Re: DaVinci Junior cartridge reset
Is anyone interested in a simple mod to make handling multiple cards easier? Currently I only have it for reading cards, but it shouldn't take to long to implement in updating them also.
- Bozotclown1970
- Member
- Offline
Re: DaVinci Junior cartridge reset
Bozotclown1970 wrote:
Is anyone interested in a simple mod to make handling multiple cards easier? Currently I only have it for reading cards, but it shouldn't take to long to implement in updating them also.
Does that mean we can change how much filament is left to use "other filament"?
- Bozotclown1970
- Member
- Offline
Re: DaVinci Junior cartridge reset
I am going to work on the update code today. At that point as long as you have the password in the menu portion of the code. It will allow you to update. Each different spool/password will need to be added to the menu.
switch(sColor) {
case 1 :
pwd[0] = (0x81);
pwd[1] = (0x7B);
pwd[2] = (0xE8);
pwd[3] = (0xC1);
Serial.print("Waiting for Stock Neutral Spool\n");
break; /* optional */case 2 :
pwd[0] = {0xC4};
pwd[1] = {0x59};
pwd[2] = {0x12};
pwd[3] = {0x41};
break; /* optional */case 9 :
Serial.print("Program has exited!\n");
delay(1000);
exit(0);
Re: DaVinci Junior cartridge reset
Bozotclown1970 wrote:
I am going to work on the update code today. At that point as long as you have the password in the menu portion of the code. It will allow you to update. Each different spool/password will need to be added to the menu.
switch(sColor) {
case 1 :
pwd[0] = (0x81);
pwd[1] = (0x7B);
pwd[2] = (0xE8);
pwd[3] = (0xC1);
Serial.print("Waiting for Stock Neutral Spool\n");
break; /* optional */case 2 :
pwd[0] = {0xC4};
pwd[1] = {0x59};
pwd[2] = {0x12};
pwd[3] = {0x41};
break; /* optional */case 9 :
Serial.print("Program has exited!\n");
delay(1000);
exit(0);
THANK YOU!!!
But how do do I know the password??
- Bozotclown1970
- Member
- Offline
Re: DaVinci Junior cartridge reset
You will need to capture it with your Logic Analyzer before you can use it on your Adruino with a NFC shield. Other than that, there is now way as of now.
Re: DaVinci Junior cartridge reset
Bozotclown1970 wrote:
You will need to capture it with your Logic Analyzer before you can use it on your Adruino with a NFC shield. Other than that, there is now way as of now.
Can you give me exact directions and what to buy and how to do it please I am new to this?
Re: DaVinci Junior cartridge reset
crcasey wrote:
wingnutmedia wrote:I just got the Jr. for xmas, so a total noob at 3D printing, but familiar with G-Code on my homebrew CNC. Anyway, congratulations to crcasey and Alien_ant_farm for the progress and status! Is there and 'easy' list of parts and programming needed to accomplish the 200m reset?
ex:
1. get part (nfc reader)
2. use arm/arduino/etc to push code to nfc
3. Print like a free man/person.I am sure everyone would appreciate a nice writeup or howto on this process. Thanks again!
The first thing you need to do is open the left side of your printer, this will give you access to the NFC reader board. The on board micro controller uses 400KHz I2C to talk to this chip.
The bus pirate is not fast enough and does not have a deep enough buffer to capture the password on the NFC chip. Saleae logic 4 is about the cheapest logic analyser you would buy, there may be some knock off's of this product.
With that in hand you use the pin out Crgpgh posted to grab the two channels of clock and data.
Pin 2 - Ground
Pin 5 - Data
Pin 6 - ClockHook it up, start the logic capture, power up the printer. In about 10 seconds the capture is done, use the logic software to decode the I2C and search for the value 1B in the data streem. The following 4 returned bytes are the NFC chip password. I2C has to do two writes to get a read back, don't get confused.
Now you need an NFC writer, I think the people that have captured dumps here are all using an arduino and the Adafruit NFC shield. Splicing in Crgpgh's password authentication patch into the Adafruit library.
If you don't know C, this may be beyond your range.Next you modify the example reader sketch to send the password to the chip, and read and dump the contents of your spool chip.
1
Finally you use a sketch to write the blocks you want back to the RFC chip. The blocks you want are 8-11 ykamlsand 20-23. Replacing those blocks from any spool with any other set from another spool will let you clone it.It may not be as simple as you would wish, but I am sure we could post the hacked library and the sketches somewhere.
Good luck, maybe someone will figure out how to decode the password from the unprotected blocks, then someone could just write a smartphone spool reset program. In the mean time this is the hack.
