A Canon PIXMA Printer (e.g. MX925) does not take excellent pictures as the other devices here (at least it has a scanner), but most important is that it uses same DryOS and libs as the camera systems do. Here is my status to access the PIXMA system. Goal is to collect more DryOS knowlege, extent community capability to maintain and fix software-bricked PIXMA systems and later, maybe, also to extend features/firmware. So, now to access the console(s) of MX925:
The controller PCB is located on the left side of the printer, see open printer with already taken out the PCB:

On the PCB you'll find two pads for unpopulated (probably mini USB) connectors. See red markers. They are named with RDB and RELAX. RDB seems inactive. On RELAX (3,3V-TTL UART with 19200 Baud, 8,N,1) promts directly with the DryOS shell.

Each of the 4-pin connectors supplies GND, 3.3V, RxD and TxD.

The RxD/TxD signals of the DryOS-RELAX port are easier accessible in the 2 vias below the connector itself. BTW : I already had soldered wires to the connector pads, but they are very fragile and bare the risk of getting ripped of the PCB.
The shell promt takes approx 4 seconds after power-on (so I assume the DryOS has another real kernel command shell where e.g. booting can be seen and controlled as in linux).

If you want to operate the PCB on a plain desk instead mouonted in the printer : The printer's power supply can easily clicked out and supply the PCB on the plain desk. Be careful : I could imagine that you may generate other sw-brick errors in the system when booting with all pheripherals detached like i do here.
The DryOS Shell Overview from my MX925 is here in some screenshots.
[Next/ToDo/HelpNeeded] system commands to access the internal file system of the OS. Find out RDB port function. Reset printer error status. dump and analzse the firmware/os.



==
"Dry-shell" 105 command list with usage/examples on spreadsheet : ==
"Dry-shell" Command list gathered from shell :[]
acfa (AOSS Debug Command("acfa n" with n=1,2,3 or4 for init, start, stop or term)) alinkcmd (ALINK(use "alinkcmd ?")) aoss (AOSS Debug Command(AOSS = AirStation One-Touch Secure System by Buffalo Technology)) arp (Print all arp entries()) arpsend (send arp/rarp packet using PF_PACKET()) chkit4 (check Dry-ITRON4.0 interface()) chkspi (check Dry-SPI interface()) cmp (compare contents of memory()) cond (display condition variable information()) crypto (Marvell Crypto Test()) date (display and write the date and time()) delete (delete a kernel object()) dhcps (Test DHCP Server()) dminfo (print information of Dry-DM()) dnsutil (DNS client utilty()) down (down()) echod (Fork stream echod()) elog (elog()) eth (Ethernet_MAC driver debug commands()) eth_az (n.a.(Acticate or Deactivate the Eth energy safe mode IEEE802.3az)) event (display event-flag information()) exit (finish Dry-shell()) gtime (Get time from server using daytime port.(TCP/UDP)()) help (n.a.(displays command list and usage)) host (look up host names using DNS()) icyc (display Dry-ITRON4.0 cyc information(timer?)) idtq (display Dry-ITRON4.0 dtq information()) ifconfig (up/down network interfaces, add/del ipv6 address()) iflg (display Dry-ITRON4.0 flg information(flg=flag)) imbx (display Dry-ITRON4.0 mbx information(mbx=messagebox)) impf (display Dry-ITRON4.0 mpf information()) impl (display Dry-ITRON4.0 mpl information(mpl=messagepool)) iotest (I/O test()) isem (display Dry-ITRON4.0 sem information(sem=semaphore)) itsk (display Dry-ITRON4.0 tsk information(tsk=task)) join (join essid mode()) kill (delete a task()) leave (()) loosesock (tcp powerful test program()) mbufs (view mbuf used by net for debug()) mclose (n.a.()) mctalk (Multicast tiny talk()) meminfo (n.a.(not operational on my PIXMA as compiler flags were not set)) mget (()) mkcfg (print Dry-MK configuration information()) mkobjsize (print all sizes of Dry-MK's objects()) mktest (Dry-MK performance test()) mopen (n.a.()) mq (display mq information(mq = Message Queue)) mset (mset : mset add 252.0.0.1 192.168.30.10()) mutex (display mutex information()) nell-attach (attach()) nell-detach (detach()) nell-wakeup (wakeup()) netecho (Echoing test using echo port.(TCP/UDP)()) netrace (the network race()) netstat (Print routing information()) nlog (get/set log level()) nsclog (NSC log-level()) nsupdate (update the name server()) objinfo (n.a.(not operational on my PIXMA as compiler flags were not set)) otg (OTG host driver debug command()) otg_cleanup (n.a.()) otg_init (n.a.()) phy_ctrl (Ether/OTG PHY Control()) ping (send icmp echo and get icmp echo reply()) pingall (fill arp-table()) pngl (simple ping command()) prio (change a priority of task()) ract (RakuRaku Controller(WTF is that ? Maybe it can take pictures from an Rakuraku Dino Tamagotchi)) release (release a task from wait status()) resume (resume a task()) route (Add or Delete routing table entry()) rt (well_tmn_release_test()) scan (scan()) sem (display semaphore information()) setipsec (n.a.(Set IP Security-System)) shutdown (close all devices, file and socket()) slaup (do stateless address autoconfiguration if possible()) sockhalt (Halt sockets violently()) stat (stat()) suspend (suspend a task()) task (display task information()) tcputil (Print tcp information()) time (time count(maybe a pause command for scripting)) timer (display timer information()) tm (Total Manegement Network()) uap (uap mode(Slim WLAN Access Point ?)) up (up()) vers (print version information()) w12get (w12get mode()) w12set (()) wcf (WCF(WCF = Windows COMMUNICATION Foundation ?
WPF = Windows PRESENTATION Foundation ?
WPS = )) wcfcmd (n.a.()) wep ((WEP key idx mode/set)) wget (get well parameter()) wprd (WiFi Test Tool for Product()) wpscmd (n.a.()) wpse (Wi-fi Protected Setup Enrollee()) wset (set well parameter()) wtst (WiFi Test Tool for Product()) xd (dump contents of memory()) xhlog (we test XHCOM-Driver now.()) xhtest (we test XHCOM-Driver now.()) xm (write in memory())