All contents on this page were obtained through observing the communication between the Windows TWAIN drivers (using GIMP) and the device connected on the LAN (using wireshark), plus some documents found on the internet (in particular, the SCL specification for HP scanners, written in 1999). The purpose is solely for documentational purposes, so that I will be able to write a proper SANE backend to support these devices. I do not have any access to any internal documentation of the device or protocol :( I also did not disassemble the windows driver, just looked at the commands sent over the local network.

The information on this page applies (at least) to the following devices:

• KONICA MINOLTA bizhub C203
• KONICA MINOLTA bizhub 363

Other devices might also use this type of scanning protocol, but I have not had access to them so far.

The different devices have a similar command set, but slight differences exist.

The Windows TWAIN driver has lots of settings, some of which are processed by the scanner (and need to be implemented in the SANE driver, too), some of which are applied by the scanner driver after the data is obtained from the scanner. These don't have to be implemented in SANE.

bizhub C203:

• Initial communication to connect and open the scanner (until scanning window appears)
• Preview scan of whole FBF area in B/W
• Preview scan of part of FBF area in Grayscale
• Grayscale scan in 100dpi(200dpi) from FBF, part of area, Wait for button
• B/W scan in 600dpi from FBF, part of area, contrast set to low
• 100dpi scan A4 landscape in BW from simplex ADF
• 100dpi scan A4 portrait in BW from duplex ADF

bizhub 363:

• TODO

The Windows driver tries to detect the scanner via SVRLOC (SLP), using either of the two services

• service:KMRealTWScan0200.KONICAMINOLTA (for real scans)
• service:KMHDDTWScan0200.KONICAMINOLTA (for retrieving documents from the harddisk of the copier)

A broadcast example can be found here.

Unfortunately, it seems that the scanner is not responding to SLP requests (even though that setting is enabled), so the auto-detection does not work with the Windows TWAIN driver, either.

The bizhub device can be detected via SNMP similar to the Magicolor devices. The sysObjectID for bizhub devices starts with

• 1.3.6.1.2.1.1.2.0 (SNMPv2-MIB::sysObjectID.0) = OID: SNMPv2-SMI::enterprises.18334.1.1.1.2.1.xx.x.x

The network communication uses port 59158 on the scanner/copier.

In contrast to the protocol of the magicolor 1690mf, there is no particular LAN communication wrapper.

Instead, all commands and all responses have a 12-byte header of the form tt 00 00 00 ss ss ss ss xx 00 00 yy, where „tt“ indicates the target („02“ for scanner access, „01“ for box access, i.e. scans saved on the scanner's HDD), „ss ss ss ss“ indicates the whole size of the packet (header+data), „xx“ indicates the type of request (read or write) and „yy“ indicates the direction. After this header, the actual data bytes of the packet follow (typically in Scanner command language (SCL) syntax, see below)

The devices do not automatically return data, but instead only respond to particular read requests (similar to how USB communication between host and device). So, a function call consists of three steps:

1. Send the function call with possible arguments to the device (xx=01, yy=00)
2. Send a data request packet to the device (xx=02, yy=00)
3. Receive data packet from the device (xx=01, yy=80)

A typical function call is:

  02 00 00 00 15 00 00 00   01 00 00 00  1b 2a 73 32 31 30 30 34  45              .*s21004 E    (send *s21004 function call)
  02 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00                                            (request response)
      02 00 00 00 17 00 00 00   01 00 00 80  1b 2a 73 32 31 30 30 34 64 33 56     .*s21004 d3V  (response *s21004 by scanner)

After the header, the data content of the packet is sent. The amount is specified by bytes 5-8 of the header.

If a response to a function call is requested by the scanner, a request with the following form needs to be sent to the scanner, after which a sending data packet is returned by the scanner:

  02 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
  

The first 12 bytes are the usual packet header, the remaining 4 bytes indicate :

• For inquire calls: 00 01 00 00
• For binary uploads: data size???
• For scan data request: data size?

The protocol is based on HP's Scanner Command Language (SCL). See e.g.

