, but I could also see that his hands were well and truly tied by his employer.
A little later on I figured out WHY Canon won't tell you how to reset the password. It's because it's not a simple job. (OK, it isn't that complicated, but it's not the sort of thing the help desk call centre at a major electronics manufacturer will tell random punters over the phone.)
Now, if there's one way to get me to solve a problem, it's to tell me I can't do it. Canon told me I couldn't reset the admin password on my scanner... so I did! And this is my story...
It's just a little PC
I'd figured out reasonably conclusively at some point in the past that this was a Windows CE box ("Wince", never a more appropriate name was chosen, huh?!). At the time, that raised my contempt for the device a bit, but I just filed the knowledge away, not having any real use for it at the time.
I did find it interesting that I could plug a common-or-garden USB keyboard and mouse into this thing (in hindsight, the PS/2 keyboard and mouse ports should have told me something) and operate it with them rather than via the touch screen.
The real breakthrough came when, out of sheer frustration right after the telephone call with Canon, I was banging away at the keyboard whilst powering the scanner up and down. Guess what happened when I banged away on the DEL key whilst it was booting? It threw me to an ordinary Phoenix AwardBIOS screen, just like the one you'd expect to see with any generic personal computer!
You can see where I'm going with this, can't you...
Digging Around
So, I fiddled with boot settings. Told the scanner to boot DOS off of a USB stick I had laying around already. Found that it has a single 128Mb flash disk in it, formatted with a single FAT16 partition, and that there's a very minimalist, but recognizable, DOS/Windows style system on that disk.
I dug through the obvious-looking suspects on the filesystem. Found no obvious things to change. Brought out the big guns.
OK, the small guns. The damn small guns. I installed Damn Small Linux (DSL) on another USB flash drive, and booted that. NOW we're cookin' with gas! Used dd to dump an image of the filesystem. Took that image elsewhere. Parsed, grep'ed, hex-edited, you name it. Didn't make a whole lot of headway. (It's a Wince system, what did you expect?). Found that there's two specific config files, WinCE has much the same concept of a registry 'hive' as does all of the other recent versions of windows. Found a tool to dump those and drew yet another blank.
Then, when reading through various Microsoft documentation on WinCE I stumbled across a rather tasty little tid-bit of information. If you delete the system and user 'hives' from a WinCE system, the next time the system boots it will regenerate them from the defaults stored elsewhere in 'ROM' (in the case of this device, on flash). Having already made dumps of the whole flash disk and the main partition, I had nothing to lose. So I mounted the filesystem, deleted the hives, rebooted the scanner and... it worked. It took a little longer to boot than usual, then it took me through the first-time calibration and setup process.
OK, so technically I didn't reset the admin password, I reset the whole box. But at least I got control of the box.
So here's how to do it yourself...
HOWTO: Reverting a Scanfront 220P to ex-Factory State
Stage 1: Make a Bootable USB Key with Linux Installed
There are lots of ways to do this. I happen to have a Windows box on this particular desktop (I have Gentoo servers everywhere, and OS X laptops, but this box is Windows, sigh!) A nice, quick and easy way to do this with Windows is to grab the Universal USB Installer from PenDriveLinux and follow the bouncing ball. I knew exactly what I wanted, and so a nice small Linux system with just the basics was all I needed. Damn Small Linux was the obvious choice, and so DSL 4.4.9 (current at the time) is what I chose. Universal USB Installer helped me download the right image, and installed it on a USB key for me in a couple of minutes. As easy as cake!
Any other Linux ought to work well enough, I chose DSL purely because it was small and I could download it quickly.
Stage 2: Boot the Scanner into Linux
Turn the scanner off. Plug a USB keyboard into the top USB port and the USB flash drive with Linux installed in the bottom port(I found that the box is fussy about detection and boot order. The keyboard didn't come up reliably for me unless the keyboard was in the top port and the USB flash drive was in the bottom port). Turn the scanner on, and go hell-for-leather on the DEL key on the keyboard, just like you would when booting any recalcitrant desktop PC! When it loads the BIOS menu, go to the 'Advanced BIOS Features' menu, and change 'First Boot Device' to 'USB-HDD'. Save and Exit, and let the scanner reboot again.
If all goes according to plan, you'll get a nice Damn Small Linux splash screen, and the standard boot prompt at the bottom of the screen. You'll need to move a little bit quickly, at least press something on the keyboard before the boot prompt times out and it boots to default. I didn't try booting X Windows on this scanner (though it might work), I just wanted a command line. To achieve that, type
dsl 2and hit enter. NOTE: this will work if you use Damn Small Linux. Other Linuces will require a different boot command. Gentoo, for example, will expect you to type "boot 2", Knoppix will expect "knoppix 2". If you're not using DSL you'll need to RTFM, or at least check the boot examples (try hitting F2 and F3) to see what your choice of linux expects.
... and it begins to boot. It has a disconcertingly long pause at first while it loads the kernel. Remember, you're working with relatively slow embedded hardware here. A Core 2 Duo it ain't, so things take a little time to happen.
There's something kinda nice about seeing a previously locked up box with a single penguin in the top-left of the display! It made me giggle. After a bit of giggling, you'll see the box work through a pretty standard Linux boot process, detecting hardware, loading drivers. Mine even discovered the network interface, launched DHCPcd and helped itself to an IP address (and yes, DSL does include sshd and you can ssh into this scanner while it's running Linux)!
And then you have a command prompt.
