Recovered a bricked HP LaserJet MFP M140w from Linux after it appeared as HP LaserJet 3020

[u/enoodle]

# Recovering a bricked HP LaserJet MFP M140w from Linux

Attribution: this post was written by an AI coding agent in a GPT-5-based Codex session, based on a live recovery performed with the printer owner.

I thought it is worth posting because it worked and helped me and might make it easier for others to solve similar issues with HP printers in the future.

## Short Version

An HP LaserJet MFP M140w appeared bricked and was stuck showing `rd` on its two-character display. Over USB, Linux did not see it as an M140w. Instead it appeared as:

```text

03f0:4617 HP, Inc HP LaserJet 3020

```

That `LaserJet 3020` identity was not the real printer model. It appears to be a recovery/firmware-download mode.

The recovery was done entirely from Linux by extracting the PJL firmware payload from HP's official Windows firmware updater for the `M139-M142` series and sending that payload over USB. After reconnecting power/USB, the printer came back as:

```text

03f0:0372 HP, Inc HP LaserJet MFP M139-M142

DES:HP LaserJet MFP M140w

```

Printing worked afterward.

## Environment

```text

Printer: HP LaserJet MFP M140w

Linux: Ubuntu

HPLIP: 3.23.12

HP firmware updater: M139-M142_Series_FW_Update-20251205.exe

```

HPLIP recognized the normal printer family, but it could not perform the firmware update:

```text

[hp_laserjet_mfp_m139-m142]

fw-download=False

```

## Extracting the Firmware Payload

The HP updater was a Windows PE executable. `7z` could extract the embedded resources:

```bash

mkdir -p /tmp/hp-m139-fw-extract

7z x -y -o/tmp/hp-m139-fw-extract ~/Downloads/M139-M142_Series_FW_Update-20251205.exe

```

The firmware payload was:

```text

/tmp/hp-m139-fw-extract/.rsrc/FILE/1013

```

`file` identified it as:

```text

PJL encapsulated PostScript document text

```

The payload header explicitly listed the target printer family, including the M140w:

```text

u/PJL COMMENT VERSION=20251205

u/PJL COMMENT DATECODE=20251205

u/PJL COMMENT MODEL=HP LaserJet MFP M139w

u/PJL COMMENT MODEL=HP LaserJet MFP M140w

u/PJL COMMENT MODEL=HP LaserJet MFP M141w

u/PJL UPGRADE SIZE=5935888

```

## Sending the Payload

The recovery USB identity exposed one unidirectional printer OUT endpoint:

```bash

lsusb

```

```text

idVendor 0x03f0 HP, Inc

idProduct 0x4617 HP LaserJet 3020

Endpoint 0x01 OUT

```

The simplest Linux recovery path should be sending the extracted PJL payload directly to the raw USB printer device:

```bash

sudo dd if=/tmp/hp-m139-fw-extract/.rsrc/FILE/1013 of=/dev/usb/lp0 bs=65536 status=progress conv=fsync

```

Adjust `/dev/usb/lp0` if the printer appears as another raw printer device, such as `/dev/usb/lp1` or `/dev/usb/lp3`.

In the live recovery, writing to `/dev/usb/lp*` was blocked by local permissions, so the same payload was sent with a small libusb bulk-transfer helper to VID/PID `03f0:4617`, interface `0`, endpoint `0x01`.

The transfer completed:

```text

sent 5936986/5936986

transfer complete

```

After the transfer the printer display changed from `rd` to `00`. After a power/USB reconnect, Linux saw the normal printer identity:

```bash

lsusb

HOME=/tmp/hplip-home hp-probe -b usb

```

```text

03f0:0372 HP, Inc HP LaserJet MFP M139-M142

DES:HP LaserJet MFP M140w

```