• http://www.josefsipek.net/mirrors/www.nondot.org/sabre/os/incoming/HP-ScanJet-SCL.TXT
• http://cubeman.org/manuals/sclv10.doc, http://cubexyz.blogspot.com/2008/09/programming-flatbed-scanner.html
• http://www.freepatentsonline.com/6237032.html for a number of *s… commands

Each function call and each response has the following form (byte-wise, where the spaces between the actual bytes are not part of the communication):

Note: In all examples, the first part is the actual data (hexadecimal, bytes separated by spaces) transferred, a human-readable ASCII representation is shown at the end of the line (only the command, not the 12 byte header), where ESC indicates the escape character 0x1b. A $$ or ## in a function or return value indicates a numeric value, mostly one of the variables listed at the end of this section, or its value.

Known SCL commands used by the bizhub devices:

Command	Return command	Parameter	Short description	Series
EscE	Esc*s##r$$V	20112	Welcome	all
Obtaining information from the scanner
Esc*s##E	Esc*s##d$$V	##	Inquire device parameter ##	all
Esc*s##U	Esc*s##t$$W[…]	##	Request binary data of a device variable ##	all
	Esc*s##tN	##	NULL-return of binary data in variable ##	all
Esc*???	Esc*s##r$$V (1)		Returns value (mostly success/failure) of a function call ##	all
	Esc*s##t$$V[…] (2)		Returns $$ byte of binary return value of function call ##	all
Functions
Esc*w#U[…]	(1)	20119	Login(# bytes of login data); Logout if #=-1	(423/?)
Esc*w#J	(1)	20100	Lock/unlock scanner	all
Esc*z##G[…]	(1)	20116	Setting image parameters (##=24, i.e. 24 bytes)	C353
Esc*z##H[…]	(1)	20122	Setting image parameters (##=27, i.e. 27 bytes)	423
Esc*w0W	(1)	20101	Wait for button	all
Esc*f0S	(1)	20113	Scan Window	all
Esc*w0S	binary data	-	Read scan data	all
Box handling
Esc*h$B	(1)	21100	Select/Lock Box $ (unlock if $=-1)	(423/?)
Esc*h$$F	(1)	21100	????	(423/?)
Esc*h$$K	(2)	21111	Retrieve preview image ($$ bytes of arguments)	(423/?)
Esc*h$$L	(2)	21116	: Image settings/select image; Return: image size in bytes	(423/?)
Error handling
Esc*oE	-		Clear error stack	all

Handshake, very first escape sequence sent to the scanner upon startup (Only for real scanning, not for HDD access). Returned is an ESC*20112r1V command (success of function).

Example:

02 00 00 00 0e 00 00 00   01 00 00 00  1b 45                                  ESC E
02 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
    02 00 00 00 17 00 00 00   01 00 00 80  1b 2a 73 32 30 31 31 32 72 31 56   ESC*s20112 r1V

Request the value of a device parameter from the scanner (varialbe indicated by ## parameter value).

Example, requesting (and receiving) the binary value of variable 21004 (value is 3):

  02 00 00 00 15 00 00 00   01 00 00 00  1b 2a 73 32 31 30 30 34  45              ESC*s21004 E
  02 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
      02 00 00 00 17 00 00 00   01 00 00 80  1b 2a 73 32 31 30 30 34 64 33 56     ESC*s21004 d3V

Request a binary value (type indicated by ## parameter value) from the scanner.

Example, requesting (and receiving) the binary value of variable 265:

  02 00 00 00 13 00 00 00   01 00 00 00  1b 2a 73 32 36 35 55         ESC*s265U
  02 00 00 00 10 00 00 00   02 00 00 00  08 01 00 00
      02 00 00 00 1d 00 00 00   01 00 00 80
      1b 2a 73 32 36 35 74 38   57 78 06 cf  00 22 09 00 00 00        ESC*s265t8 Wx..."..

Response indicating the success or failure of a function call.

User name is „limited“ to 64 characters, then come 94 0x00 bytes, then apparently a hashed password (16 bytes).

Data format:

Public login has 100 bytes (6 user name, 94 delimiter), user login has up to 174 bytes (up to 64 user name, 94 delimiter, 16 password hash)

Example:

  1b 2a 77 31 30 30 55 70   75 62 6c 69  63 00 00 00 ESC*w100Upublic
  00 00 00 00 00 00 00 00   00 00 00 00  00 00 00 00 
  00 00 00 00 00 00 00 00   00 00 00 00  00 00 00 00 
  00 00 00 00 00 00 00 00   00 00 00 00  00 00 00 00 
  00 00 00 00 00 00 00 00   00 00 00 00  00 00 00 00 
  00 00 00 00 00 00 00 00   00 00 00 00  00 00 00 00 
  00 00 00 00 00 00 00 00   00 00 00 
  01 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
      01 00 00 00 17 00 00 00   01 00 00 80
      1b 2a 73 32 30 31 31 39   72 31 56                ESC*s20119 r1V