Finally, the more unused spools we dump the larger the set of 'blanks' we can clone from. So sniff those new spools of PLA, once you know what they smell like, read the chip and post the data here. The last reason to dump the fresh spool is that it fixes one variable of the encryption hash of the length to a known number. To put it another way, it would greatly simplify hunting for the keys to not need a I2C logic sniffer.
Let me be clear here i am not the source of this hack the 1B hack was prior work of another hacker.
Thanks!
-Cecil
- Bozotclown1970
- Member
- Offline
Re: DaVinci Junior cartridge reset
Ok, folks here is what I have. Three spools, Stock Nature with 69M left, Brand new Clear Yellow, and Brand new Nature.
Stock Nature 69m Left Full Clear Yellow Full Nature
PWD = 0x81, 0x7B, 0xE8, 0xC1 PWD = 0xC4, 0x59, 0x12, 0x41 PWD = 0x28, 0xE6, 0x97, 0x5A
Seems to be an NTAG2xx tag (7 byte UID) Seems to be an NTAG2xx tag (7 byte UID) Seems to be an NTAG2xx tag (7 byte UID)
PAGE 00: 04 BD 5D 6C 04 0D 38 B9 04 7E B9 4B
PAGE 01: 22 97 3C 80 22 97 3C 81 2A 97 3C 81
PAGE 02: 09 48 00 00 08 48 00 00 00 48 00 00
PAGE 03: E1 10 12 00 E1 10 12 00 E1 10 12 00
PAGE 04: 01 03 A0 0C 01 03 A0 0C 01 03 A0 0C
PAGE 05: 34 03 00 FE 34 03 00 FE 34 03 00 FE
PAGE 06: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 07: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 08: 5A 50 5A 00 5A 50 4F 00 5A 50 5A 00
PAGE 09: 00 35 34 50 00 35 34 48 00 35 33 54
PAGE 10: A0 86 01 00 40 0D 03 00 40 0D 03 00
PAGE 11: A0 86 01 00 40 0D 03 00 40 0D 03 00
PAGE 12: D2 00 2D 00 D2 00 2D 00 D2 00 2D 00
PAGE 13: 54 48 47 42 54 48 47 42 54 48 47 42
PAGE 14: 30 37 38 32 30 32 38 32 30 30 31 39
PAGE 15: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 16: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 17: 34 00 00 00 34 00 00 00 34 00 00 00
PAGE 18: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 19: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 20: 0E 0E 01 00 40 0D 03 00 40 0D 03 00
PAGE 21: 46 1C 33 54 08 1F 31 54 08 1F 31 54
PAGE 22: 86 B1 E2 CE 50 B1 E0 CE 50 B1 E0 CE
PAGE 23: 20 E0 49 76 52 E7 4F 76 52 E7 4F 76
PAGE 24: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 25: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 26: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 27: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 28: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 29: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 30: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 31: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 32: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 33: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 35: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 36: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 37: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 38: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 39: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 40: 00 00 00 BD 00 00 00 BD 00 00 00 BD
PAGE 41: 07 00 00 FF 07 00 00 08 07 00 00 08
PAGE 42: 80 05 00 00 80 05 00 00 80 05 00 00
PAGE 43: 00 00 00 00 00 00 00 00 00 00 00 00
PAGE 44: 00 00 00 00 00 00 00 00 00 00 00 00
434 2016-02-07 17:27:44 (edited by jakecrowley 2016-02-07 17:31:36)
Re: DaVinci Junior cartridge reset
Bozotclown1970 wrote:
I am going to work on the update code today. At that point as long as you have the password in the menu portion of the code. It will allow you to update. Each different spool/password will need to be added to the menu.
switch(sColor) {
case 1 :
pwd[0] = (0x81);
pwd[1] = (0x7B);
pwd[2] = (0xE8);
pwd[3] = (0xC1);
Serial.print("Waiting for Stock Neutral Spool\n");
break; /* optional */case 2 :
pwd[0] = {0xC4};
pwd[1] = {0x59};
pwd[2] = {0x12};
pwd[3] = {0x41};
break; /* optional */case 9 :
Serial.print("Program has exited!\n");
delay(1000);
exit(0);
Where do I put that code? I'm a bit rusty on my C. Also, how do I convert those hex numbers into decimal, I've tried to use a hex to dec converter and it gives me some random number.
