1,026

Re: DaVinci Junior cartridge reset

tobias.friberg wrote:

I'm not sure where people are stuck with this 2.2.7 issue and is it possible to contribute somehow?

At this point I'm not sure if anyone is even looking at doing anymore on this. The thread has pretty much dried up. Have you tried anything on your end, like using a Logic Analyzer and seeing what information is being passed back and forth? I can't really be of much help. I have no hacking skills, but was able to get enough information from this forum to keep my printer going.

1,027

Re: DaVinci Junior cartridge reset

Bozotclown1970 wrote:

At this point I'm not sure if anyone is even looking at doing anymore on this. The thread has pretty much dried up. Have you tried anything on your end, like using a Logic Analyzer and seeing what information is being passed back and forth? I can't really be of much help. I have no hacking skills, but was able to get enough information from this forum to keep my printer going.

That's too bad. Frankly I think that putting a chip and disable downgrade is bull, that's enough reason for me to try to hack this machine. I'm not really good with hardware but I have some skill with programming and software. It seems like a lot of you people had hit a brick wall investigating this issue. After reading about 2.2.7 I really cannot recommend XYZ to anyone anymore sad

I just might convert my printer to RAMPS 1.4 instead, I figure this http://www.soliforum.com/topic/15273/ho … -ramps-14/ might help me going.. ofc read the whole post before doing anything stupid. smile

I'll just hope this unable to downgrade bullshit or new codes comes out soon, because you cannot just have these kind of chips inside cartridges, it's insane! Damn you XYZ! you used to be cool, what happend?!

1,028

Re: DaVinci Junior cartridge reset

I've been working on understanding this thing for a while. I got to this thread a little too late and realized I have firmware 2.2.7.

So far I got my I2C sniffer to work and was able to get passwords for all my spools. Currently working on emulating the I2C traffic in an Arduino. The idea is that Arduino would respond as the PN512 chip but feed the data from another RFID card. Since apparently the controller saves UUIDs + Lengths of cards its sees it's not as easy as changing the length on an existing card. Once the emulation works I can feed the printer with data from another card that my controller has never seen but change the filament length beforehand.

Here's what I got today. The controller writes/reads 30 out of 64 registers in the PN512 chip so not all functionality has to be coded. If someone is interested here's an I2C traffic. 50 means write to address 0x28 and 51 is a read from 0x28.