Example:

  02 00 00 00 11 00 00 00   01 00 00 00  1b 2a 77 30 4a         ESC*w0J
  02 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
      02 00 00 00 17 00 00 00   01 00 00 80
      1b 2a 73 32 30 31 30 30   72 31 56                        ESC*s20100 r1V

Image parameters for the scan. All values are sent in little endian, but in the table they are shown as human-readable hex numbers

Escape sequence: ESC*z##G[24byte_binary_data]
	##G	Parameter G: Size of image data parameters (24 bytes), always 24G
	24 bytes binary data
		Byte 1-2:	x Resolution (little endian)	0x00c8=200dpi, 0x012c=300dpi; 100dpi uses 200dpi!
		Byte 3-4:	y Resolution (little endian)	0x00c8=200dpi, 0x012c=300dpi; 100dpi uses 200dpi!
		Byte 5-6:	Color mode: Unknown,	0=BW, 1=Gray, ??=Color (Preview: 0x00 for BW, 0x04 for Gray, 0x05 for Color; Scan: ???)
		Byte 7-8:	Bits per pixel	BW: 0x0001, Gray: 0x008, Color: 0x0018 (=24)
		Byte 9-10:	Unknown,	0x0082 for BW preview 0x0000 for all other previews; 0x0081 for Grayscale JPEG compression
		Byte 11-12:	Duplex	0x0000=simplex, 0x0001=duplex
		Byte 13-14:	Remove Background	range -6… 2 (fa ff=0xfffa to 02 00=0x0002), 0x0100 (00 01) for Auto
		Byte 15-16:	Rotation	0x0000=no rotation, 0x0001=rotate 180, 0x0002=counter-clockwise (270), 0x0003=clockwise (90)
		Byte 17-18:	Duplex binding	0x0000=simplex, 0x0001=left binding, 0x0002=top binding, 0x0003=right binding, 0x00ff=autodetect binding
		Byte 19-20:	Preview/Final scan	0x0000=Preview, 0x0001=Normal scan
		Byte 21-22:	Image type	see below for image types
		Byte 23-24:	Paper size / Image area?	First half-byte: 0x0=portrait,0x1=landscape; see below (ESC*z##H) for the paper formats
Return data: ESC*s20116r1V
	20116r	Variable 20116: See below
	1V	Return value: 1..OK, 0..????

Example (BW preview scan from FBF, whole area):

  02 00 00 00 2a 00 00 00   01 00 00 00
  1b 2a 7a 32 34 47 c8 00   c8 00 00 00  01 00 82 00             ESC*z24G
  00 00 00 01 00 00 00 00   00 00 02 00  50 15
  02 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
      02 00 00 00 17 00 00 00   01 00 00 80
      1b 2a 73 32 30 31 31 36   72 31 56                         ESC*s20116 r1V

Image parameters for the scan. All values are sent in little endian, but in the table they are shown as human-readable hex numbers

Example (BW preview scan from FBF, whole area):

  02 00 00 00 2d 00 00 00  01 00 00 00
  1b 2a 7a 32 37 48 c8 00  c8 00 00 00 01 00 82 00        ESC*z27H
  00 00 02 00 00 00 00 00  00 00 06 00 63 0e 00 01 00
  02 00 00 00 10 00 00  00 02 00 00 00 00 01 00 00
      02 00 00 00 17 00 00 00  01 00 00 80
      1b 2a 73 32 30 31 32 32  72 31 56                   ESC*s20122 r1V

Custom formats use the smallest size that encloses the custom format. e.g. 33x21mm and 85x99mm both use A6 SEF (0x1106 = 06 11)

The scanner sends empty responses (every ~9 seconds), until a button is pressed (and a proper response is sent).

Example:

  02 00 00 00 11 00 00 00   01 00 00 00  1b 2a 77 30 57        ESC*w0W
  02 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
      02 00 00 00 0c 00 00 00   02 00 00 80
      02 00 00 00 0c 00 00 00   02 00 00 80
      02 00 00 00 17 00 00 00   01 00 00 80
      1b 2a 73 32 30 31 30 31   72 31 56                       ESC*s20101 r1V

Starts the scan of the window (window position and extent as set by previous SCL calls, or whole FBF).