Re: DaVinci Junior cartridge reset
Wow this topics gone inactive. Two days since the last post. Are you guys just ditching this idea and leaving all the non tech-savy people in the dust?? I'm quite happy (I've gotten wood and bronze fill as well as glow in the dark although i have heard that glow in the dark is corrosive on your nozzle) with my hacked chip but many non tech-savy users of this printer might be stumped. Theres gotta be a way to figure out the password without the analyzer and be able to write to the chip with say a phone app.
- Bozotclown1970
- Member
- Offline
Re: DaVinci Junior cartridge reset
My guess on this is the passwords are at least partially generated from the printers serial number. Since the password has be be generated prior to the printer gaining access to the card. As I said, strictly a guess.
Re: DaVinci Junior cartridge reset
How does the printer obtain the password to the chip is what i'm stumped on.
- Bozotclown1970
- Member
- Offline
Re: DaVinci Junior cartridge reset
I think the printers processor is programmed to do this. It must have an predetermined logarithm for doing this.
Re: DaVinci Junior cartridge reset
Is anyone working on or interested in working on a pin trace of the main board? We need a pin trace and then repetier can be flashed to this board.
Re: DaVinci Junior cartridge reset
DocD7 wrote:
Is anyone working on or interested in working on a pin trace of the main board? We need a pin trace and then repetier can be flashed to this board.
I wish I had the tools to do this because it seems that the nfc hack is all that they are interested in right now. Although I believe a repetier flash would be much better.
Re: DaVinci Junior cartridge reset
Does anybody know what material the jr's nozzle is made out of? I was about to buy some glow in the dark filament but they said it can corrode your nozzle and you need to buy a steel nozzle but after taking apart the extruder its not as simple as unscrewing the nozzle you have to replace the whole hot end and xyzprinting doesn't sell hot ends that are steel.
Re: DaVinci Junior cartridge reset
jakecrowley wrote:
DocD7 wrote:Is anyone working on or interested in working on a pin trace of the main board? We need a pin trace and then repetier can be flashed to this board.
I wish I had the tools to do this because it seems that the nfc hack is all that they are interested in right now. Although I believe a repetier flash would be much better.
A visual trace would be feasible, but obviously much slower. Before my wife caught me taking the printer apart and "objected", I had already traced one pin and most of the way to a second. Needless to say, I haven't made any further progress.
Re: DaVinci Junior cartridge reset
DocD7 wrote:
jakecrowley wrote:DocD7 wrote:Is anyone working on or interested in working on a pin trace of the main board? We need a pin trace and then repetier can be flashed to this board.
I wish I had the tools to do this because it seems that the nfc hack is all that they are interested in right now. Although I believe a repetier flash would be much better.
A visual trace would be feasible, but obviously much slower. Before my wife caught me taking the printer apart and "objected", I had already traced one pin and most of the way to a second. Needless to say, I haven't made any further progress.
At least for now, have you checked out the NFC hack? It works flawlessly and is a quick and easy little hack for using third party filaments. I've been using many different filaments just fine now!
Re: DaVinci Junior cartridge reset
jakecrowley wrote:
At least for now, have you checked out the NFC hack? It works flawlessly and is a quick and easy little hack for using third party filaments. I've been using many different filaments just fine now!
No, I don't have any logic analyzer or NFC reader, so I'm kinda out of that game. I'll see if I can get back to working on a pin trace sometime soon. And it's not just about the filament for me. XYZWare plain ole' sucks. Had numerous run-ins with that software just trying to get things to print even half-way decently. Most frustratingly, it often just does away with the "primer" bead that normally runs along the right side of the print bed just to get the extruder primed and ready to print. It also doesn't offer skirts which would eliminate (mostly) the need for the primer bead. Further, I really don't want to have to mess with the "Advanced Mode" XYZWare as it requires a VM with Windows install (Mac guy here) and there's a few critical glitches with my VM/Advanced Mode that kinda hoses the whole thing.
I really just want to be able to pick my favorite modeler, pick my favorite slicer, dump the gcode to an SD card, and print. Filament aside, I firmly believe in my ability to choose how I produce the output. The printer should be the TOOL - it shouldn't limit me arbitrarily. Using filaments of my own choosing is part of that, but not necessarily my driving motivation.
Simplicity should be the goal here. Sure, there are "options" for forcing this printer to behave but the toolchains (not to mention the secondary hardware investments) are getting longer and much more involved. As far as I'm concerned, (unless you're building a printer from scratch) hardware investments should be for upgrades and better-than-stock performance rather than working around crap software and locked-source expendables. And software toolchains should be as short and simple as possible within performance constraints.
Anyway, I'll get off my soap box now. And, I mean no offense to those working the NFC route. You've all done fantastic work figuring it out and I applaud your efforts. I just think it isn't the final solution.
