151

Re: DaVinci Junior cartridge reset

I've signed up for an account on this forum just to say that I will support you however you need (if you haven't got everything handled already, everyone on here seems exceedingly intelligent).

I haven't got an NFC shield for my Arduinos, but I could get one if it would help, ChunkLady. I am, however, an avid linux user and would be very happy to help test the encryptor you are creating, sztupy.

All in all, I am in awe of how amazing you all are at reverse engineering, and I only wish I had comparable skills or knew how I could contribute. At the very least, keep it up guys; you are doing great work and it is very much appreciated!

152 (edited by hydronait 2015-12-21 04:55:41)

Re: DaVinci Junior cartridge reset

I can't really offer much but moral support.  I hope somebody eventually comes  up with something as I have one coming for Christmas.  I am assuming many others do too.

153

Re: DaVinci Junior cartridge reset

Anybody have any luck or updates?  I see a lot of new posts regarding the Jr.  My bed was a little off so did an adjustment using the power supply method shown in their video.  This allowed me to reduce the z-offset a little as the extruder nozzle was rubbing on one side.  The thing now prints wonderful and am anxious to try some non-proprietary filament.

154 (edited by hydronaut 2015-12-30 22:30:43)

Re: DaVinci Junior cartridge reset

Ordered a Bus Pirate and an NFC Module for my Arduino.

One quick question, if the password is derived from the manufacturer programmed fields (Pages 0-3) or 4/5 which seem to be the same for all spools.  What happens if you take a random NFC chip (non XYZ) and check the status while listening in on the I2C bus?

Does it try to authenticate using a password that it creates based on the values stored on the non XYZ chip?

If not what happens if you change page 4/5 to match the XYZ chip?

crgpgh wrote:

I am having trouble replicating the communication grabbed from I2C bus. I think there is a loop checking interrupts and status that I have not implemented correctly.

Instead, I purchased an NFC shield for the Arduino that has a library for communicating. I can read data from the chip just like the phone apps. Now I am trying to get this reader to authenticate.

In the mean time, here is the information from the three chips I have. It includes the unprotected pages on the chip as well as the password (PWD) I grabbed from I2C. Maybe someone can figure out how the passwords are being generated. My guess is it has to do with some unprotected data on the chip.

UID Value: 0x04 0x38 0xDC 0x22 0x9A 0x3D 0x81
PWD: 0x22 0x66 0x52 0xC6 
PAGE 00: 04 38 DC 68  .8�h
PAGE 01: 22 9A 3D 81  "�=�
PAGE 02: 04 48 00 00  .H..
PAGE 03: E1 10 12 00  �...
PAGE 04: 01 03 A0 0C  ..�.
PAGE 05: 34 03 00 FE  4..�
PAGE 06: 00 00 00 00  ....
PAGE 07: 00 00 00 00  ....

UID Value: 0x04 0x20 0x57 0x22 0x97 0x3C 0x80
PWD: 0x93 0x1B 0x18 0x0C
PAGE 00: 04 20 57 FB  . W�
PAGE 01: 22 97 3C 80  "�<�
PAGE 02: 09 48 00 00  .H..
PAGE 03: E1 10 12 00  �...
PAGE 04: 01 03 A0 0C  ..�.
PAGE 05: 34 03 00 FE  4..�
PAGE 06: 00 00 00 00  ....
PAGE 07: 00 00 00 00  ....

UID Value: 0x04 0x4F 0x57 0x22 0x97 0x3C 0x80
PWD: 0x75 0x9A 0x67 0x0D
PAGE 00: 04 4F 57 94  .OW�
PAGE 01: 22 97 3C 80  "�<�
PAGE 02: 09 48 00 00  .H..
PAGE 03: E1 10 12 00  �...
PAGE 04: 01 03 A0 0C  ..�.
PAGE 05: 34 03 00 FE  4..�
PAGE 06: 00 00 00 00  ....
PAGE 07: 00 00 00 00  ....