Stage 2a: If the Scanner doesn't boot into Linux
I've received some feedback from others who have used these instructions, and tried it a few more times myself. We have, collectively, learned that the scanners can sometimes be a bit fussy about USB flash drives; some will work and some won't. I did the original hack using a 4Gb 'Transcend' branded flash drive. I tried it later with a 16Gb version of the same key and the scanner refused to boot from it. Also, on one attempt, I had to switch the keyboard and flash drive between USB ports for the initial boot to change the boot device, then back later to do the hack. In short, if at first you don't succeed, experiment!
Stage 3: At the Command Prompt
Actually, there's two stage 3's. The conservative 'make a backup' stage, and the not-so-conservative 'hop in and hack' stage. I'll show you both...
Stage 3a: Make a Backup
Hopefully the USB flash drive you chose to boot linux has a bit of free space on it after linux is installed. I used a 2Gb drive with DSL, and I had plenty of space left over. Now, when working with disks, pretty much the safest type of backup you can make is a direct bit-for-bit dump of everything on the disk. Linux (and all unixes) provide a command called 'dd' (Disk Dump). It's safe because it's an absolute no brainer. It just takes all the ones and zeroes, in order, and writes them to wherever you tell it to.
My digging around told me that my scanner's internal flash 'disk' was presented by BIOS as the first IDE disk. In unix terms, that's at device node /dev/hda . The disk in my scanner had a single FAT16 partition on that disk, called /dev/hda1
To back it up, just tell dd to dump it. I saved my backups to the /cdrom partition that DSL mounted when it booted (that's actually a writable partition on the USB flash drive). So, a command like this
dd if=/dev/hda of=/cdrom/scanfront-220p-hda.dd bs=512tells dd to do a bit-for-bit dump of the device at /dev/hda into a file called /cdrom/scanfront-220p-hda.dd, 512 bytes at a time. If you want to be double-careful, or you just want a raw dump of the partition to loopback mount and dig around in later, also dump the hda1 partition
dd if=/dev/hda1 of=/cdrom/scanfront-220p-hda1.dd bs=512That takes care of the backups. Do it, it's good insurance. It saved my butt!
Stage 3b: Hop in and Hack
Now, all that's left to be done is to remove the two 'hive' files and reboot the scanner. NOTE: this isn't a password reset, this is a complete factory reset. ALL of your settings will be deleted if you do this. It's lucky you made that backup of the settings back when you remembered the password, isn't it!
This is simple enough. Mount the hda1 filesystem on the scanner's internal flash drive. Remove two files. Reboot. You're done. Here are the steps:
Mount the hda1 partition
mount /mnt/hda1(This works because DSL parses the partition tables on all disks present at boot time, and writes appropriate entries in /etc/fstab and creates mount points in /mnt .) If that doesn't work for you, try:
mkdir /mnt/hda1 mount -t vfat /dev/hda1 /mnt/hda1Once it's mounted, just change into the DOS partition, and hunt down the files we need to remove.
First, get the 'system' hive...
cd /mnt/hda1/Documents\ and\ Settings/ lsYou'll see a few files sitting there, including 'system.hv'. That's the system hive, the system part of the WinCE registry
If you're feeling brave, type
rm system.hvand answer yes to the "Are you sure" question. If you're feeling conservative, just rename it so you can put it back later if you think you need to
mv system.hv system.hv.oldEither approach will have the same effect on the booting system. Factory reset. Now, do the same for the user hive, user.hv
cd /mnt/hda1/Documents\ and\ Settings/Default lsYou'll see user.hv sitting there, quivering by now. Again, either delete it..
rm user.hv(and answer Yes), or rename it
mv user.hv user.hv.oldI don't know that DOS filesystems really care, but properly unmounting things is good practice. Move out of the filesystem, then unmount the DOS filesystem
cd / umount /mnt/hda1And you're done. Just shut down the DSL Linux (don't just power it off, you want to ensure the USB flash is unmounted properly to preserve the backups you just made)
shutdown -h nowand wait. When you get the 'DSL Halted' message (or equivalent "I'm done!" message), remove the USB flash drive, and power the scanner off by holding the power button down for five-ish seconds.
Stage 4: Booting back into WinCE/Scanner OS
This part is easy enough. Just don't forget to go back into BIOS and change the 'First Boot Device' back to HDD-0. If you don't do that, you'll scratch your head for hours wondering why, when you did everything right, the silly machine just won't boot. You'll wonder what could possibly have gone wrong (dd is foolproof, right?) and you'll wonder how you're going to explain to your boss that you just bricked a $2500 scanner. Then you'll feel like a right goose when you realise what you've done.
So don't forget to change the first boot device back like I did, OK! :-)
Once you've done that, Save and Exit, let the scanner reboot, and enjoy your factory fresh scanner!
If You REALLY Messed It Up
I kept copies of my own backups. They might work on your machine. Ask me, I'll help if I can.
Quelle: http://www.geoffbreach.com/hacks/scanfront
Die Abänderungen waren: zum Start in das BIOS hatte ich bei mir keinen Erfolg mit der ENTF-Taste, ich musste F3+SHIFT drücken. Das 2. war, dass ich kein dd auf den mountpoint /mnt/cdrom machen konnte, da obwohl noch über 2GB frei waren, "kein Platz" mehr war.
Ich habe die USB-Tastatur hinten links unten angesteckt und den USB-Stick rechts vorne. Als USB-Medium verwendete ich einen 8GB SD-Kartenleser.
