951

Re: DaVinci Junior cartridge reset

@Bozotclown1970 - Do you have any issues if I make your document about getting your own password with an analyzer into an instructable to add to the series of other ones?

952

Re: DaVinci Junior cartridge reset

I know it has been posted a few places, but not on this main thread, so I just formally wanted to make a post.  We are finding that if you have firmware version 2.2.7 on your printer that if you try to rollback firmware in the same as we found out work with firmware 2.2.6, that it will not work with the newer firmware version 2.2.7.  kr15_uk has a proposed idea in other thread on here if anyone with 2.2.7 wants to try it.  Otherwise let us know if anyone out there finds a way to rollback firmware when you have firmware version 2.2.7.

953

Re: DaVinci Junior cartridge reset

This document was meant for the community that contributed to it's creation. Not for people that are exploiting them by charging for passwords. That is why there are watermarks on all of the documents. To make sure they do not get used on other sites.


greatone76 wrote:

@Bozotclown1970 - Do you have any issues if I make your document about getting your own password with an analyzer into an instructable to add to the series of other ones?

954

Re: DaVinci Junior cartridge reset

Just to clarify, I'm not taking any sides what so ever. Just want to comment on this.

@Bozotclown1970 - it's your document, work etc and your decision entirely, totally agree, all do respect.
But @greatone76 just offered you to post this document on Instructable so it's much easier to find for anyone of interest which isn't part of this forum, not to make money of your work (I guess). Personally I don't see any issues there if your name is mentioned all over the place in the Instructable. Just makes it easier for newbies to find. But once again, it's your work and your decision, I do respect that.

Also just want to comment about @greatone76 "side business" - I know it may seem to be unfair to the community that he's/she's making money out of it. But in defence to @greatone76 he's/she's active member of this forum and all XYZ hacking community all over the net and helps to solve issues people are having with XYZ printers.
He's/she's not saying "don't waste your time with logic analysers just buy this brilliant code and all your problems will go away".
He's/she's just offering to do job for you and charge fair amount for that.

For example - me, I was considering to buy logic analyser and try to hack NFC myself. But then I weighted both options.
To hack it myself I'd have to spend £5-10 on all the stuff, wait for it to arrive and then spend at least an hour of my time to get that pesky code.
And on the other hand by buying (what I did) that code which cost me roughly the same I've got the code pretty much within an hour or so and I was ready to print in no time.
It's like when you're heading home after long day, feel hungry and see McDonalds... You know that home cooked food is healthier, cheaper and better in general but yeah - McD's is there for you! big_smile

I know, I'd learn something new by playing with logic analyser and I could generate passwords for all my NFC tags. But yeah... I need just one tag at the end of the day, more than one would be probably better but 1x works well for me hence all temp adjustments I do through the gcode editing etc.
(Btw, now I've ordered logic analyser and I'll finally do it myself to learn and not to be dependant on @greatone76 or who ever will come up with another hacking procedure. But at the time that was the easiest way.)

Just to clarify, this is just a personal opinion, no plan intended to take any sides or what so ever, @Bozotclown1970 I do totally respect your decision and also thanks for the effort you've put into producing this document.

955

Re: DaVinci Junior cartridge reset

I appreciate your feedback on this matter> If you read his post it is all about him creating the indestructible where I did all of the work. I have solved the problem by moving the document and people will need to request it in a PM like before. I guess I could just charge for it and email it to everyone. You have to agree, that would be fair!.

956

Re: DaVinci Junior cartridge reset

I'm intrigued as to how XYZ have implemented the lock down on "hacked" rfid tags in the firmware.

I wonder if they just store the tag no and remaining length in flash for the last one or for all tags ever used?
If it's just the last one then all we need do it have 2 tags and change then over.
How much flash is available to them anyway as I doubt if they put lots of spare in the printer in the first place.
Just need someone who has upgraded in error to test... no I'm not volunteering smile

I suspect that it is still possible to use the "hacked" tags as long as the printer hasn't seen it with a lower length remaining value before hand (or have they put logic in the check to see if it is > 100m>?).  So again, we could modify a tag first then present it to the printer and see it if accepts 300m (or whatever length is used) .  But the tag is still a one use tag for that printer.
We could all band together and have a tag swop-shop..

957 (edited by steve_lloyd2000 2016-06-18 22:22:36)

Re: DaVinci Junior cartridge reset

cgrillo wrote:

I'm intrigued as to how XYZ have implemented the lock down on "hacked" rfid tags in the firmware.