155 (edited by 0x6e657762 2015-12-31 05:44:44)

Re: DaVinci Junior cartridge reset

I've tried to pull data off of my own NFC chip but I am new to this and the data I am attempting to pull isn't entirely useful to me. I am wondering if there are multiple devices addressed on the I2C bus. The application I am using doesn't log the data and it seems if I want to log it I'll have to recompile it myself. I will need to learn a lot to be useful here.

The data also seems to be coming across very quickly. Do we know if this is 400kbit/s instead of 100kbit/s

The logic 4 looks really good right now...

Post's attachments

xscope.png
xscope.png 91.64 kb, 1 downloads since 2015-12-31 

You don't have the permssions to download the attachments of this post.

156

Re: DaVinci Junior cartridge reset

hydronaut wrote:

Ordered a Bus Pirate and an NFC Module for my Arduino.

One quick question, if the password is derived from the manufacturer programmed fields (Pages 0-3) or 4/5 which seem to be the same for all spools.  What happens if you take a random NFC chip (non XYZ) and check the status while listening in on the I2C bus?

Does it try to authenticate using a password that it creates based on the values stored on the non XYZ chip?

If not what happens if you change page 4/5 to match the XYZ chip?

I imagine since the password is different for each spool that the password is generated based on data that is different for each spool.

Pages 00 and 01 are different. We know that the first byte of page 00 is 04, and the first byte of page 01 is 22.

I have not caught any type of pattern yet but I'm not experienced in cryptography.

157

Re: DaVinci Junior cartridge reset

Page 0 and 1 are the serial number.

The first 2 bytes of page 2 are generated from the serial number and the last 2 bytes are lock bits.  Page 3 is the Capability Container and seems to be the same for all cards.  Page 4 on is the data.

I am more curios what happens if somebody takes a NTAG213 and scans it to see if it tries to authenticate with a calculated password.

0x6e657762 wrote:
hydronaut wrote:

Ordered a Bus Pirate and an NFC Module for my Arduino.

One quick question, if the password is derived from the manufacturer programmed fields (Pages 0-3) or 4/5 which seem to be the same for all spools.  What happens if you take a random NFC chip (non XYZ) and check the status while listening in on the I2C bus?

Does it try to authenticate using a password that it creates based on the values stored on the non XYZ chip?

If not what happens if you change page 4/5 to match the XYZ chip?

I imagine since the password is different for each spool that the password is generated based on data that is different for each spool.

Pages 00 and 01 are different. We know that the first byte of page 00 is 04, and the first byte of page 01 is 22.

I have not caught any type of pattern yet but I'm not experienced in cryptography.

158

Re: DaVinci Junior cartridge reset

The ones i ordered was missing the option to overwrite the uuid and several other pages. I am currently looking to either buy some that can be completely overwritten or a NFC-simulator.

159

Re: DaVinci Junior cartridge reset

ChunkLady wrote:

The ones i ordered was missing the option to overwrite the uuid and several other pages. I am currently looking to either buy some that can be completely overwritten or a NFC-simulator.

My guess is best bet is just to rewrite an existing to its original state.

Password is easy enough to get and the libraries are available for the PN532 reader/writer.

Once everything arrives I will give it a go.  Just want to wait until my order of a few spools of filament come in.

160

Re: DaVinci Junior cartridge reset

Greetings, everyone!
As I received a DaVinci Jr as a Christmas gift, I am so hoping you good folks can come up with a workaround for this! After leveling the bed and tinkering a bit, I am quite impressed with its performance (given its price tag). And I really would love to see the NFC defeated entirely mostly because I want more control over my printer. The PLA XYZPrinting supplies for this printer seems to be of at least pretty decent quality thus far and I can't say I have any issues with it. The limited colors is disappointing but most of what I've been printing is merely structural components and color isn't really a big deal. Might be in the future though.

I'm now down to the last 4 meters as reported by the printer although there is definitely more than 4 meters left on the roll. Of course I've ordered more, but would love to have a little more flexibility in materials.