5037 - From register 0x37 (PN512 chip version)
5182 - Read data from register 0x37 -> 0x82
500100 - Write to command register -> IDLE command
50047F - interrupt mask register
50010F - Write to command register -> RESET command
5037
5182
5037
5182
500100
50047F
50010F
5037
5182
5014
5180
501480
500100
502B01
502A
5100
502A00
502D15
502C59
500C
5100
500201
50047F
500C40
5002
5101
500203
5003
5100
500300
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5131
500200
500300
5004
5105
5005
5100
50047F
502B00
502A
5100
502A00
502D67
502C02
5014
5180
501483
500100
502B01
502A
5100
502A00
502D15
502C59
500C
5100
500201
50047F
500C40
5002
5101
500203
5003
5100
500300
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5131
500200
500300
5004
5105
5005
5100
50047F
502B00
502A
5100
502A00
502D67
502C02
501200
501300
502426
501884
500C10
502648
5014
5183
501487
501780
501100
5027FF
50282F
5023F2
500D00
502A80
500B3F
501D
5100
5012
5100
5013
5100
5017
5180
501788
5012
5100
5013
5100
502B00
502A
5180
502A80
502D59
502C0A
501540
5008
5100
5008
5100
5012
5100
5013
5100
502B00
502A
5180
502A80
502D15
502C0A
5017
5188
501788
5012
5100
5013
5100
500D
5100
500D07
500100
500A80
50047F
50057F
500A
5100
500926
50010C
500D
5107
500D87
5002
5100
500250
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
500D
5107
500D00
5002
5100
50023B
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
5004
516C
500A
5102
5009
5144
5009
5100
5004
516C
500A
5100
500C
5110
5014
5183
501480
500100
502B01
502A
5180
502A80
502D15
502C59
500C
5110
500201
50047F
500C50
5002
5101
500203
5003
5100
500300
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5131
500200
500300
5004
5105
5005
5100
50047F
502B00
502A
5180
502A80
502D15
502C0A
5014
5180
501483
500100
502B01
502A
5180
502A80
502D15
502C59
500C
5110
500201
50047F
500C50
5002
5101
500203
5003
5100
500300
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5129
5007
5131
500200
500300
5004
5105
5005
5100
50047F
502B00
502A
5180
502A80
502D15
502C0A
501200
501300
502426
501884
500C10
502648
5014
5183
501487
501780
501100
5027FF
50282F
5023F2
500D00
502A80
500B3F
501D
5100
5012
5100
5013
5100
5017
5180
501788
5012
5100
5013
5100
502B00
502A
5180
502A80
502D59
502C0A
501540
5008
5100
5008
5100
5012
5100
5013
5100
502B00
502A
5180
502A80
502D15
502C0A
5017
5188
501788
5012
5100
5013
5100
500D
5100
500D07
500100
500A80
50047F
50057F
500A
5100
500926
50010C
500D
5107
500D87
5002
5100
500250
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
500D
5107
500D00
5002
5100
50023B
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
5004
516C
500A
5102
5009
5144
5009
5100
5004
516C
500A
5100
500C
5110
5012
5100
5013
5100
500D
5100
500D00
500D
5100
500D00
500100
500A80
50047F
50057F
500A
5100
500993
500920
50010C
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
5002
5100
50023B
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
5004
516C
500A
5105
5009
5188
5009
5104
5009
51AA
5009
51D2
5009
51F4
5004
516C
500A
5100
500C
5110
500D
5100
500D00
5012
5100
501280
5013
5100
501380
500D
5100
500D00
500D
5100
500D00
500100
500A80
50047F
50057F
500A
5100
500993
500970
500988
500904
5009AA
5009D2
5009F4
50010C
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5002
5100
50023B
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5004
516C
500A
5101
5009
5104
5004
516C
500A
5100
500C
5110
500D
5100
500D00
5012
5180
501200
5013
5180
501300
500D
5100
500D00
500D
5100
500D00
500100
500A80
50047F
50057F
500A
5100
500995
500920
50010C
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
5002
5100
50023B
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
5004
516C
500A
5105
5009
512A
5009
5197
5009
513C
5009
5180
5009
5101
5004
516C
500A
5100
500C
5110
500D
5100
500D00
5012
5100
501280
5013
5100
501380
500D
5100
500D00
500D
5100
500D00
500100
500A80
50047F
50057F
500A
5100
500995
500970
50092A
500997
50093C
500980
500901
50010C
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5002
5100
50023B
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5004
516C
500A
5101
5009
5100
5004
516C
500A
5100
500C
5110
500D
5100
500D00
502B01
502A
5180
502A80
502D5D
502CB1
5012
5180
5013
5180
501300
500100
500A80
50047F
50057F
500A
5100
500960 - VERSION command (written to FIFO to be sent to card)
50010C - TRANSCEIVE command
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5002
5100
50023B
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5004
516C
500A
510A
5009
5100
5009
5104
5009
5104
5009
5104
5009
5101
5009
5100
5009
510F
5009
5103
5009
5118
5009
51AA
5004
516C
500A
5100
500C
5110
5012
5180
5013
5100
500100
500A80
50047F
50057F
500A
5100
500930 - READ page 0
500900
50010C - TRANSCEIVE command
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
5002
5100
50023B
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5004
516C
500A
5112
5009
5104
5009
51AA
5009
51D2
5009
51F4
5009
512A
5009
5197
5009
513C
5009
5180
5009
5101
5009
5148
5009
5100
5009
5100
5009
51E1
5009
5110
5009
5112
5009
5100
5009
5150
5009
5170
5004
516C
500A
5100
500C
5110
5012
5180
5013
5100
500100
500A80
50047F
50057F
500A
5100
500930 - READ Page 4 Command
500904
50010C
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100
5002
5100
50023B
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5004
516C
500A
5112
5009
5101
5009
5103
5009
51A0
5009
510C
5009
5134
5009
5103
5009
5100
5009
51FE
5009
5100
5009
5100
5009
5100
5009
5100
5009
5100
5009
5100
5009
5100
5009
5100
5009
5185
5009
5133
5004
516C
500A
5100
500C
5110
5012
5180
5013
5100
500100
500A80
50047F
50057F
500A
5100
50091B - PWD_AUTH Command
5009EE
50098F
500950
5009E1
50010C
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5002
5100
50023B
5003
5100
500300
5007
5173
500200
500300
5004
516C
5005
5100
5004
516C
500A
5104
5009 - Read PACK bytes -> E7 66
51E7
5009
5166
5009
5101
5009
51BC
5004
516C
500A
5100
500C
5110
5012
5180
5013
5100
500100
500A80
50047F
50057F
500A
5100
500930 - READ Page 8 command (without the password that would fail)
500908
50010C
500D
5100
500D80
5002
5100
500250
5003
5100
500300
5007
5133
500200
500300
5004
516C
5005
5100