I wonder if they just store the tag no and remaining length in flash for the last one or for all tags ever used?
If it's just the last one then all we need do it have 2 tags and change then over.
How much flash is available to them anyway as I doubt if they put lots of spare in the printer in the first place.
Just need someone who has upgraded in error to test... no I'm not volunteering smile

I suspect that it is still possible to use the "hacked" tags as long as the printer hasn't seen it with a lower length remaining value before hand (or have they put logic in the check to see if it is > 100m>?).  So again, we could modify a tag first then present it to the printer and see it if accepts 300m (or whatever length is used) .  But the tag is still a one use tag for that printer.
We could all band together and have a tag swop-shop..

I was running 2.2.4 firmware with a hacked chip and no issues.  The XYZWare software started prompting every few minutes to run a software update (not the printer) so I eventually agreed and a new version was installed.  As soon as the PC rebooted and I restarted the app, it forced a firmware check against the connected printer and automatically downloaded 2.2.7  Following its' installation, I am now getting an error using the hacked chip but the printer works perfectly with an OEM chip. 

I've tried downgrading the printer firmware using the boot loader method but the firmware BIN file won't apply to it any more.

I'm happy to test another hacked chip as I have 3 other genuine ones here that I can unlock if I can get the password for them.

Cheers
Steve

958 (edited by szkusza 2016-06-19 12:32:32)

Re: DaVinci Junior cartridge reset

steve_lloyd2000 wrote:

I was running 2.2.4 firmware with a hacked chip and no issues.  The XYZWare software started prompting every few minutes to run a software update (not the printer) so I eventually agreed and a new version was installed.  As soon as the PC rebooted and I restarted the app, it forced a firmware check against the connected printer and automatically downloaded 2.2.7 [...]

The same happened to me. Funny part is that even if you deny (be clicking "X") XYZWare proceeds with upgrade. At this moment I just disconnected the USB cable and went back to an early version of XYZWare.

Regards,
Marcin

959

Re: DaVinci Junior cartridge reset

steve_lloyd2000 wrote:
cgrillo wrote:

I'm intrigued as to how XYZ have implemented the lock down on "hacked" rfid tags in the firmware.

I wonder if they just store the tag no and remaining length in flash for the last one or for all tags ever used?
If it's just the last one then all we need do it have 2 tags and change then over.
How much flash is available to them anyway as I doubt if they put lots of spare in the printer in the first place.
Just need someone who has upgraded in error to test... no I'm not volunteering smile

I suspect that it is still possible to use the "hacked" tags as long as the printer hasn't seen it with a lower length remaining value before hand (or have they put logic in the check to see if it is > 100m>?).  So again, we could modify a tag first then present it to the printer and see it if accepts 300m (or whatever length is used) .  But the tag is still a one use tag for that printer.
We could all band together and have a tag swop-shop..

I was running 2.2.4 firmware with a hacked chip and no issues.  The XYZWare software started prompting every few minutes to run a software update (not the printer) so I eventually agreed and a new version was installed.  As soon as the PC rebooted and I restarted the app, it forced a firmware check against the connected printer and automatically downloaded 2.2.7  Following its' installation, I am now getting an error using the hacked chip but the printer works perfectly with an OEM chip. 

I've tried downgrading the printer firmware using the boot loader method but the firmware BIN file won't apply to it any more.

I'm happy to test another hacked chip as I have 3 other genuine ones here that I can unlock if I can get the password for them.

Cheers
Steve


Have you considered purchasing a Logic Analyzer for about $10 to retrieve the passwords with?

960

Re: DaVinci Junior cartridge reset

Bozotclown1970 wrote:

Have you considered purchasing a Logic Analyzer for about $10 to retrieve the passwords with?

I hadn't because I've already paid the 6GBP for the password via the Ebay listing which has been working fine until the 2.2.7 firmware upgrade.  As I have a hacked NFC tag here already I was hoping to do some testing for greatone76 to help me to carry on using the hacked chip and help them with future Ebay sales.

961

Re: DaVinci Junior cartridge reset

Sounds like you already have a plan.

962

Re: DaVinci Junior cartridge reset

@Bozotclown1970 - Correct me if I'm wrong but logic analyser isn't the answer to the firmware 2.2.6+
You can simply do passcode decoding to unlock NFC editing options?! Or I'm missing something?!
(Still waiting for my analyser to arrive, btw do you mind PM'ing your document?!)

I had 2.2.6 installed on my one for couple of weeks and after you do at least one change to the NFC (temp, length etc) it puts that NFC chip into his "blacklist" and no meter what you do you can't revive it.

963

Re: DaVinci Junior cartridge reset

kr15_uk wrote:

@Bozotclown1970 - Correct me if I'm wrong but logic analyser isn't the answer to the firmware 2.2.6+
You can simply do passcode decoding to unlock NFC editing options?! Or I'm missing something?!
(Still waiting for my analyser to arrive, btw do you mind PM'ing your document?!)