All that being said, and after having read through this thread, I'm wondering if anyone has tried just making a full copy of a brand new, valid card and cloning it to a new blank. Would that work? And, if so, in the process of cloning the card, could one change the filament qty to something else - say 999 meters? It would be interesting to see if there are any "sanity" checks taking place like, all valid spool amounts are between 0-300, or 0-500, 0-?.

161

Re: DaVinci Junior cartridge reset

hydronaut wrote:
ChunkLady wrote:

The ones i ordered was missing the option to overwrite the uuid and several other pages. I am currently looking to either buy some that can be completely overwritten or a NFC-simulator.

My guess is best bet is just to rewrite an existing to its original state.

Password is easy enough to get and the libraries are available for the PN532 reader/writer.

Once everything arrives I will give it a go.  Just want to wait until my order of a few spools of filament come in.

I agree, for hackers/makers that might be the way to go. However, the DaVinci is a consumer product, and the approach where you first have to I2C your way into the chip, then find out what the password is, then enter the password into a program that resets the chip, just isn't very consumer friendly.

My idea of a "perfect hack" would be some kind of easily available NFC chip you can buy (from a 3dstore or just eBay) that you can programme with your Android phone or an Arduino NFC shield (or an NFC-iPhone adapter), with one or more of the current leaked passwords.

I still haven't found any cheap available NFC chip I know I can erase entirely. Anyone knows of one by any chance ? (or even just what to look for on eBay)

162 (edited by hydronaut 2016-01-04 19:16:34)

Re: DaVinci Junior cartridge reset

I don't think there are any ntag2xx nfc tags that allow the UUID to be overwritten.  There are other types but not ntag2xx.

The problem also without the password there is no way to get the data to write to the NFC unless you use some of the dumps posted in this thread.  Also, I don't know of any android apps that read/write password protected ntag2xx or Mifare Ultralight C tags.  So without some tools might be difficult and not feasible for the average consumer (which I am assuming they are trying to prevent from bypassing their DRM).

Hopefully somebody maps everything out and comes up with a Repetier flash as would would solve everybody's problems.

Just curious if anybody who was working with the 3w decrypting created a new file and changed the filament required to a lower number?


ChunkLady wrote:
hydronaut wrote:
ChunkLady wrote:

The ones i ordered was missing the option to overwrite the uuid and several other pages. I am currently looking to either buy some that can be completely overwritten or a NFC-simulator.

My guess is best bet is just to rewrite an existing to its original state.

Password is easy enough to get and the libraries are available for the PN532 reader/writer.

Once everything arrives I will give it a go.  Just want to wait until my order of a few spools of filament come in.

I agree, for hackers/makers that might be the way to go. However, the DaVinci is a consumer product, and the approach where you first have to I2C your way into the chip, then find out what the password is, then enter the password into a program that resets the chip, just isn't very consumer friendly.

My idea of a "perfect hack" would be some kind of easily available NFC chip you can buy (from a 3dstore or just eBay) that you can programme with your Android phone or an Arduino NFC shield (or an NFC-iPhone adapter), with one or more of the current leaked passwords.

I still haven't found any cheap available NFC chip I know I can erase entirely. Anyone knows of one by any chance ? (or even just what to look for on eBay)

163

Re: DaVinci Junior cartridge reset

sztupy wrote:

--snip--

Hi, I've already hacked the 3w format and made both an encoder and decoder (check previous page of this forum). I'll be ready with something useable this weekend for public consumption, you will be able to check it's source code to determine how it is done.

For the NFC part, that is done in ARM, which is harder to disassemble and figure out how it works. I'm not even sure whether anyone has a complete dump of a recent FW (but I would be interested if someone has)

Hello,

Have you had any luck with this? My spool is reporting zero even though it had plenty left and xyz customer support has of course left me out to dry, so I'm hoping you've had some luck around the DRM by now.