A sample scan operation, including all headers looks like:

  02 00 00 00 11 00 00 00   01 00 00 00  1b 2a 66 30 53                          ESC*f0S
  02 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
      02 00 00 00 17 00 00 00   01 00 00 80  2a 73 32 30   31 31 33 72 31 56     ESC*s20113 r1V

Argument of the subsequent request calls (with 02 in the packet header): maximum buffer size.

Multiple request calls (with 02 in the packet header) might have to be used to fetch all scan data. The end of the data is indicated by a response with packet type 04 and data 00 00 00 00.

Example:

  02 00 00 00 11 00 00 00   01 00 00 00  1b 2a 77 30 53        ESC*w0S
  02 00 00 00 10 00 00 00   02 00 00 00  a0 fa 0f 00
      02 00 00 00 ac fa 0f 00   01 00 00 80
      ff ff ff ff ff ff ff ff   ff ff ff ff ff ff ff ff
      [...]
      fe ff ff ff ff ff ff ff
  02 00 00 00 10 00 00 00   02 00 00 00  58 ed 0f 00
      02 00 00 00 64 ed 0f 00  01 00 00 80
      ff ff ff ff ff ff ff ff  ff ff ff ff ff ff f9 f9
      [...]
      f9 f9 f9 f9 f8 f7 f9 f9  f6 fa fa fa f7 f7 fa fa
      fd ff ff ff ff ff ff ff
  [...]
  02 00 00 00 10 00 00 00   02 00 00 00  58 ed 0f 00
      02 00 00 00 10 00 00 00  04 00 00 80 00 00 00 00

Example:

  01 00 00 00 11 00 00 00   01 00 00 00  1b 2a 68 31 42    ESC*h1B
  01 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
      01 00 00 00 17 00 00 00   01 00 00 80
      1b 2a 73 32 31 31 30 30   72 31 56                   ESC*s21100r1V

Example:

  01 00 00 00 12 00 00 00   01 00 00 00  1b 2a 68 36 34 46    ESC*h64F
  01 00 00 00 10 00 00 00   02 00 00 00  00 01 00 00
      01 00 00 00 17 00 00 00  01 00 00 80
      1b 2a 73 32 31 31 30 34  72 31 56                       ESC*s21104 r1V

Escape sequence: ESC*h$$K [12 bytes binary data]
	$$K	Parameter K: #bytes for preview image specs, always 12K
	12 bytes of binary data
		Bytes 1-2:	Image Number (Index)
		Bytes 3-4:	: Unknown (00 00)
		Bytes 5-6:	: Unknown (01 00), color mode?
		Bytes 7-8:	: Unknown (78 00), preview image height?
		Bytes 9-10:	: Unknown (54 00), preview image width?
		Bytes 11-12:	: Unknown (00 00)
Return data: ESC*s21111t$$V[binary data]
	21111t	Variable 21111 returns size of binary data
	$$W	Parameter W: Length of binary data
	[data]	Binary data of length as given in the W parameter

Example:

  01 00 00 00 1e 00 00 00   01 00 00 00             
  1b 2a 68 31 32 4b 01 00   00 00 01 00 78 00 54 00 00 00        ESC*h12K
  01 00 00 00 10 00 00 00   02 00 00 00  00 00 10 00                                            
      01 00 00 00 d7 09 00 00  01 00 00 80
      1b 2a 73 32 31 31 31 31  74 32 34 39 33 57 ff d8           ESC*s21111t2493W[Img data]
      ff e0 00 10 4a 46 49 46  00 01 01 00 00 64 00 64
      00 00 ff db 00 43 00 03  02 02 03 02 02 03 03 03
      [...]