and so on

1,029

Re: DaVinci Junior cartridge reset

Please avoid copy and paste with long scripts of code.  Find out how I corrected your posted code above, here http://www.soliforum.com/help/bbcode/

Printit Industries Model 8.10 fully enclosed CoreXY, Chamber heat
3-SD3's & a Workbench all fully enclosed, RH-Slic3r Win7pro, E3D V6, Volcano & Cyclops Hot End
SSR/500W AC Heated Glass Bed, Linear bearings on SS rods. Direct Drive Y-axis, BulldogXL
Thanks to all for your contributions

1,030

Re: DaVinci Junior cartridge reset

As for the discussion on UIDs and PACKs.

Indeed UIDs are read-only on any MIFARE tags. The password that's sent to the tag to unlock pages 8 and up is derived from the UID using some kind of hash algorithm. The PACK (password ack) is sent back by the tag and is probably UID based too. Both the 4 byte password and 2 bytes PACK are stored on the tag by the way (when they prep the spool for shipping) on page 0x2b and 0x2c respectively but when reading an open card they read as zeros anyway.
If we knew what algorithm they use to generate passwords and PACKs we could use any tag with any UID. The algorithm is actually implemented in the printer's firmware but the binary is encrypted and only the loader has the key to decrypt that.
As you can see we're a little stuck here... sad

1,031

Re: DaVinci Junior cartridge reset

Quite off-topic but something to do with the NFC tags.
I've been clearing out some unused parts of my Jr and realised that I haven't published my NFC holder - it's on thingiverse now.

http://www.thingiverse.com/thing:1876514

1,032

Re: DaVinci Junior cartridge reset

kr15_uk wrote:

Quite off-topic but something to do with the NFC tags.
I've been clearing out some unused parts of my Jr and realised that I haven't published my NFC holder - it's on thingiverse now.

http://www.thingiverse.com/thing:1876514


Quite a nice piece of handy work. I am going to print one up because this looks better than what I am using at the moment.

BTW do you still have your JRs MB? Someone on here was having an issue with the new firmware and I mentioned that you may have one available.