164

Re: DaVinci Junior cartridge reset

I was planning ordering a few spools to play around. Nobody seems to have any in stock. Amazon is sold out.  If they are going to force people to buy their filament they should make sure the stores stock it.

165

Re: DaVinci Junior cartridge reset

hydronaut wrote:

I was planning ordering a few spools to play around. Nobody seems to have any in stock. Amazon is sold out.  If they are going to force people to buy their filament they should make sure the stores stock it.

best buy has it

166

Re: DaVinci Junior cartridge reset

Hi. I find out how to save some filament amount recorded on NFC . Do not print to 0. Leave one meter oe les on the chip. I was need print bear mug it uses 91m of filament. In new spool i put NFC with 1m left filament. In Gcode changed filament usage to 0 and printed all mug. I saved 90m on NFC

167

Re: DaVinci Junior cartridge reset

vienisas wrote:

Hi. I find out how to save some filament amount recorded on NFC . Do not print to 0. Leave one meter oe les on the chip. I was need print bear mug it uses 91m of filament. In new spool i put NFC with 1m left filament. In Gcode changed filament usage to 0 and printed all mug. I saved 90m on NFC

How are you changing the guide and converting it back to 3w?  Did the chip with less than 1 meter go to 0 after the print?

168

Re: DaVinci Junior cartridge reset

vienisas wrote:

Hi. I find out how to save some filament amount recorded on NFC . Do not print to 0. Leave one meter oe les on the chip. I was need print bear mug it uses 91m of filament. In new spool i put NFC with 1m left filament. In Gcode changed filament usage to 0 and printed all mug. I saved 90m on NFC

So, I'm just a bit confused... Left about 1m on the chip, new spool with old (<1m) chip, alter GCode to change filament usage to 0, print, and it ADDED 90m to the tag? Or it just used the 1m left on the tag and continued to print anyway? Is the tag now reporting 0m left? So many questions!

169

Re: DaVinci Junior cartridge reset

I really don't know what I am doing but I thought I might try to help in this endeavor, since I am in the same boat as everyone else on here. As I was reading through this I got to thinking. How would the software write to the RFID chip? It doesn't make sense that it does since there are no wires going to the spool. So any information must be stored somewhere on the computer. So I ran a decoder on the XZY software and came up with the following. Not sure if it will help or not.

     

public static string Encrypt(string toEncrypt, string key)
        {
            byte[] bytes = Encoding.UTF8.GetBytes(key);
            byte[] bytes2 = Encoding.UTF8.GetBytes(toEncrypt);
            ICryptoTransform cryptoTransform = new RijndaelManaged
            {
                Key = bytes,
                Mode = CipherMode.ECB,
                Padding = PaddingMode.PKCS7
            }.CreateEncryptor();
            byte[] array = cryptoTransform.TransformFinalBlock(bytes2, 0, bytes2.Length);
            return Convert.ToBase64String(array, 0, array.Length);
        }

        public string Decrypt(string toDecrypt, string key)
        {
            byte[] bytes = Encoding.UTF8.GetBytes(key);
            byte[] array = null;
            try
            {
                array = Convert.FromBase64String(toDecrypt);
            }
            catch
            {
            }
            ICryptoTransform cryptoTransform = new RijndaelManaged
            {
                Key = bytes,
                Mode = CipherMode.ECB,
                Padding = PaddingMode.PKCS7
            }.CreateDecryptor();
            byte[] bytes2 = cryptoTransform.TransformFinalBlock(array, 0, array.Length);
            return Encoding.UTF8.GetString(bytes2);
        }

Something that is very curious is the following:

