DaVinci Junior cartridge reset (Page 26 of 58)

I contacted greatone76 and went through the process with him.

Thank you greatone76 worked perfect.

loading filament now

Here we go ---  I can verify that the password is created using only the UID of the tag. Below are a few simplified UID’s and then one UID with one digit added to each value:

UID: 00 00 00 00 00 00 00          Pass: 5A DB F8 F3
UID: 01 01 01 01 01 01 01          Pass: 45 86 B5 E5
UID: FF FF FF FF FF FF FF          Pass: 7D 10 F3 A6

Base:
UID: 04 31 CE 22 9A 3D 80    Pass: 8B BB D0 FC

Adding one to each digit of the base:
UID: 05 31 CE 22 9A 3D 80    Pass: 68 91 A5 D1
UID: 04 32 CE 22 9A 3D 80    Pass: 3D 34 64 97
UID: 04 31 CF 22 9A 3D 80    Pass: B2 B0 58 8B
UID: 04 31 CE 23 9A 3D 80    Pass: 59 AC 9A 62
UID: 04 31 CE 22 9B 3D 80    Pass: AF E8 35 75
UID: 04 31 CE 22 9A 3E 80            Pass: E1 39 B9 13
UID: 04 31 CE 22 9A 3E 81            Pass: D2 27 C1 C9
UID: 14 31 CE 22 9A 3D 80    Pass: AF 8B 77 25
UID: 04 41 CE 22 9A 3D 80    Pass: 5B 2A D9 8E
UID: 04 31 DE 22 9A 3D 80    Pass: 99 87 4A 39
UID: 04 31 CE 32 9A 3D 80    Pass: 81 61 0A 5C
UID: 04 31 CE 22 AA 3D 80    Pass: B6 A1 03 6A
UID: 04 31 CE 22 9A 4D 80    Pass: 6A AF 9D 79
UID: 04 31 CE 22 9A 3D 90    Pass: F5 A2 60 C9

I hope somebody sees it cause I sure don't.  I just feel stupid for trying to add the basic 2 and 4 digit hex to try to figure it out.  This appears to be quite a complete algorithm.  Tell me if you want another number like 00 00 00 00 00 00 01 or something else basic to help out or check a theory.

hmm  so far there is an obvious pattern.

what happens when we expect Byte 1 to always be 04 since that is the manufacture byte id.

next is well byte 2&3, 4&5 and 6&7  looks to generate the same  result.

could you try and  generate a few more pairs and see if it holds true?

also are you using something like a hydranfc or proxmark to emulate the tags? mby if we were more that could emulate tags we could generate sample data faster.

btw. i'm a QA pro and one of my specialitys are patterns on large data sets.
i'd be willing to look over data data sets for patterns if that can help in any way.

Created an account to say thanks for all the efforts and i will drop you a pm once i have my printer, due in the next few weeks

just one Q - can the chip that comes with the demo filament be reset and be made to show the full 300m ?

Thanks !

Just wanted to report that Greatone's instructions worked like a charm.  I was able to rewrite both my natural (that came with the printer) and a black that was about 1/2 used to black and 300 M of 300 M remaining. 

I'm off to order some generic filament now!

Oh, I wanted to ask, is there any danger that this hack could be closed by firmware updates?  Every time I run the software, it indicates that a firmware update is available.  So far, I've declined to install it fearing that they'll close any exploits that would allow it to be further hacked in the future.

If it helps anyone figure out how the system works, here's the info for both of my tags:

if you have the keys and can reset your nfc card I don't think they can block that because they won't know if it's moded or not

I also had greatone76 generate the password for the tag that came with my starter filament.  I was able to easily set it to 300m using my Nexus tablet's NFC reader and the RFID NFC tool downloaded from the Play store. 

One hiccup was that I got the 'unidentified spool' error but I used the advice from a few posts back that said to, "try writing line 08 to 5A505000 and it will let you change lines 0A,0B &14 to E0930400." 

Now I can use the rest of the starter filament I was going to have to throw away otherwise!

I get one forum they get algo for getting password and gave web page where you can get password from UID, but for my UID and know password it do not work

would be very happy if someone would find out the paswort me

http://www.proxmark.org/forum/viewtopic … 57&p=9

Is the forum vienisas is talking about. The password is for the Lego dimensions NFc tags. Same NTAG213, but I'm sure a different algorithm and why it doesn't work. I have not had time but we should look through their process. Based on the forum it looks like they are using a proxmark3 emulation to play. It could also be valuable to know what numbers they used to break the password. Same size pass key as ours. Could be a good guide.

@vienisas. that is the rabbit hole i'm going down right now.
i think that the proxmark way is probably one of the ways we can crack this, but that hardware cost is pretty high compared to a cheapo logic analyser and reuse old cards.

just waiting on hardware and more free time to learn about rfid and crypto.
i'm going slow and learning as i go here, so don't count on any results from me.

I finally understood! Page 2 must not contain FF.  This is irreversible and the tag is off. It s come when we go to the end of the coil and the printer locks all .Its works with other coils not at end .Warning to length if you want to use your Tag with the password....