I had 2.2.6 installed on my one for couple of weeks and after you do at least one change to the NFC (temp, length etc) it puts that NFC chip into his "blacklist" and no meter what you do you can't revive it.


I have not upgraded my firmware so I cannot really give you you a straight answer on that, but I doubt it will be any different since it will only provide you with an alternative way to capture the password.

You are correct when you say password decoding only.

I would look very closely at the data on the chip and make sure it has not been locked. When I say locked, there is a way to make the tag read only, but without seeing it I cannot say. A couple of weeks ago I purchased a piece of software on ebay that will allow you to look at all aspects of the card and change ALMOST all settings on it. It's call "Understanding RFID". If you can do a byte by byte check you should be able to tell if it has been locked. I keep dumps of all of my tags in a database so I can reference them if I need to.

964 (edited by cgrillo 2016-06-20 13:02:13)

Re: DaVinci Junior cartridge reset

On a slightly off topic note, I have purchased a Hobby Components logic analyser and have to use the sigrok software (Pulseview or sigrok-cli).

I have wired it up as per Bozotclown1970's documentation (GnD, SDA & SCL) , but I'm not getting anything like the data that I'd expect.
I have the password for my card and see many 0x1B bytes , but none are followed by the password I expect.
It is probably user error.

Has anyone any experience with this analyser?

965

Re: DaVinci Junior cartridge reset

cgrillo wrote:

On a slightly off topic note, I have purchased a Hobby Components logic analyser and have to use the sigrok software (Pulseview or sigrok-cli).

I have wired it up as per Bozotclown1970's documentation (GnD, SDA & SCL) , but I'm not getting anything like the data that I'd expect.
I have the password for my card and see many 0x1B bytes , but none are followed by the password I expect.
It is probably user error.

Has anyone any experience with this analyser?


I have not used that make of analyzer, but I believe I helped someone with a similar situation. Make sure that you have the software in HEX mode before capturing the data.

966 (edited by alfa1 2016-06-21 16:18:58)

Re: DaVinci Junior cartridge reset

Alien_Ant_Farm wrote:
hydronaut wrote:
Bozotclown1970 wrote:

I understand that, but where is it generated. Does it already exist on a new chip or does it get created when a chip is used? How does the firmware know each password if it is already on the chip?

Can be as simple as running the ID of the chip though a predefined algorithm in the firmware.  We will never know...

Page 30 on the data sheet for NTAG21x says "To improve the overall system security, it is advisable to diversify the password
and the password acknowledge using a die individual parameter of the IC, that is the
7-byte UID available on NTAG21x." Looking at the two green spools that we know the password and ID to we see the passwords are totally different but yet the IDs are only different in the 2nd byte. If there is any chance the ID creates the password then it has to be with that 2nd byte.

Green 1 200 of 200m
         Hex  Dec
ID:    4F     79             
Pass: 75     117
         9A     154
         67     103
         0D     13

Green 2 200 of 200m
         Hex  Dec
ID:    20     32             
Pass: 93     147
         1B     27
         18     24
         0C     12

I don't see a relationship but maybe someone will.
Here's the data sheet. Good read for anyone who wants to understand what we are up against.
http://cache.nxp.com/documents/data_she … df?pspll=1

Different in the 2nd AND 4rd  byte!!
04 4F 57 94 vs
04 20 57 FB

As well as page 14.

30 31 32 33 vs
30 34 39 35

967

Re: DaVinci Junior cartridge reset

charleshyman wrote:

Hi guys.

The idea of locking page 20 occurred to me a while ago... sounds good until you realize that an attempt to write to that page would generate a write error resulting in an NACK or Error ACK from the card, sending you down the "SPOOL ERROR" path.

The key here is to be able to generate our own tags cheap and quick using a $0.10 paper NTAG213 you can get on amazon.

The stumbling block is the password algorithm.  But, don't get depressed, I have a plan.

If I can control the UID sent to the printer I can then see the generated response. If I sent a uid of 00 00 00 00 00 00 00 or FF FF FF FF FF FF FF the password generated from that would yield a lot of progress toward cracking the algorithm.

The NTAG213 does not allow you to set the UID, this is both good and bad for us.  Its good because if we can't set the UID, XYZ cant do it either and the algorithm must accommodate factory set UID codes.

My plan is to use my PN532 in TARGET mode, and on the RASBERRY PI, I will write the code necessary to EMULATE a NTAG213.
Not for the purpose of spoofing a tag, but with the goal of cracking the algorithm.  I will be able to see the effects that the UID bytes have directly on the Password string and hopefully this will yield the pattern necessary to crack it.