     

public void WriteMachineInformat()
        {
            string text = "";
            string text2 = "";
            string text3 = "";
            string text4 = "";
            string text5 = "";
            string text6 = "";
            string text7 = "";
            string key = "1234567890123456";
            string text8 = "";
            string text9 = "";
            string text10 = "0123456789ABCDEFGHJKLMNPQRSTVWXY";
            string text11 = "123456789ABC";
            Main.conn.GetModelname();
            new List<XYZSetting.H>();
            new List<XYZSetting.M>();
            new List<XYZSetting.C>();
            new List<XYZSetting.C>();
            new List<List<XYZSetting.C>>();
            string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
            string path = folderPath + "\\MyTest.json";
            if (File.Exists(path))
            {
                string str = ",";
                string toDecrypt = File.ReadAllText(path);
                string text12 = this.Decrypt(toDecrypt, key);
                string text13 = text12.TrimEnd(new char[]
                {
                    ']'
                });
                text13 += str;
                string contents = XYZSetting.Encrypt(text13, key);
                File.WriteAllText(path, contents);
            }

170

Re: DaVinci Junior cartridge reset

Bozotclown1970 wrote:

How would the software write to the RFID chip? It doesn't make sense that it does since there are no wires going to the spool

NFC doesn't need physical contact to write to the chip.  It was confirmed that data on the chip does indeed change as the filament is used.

How did you get that code you posted?  Decompiled XYZWare?

171

Re: DaVinci Junior cartridge reset

Chip with 1 m  install in to spool with enough filament to print project. After modify g code printer will start printing, chip will become 0m but print will continue. This is 91m project printed with 1m chip.

172

Re: DaVinci Junior cartridge reset

ok maybe i am wrong but i think this is what hes saying

use your spool like normal until it gets low lets say 1m. change that spool with a new spool (not xyz spool) but use that chip print a big project (you can only use this chip 1 time because it will read 0 after you print) when the printer says low filament just hit ok.

no clue what he means about modding the gcode.

i do not have a low card to test this so not sure if t works or not

might be a way to save a little money if it works

173

Re: DaVinci Junior cartridge reset

XYLenTech,

Sorry for posting under a different account, but I could not log back in using my original account

Thank you very much for that information about the RFID chip. As I mentioned I am new to all of this. but would sure like to see a resolution to the problem we are all facing. I do have quite a bit of IT experience though.

How did you get that code you posted?  Decompiled XYZWare?

I decompiled my copy of the XYZ exe. The parts I posted is just a small amount of all the code that decompiled.

174 (edited by TwistedMexi 2016-01-06 06:59:05)

Re: DaVinci Junior cartridge reset

johnboyjr wrote:

ok maybe i am wrong but i think this is what hes saying

use your spool like normal until it gets low lets say 1m. change that spool with a new spool (not xyz spool) but use that chip print a big project (you can only use this chip 1 time because it will read 0 after you print) when the printer says low filament just hit ok.

no clue what he means about modding the gcode.

i do not have a low card to test this so not sure if t works or not

might be a way to save a little money if it works


He means you need at least 1m left. (anything less than that, the printer reads zero and will say unrecognized cartridge.)


In his example, he had a roll with 91m left. He took a project out of slic3r, modified the gcode to read 0 filament usage, converted it to 3w (there's a few ways to do this... would love to know the exact way he did it for confirmation)

Apparently this results in the printer to defaulting to 1m so it still costs a bit off the chip, but you use the chip for a much longer period of time. So he was left with a chip that had 90m left.

175

Re: DaVinci Junior cartridge reset

vienisas wrote:

Hi. I find out how to save some filament amount recorded on NFC . Do not print to 0. Leave one meter oe les on the chip. I was need print bear mug it uses 91m of filament. In new spool i put NFC with 1m left filament. In Gcode changed filament usage to 0 and printed all mug. I saved 90m on NFC

Excuse the double post, unsure if editing a post to quote someone alerts them or not.

Wanted to know what process did you use to conver gcode to 3w?

I know of the website, which I think is meant specifically for the pro, and it would format the incorrect machine type.

Then there's the xyzifier cabal project, but I can't seem to get it to compile as one of the dependencies on hackage is messed up.

Finally there's a modified xyzware out there that allows direct gcode import but it was pulled from all of the old download links, and the one download I could find didn't have the jr as an option.

I'd love to know how exactly you went about it.

Thanks!