1,033

Re: DaVinci Junior cartridge reset

@Bozotclown1970 - Thanks that you pointed out my board. Yeah, he/she emailed me.
But it's pretty much the same story all the time - to expensive.
Is it really?! Logic board + 4x NFC tags for £38 ($47). NFC tag hack off eBay goes for £8 a pop (£32 in total)
Don't know if I've overpriced it, did I?! 2x decent 1kg PLA generic spools are +/-£20 each, Jr spool is £20 for .6kg - it pays off quickly.
Yeah it's more than RAMPS conversion but to do RAMPS you need some skill + some spare time etc... Jr swap - 10mins top.
Don't know, if you guys think it's too much - let me know and I'll consider lowering the price but only if it makes sense.

About that NFC reader on thingiverse, I've updated STL's with the right orientation to the build plate. Also added more photos to easier get component placement within.

1,034

Re: DaVinci Junior cartridge reset

I would definitely take it off your hands for the price you put it up for, If it included the NFC reader and the old LCD and cables (or even a couple of quid more to allow for the additional stuff I ask for)
I just need to ensure that those pieces were all I needed to test whether a card would work in another Jr.
i.e. present the card to the NFC reader and see if it would give me "spool info" on the LCD.
I basically want it so that I can try and work out the algorithm for the cards password etc without having to butcher my working Jr.

1,035

Re: DaVinci Junior cartridge reset

@cgrillo - Jr logic board has quite a lot of failsafe inbuilt, if you boot up Jr without steppers connected it will report an error. So effectively you need whole printer to do all that hacking.

1,036

Re: DaVinci Junior cartridge reset

Cheers sad

kr15_uk wrote:

@cgrillo - Jr logic board has quite a lot of failsafe inbuilt, if you boot up Jr without steppers connected it will report an error. So effectively you need whole printer to do all that hacking.

1,037

Re: DaVinci Junior cartridge reset

Hello everyone !
I will tell you my experiences with a Da Vinci Mini W, with my poor english sorry...
I've resetted a cartdridge with greatone76 key, il works fine BUT :
-If I set the length to a previous value, the software recognize the lenght, color... whithout errors. But when I try a

print the del turn to red flashing and the f... message appears in the soft...
- If I set the length (pages 14 to 17) at the last value : it works again...
I've tried to print on another computer removing internet connection and the problem is the same.
So my conclusion is : the cartridges lengths are stored in the printer (tell me if I'm wrong).
I will try to reset the print memory (don't know exactly how, help welcome) to go through...
- When I turn on the printer with button press, the del turn to white ! This color is not on the documentation !!!

Hidden feature ? I will also follow this way...
If you have any idea : cool !
Hope this could help and re-activate this post...

1,038

Re: DaVinci Junior cartridge reset

Just a quick update. I've sold my logicboard to forum user @drmih. Hopefully he'll be back in business very soon. Also I'll presume that he not gonna need his old logicboard and maybe some of you into hacking will want to buy it for testing etc.

1,039

Re: DaVinci Junior cartridge reset

Is this similar chip type in the Davinci Mini

1,040 (edited by Bozotclown1970 2016-11-23 02:22:22)

Re: DaVinci Junior cartridge reset

ak wrote:

I've been working on understanding this thing for a while. I got to this thread a little too late and realized I have firmware 2.2.7.

So far I got my I2C sniffer to work and was able to get passwords for all my spools. Currently working on emulating the I2C traffic in an Arduino. The idea is that Arduino would respond as the PN512 chip but feed the data from another RFID card. Since apparently the controller saves UUIDs + Lengths of cards its sees it's not as easy as changing the length on an existing card. Once the emulation works I can feed the printer with data from another card that my controller has never seen but change the filament length beforehand.

Here's what I got today. The controller writes/reads 30 out of 64 registers in the PN512 chip so not all functionality has to be coded. If someone is interested here's an I2C traffic. 50 means write to address 0x28 and 51 is a read from 0x28.

and so on



ak,

Not sure how I missed this post but, there is also the matter of the "Pack Code" you will need to contend with. That is stored in Page 44 and is also hashed out in the printer for password confirmation. Now I know for a fact there is a person on this forum that is doing tag emulation but I have not seen him mention one word of it on this forum. Some folks just love to take, take, take and not worry about contributing. Now to be fair that information did not come from this forum, and he does not use and Arduino, but he has made out very well from this forum.