Re: DaVinci Junior cartridge reset
Been busy with work and such but I did fork the Adafruit library on github.com and merged the method for authenticating.
Should make it a little easier for people just getting started.
https://github.com/chrisgrill/Adafruit-PN532
I sent them a pull request so maybe it will get merged into their library at some point.
As for some of the questions recently regarding the password, it would seem that the password is generated based on the serial number of the NTAG213 chip and a key. It seems doubtful it has anything to do with the serial number of the printer.
The more people capture the passwords and post both the password and the unprotected information on their NTAG213 chip, the closer we will get to someone cracking the password generation.
Re: DaVinci Junior cartridge reset
Hi guys.
The idea of locking page 20 occurred to me a while ago... sounds good until you realize that an attempt to write to that page would generate a write error resulting in an NACK or Error ACK from the card, sending you down the "SPOOL ERROR" path.
The key here is to be able to generate our own tags cheap and quick using a $0.10 paper NTAG213 you can get on amazon.
The stumbling block is the password algorithm. But, don't get depressed, I have a plan.
If I can control the UID sent to the printer I can then see the generated response. If I sent a uid of 00 00 00 00 00 00 00 or FF FF FF FF FF FF FF the password generated from that would yield a lot of progress toward cracking the algorithm.
The NTAG213 does not allow you to set the UID, this is both good and bad for us. Its good because if we can't set the UID, XYZ cant do it either and the algorithm must accommodate factory set UID codes.
My plan is to use my PN532 in TARGET mode, and on the RASBERRY PI, I will write the code necessary to EMULATE a NTAG213.
Not for the purpose of spoofing a tag, but with the goal of cracking the algorithm. I will be able to see the effects that the UID bytes have directly on the Password string and hopefully this will yield the pattern necessary to crack it.
I will be very annoyed if it turns out to be a simple algorithm.
wish me luck.
Re: DaVinci Junior cartridge reset
DocD7 wrote:
jakecrowley wrote:At least for now, have you checked out the NFC hack? It works flawlessly and is a quick and easy little hack for using third party filaments. I've been using many different filaments just fine now!
No, I don't have any logic analyzer or NFC reader, so I'm kinda out of that game. I'll see if I can get back to working on a pin trace sometime soon. And it's not just about the filament for me. XYZWare plain ole' sucks. Had numerous run-ins with that software just trying to get things to print even half-way decently. Most frustratingly, it often just does away with the "primer" bead that normally runs along the right side of the print bed just to get the extruder primed and ready to print. It also doesn't offer skirts which would eliminate (mostly) the need for the primer bead. Further, I really don't want to have to mess with the "Advanced Mode" XYZWare as it requires a VM with Windows install (Mac guy here) and there's a few critical glitches with my VM/Advanced Mode that kinda hoses the whole thing.
I really just want to be able to pick my favorite modeler, pick my favorite slicer, dump the gcode to an SD card, and print. Filament aside, I firmly believe in my ability to choose how I produce the output. The printer should be the TOOL - it shouldn't limit me arbitrarily. Using filaments of my own choosing is part of that, but not necessarily my driving motivation.
Simplicity should be the goal here. Sure, there are "options" for forcing this printer to behave but the toolchains (not to mention the secondary hardware investments) are getting longer and much more involved. As far as I'm concerned, (unless you're building a printer from scratch) hardware investments should be for upgrades and better-than-stock performance rather than working around crap software and locked-source expendables. And software toolchains should be as short and simple as possible within performance constraints.
Anyway, I'll get off my soap box now. And, I mean no offense to those working the NFC route. You've all done fantastic work figuring it out and I applaud your efforts. I just think it isn't the final solution.
I'm not saying your wrong, but I've pretty much done all that you've talked about. The only thing is running the outputted gcode into ThreeDubber before putting it onto an SD card.
Re: DaVinci Junior cartridge reset
Sorry if this has been answered already, or is just a dumb question, but do you need a new spool/chip to grab the password, or can you use one that has already been used to some degree or completely?
Can you then reset that particular chip to act like any color/temp you would like to make it or will it only reset to the color/temp it was originally?
Thanks!
Re: DaVinci Junior cartridge reset
You can get password from any chip, and can reset it to any color/temp
Re: DaVinci Junior cartridge reset
Hi
Is there anyone willing to hack me a drum if I pay you I can send you a few drums if you need them be very grateful if some one can help us out
I can send you a load you can keep the rest hack the RFID and sell them on ebay to other users that cannot hack the RFID them selfs
Hope some willing to help many thanks
Pete