Silly HP, they thought they patched out the logging and debugging functions by putting 'return true' at the start of them, but the compiler still left all the calls in...
So then it was just a matter of finding the function which called the 'TonerLowAlert', finding where it gets its data from, and patching it to always think it has a full toner tank (and full imaging unit... And full transfer roller... And full finisher... And 15 consumables any of which could make the machine stop printing!). There was the minor hitch of a custom RPC mechanism between all the components, but that was quickly overcome.
Then patching all the firmware checksums (which obviously all use custom algorithms - and the machine has 5 different firmware images!)
And finally reflashing, and we were done! I even customized the 'Ready' homescreen message so everyone knew it was modded.