1,041 (edited by silentman 2016-11-23 08:09:30)

Re: DaVinci Junior cartridge reset

xairflyer wrote:

Is this similar chip type in the Davinci Mini

The system is the same in the Da Vinci Mini, TAG 213 and PN512.
It is possible to emulate I2C traffic but the problem remain the same :
- we haven't the pack for response
- the printer stores the last state of the cartridges

Changing the firmware doesn't wipe the lengths, I will try a reseted tag on an another machine asap to confirm this feelings...

1,042

Re: DaVinci Junior cartridge reset

I'm now able to emulate a NTAG213 with respect to it's UID and so can put in any card no and sniff the password that is attempted by the Jr.

If anyone needs a card password - just PM me the 7 byte UID and I'll reply with your password.
Or even if some people who know their password - send me the UID and I can double check that it actually works smile

I haven't done anything with the firmware and don't know the password or PACK algorithm.
The PACK and PASSWORD are stored on the card but it is in WRITE ONLY memory, so trying to read it is futile.

1,043

Re: DaVinci Junior cartridge reset

cgrillo,

You can retrieve the Pack code by passing the password then the Pack code will be sent back automatically. it is part of the verification process. I have been successful in doing this .net. The problem is there is no way to calculate it.

1,044

Re: DaVinci Junior cartridge reset

Could read the nfc card but not the password. Is there any way to decipher it?

1,045

Re: DaVinci Junior cartridge reset

@mdmalavadomanuel - if you are on v2.2.4 or lower then you can get cheap logic analyser and capture password (info in this thread), if v2.2.6 - you can downgrade to v2.2.4 and do logic analyser trick but if you are on v.2.2.7+ then you are out of luck.

1,046

Re: DaVinci Junior cartridge reset

Hey there! I just trawled through this thread and wow alot of that was over my head!

I am due to receive my new printer next week and wondered if anyone knows if they update the FW at the factory? I will not update it and hope it's below the 2.2.4 required.

My question (probably mainly for KR15_uk) is can those ebay usb logic analysers be used with a mac? I am struggling to find a version of the advanced settings for mac and just hope I can buy cheap filament. I need to print ABS so a heated bed is in my future somewhen anyway.

The other option is paying for an unlock but all the old ebay links are dead, both here and instructables and thingiverse.... I can get an arduino and nfc shield as its handy for my other hobby (Reefkeeping).

1,047 (edited by cgrillo 2016-11-24 21:31:53)

Re: DaVinci Junior cartridge reset

Hi thegasman2000,

If you read the posts just above this one, I can provide you with the unlock password for free.
I just need the UID of the card - you, obviously, need a way of reading and writing to it.

Charlie

1,048

Re: DaVinci Junior cartridge reset

cgrillo wrote:

Hi thegasman2000,
you, obviously, need a way of reading and writing to it.
Charlie

The android app RFID NFC Tool works for this bit no? Or it has to be the arduino and the NFC shield? Sorry read so much its all confugled up!

1,049

Re: DaVinci Junior cartridge reset

I use an Auduino and the NFC shield.
I don't know about the Andriod app, I'm sure there's a lot of info on it in the previous 40+ pages!

1,050

Re: DaVinci Junior cartridge reset

cgrillo wrote:

I use an Auduino and the NFC shield.
I don't know about the Andriod app, I'm sure there's a lot of info on it in the previous 40+ pages!


cgrillo,

If you are using an Arduino for updating your tag. I have written some software to make the task easier if you are interested.

Post's attachments

Arduino.JPG
Arduino.JPG 111.92 kb, file has never been downloaded. 

You don't have the permssions to download the attachments of this post.