Escape sequence: ESC*h$$L [25 bytes binary data]
	$$L	Parameter L: #bytes image settings, always 25L
	25 bytes of binary data
		Bytes 1-2:	: Unknown (01 00)
		Bytes 3-4:	: Unknown (01 00)
		Bytes 5-6:	: Unknown (00 00)
		Bytes 7-7:	: Unknown (01 00)
		Bytes 9-10:	: Unknown (01 00)
		Bytes 11-12:	: Unknown (81 00)
		Bytes 13-14:	: Unknown (c8 00)
		Bytes 15-16:	: Unknown (00 00)
		Bytes 17-18:	: Unknown (64 00)
		Bytes 19-20:	: Unknown (00 00)
		Bytes 21-22:	: Unknown (01 00)
		Bytes 23-24:	: Unknown (00 00)
		Byte 25:	: Unknown (00)
Return data: ESC*s21116r$$$V[binary data]
	21116r	Variable 21116 returns size of image data
	$$$V	Parameter V: Size of binary image data to be requested

Example:

  01 00 00 00 2b 00 00 00  01 00 00 00
  1b 2a 68 32 35 4c 01 00  01 00 00 00 01 00 01 00       ESC*h25L
  81 00 c8 00 00 00 64 00  00 00 01 00 00 00 00 01
  00 00 00 10 00 00 00 02  00 00 00 00 01 00 00
      01 00 00 00 1c 00 00 00  01 00 00 80
      1b 2a 73 32 31 31 31 36  72 33 39 34 33 31 30 56   ESC*s21116 r394310V

Clear the error state on the scanner (error stack, error number, etc.) / reset the device.

Example, clearing up / resetting the device after an error:

  02 00 00 00 10 00 00 00   01 00 00 00  1b 2a 6f 45                  .*oE

Unknown,

Possible Entries:

1. Protocol version
2. Authentication needed
3. public access allowed
4. ADF installed
5. ADF duplex
6. Color or only B/W
7. Compression available
8. HDD installed (i.e. scan to/from box)

The BINARY parameter names appear to be a tree. The device starts from the beginning and as soon as a known parameter is found, it is returned, even if the requested parameter is longer. E.g. a request for parameter 25800 (and anything starting with 258) will return the parameter 258, since that is known.

Param	Type	Description	Comments / returned value
24	int	ADF present	*s24d1V
25	int	ADF loaded	*s25d0V
257	int	error stack size
258	bin (30)	capabilities
259	int	current error	*s259dN or *s259d0V for no error
261	bin (16)	one-time random encryption key (128 bit)
264	bin (129)	SNMP identification
265	bin (8)	Image extent
267	bin (?)	?
269	bin (?)	?
270	bin (11)	Installed hardware (like 280)	01 00 00 00 04 02 01 00 00 00 00
271	bin (70)	?	all 00
272	bin (226)	?	all 00
273	bin (36)	capabilities	423 series
274	bin (?)	List of public boxes for HDD TWAIN
275	bin (?)	: List of user boxes for HDD TWAIN
276	bin (?)	?
277	bin (?)	List of images in selected box (HDD TWAIN)
280	bin (12)	Installed hardware (like 270)	bit 5 00 or 04, additional 00
301	bin (32)	?	01 04 11 01 00 00 00 64 02 03 11 01 00 00 00 64 14 04 01 01 00 00 00 64 15 04 01 01 00 00 00 00
307	bin (?)	?	*s307t0:0/0W
308	bin (?)	?	*s308t41910:66/66W……PRINT………[…]
309	bin (36)	?	e8 03 40 0d 03 00 c8 00 00 00 10 27 00 00 10 27 00 00 b8 0b 00 00 0a 00 01 00 14 00 64 00 05 00 01 00 c8 00
310	bin (?)	?
311	bin (?)	?
312	bin (4)	?	01 01 01 01
314	bin (2)	?	02 00
401	bin (?)	?
402	bin (?)	?
403	bin (?)	?
1024	int	?	dN
1025	int	?	dN
1026	int	?	dN
20001	int	?	d0V
20002	int	?	d1V
20003	int	?	d4V
20004	int	?	d0V
20005	int	?	dN
20006	int	?	d1V
20007	int	?	d0V
20008	int	?	dN
20009	int	?	d0V
20200	int	?	d0V
20201	int	?	d0V
21000	int	?	dN
21003	int	?	dN
21004	int	?	d3V
21005	int	?	d4V
21006	int	?	dN
21024	int	?	dN
21025	int	?	dN
21026	int	?	dN
21027	int	?	d1V
30010	int	?	d110036:210036V
30020	int	?	d0V
30030	int	?	d1V
30031	int	?	d1V

Parameters that are aliases / return a different parameter than requested:

'⇒' indicates data/command sent to scanner, '⇐' indicated data returned by the scanner (request data packet omitted here!):