I will be very annoyed if it turns out to be a simple algorithm.

wish me luck.

Good luck and looking forward to hear how it went.

968

Re: DaVinci Junior cartridge reset

Bozotclown1970 wrote:

Not sure if anyone really cares, but I have posted the spreadsheet with the macros on my own server. If you are interested use the following URL. Google Docs stripped out the macro.

http://sizzlingsource.com:22880/

link not working!

969

Re: DaVinci Junior cartridge reset

You are correct, that link no longer works. No one was interested.

What are you looking for, and what kind of hardware are you using to reset your chip with?

970

Re: DaVinci Junior cartridge reset

Regarding the nagging upgrade and potential to initiate it by accident, I assume people would know about this, but I thought I'd post anyway in case - you can easily add a rule to the Windows firewall to prevent individual applications from accessing the internet.  Once the nag screen started coming up every few minutes, I just blocked XYZ Ware from accessing the internet and that did it - if it can't access the internet, it can't check for new versions and/or firmware.  The program doesn't use "the cloud" to slice, so it continues to work just fine "offline". 

Here's a page detailing how to add a new rule:  http://www.howtogeek.com/227093/how-to- … s-firewall

Hopes this helps someone avoid inadvertently upgrading their firmware and breaking the NFC hack.

971 (edited by cory14893 2016-07-06 23:57:46)

Re: DaVinci Junior cartridge reset

I just pulled this off my 3D printer

8.103271041666666,I2C,0x1B + ACK
8.103368625000000,I2C,Setup Write to [0x50] + ACK
8.103448500000001,I2C,0x09 + ACK
8.103528333333333,I2C,0x3B + ACK
8.103625875000001,I2C,Setup Write to [0x50] + ACK
8.103705708333333,I2C,0x09 + ACK
8.103785541666667,I2C,0x3D + ACK
8.103883083333333,I2C,Setup Write to [0x50] + ACK
8.103962958333334,I2C,0x09 + ACK
8.104042791666666,I2C,0x55 + ACK


does it look right?

And would the pwd be 3b3d?


PS. thank you Bozotclown1970

972

Re: DaVinci Junior cartridge reset

cory14893 wrote:

I just pulled this off my 3D printer

8.103271041666666,I2C,0x1B + ACK
8.103368625000000,I2C,Setup Write to [0x50] + ACK
8.103448500000001,I2C,0x09 + ACK
8.103528333333333,I2C,0x3B + ACK
8.103625875000001,I2C,Setup Write to [0x50] + ACK
8.103705708333333,I2C,0x09 + ACK
8.103785541666667,I2C,0x3D + ACK
8.103883083333333,I2C,Setup Write to [0x50] + ACK
8.103962958333334,I2C,0x09 + ACK
8.104042791666666,I2C,0x55 + ACK


does it look right?

And would the pwd be 3b3d?


PS. thank you Bozotclown1970

You have 3B 3D 55 missing one number if you have it this is will be password

973

Re: DaVinci Junior cartridge reset

8.103271041666666,I2C,0x1B + ACK
8.103368625000000,I2C,Setup Write to [0x50] + ACK
8.103448500000001,I2C,0x09 + ACK
8.103528333333333,I2C,0x3B + ACK
8.103625875000001,I2C,Setup Write to [0x50] + ACK
8.103705708333333,I2C,0x09 + ACK
8.103785541666667,I2C,0x3D + ACK
8.103883083333333,I2C,Setup Write to [0x50] + ACK
8.103962958333334,I2C,0x09 + ACK
8.104042791666666,I2C,0x55 + ACK
8.104140416666667,I2C,Setup Write to [0x50] + ACK
8.104220249999999,I2C,0x09 + ACK
8.104300083333333,I2C,0x41 + ACK

pwd 3b 3d 55 41

974

Re: DaVinci Junior cartridge reset

Where you able to set the card anywhere above 300M?
I've tried without luck, i believe that the firmware block anything above 300M or the checksum return negative results.

975

Re: DaVinci Junior cartridge reset

Has anyone been able to test firmware 2.2.7 with a previously unused unlocked tag?  If the new firmware is caching the tag serial when its' used, it may then block it for future use so it would be interesting if someone is able to test it.  I've got a tag that's been unlocked and previously used on my Junior with firmware 2.2.4.  Once the printer upgraded to 2.2.7, the tag is no longer recognised (or is blocked) but OEM locked tags still work fine.

Happy to do a swap with someone else's unlocked tag to try it out.

Cheers
Steve