⇒ EscE                              Reset/Init device
⇐     Esc*s20112r1V                 Success
⇒ Esc*s21004E                       Request variable 21004
⇐     Esc*s21004d3V                 Variable 21004 has value 3
⇒ Esc*s21005E                       Request variable 21005
⇐     Esc*s21005d1V                 Variable 21005 has value 1
⇒ Esc*s264U                         Request binary data of variable 264 (device identification)
⇐     Esc*s264t129W1.3.6.1.4.[....] 129 bytes of SNMP device id. (sysObjectID, sysDescr, ifPhysAddress)

C353series:

⇒ Esc*s270U                         Request binary data of variable 270 (C353series)
⇐     Esc*s270t11W[.....]           11 bytes of binary data in variable 270

423series:

⇒ Esc*s280U                         Request binary data of variable 280 (423series)
⇐     Esc*s280t12W[.....]           12 bytes of binary data in variable 280

[OPTIONAL: If login desired/required (see 270/280 variable):
    ⇒ Esc*s261U                         Request encryption key
    ⇐     Esc*s261t16W[...]             16 bytes (128-bit) encryption key
    ⇒ Esc*w100U[public...]              Sending login data
    ⇐     Esc*s20119r1V                 Login successful
]

C353series:

⇒ Esc*s258U                         Request binary data of variable 258 (scanner capabilities)
⇐     Esc*s258t30W[.....]           30 bytes of binary scanner capabilities data in variable 258

423series:

⇒ Esc*s20005E                       Request variable 20005
⇐     Esc*s20005d8V                 Variable 20005 has value 8
⇒ Esc*s20008E                       Request variable 20008
⇐     Esc*s20008d0V                 Variable 20008 has value 0
⇒ Esc*s273U                         Request binary data of variable 273 (scanner capabilities)
⇐     Esc*s273t36W[.....]           36 bytes of binary scanner capabilities data in variable 273

⇒ Esc*w0J                           Lock scanner
⇐     Esc*s20100r1V                 Success
⇒ Esc*s25E                          Request variable 25 (ADF loaded)
⇐     Esc*s25d1V                    Variable 25 has value 1 (ADF is loaded)

C353series:

⇒ Esc*z24G[...]                     Set image parameters (24 bytes of binary data sent)
⇐     Esc*s20116r1V                 Success

423series:

⇒ Esc*z27H[...]                     Set image parameters (27 bytes of binary data sent)
⇐     Esc*s20122r1V                 Success

all series:

[OPTIONAL:
    ⇒ Esc*w0W                           Wait for button
    ⇐     -                             Empty packet, indicating still waiting for button
    ⇐     -                             Empty packet, indicating still waiting for button
    ⇐     Esc*s20101r1V                 Button pressed → start scan now allowed
]
⇒ Esc*f0S                           Start scan
⇐     Esc*s20113r1V                 Success
⇒ Esc*s265U                         Request binary data of variable 265 (image extent)
⇐     Esc*s265t8W[...]              8 bytes of image extent information in variable 265
⇒ Esc*w0S                           Request image data
⇐     [binary data]                 Image data returned by scanner
⇐     '00 00 00 00'                 Empty packet with type 'no data available' indicates end of scan data
[OPTIONAL: for scan from ADF
    ⇒ Esc*s20201E                   Request variable 25 (ADF state / more pages available)
    ⇐     Esc*s20201d1V             ADF still loaded / more pages available (d0V would be unloaded)
    [if d1V: 
      REPEAT from Esc*s265U above
    ]
]

⇒ Esc*w1J                           Unlock scanner
⇐     Esc*s20100r1V                 Success
⇒ Esc*w-1U                          Logout
⇐     Esc*s20119r1V                 Success

⇒ Esc*w1J                           Unlock device (e.g. after not enough data could be read)
⇐     Esc*s20100r0V                 r0V indicating FAILURE of a function
⇒ Esc*s257E                         Request error status (variable 257)
⇐     Esc*s257d1V                   Error available in queue
⇒ Esc*s259E                         Request error code (variable 259)
⇐     Esc*s259d10001V               Last error code is 10001
⇒ Esc*oE                            Reset / cleanup error

1. If JPEG compression is used, the complete JFIF data is sent as the return value of the Esc*w0S command. I.e. the data starts with the JFIF header ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 c8 (ffd8=Start of Image, ffe0=APP0 JFIF tag, 0010=10 bytes of JFIF tag including size, 4a 46 49 46=„JFIF“, 00 01 01 01)
2. If raw data is used,